Documentation ¶
Index ¶
- Constants
- Variables
- func DefaultIPBlockPeers(podIP string) []NetworkPolicyPeer
- func DefaultIngressOrEgressFeatures(isIngress bool, peers *NetpolPeers, features map[string]bool)
- func DefaultNamespaces() []string
- func DefaultPeerFeatures(isIngress bool, peers []NetworkPolicyPeer, features map[string]bool)
- func DefaultPeers(podIP string) []NetworkPolicyPeer
- func DefaultPodPeers() []NetworkPolicyPeer
- func DefaultPolicyFeatures(policy *Netpol, features map[string]bool)
- func DefaultPortFeatures(isIngress bool, npPorts []NetworkPolicyPort, features map[string]bool)
- func DefaultPorts() []NetworkPolicyPort
- func DefaultRuleFeature(isIngress bool, rule *Rule, features map[string]bool)
- func DefaultSinglePeerFeature(isIngress bool, peer NetworkPolicyPeer, features map[string]bool)
- func DefaultSinglePortFeature(isIngress bool, npPort NetworkPolicyPort, features map[string]bool)
- func DefaultTargetFeatures(target *NetpolTarget, features map[string]bool)
- func DefaultTargets() []metav1.LabelSelector
- func RunDiscreteGeneratorTests()
- func SinglePortProtocolTestCases() []NetworkPolicyPort
- type Action
- func CreateNamespace(ns string, labels map[string]string) *Action
- func CreatePod(namespace string, pod string, labels map[string]string) *Action
- func CreatePolicy(policy *networkingv1.NetworkPolicy) *Action
- func DeleteNamespace(ns string) *Action
- func DeletePod(namespace string, pod string) *Action
- func DeletePolicy(ns string, name string) *Action
- func ReadNetworkPolicies(namespaces []string) *Action
- func SetNamespaceLabels(ns string, labels map[string]string) *Action
- func SetPodLabels(namespace string, pod string, labels map[string]string) *Action
- func UpdatePolicy(policy *networkingv1.NetworkPolicy) *Action
- type BreadthGenerator
- type ConflictGenerator
- type CreateNamespaceAction
- type CreatePodAction
- type CreatePolicyAction
- type DeleteNamespaceAction
- type DeletePodAction
- type DeletePolicyAction
- type DepthGenerator
- type DiscreteGenerator
- type ExampleGenerator
- type FragmentGenerator
- func (g *FragmentGenerator) EgressPolicies() []*NetworkPolicy
- func (g *FragmentGenerator) FragmentEgressPolicies() []*NetworkPolicy
- func (g *FragmentGenerator) FragmentIngressPolicies() []*NetworkPolicy
- func (g *FragmentGenerator) FragmentPolicies() []*NetworkPolicy
- func (g *FragmentGenerator) GenerateTestCases() []*TestCase
- func (g *FragmentGenerator) IngressEgressPolicies(allowDNS bool) []*NetworkPolicy
- func (g *FragmentGenerator) IngressPolicies() []*NetworkPolicy
- func (g *FragmentGenerator) PeerSlices() [][]NetworkPolicyPeer
- func (g *FragmentGenerator) PortSlices() [][]NetworkPolicyPort
- func (g *FragmentGenerator) RuleSlices() [][]*Rule
- func (g *FragmentGenerator) Rules() []*Rule
- type Netpol
- func AllowAllEgressDenyAllIngress(source *NetpolTarget, dest *NetpolTarget) []*Netpol
- func AllowAllIngressDenyAllEgress(source *NetpolTarget, dest *NetpolTarget) []*Netpol
- func AllowDNSPolicy(source *NetpolTarget) *Netpol
- func BuildPolicy(setters ...Setter) *Netpol
