OPRUN-3873: Add e2e tests for NetworkPolicies

Author: anik120

test/e2e/network_policy_test.go

@@ -0,0 +1,302 @@
+package e2e
+
+import (
+	"context"
+	"fmt"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	corev1 "k8s.io/api/core/v1"
+	networkingv1 "k8s.io/api/networking/v1"
+	"k8s.io/apimachinery/pkg/api/equality"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/util/intstr"
+	"k8s.io/utils/ptr"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+)
+
+const (
+	olmSystemNamespace      = "olmv1-system"
+	minJustificationLength  = 40
+	catalogdManagerSelector = "control-plane=catalogd-controller-manager"
+	operatorManagerSelector = "control-plane=operator-controller-controller-manager"
+)
+
+type PortWithJustification struct {
+	Port          []networkingv1.NetworkPolicyPort
+	Justification string
+}
+
+// IngressRule defines a k8s IngressRule, along with a justification.
+type IngressRule struct {
+	Ports []PortWithJustification
+	From  []networkingv1.NetworkPolicyPeer
+}
+
+// EgressRule defines a k8s EgressRule, along with a justification.
+type EgressRule struct {
+	Ports []PortWithJustification
+	To    []networkingv1.NetworkPolicyPeer
+}
+
+// AllowedPolicyDefinition defines the expected structure and justifications for a NetworkPolicy.
+type AllowedPolicyDefinition struct {
+	Selector                          metav1.LabelSelector
+	PolicyTypes                       []networkingv1.PolicyType
+	IngressRule                       IngressRule
+	EgressRule                        EgressRule
+	DenyAllIngressByTypeJustification string // Justification if Ingress is in PolicyTypes and IngressRules is empty
+	DenyAllEgressByTypeJustification  string // Justification if Egress is in PolicyTypes and EgressRules is empty
+}
+
+var allowedNetworkPolicies = map[string]AllowedPolicyDefinition{
+	"catalogd-controller-manager": {
+		Selector:    metav1.LabelSelector{MatchLabels: map[string]string{"control-plane": "catalogd-controller-manager"}},
+		PolicyTypes: []networkingv1.PolicyType{networkingv1.PolicyTypeIngress, networkingv1.PolicyTypeEgress},
+		IngressRule: IngressRule{
+			Ports: []PortWithJustification{
+				{
+					Port:          []networkingv1.NetworkPolicyPort{{Protocol: ptr.To(corev1.ProtocolTCP), Port: intOrStrPtr(8443)}},
+					Justification: "Allows Prometheus to scrape metrics from catalogd, which is essential for monitoring its performance and health.",
+				},
+				{
+					Port:          []networkingv1.NetworkPolicyPort{{Protocol: ptr.To(corev1.ProtocolTCP), Port: intOrStrPtr(9443)}},
+					Justification: "Permits Kubernetes API server to reach catalogd's mutating admission webhook, ensuring integrity of catalog resources.",
+				},
+				{
+					Port:          []networkingv1.NetworkPolicyPort{{Protocol: ptr.To(corev1.ProtocolTCP), Port: intOrStrPtr(7443)}},
+					Justification: "Enables clients (eg. operator-controller) to query catalog metadata from catalogd, which is a core function for bundle resolution and operator discovery.",
+				},
+			},
+		},
+		EgressRule: EgressRule{
+			Ports: []PortWithJustification{
+				{
+					Port:          nil, // Empty Ports means allow all egress
+					Justification: "Permits catalogd to fetch catalog images from arbitrary container registries and communicate with the Kubernetes API server for its operational needs.",
+				},
+			},
+		},
+	},
+	"operator-controller-controller-manager": {
+		Selector:    metav1.LabelSelector{MatchLabels: map[string]string{"control-plane": "operator-controller-controller-manager"}},
+		PolicyTypes: []networkingv1.PolicyType{networkingv1.PolicyTypeIngress, networkingv1.PolicyTypeEgress},
+		IngressRule: IngressRule{
+			Ports: []PortWithJustification{
+				{
+					Port:          []networkingv1.NetworkPolicyPort{{Protocol: ptr.To(corev1.ProtocolTCP), Port: intOrStrPtr(8443)}},
+					Justification: "Allows Prometheus to scrape metrics from operator-controller, which is crucial for monitoring its activity, reconciliations, and overall health.",
+				},
+			},
+		},
+		EgressRule: EgressRule{
+			Ports: []PortWithJustification{
+				{
+					Port:          nil, // Empty Ports means allow all egress
