mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-14 00:23:54 +09:00
Myasnikov DaniilandClaude Fable 5
dd2f89d208
Main added securitygroup.bats (#2922 membership model) and serviceexposure.bats (#3081 ExposureClass/ServiceExposure) after the Chainsaw migration branch was cut. - securitygroup: two Tests — the aggregated-API projection round-trip (backing CNP marker label, empty-value membership endpointSelector, lineage fromApp + membership fromSG peers, 1:1 rule translation, the view hiding storage internals, unmarked-CNP invisibility via an error op, delete propagation) and the controller membership-label stamp/clear lifecycle. Only the attachments annotation stays a jq script (it is a JSON string). Chainsaw auto-cleanup covers every fixture even on mid-test failure — the bats had no teardown hook and leaked its fixtures. - serviceexposure: the externalIPs backend resolve/Ready/assignedIPs path with the no-MetalLB-pool negative as an error op (ordered after resolvedBackend so it cannot false-pass), and the finalizer-removal test collapsed onto the delete op itself, which waits for full disappearance. - selection: kubernetes-application now also maps to the two OIDC render-side suites (they exercise the same app chart — a gap main's bats selection had too); the new dirs enter all_apps discovery automatically. Selector unit tests extended and green (13/13 under cozytest). - README: suites list updated. Assisted-By: Claude <noreply@anthropic.com> Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
18 lines
566 B
YAML
18 lines
566 B
YAML
apiVersion: cilium.io/v2
|
|
kind: CiliumNetworkPolicy
|
|
metadata:
|
|
name: plain-cnp-e2e
|
|
spec:
|
|
endpointSelector:
|
|
matchLabels:
|
|
app: untouched
|
|
# A rule is mandatory: the CiliumNetworkPolicy CRD requires at least one of
|
|
# ingress/ingressDeny/egress/egressDeny (spec anyOf), so a selector-only
|
|
# policy is rejected at apply time. This keeps the fixture a valid, applyable
|
|
# CNP while leaving it unmarked (no securitygroup label) — so it must stay
|
|
# invisible to the SecurityGroup API.
|
|
ingress:
|
|
- fromEndpoints:
|
|
- matchLabels:
|
|
app: peer
|