zeeke / multus-networkpolicy / 10792966771

58%

master: 58%

Build Type

push

github

Committed by zeeke

Commit Message

Make sure that policies with no valid peers are enforced

If a policy rule has a `from` (or `to`) selector that matches no pods,
the subject pod has to not be reached by  (or has to not reach) any pods.

The following example helps clarify the reasons behind these:
Given a scenario  with 3 pods (A, B, C) and a rule like:
```
podSelector:
    matchLabels:
      name: A
  ingress:
  - from:
    - podSelector:
        matchLabels:
          name: B
  policyTypes:
  - Ingress
```
Pod A can be reached only by pod B. Pod C can't reach A, and this has to be
ensured even if pod B is deleted.

Add an end-to-end test case to validate this scenario and adjust unit
tests accordingly.

Signed-off-by: Andrea Panattoni <apanatto@redhat.com>

Run Details

2 of 2 new or added lines in 1 file covered. (100.0%)

23 existing lines in 1 file now uncovered.

1105 of 1916 relevant lines covered (57.67%)

0.67 hits per line