46 lines
1.7 KiB
Python
46 lines
1.7 KiB
Python
|
"""The sso namespace admits the bounded executor exactly where its pilot steps go (NK-WP-0056). No cluster."""
|
||
|
|
|
||
|
|
import pathlib
|
||
|
|
import unittest
|
||
|
|
|
||
|
|
import yaml
|
||
|
|
|
||
|
|
NETPOL = pathlib.Path(__file__).resolve().parents[1] / "network-policies" / "netpol-sso.yaml"
|
||
|
|
EXECUTOR = {"app.kubernetes.io/name": "bounded-executor"}
|
||
|
|
EXPECTED = {("lldap", 17170), ("keycape", 8080), ("authelia", 9091)}
|
||
|
|
|
||
|
|
|
||
|
|
def policies():
|
||
|
|
return [d for d in yaml.safe_load_all(NETPOL.read_text()) if d]
|
||
|
|
|
||
|
|
|
||
|
|
def executor_ingress():
|
||
|
|
for pol in policies():
|
||
|
|
for rule in pol["spec"].get("ingress", []):
|
||
|
|
if any(peer.get("podSelector", {}).get("matchLabels") == EXECUTOR for peer in rule["from"]):
|
||
|
|
yield pol, rule
|
||
|
|
|
||
|
|
|
||
|
|
class ExecutorIngress(unittest.TestCase):
|
||
|
|
def test_exactly_the_pilot_paths(self): # in particular never LDAP :3890
|
||
|
|
found = set()
|
||
|
|
for pol, rule in executor_ingress():
|
||
|
|
target = pol["spec"]["podSelector"]["matchLabels"]["app.kubernetes.io/name"]
|
||
|
|
found |= {(target, p["port"]) for p in rule["ports"]}
|
||
|
|
self.assertEqual(found, EXPECTED)
|
||
|
|
|
||
|
|
def test_peers_are_in_namespace_executor_pods_only(self):
|
||
|
|
for pol, rule in executor_ingress():
|
||
|
|
self.assertEqual(pol["metadata"]["namespace"], "sso")
|
||
|
|
self.assertEqual(pol["spec"]["policyTypes"], ["Ingress"])
|
||
|
|
for peer in rule["from"]:
|
||
|
|
self.assertEqual(peer, {"podSelector": {"matchLabels": EXECUTOR}})
|
||
|
|
|
||
|
|
def test_default_deny_is_kept(self):
|
||
|
|
deny = [p for p in policies() if p["metadata"]["name"] == "default-deny-all"]
|
||
|
|
self.assertEqual(deny[0]["spec"], {"podSelector": {}, "policyTypes": ["Ingress", "Egress"]})
|
||
|
|
|
||
|
|
|
||
|
|
if __name__ == "__main__":
|
||
|
|
unittest.main()
|