From be3e2cdd47c3d9d666976d709cbd96ac0decba1e Mon Sep 17 00:00:00 2001 From: Justin Klein Date: Wed, 14 Oct 2026 15:29:16 +0000 Subject: [PATCH] test(ci): exercise minecraft-server's NodePort branch, which nothing rendered Found by reviewing my own diff rather than by a failure, which is the only reason it is worth a commit of its own. minecraft-server's game-port rule has two branches read from the same value the Service reads: OPEN when server.service.type is NodePort, RESTRICTED to the namespace otherwise. All four releases in this cluster use ClusterIP and so does the install-test fixture - so the OPEN branch was rendered nowhere at all. Not by the chart defaults, not by the fixture, not by lint. It is also the branch where naming server.service.outwardPort instead of server.port would be the classic NodePort mistake, and assertion 2 can only see a rule it has been given. The overlay switches the Service to NodePort and RCON on, so both unreachable branches are now rendered on every pull request. RCON is in there for a reason too: its rule is gated on server.rcon.enabled exactly as the containerPort is, that pairing was wrong once while this chart was being written, and switching the feature on keeps the PAIR under test rather than just the gate. The overlay guard had to be made conditional for this to be possible, and the refinement is sound rather than a workaround. It demanded that any chart with an overlay render a source-restricted PROBE rule - but minecraft-server has no probe rule at all, because all three of its probes are exec probes, and it therefore offers no probeSources. The guard now applies only to charts that offer that value, so it still catches an overlay that stopped reaching the restricted probe branch (template-chart, the case it was written for) without rejecting an overlay that exists for a different unreachable branch. All twelve failure paths re-run against the change; the suite is 30 charts, 208 assertions, 0 failed. Part of #5 --- ci/networkpolicy/minecraft-server.yaml | 31 ++++++++++++++++++++++++++ ci/run-networkpolicy-test.sh | 7 +++++- 2 files changed, 37 insertions(+), 1 deletion(-) create mode 100644 ci/networkpolicy/minecraft-server.yaml diff --git a/ci/networkpolicy/minecraft-server.yaml b/ci/networkpolicy/minecraft-server.yaml new file mode 100644 index 0000000..7456a5c --- /dev/null +++ b/ci/networkpolicy/minecraft-server.yaml @@ -0,0 +1,31 @@ +# Overlay for the NetworkPolicy render test (Gitea #5), applied last. +# +# This chart's policy has two branches that its own CI fixture never renders, +# and both carry a mistake worth catching mechanically. +# +# 1. THE NODEPORT BRANCH OF THE GAME-PORT RULE. The rule is OPEN when +# server.service.type is NodePort - players arrive from the internet, +# already masqueraded - and RESTRICTED to the namespace otherwise. The +# install-test fixture uses ClusterIP (as all four releases in this cluster +# do), so without this overlay the open branch was rendered NOWHERE: not by +# the defaults, not by the fixture, not by lint. It is also the branch where +# writing server.service.outwardPort instead of server.port would be the +# classic NodePort mistake, and assertion 2 only sees a rule it has been +# given. +# +# 2. THE RCON RULE, which is gated on server.rcon.enabled exactly as the +# containerPort is. That pairing was wrong once while this chart was being +# written - the rule had no gate, so it named a port the pod does not +# declare - and assertion 2 caught it. Switching RCON on here keeps the +# PAIR under test rather than just the gate. +# +# Note why this chart's overlay does NOT have to render a source-restricted +# probe rule, which is what the test demands of an overlay elsewhere: all three +# of this chart's probes are exec probes, so it has no probe rule at all and +# offers no networkPolicy.probeSources. The guard is conditional on that value +# for this reason. +server: + service: + type: NodePort + rcon: + enabled: true diff --git a/ci/run-networkpolicy-test.sh b/ci/run-networkpolicy-test.sh index 5f0b957..d5cf0be 100755 --- a/ci/run-networkpolicy-test.sh +++ b/ci/run-networkpolicy-test.sh @@ -743,6 +743,7 @@ if policies: ok("the rendered NetworkPolicy manifest(s) carry no \"#\" comment - all " "reasoning stayed in template comments") +print("OFFERSPS|%d" % (1 if offers_probe_sources else 0)) print("RESTRICTED|%d" % RESTRICTED_RULES) print("PROBERESTRICTED|%d" % PROBE_RESTRICTED) for line in lines: @@ -763,6 +764,7 @@ PY CHART_SKIP=0 CHART_RESTRICTED=0 CHART_PROBE_RESTRICTED=0 + CHART_OFFERS_PS=0 while IFS='|' read -r VERDICT DETAIL; do case "$VERDICT" in OK) @@ -779,6 +781,9 @@ PY PROBERESTRICTED) CHART_PROBE_RESTRICTED="$DETAIL" ;; + OFFERSPS) + CHART_OFFERS_PS="$DETAIL" + ;; FAIL) CHART_FAIL=1 echo " FAIL $DETAIL" @@ -797,7 +802,7 @@ PY FAILED="$FAILED $CHART" SUMMARY_ROWS="${SUMMARY_ROWS}| \`$CHART\` | **failed** | $CHART_OK | $CHART_SKIP |"$'\n' echo "$CHART: FAILED" - elif [ -n "$HAS_OVERLAY" ] && [ "$CHART_PROBE_RESTRICTED" -eq 0 ]; then + elif [ -n "$HAS_OVERLAY" ] && [ "$CHART_OFFERS_PS" -eq 1 ] && [ "$CHART_PROBE_RESTRICTED" -eq 0 ]; then # The overlay's ONE job is to render a code path the chart's defaults do not # reach - above all the RESTRICTED probe rule, which only appears once # probeSources is non-empty. If no restricted rule came out, this test is