The part that carries the rollout of Gitea #5. 29 charts get a policy that is
on by default, and every way one of them can be wrong is SILENT: the API server
accepts a policy that filters nothing just as readily as one that filters
everything, and neither is a render error, so neither the build nor a rollout
sees it.
ci/run-networkpolicy-test.sh holds every rendered NetworkPolicy against the pod
specs, probes and Services of the SAME render:
1. the podSelector really matches a pod of that render - otherwise the object
sits in the namespace, is listed by kubectl, reads as a boundary and
filters nothing, usually because a label was renamed in another file;
2. every INGRESS port is a containerPort of the selected pods, which catches
the NodePort mistake mechanically. Egress ports are deliberately excluded:
an egress port belongs to the DESTINATION, and comparing it would fail
every chart that reaches a database;
3. no ingress rule allows every source by accident. "from: []" always fails -
it allows everything while reading as a restriction. A MISSING "from" is
the documented open form and is accepted only where the render justifies
it: every port of the rule is addressed by a network probe, or published by
a NodePort Service. That is stricter than the plan's wording, which banned
both forms, and it had to be, because the precedents use the second one on
purpose;
4. the probe path. For every port a NETWORK probe addresses, the policy either
leaves it unrestricted or the chart offers networkPolicy.probeSources AND
says in NOTES.txt that a list missing the node's IP leaves the pod
permanently un-Ready. exec probes are excluded by design - they run inside
the container and put no packet on the network, which is exactly why
valkey and minecraft-server can restrict their port by source with no
probeSources at all.
Two guards beyond the four: a chart that renders NO policy fails, because that
is how this issue decayed in the first place - garage and keycloak were both
created after #5 and both arrived without one. And a "#" comment inside a
rendered policy fails, because it is part of the object and is shipped to the
cluster.
Helm is the parser through ci/yaml2json, as in the other render tests: the
runners have neither pyyaml nor yq, and a hand-written parser could read
nothing, find nothing and leave this green over a chart it never looked at.
Every failure path was run, not just the green ones, and one of them earned its
keep immediately: the probeSources check was a substring test, so a chart whose
key had been deleted while the comment above it still discussed the value
passed. It now looks for the key.
Part of #5
jklein
36bcfd3b11