diff --git a/src/main/helm/templates/network_policy.yaml b/src/main/helm/templates/network_policy.yaml index c1b0e20d49e0f76e1c935671c4cb666cf8840961..e71661fe1b4f695d2dce6dcc72babb43473a7215 100644 --- a/src/main/helm/templates/network_policy.yaml +++ b/src/main/helm/templates/network_policy.yaml @@ -110,14 +110,17 @@ spec: matchLabels: component: info-manager {{- end }} -{{- if ((.Values.ozgcloud).zufi).enabled }} +{{- if (.Values.zufiManager).enabled }} - to: - namespaceSelector: matchLabels: - kubernetes.io/metadata.name: {{ required "ozgcloud.zufi.namespace must be set if zufi is enabled" ((.Values.ozgcloud).zufi).namespace }} + kubernetes.io/metadata.name: {{ required "zufiManager.namespace must be set if zufiManager server is enabled" (.Values.zufiManager).namespace }} podSelector: matchLabels: component: zufi-server + ports: + - port: 9190 + protocol: TCP {{- end }} - to: - namespaceSelector: diff --git a/src/test/helm/network_policy_test.yaml b/src/test/helm/network_policy_test.yaml index e601e5f02519a0e8ddafa1b204559834ab62d022..5394332e621f85a6464dac1e34ba11adce5dd6b0 100644 --- a/src/test/helm/network_policy_test.yaml +++ b/src/test/helm/network_policy_test.yaml @@ -264,38 +264,68 @@ tests: - it: should add egress rule to zufi server if zufi is enabled set: - ozgcloud: - zufi: - enabled: true - namespace: zufi + zufiManager: + enabled: true + namespace: zufi asserts: - contains: path: spec.egress content: to: - - namespaceSelector: - matchLabels: - kubernetes.io/metadata.name: zufi - podSelector: - matchLabels: - component: zufi-server + - podSelector: + matchLabels: + component: zufi-server + namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: zufi + ports: + - port: 9190 + protocol: TCP + - it: should not add egress rule to zufi server if zufi is disabled set: - ozgcloud: - zufi: - enabled: false + zufiManager: + enabled: false asserts: - notContains: path: spec.egress content: to: - - namespaceSelector: - matchLabels: - kubernetes.io/metadata.name: zufi - podSelector: - matchLabels: - component: zufi-server + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: zufi + podSelector: + matchLabels: + component: zufi-server + ports: + - port: 9190 + protocol: TCP + - it: should throw error if zufi is enabled but zufi namespace is not set + set: + zufiManager: + enabled: true + namespace: + asserts: + - failedTemplate: + errorMessage: zufiManager.namespace must be set if zufiManager server is enabled + + - it: should not enable zufi netpol by default + asserts: + - notContains: + path: spec.egress + content: + to: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: zufi + podSelector: + matchLabels: + component: zufi-server + ports: + - port: 9190 + protocol: TCP + - it: should add egress rule to dns service