+					Justification: "Enables operator-controller to pull bundle images from arbitrary image registries, connect to catalogd's HTTPS server for metadata, and interact with the Kubernetes API server.",
+				},
+			},
+		},
+	},
+	"default-deny-all-traffic": {
+		Selector:    metav1.LabelSelector{}, // Empty selector, matches all pods
+		PolicyTypes: []networkingv1.PolicyType{networkingv1.PolicyTypeIngress, networkingv1.PolicyTypeEgress},
+		// No IngressRules means deny all ingress if PolicyTypeIngress is present
+		// No EgressRules means deny all egress if PolicyTypeEgress is present
+		DenyAllIngressByTypeJustification: "Denies all ingress traffic to pods selected by this policy by default, unless explicitly allowed by other policy rules, ensuring a baseline secure posture.",
+		DenyAllEgressByTypeJustification:  "Denies all egress traffic from pods selected by this policy by default, unless explicitly allowed by other policy rules, minimizing potential exfiltration paths.",
+	},
+}
+
+func TestNetworkPolicyJustifications(t *testing.T) {
+	ctx := context.Background()
+
+	// Validate justifications have min length in the allowedNetworkPolicies definition
+	for name, policyDef := range allowedNetworkPolicies {
+		for i, pwj := range policyDef.IngressRule.Ports {
+			assert.GreaterOrEqualf(t, len(pwj.Justification), minJustificationLength,
+				"Justification for ingress PortWithJustification entry %d in policy %q is too short: %q", i, name, pwj.Justification)
+		}
+		for i, pwj := range policyDef.EgressRule.Ports { // Corrected variable name from 'rule' to 'pwj'
+			assert.GreaterOrEqualf(t, len(pwj.Justification), minJustificationLength,
+				"Justification for egress PortWithJustification entry %d in policy %q is too short: %q", i, name, pwj.Justification)
+		}
+		if policyDef.DenyAllIngressByTypeJustification != "" {
+			assert.GreaterOrEqualf(t, len(policyDef.DenyAllIngressByTypeJustification), minJustificationLength,
+				"DenyAllIngressByTypeJustification for policy %q is too short: %q", name, policyDef.DenyAllIngressByTypeJustification)
+		}
+		if policyDef.DenyAllEgressByTypeJustification != "" {
+			assert.GreaterOrEqualf(t, len(policyDef.DenyAllEgressByTypeJustification), minJustificationLength,
+				"DenyAllEgressByTypeJustification for policy %q is too short: %q", name, policyDef.DenyAllEgressByTypeJustification)
+		}
+	}
+
+	networkPolicyList := &networkingv1.NetworkPolicyList{}
+	err := c.List(ctx, networkPolicyList, client.InNamespace(olmSystemNamespace))
+	require.NoError(t, err, "Failed to list NetworkPolicies in namespace %q", olmSystemNamespace)
+
+	validatedRegistryPolicies := make(map[string]bool)
+
+	for _, clusterPolicyItem := range networkPolicyList.Items {
+		clusterPolicy := clusterPolicyItem
+		policyName := clusterPolicy.Name
+
+		t.Run(fmt.Sprintf("Policy_%s", strings.ReplaceAll(policyName, "-", "_")), func(t *testing.T) {
+			expectedPolicy, found := allowedNetworkPolicies[policyName]
+			require.Truef(t, found, "NetworkPolicy %q found in cluster but not in allowed registry. Namespace: %s", policyName, clusterPolicy.Namespace)
+			validatedRegistryPolicies[policyName] = true
+
+			// 1. Compare PodSelector
+			assert.True(t, equality.Semantic.DeepEqual(expectedPolicy.Selector, clusterPolicy.Spec.PodSelector),
+				"PodSelector mismatch for policy %q. Expected: %+v, Got: %+v", policyName, expectedPolicy.Selector, clusterPolicy.Spec.PodSelector)
+
+			// 2. Compare PolicyTypes
+			require.ElementsMatchf(t, expectedPolicy.PolicyTypes, clusterPolicy.Spec.PolicyTypes,
+				"PolicyTypes mismatch for policy %q.", policyName)
+
+			// 3. Validate Ingress Rules
+			hasIngressPolicyType := false
+			for _, pt := range clusterPolicy.Spec.PolicyTypes {
+				if pt == networkingv1.PolicyTypeIngress {
+					hasIngressPolicyType = true
+					break
+				}
+			}
+
+			if hasIngressPolicyType {
+				if len(clusterPolicy.Spec.Ingress) == 0 {
+					// Cluster: PolicyType Ingress is present, but no explicit ingress rules -> Deny All Ingress by this policy.
+					// Expected: DenyAllIngressByTypeJustification is set; IngressRule.Ports and .From are empty.
