diff --git a/test/e2e/network/netpol/network_policy.go b/test/e2e/network/netpol/network_policy.go index 5b79160d585..85d686b294e 100644 --- a/test/e2e/network/netpol/network_policy.go +++ b/test/e2e/network/netpol/network_policy.go @@ -556,6 +556,17 @@ var _ = SIGDescribeCopy("Netpol [LinuxOnly]", func() { ValidateOrFail(k8s, model, &TestCase{ToPort: 80, Protocol: v1.ProtocolTCP, Reachability: reachability}) }) + ginkgo.It("should deny egress from all pods in a namespace [Feature:NetworkPolicy] ", func() { + nsX, _, _, model, k8s := getK8SModel(f) + policy := GetDenyEgress("deny-egress-ns-x") + CreatePolicy(k8s, policy, nsX) + + reachability := NewReachability(model.AllPods(), true) + reachability.ExpectPeer(&Peer{Namespace: nsX}, &Peer{}, false) + + ValidateOrFail(k8s, model, &TestCase{ToPort: 80, Protocol: v1.ProtocolTCP, Reachability: reachability}) + }) + ginkgo.It("should work with Ingress, Egress specified together [Feature:NetworkPolicy]", func() { allowedPodLabels := &metav1.LabelSelector{MatchLabels: map[string]string{"pod": "b"}} policy := GetAllowIngressByPod("allow-client-a-via-pod-selector", map[string]string{"pod": "a"}, allowedPodLabels) diff --git a/test/e2e/network/netpol/policies.go b/test/e2e/network/netpol/policies.go index d76a66de90f..89eeeec7480 100644 --- a/test/e2e/network/netpol/policies.go +++ b/test/e2e/network/netpol/policies.go @@ -40,6 +40,20 @@ func GetDenyIngress(name string) *networkingv1.NetworkPolicy { } } +// GetDenyEgress returns a default deny egress policy. +func GetDenyEgress(name string) *networkingv1.NetworkPolicy { + return &networkingv1.NetworkPolicy{ + ObjectMeta: metav1.ObjectMeta{ + Name: name, + }, + Spec: networkingv1.NetworkPolicySpec{ + PodSelector: metav1.LabelSelector{}, + PolicyTypes: []networkingv1.PolicyType{networkingv1.PolicyTypeEgress}, + Egress: []networkingv1.NetworkPolicyEgressRule{}, + }, + } +} + // GetDenyEgressForTarget returns a default deny egress policy. func GetDenyEgressForTarget(name string, targetSelector metav1.LabelSelector) *networkingv1.NetworkPolicy { return &networkingv1.NetworkPolicy{