tegwick
387f8b1c8b
All checks were successful
netpol-sso.yaml admits only executor pods to LLDAP 17170, KeyCape 8080 and Authelia 9091 (never LDAP 3890); test_netpol.py pins it. Prepared, not applied. README reflects T13. Live reads: OpenBao open to all namespaces; approval-engine and audit-core need pod-scoped rules (requested: hub messages 39a3bffa, deea5bf8). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 5502@bnt-lap001 Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196
45 lines
1.7 KiB
Python
45 lines
1.7 KiB
Python
"""The sso namespace admits the bounded executor exactly where its pilot steps go (NK-WP-0056). No cluster."""
|
|
|
|
import pathlib
|
|
import unittest
|
|
|
|
import yaml
|
|
|
|
NETPOL = pathlib.Path(__file__).resolve().parents[1] / "network-policies" / "netpol-sso.yaml"
|
|
EXECUTOR = {"app.kubernetes.io/name": "bounded-executor"}
|
|
EXPECTED = {("lldap", 17170), ("keycape", 8080), ("authelia", 9091)}
|
|
|
|
|
|
def policies():
|
|
return [d for d in yaml.safe_load_all(NETPOL.read_text()) if d]
|
|
|
|
|
|
def executor_ingress():
|
|
for pol in policies():
|
|
for rule in pol["spec"].get("ingress", []):
|
|
if any(peer.get("podSelector", {}).get("matchLabels") == EXECUTOR for peer in rule["from"]):
|
|
yield pol, rule
|
|
|
|
|
|
class ExecutorIngress(unittest.TestCase):
|
|
def test_exactly_the_pilot_paths(self): # in particular never LDAP :3890
|
|
found = set()
|
|
for pol, rule in executor_ingress():
|
|
target = pol["spec"]["podSelector"]["matchLabels"]["app.kubernetes.io/name"]
|
|
found |= {(target, p["port"]) for p in rule["ports"]}
|
|
self.assertEqual(found, EXPECTED)
|
|
|
|
def test_peers_are_in_namespace_executor_pods_only(self):
|
|
for pol, rule in executor_ingress():
|
|
self.assertEqual(pol["metadata"]["namespace"], "sso")
|
|
self.assertEqual(pol["spec"]["policyTypes"], ["Ingress"])
|
|
for peer in rule["from"]:
|
|
self.assertEqual(peer, {"podSelector": {"matchLabels": EXECUTOR}})
|
|
|
|
def test_default_deny_is_kept(self):
|
|
deny = [p for p in policies() if p["metadata"]["name"] == "default-deny-all"]
|
|
self.assertEqual(deny[0]["spec"], {"podSelector": {}, "policyTypes": ["Ingress", "Egress"]})
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|