- func DenyAllEgressAllowAllEgress(source *NetpolTarget) []*Netpol
- func DenyAllEgressAllowAllEgressByIP(source *NetpolTarget) []*Netpol
- func DenyAllEgressAllowAllEgressByPod(source *NetpolTarget) []*Netpol
- func DenyAllEgressByIP(source *NetpolTarget) []*Netpol
- func DenyAllEgressByIPAllowAllEgressByPod(source *NetpolTarget) []*Netpol
- func DenyAllEgressByPod(source *NetpolTarget) []*Netpol
- func DenyAllEgressByPodAllowAllEgressByIP(source *NetpolTarget) []*Netpol
- func DenyAllIngressAllowAllIngress(dest *NetpolTarget) []*Netpol
- func DenyAllIngressAllowAllIngressByIP(source *NetpolTarget) []*Netpol
- func DenyAllIngressAllowAllIngressByPod(source *NetpolTarget) []*Netpol
- func DenyAllIngressByIP(source *NetpolTarget) []*Netpol
- func DenyAllIngressByIPAllowAllIngressByPod(source *NetpolTarget) []*Netpol
- func DenyAllIngressByPod(source *NetpolTarget) []*Netpol
- func DenyAllIngressByPodAllowAllIngressByIP(source *NetpolTarget) []*Netpol
- func NewNetpol(policy *NetworkPolicy) *Netpol
- type NetpolPeers
- type NetpolTarget
- type NetpolTraverser
- type PortProtocol
- type ProbeConfig
- type ReadNetworkPoliciesAction
- type Rule
- type SetNamespaceLabelsAction
- type SetPodLabelsAction
- type Setter
- func SetDescription(description string) Setter
- func SetNamespace(ns string) Setter
- func SetPeers(isIngress bool, peers []NetworkPolicyPeer) Setter
- func SetPodSelector(sel metav1.LabelSelector) Setter
- func SetPorts(isIngress bool, ports []NetworkPolicyPort) Setter
- func SetRules(isIngress bool, rules []*Rule) Setter
- type TestCase
- type TestCaseGenerator
- type TestStep
- type UpdatePolicyAction
- type UpstreamE2EGenerator
Constants ¶
const ( ActionFeatureCreatePolicy = "action: create policy" ActionFeatureUpdatePolicy = "action: update policy" ActionFeatureDeletePolicy = "action: delete policy" ActionFeatureCreateNamespace = "action: create namespace" ActionFeatureSetNamespaceLabels = "action: set namespace labels" ActionFeatureDeleteNamespace = "action: delete namespace" ActionFeatureReadPolicies = "action: read policies" ActionFeatureCreatePod = "action: create pod" ActionFeatureSetPodLabels = "action: set pod labels" ActionFeatureDeletePod = "action: delete pod" )
const ( PolicyFeatureIngress = "policy with ingress" PolicyFeatureEgress = "policy with egress" PolicyFeatureIngressAndEgress = "policy with both ingress and egress" )
const ( TargetFeatureSpecificNamespace = "target: specific namespace" TargetFeatureNamespaceEmpty = "target: empty namespace" TargetFeaturePodSelectorEmpty = "target: empty pod selector" TargetFeaturePodSelectorMatchLabels = "target: pod selector match labels" TargetFeaturePodSelectorMatchExpressions = "target: pod selector match expression" )
