diff --git a/test/e2e/network/netpol/network_policy.go b/test/e2e/network/netpol/network_policy.go index 1d813a943ef..349ab06ca27 100644 --- a/test/e2e/network/netpol/network_policy.go +++ b/test/e2e/network/netpol/network_policy.go @@ -586,6 +586,17 @@ var _ = SIGDescribeCopy("Netpol [LinuxOnly]", func() { ValidateOrFail(k8s, model, &TestCase{FromPort: 81, ToPort: 80, Protocol: v1.ProtocolTCP, Reachability: reachabilityIsolated}) }) + ginkgo.It("should deny egress from pods based on PodSelector [Feature:NetworkPolicy] ", func() { + nsX, _, _, model, k8s := getK8SModel(f) + policy := GetDenyEgressForTarget("deny-egress-pod-a", metav1.LabelSelector{MatchLabels: map[string]string{"pod": "a"}}) + CreatePolicy(k8s, policy, nsX) + + reachability := NewReachability(model.AllPods(), true) + reachability.ExpectAllEgress(NewPodString(nsX, "a"), false) + + ValidateOrFail(k8s, model, &TestCase{FromPort: 81, ToPort: 80, Protocol: v1.ProtocolTCP, Reachability: reachability}) + }) + ginkgo.It("should work with Ingress, Egress specified together [Feature:NetworkPolicy]", func() { allowedPodLabels := &metav1.LabelSelector{MatchLabels: map[string]string{"pod": "b"}} policy := GetAllowIngressByPod("allow-client-a-via-pod-selector", map[string]string{"pod": "a"}, allowedPodLabels) diff --git a/test/e2e/network/netpol/policies.go b/test/e2e/network/netpol/policies.go index 425f3e7a474..ef58fc57178 100644 --- a/test/e2e/network/netpol/policies.go +++ b/test/e2e/network/netpol/policies.go @@ -26,7 +26,7 @@ import ( metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" ) -// GetDenyIngress returns a default deny policy named 'name'. +// GetDenyIngress returns a default deny ingress policy. func GetDenyIngress(name string) *networkingv1.NetworkPolicy { return &networkingv1.NetworkPolicy{ ObjectMeta: metav1.ObjectMeta{ @@ -34,11 +34,26 @@ func GetDenyIngress(name string) *networkingv1.NetworkPolicy { }, Spec: networkingv1.NetworkPolicySpec{ PodSelector: metav1.LabelSelector{}, + PolicyTypes: []networkingv1.PolicyType{networkingv1.PolicyTypeIngress}, Ingress: []networkingv1.NetworkPolicyIngressRule{}, }, } } +// GetDenyEgressForTarget returns a default deny egress policy. +func GetDenyEgressForTarget(name string, targetSelector metav1.LabelSelector) *networkingv1.NetworkPolicy { + return &networkingv1.NetworkPolicy{ + ObjectMeta: metav1.ObjectMeta{ + Name: name, + }, + Spec: networkingv1.NetworkPolicySpec{ + PodSelector: targetSelector, + PolicyTypes: []networkingv1.PolicyType{networkingv1.PolicyTypeEgress}, + Egress: []networkingv1.NetworkPolicyEgressRule{}, + }, + } +} + // GetRandomIngressPolicies returns "num" random policies that allow a unique:n label, i.e. // unique:1, unique:2, and so on. Used for creating a 'background' set of policies. func GetRandomIngressPolicies(num int) []*networkingv1.NetworkPolicy {