+					require.NotEmptyf(t, expectedPolicy.DenyAllIngressByTypeJustification,
+						"Policy %q: Cluster has Ingress PolicyType but no rules (deny all). Registry's DenyAllIngressByTypeJustification is empty.", policyName)
+					require.Emptyf(t, expectedPolicy.IngressRule.Ports,
+						"Policy %q: Cluster has Ingress PolicyType but no rules (deny all). Registry's IngressRule.Ports is not empty.", policyName)
+					require.Emptyf(t, expectedPolicy.IngressRule.From,
+						"Policy %q: Cluster has Ingress PolicyType but no rules (deny all). Registry's IngressRule.From is not empty.", policyName)
+				} else if len(clusterPolicy.Spec.Ingress) == 1 {
+					// Cluster: PolicyType Ingress is present, and there's one explicit ingress rule.
+					// Expected: DenyAllIngressByTypeJustification is empty; IngressRule matches the cluster's rule.
+					clusterIngressRule := clusterPolicy.Spec.Ingress[0]
+					expectedIngressRule := expectedPolicy.IngressRule
+
+					require.Emptyf(t, expectedPolicy.DenyAllIngressByTypeJustification,
+						"Policy %q: Cluster has a specific Ingress rule. Registry's DenyAllIngressByTypeJustification should be empty.", policyName)
+
+					assert.True(t, equality.Semantic.DeepEqual(expectedIngressRule.From, clusterIngressRule.From),
+						"Policy %q, Ingress Rule: 'From' mismatch.\nExpected: %+v\nGot:      %+v", policyName, expectedIngressRule.From, clusterIngressRule.From)
+
+					var allExpectedPortsFromPwJ []networkingv1.NetworkPolicyPort
+					for _, pwj := range expectedIngressRule.Ports {
+						allExpectedPortsFromPwJ = append(allExpectedPortsFromPwJ, pwj.Port...)
+					}
+					require.ElementsMatchf(t, allExpectedPortsFromPwJ, clusterIngressRule.Ports,
+						"Policy %q, Ingress Rule: 'Ports' mismatch (aggregated from PortWithJustification). Expected: %+v, Got: %+v", policyName, allExpectedPortsFromPwJ, clusterIngressRule.Ports)
+				} else {
+					assert.Failf(t, "Policy %q in cluster has %d ingress rules. Allowed definition supports at most 1 explicit ingress rule.", policyName, len(clusterPolicy.Spec.Ingress))
+				}
+			} else {
+				// Policy is NOT expected to affect Ingress traffic (no Ingress in PolicyTypes)
+				// Expected: Cluster has no ingress rules; Registry has no DenyAllIngressByTypeJustification and empty IngressRule.
+				require.Emptyf(t, clusterPolicy.Spec.Ingress,
+					"Policy %q: Cluster does not have Ingress PolicyType, but has Ingress rules defined.", policyName)
+				require.Emptyf(t, expectedPolicy.DenyAllIngressByTypeJustification,
+					"Policy %q: Cluster does not have Ingress PolicyType. Registry's DenyAllIngressByTypeJustification is not empty.", policyName)
+				require.Emptyf(t, expectedPolicy.IngressRule.Ports,
+					"Policy %q: Cluster does not have Ingress PolicyType. Registry's IngressRule.Ports is not empty.", policyName)
+				require.Emptyf(t, expectedPolicy.IngressRule.From,
+					"Policy %q: Cluster does not have Ingress PolicyType. Registry's IngressRule.From is not empty.", policyName)
+			}
+
+			// 4. Validate Egress Rules
+			hasEgressPolicyType := false
+			for _, pt := range clusterPolicy.Spec.PolicyTypes {
+				if pt == networkingv1.PolicyTypeEgress {
+					hasEgressPolicyType = true
+					break
+				}
+			}
+
+			if hasEgressPolicyType {
+				// Policy is expected to affect Egress traffic
+				if len(clusterPolicy.Spec.Egress) == 0 {
+					// Cluster: PolicyType Egress is present, but no explicit egress rules -> Deny All Egress by this policy.
+					// Expected: DenyAllEgressByTypeJustification is set; EgressRule.Ports and .To are empty.
+					require.NotEmptyf(t, expectedPolicy.DenyAllEgressByTypeJustification,
+						"Policy %q: Cluster has Egress PolicyType but no rules (deny all). Registry's DenyAllEgressByTypeJustification is empty.", policyName)
+					require.Emptyf(t, expectedPolicy.EgressRule.Ports,
+						"Policy %q: Cluster has Egress PolicyType but no rules (deny all). Registry's EgressRule.Ports is not empty.", policyName)
+					require.Emptyf(t, expectedPolicy.EgressRule.To,
+						"Policy %q: Cluster has Egress PolicyType but no rules (deny all). Registry's EgressRule.To is not empty.", policyName)
+				} else if len(clusterPolicy.Spec.Egress) == 1 {
+					// Cluster: PolicyType Egress is present, and there's one explicit egress rule.