const ( RuleFeatureAllPeersAllPortsAllProtocols = "all peers on all ports/protocols" RuleFeatureSliceEmpty = "0 rules" RuleFeatureSliceSize1 = "1 rule" RuleFeatureSliceSize2Plus = "2+ rules" PeerFeaturePortSliceEmpty = "0 port/protocols" PeerFeaturePortSliceSize1 = "1 port/protocol" PeerFeaturePortSliceSize2Plus = "2+ port/protocols" PeerFeatureNumberedPort = "numbered port" PeerFeatureNamedPort = "named port" PeerFeatureNilPort = "nil port" PeerFeatureNilProtocol = "nil protocol" PeerFeatureTCPProtocol = "policy on TCP" PeerFeatureUDPProtocol = "policy on UDP" PeerFeatureSCTPProtocol = "policy on SCTP" PeerFeaturePeerSliceEmpty = "0 peers" PeerFeaturePeerSliceSize1 = "1 peer" PeerFeaturePeerSliceSize2Plus = "2+ peers" PeerFeatureIPBlockEmptyExcept = "IPBlock (no except)" PeerFeatureIPBlockNonemptyExcept = "IPBlock with except" PeerFeaturePodSelectorNil = "peer pod selector nil" PeerFeaturePodSelectorEmpty = "peer pod selector empty" PeerFeaturePodSelectorMatchLabels = "peer pod selector match labels" PeerFeaturePodSelectorMatchExpressions = "peer pod selector match expression" PeerFeatureNamespaceSelectorNil = "peer namespace selector nil" PeerFeatureNamespaceSelectorEmpty = "peer namespace selector empty" PeerFeatureNamespaceSelectorMatchLabels = "peer namespace selector match labels" PeerFeatureNamespaceSelectorMatchExpressions = "peer namespace selector match expression" )
Variables ¶
var ( ExplicitAllowAll = &NetpolPeers{ Rules: []*Rule{ {}, }, } DenyAll = &NetpolPeers{ Rules: nil, } // DenyAll2 should be identical to DenyAll -- but just in case :) DenyAll2 = &NetpolPeers{ Rules: []*Rule{}, } AllowAllPodsRule = &Rule{ Peers: []networkingv1.NetworkPolicyPeer{ { NamespaceSelector: &metav1.LabelSelector{}, }, }, } AllowAllByPod = &NetpolPeers{ Rules: []*Rule{AllowAllPodsRule}, } AllowAllByIPRule = &Rule{ Peers: []networkingv1.NetworkPolicyPeer{ { IPBlock: &networkingv1.IPBlock{ CIDR: "0.0.0.0/0", }, }, }, } AllowAllByIP = &NetpolPeers{ Rules: []*Rule{AllowAllByIPRule}, } DenyAllByIPRule = &Rule{ Peers: []networkingv1.NetworkPolicyPeer{ { IPBlock: &networkingv1.IPBlock{ CIDR: "0.0.0.0/31", }, }, }, } DenyAllByIP = &NetpolPeers{ Rules: []*Rule{DenyAllByIPRule}, } DenyAllByPodRule = &Rule{ Peers: []networkingv1.NetworkPolicyPeer{ { PodSelector: nil, NamespaceSelector: &metav1.LabelSelector{ MatchLabels: map[string]string{"this-will-never-happen": "qrs123"}, }, }, }, } DenyAllByPod = &NetpolPeers{ Rules: []*Rule{DenyAllByPodRule}, } )
var ( GeneralNetpolTraverser = &NetpolTraverser{ policy: DefaultPolicyFeatures, target: DefaultTargetFeatures, } IngressNetpolTraverser = &NetpolTraverser{ ingress: DefaultIngressOrEgressFeatures, ingressRule: DefaultRuleFeature, ingressPeers: DefaultPeerFeatures, ingressPeer: DefaultSinglePeerFeature, ingressPorts: DefaultPortFeatures, ingressPort: DefaultSinglePortFeature, } EgressNetpolTraverser = &NetpolTraverser{ egress: DefaultIngressOrEgressFeatures, egressRule: DefaultRuleFeature, egressPeers: DefaultPeerFeatures, egressPeer: DefaultSinglePeerFeature, egressPorts: DefaultPortFeatures, egressPort: DefaultSinglePortFeature, } )
var ( AllowDNSRule = &Rule{ Ports: []NetworkPolicyPort{ { Protocol: &udp, Port: &port53, }, }, } AllowDNSPeers = &NetpolPeers{ Rules: []*Rule{AllowDNSRule}, } )