+					// Expected: DenyAllEgressByTypeJustification is empty; EgressRule matches the cluster's rule.
+					clusterEgressRule := clusterPolicy.Spec.Egress[0]
+					expectedEgressRule := expectedPolicy.EgressRule
+
+					require.Emptyf(t, expectedPolicy.DenyAllEgressByTypeJustification,
+						"Policy %q: Cluster has a specific Egress rule. Registry's DenyAllEgressByTypeJustification should be empty.", policyName)
+
+					isClusterRuleAllowAllPorts := len(clusterEgressRule.Ports) == 0
+					isClusterRuleAllowAllPeers := len(clusterEgressRule.To) == 0
+
+					if isClusterRuleAllowAllPorts && isClusterRuleAllowAllPeers { // Handles egress: [{}] - allow all ports to all peers
+						require.Lenf(t, expectedEgressRule.Ports, 1,
+							"Policy %q (allow-all egress): Expected EgressRule.Ports to have 1 justification entry, got %d", policyName, len(expectedEgressRule.Ports))
+						if len(expectedEgressRule.Ports) == 1 { // Guard against panic
+							assert.Nilf(t, expectedEgressRule.Ports[0].Port,
+								"Policy %q (allow-all egress): Expected EgressRule.Ports[0].Port to be nil, got %+v", policyName, expectedEgressRule.Ports[0].Port)
+						}
+						assert.Conditionf(t, func() bool { return len(expectedEgressRule.To) == 0 },
+							"Policy %q (allow-all egress): Expected EgressRule.To to be empty for allow-all peers, got %+v", policyName, expectedEgressRule.To)
+					} else {
+						// Specific egress rule (not the simple allow-all ports and allow-all peers)
+						assert.True(t, equality.Semantic.DeepEqual(expectedEgressRule.To, clusterEgressRule.To),
+							"Policy %q, Egress Rule: 'To' mismatch.\nExpected: %+v\nGot:      %+v", policyName, expectedEgressRule.To, clusterEgressRule.To)
+
+						var allExpectedPortsFromPwJ []networkingv1.NetworkPolicyPort
+						for _, pwj := range expectedEgressRule.Ports {
+							allExpectedPortsFromPwJ = append(allExpectedPortsFromPwJ, pwj.Port...)
+						}
+						require.ElementsMatchf(t, allExpectedPortsFromPwJ, clusterEgressRule.Ports,
+							"Policy %q, Egress Rule: 'Ports' mismatch (aggregated from PortWithJustification). Expected: %+v, Got: %+v", policyName, allExpectedPortsFromPwJ, clusterEgressRule.Ports)
+					}
+				} else {
+					assert.Failf(t, "Policy %q in cluster has %d egress rules. Allowed definition supports at most 1 explicit egress rule.", policyName, len(clusterPolicy.Spec.Egress))
+				}
+			} else {
+				// Policy is NOT expected to affect Egress traffic (no Egress in PolicyTypes)
+				// Expected: Cluster has no egress rules; Registry has no DenyAllEgressByTypeJustification and empty EgressRule.
+				require.Emptyf(t, clusterPolicy.Spec.Egress,
+					"Policy %q: Cluster does not have Egress PolicyType, but has Egress rules defined.", policyName)
+				require.Emptyf(t, expectedPolicy.DenyAllEgressByTypeJustification,
+					"Policy %q: Cluster does not have Egress PolicyType. Registry's DenyAllEgressByTypeJustification is not empty.", policyName)
+				require.Emptyf(t, expectedPolicy.EgressRule.Ports,
+					"Policy %q: Cluster does not have Egress PolicyType. Registry's EgressRule.Ports is not empty.", policyName)
+				require.Emptyf(t, expectedPolicy.EgressRule.To,
+					"Policy %q: Cluster does not have Egress PolicyType. Registry's EgressRule.To is not empty.", policyName)
+			}
+		})
+	}
+
+	// 5. Ensure all policies in the registry were found in the cluster
+	assert.Equal(t, len(allowedNetworkPolicies), len(validatedRegistryPolicies),
+		"Mismatch between number of expected policies in registry (%d) and number of policies found & validated in cluster (%d). Missing policies from registry: %v", len(allowedNetworkPolicies), len(validatedRegistryPolicies), missingPolicies(allowedNetworkPolicies, validatedRegistryPolicies))
+}
+
+// Helper function to create a pointer to intstr.IntOrString from an int
+func intOrStrPtr(port int32) *intstr.IntOrString {
+	val := intstr.FromInt(int(port))
+	return &val
+}
+
+func missingPolicies(expected map[string]AllowedPolicyDefinition, actual map[string]bool) []string {
+	missing := []string{}
+	for k := range expected {
+		if !actual[k] {
+			missing = append(missing, k)
+		}
+	}
+	return missing
+}