var ( TypicalNamespace = "x" TypicalTarget = metav1.LabelSelector{ MatchLabels: map[string]string{"pod": "a"}, MatchExpressions: nil, } TypicalPorts = []NetworkPolicyPort{{Protocol: &tcp, Port: &port80}} TypicalPeers = []NetworkPolicyPeer{ { PodSelector: &metav1.LabelSelector{ MatchLabels: map[string]string{"pod": "b"}, }, NamespaceSelector: &metav1.LabelSelector{ MatchLabels: map[string]string{"ns": "y"}, }, }, } )
var (
ProbeAllAvailable = &ProbeConfig{AllAvailable: true}
)
Functions ¶
func DefaultIPBlockPeers ¶
func DefaultIPBlockPeers(podIP string) []NetworkPolicyPeer
func DefaultIngressOrEgressFeatures ¶ added in v0.2.4
func DefaultIngressOrEgressFeatures(isIngress bool, peers *NetpolPeers, features map[string]bool)
func DefaultNamespaces ¶
func DefaultNamespaces() []string
func DefaultPeerFeatures ¶ added in v0.2.4
func DefaultPeers ¶ added in v0.2.1
func DefaultPeers(podIP string) []NetworkPolicyPeer
func DefaultPodPeers ¶
func DefaultPodPeers() []NetworkPolicyPeer
func DefaultPolicyFeatures ¶ added in v0.2.4
func DefaultPortFeatures ¶ added in v0.2.4
func DefaultPorts ¶
func DefaultPorts() []NetworkPolicyPort
func DefaultRuleFeature ¶ added in v0.2.4
func DefaultSinglePeerFeature ¶ added in v0.2.4
func DefaultSinglePortFeature ¶ added in v0.2.4
func DefaultTargetFeatures ¶ added in v0.2.4
func DefaultTargetFeatures(target *NetpolTarget, features map[string]bool)
func DefaultTargets ¶
func DefaultTargets() []metav1.LabelSelector
func RunDiscreteGeneratorTests ¶ added in v0.2.1
func RunDiscreteGeneratorTests()
func SinglePortProtocolTestCases ¶ added in v0.2.4
func SinglePortProtocolTestCases() []NetworkPolicyPort
Types ¶
type Action ¶ added in v0.1.0
type Action struct { CreatePolicy *CreatePolicyAction UpdatePolicy *UpdatePolicyAction DeletePolicy *DeletePolicyAction CreateNamespace *CreateNamespaceAction SetNamespaceLabels *SetNamespaceLabelsAction DeleteNamespace *DeleteNamespaceAction ReadNetworkPolicies *ReadNetworkPoliciesAction CreatePod *CreatePodAction SetPodLabels *SetPodLabelsAction DeletePod *DeletePodAction }
Action: exactly one field must be non-null. This models a discriminated union (sum type).
func CreateNamespace ¶ added in v0.2.4
func CreatePolicy ¶ added in v0.1.0
func CreatePolicy(policy *networkingv1.NetworkPolicy) *Action
func DeleteNamespace ¶ added in v0.2.4
func DeletePolicy ¶ added in v0.1.0
func ReadNetworkPolicies ¶ added in v0.1.0
func SetNamespaceLabels ¶ added in v0.1.0
func SetPodLabels ¶ added in v0.1.0
func UpdatePolicy ¶ added in v0.1.0
func UpdatePolicy(policy *networkingv1.NetworkPolicy) *Action
type BreadthGenerator ¶ added in v0.2.4
BreadthGenerator should provide tests that cover the following features, without worrying about
corner cases or going into features in depth:
- probe, policy on tcp - probe, policy on udp - probe, policy on sctp - named port - numbered port - pod selector (all, by label) - ingress (+ same for egress)
- deny all
- allow all
- pod
- namespace selector (all, by label, same as target)
- pod selector (all, by label)
- ipblock
- allow cidr
- except cidr
- egress: DNS (udp/53)
func NewBreadthGenerator ¶ added in v0.2.4
func NewBreadthGenerator(allowDNS bool, podIP string) *BreadthGenerator
func (*BreadthGenerator) ActionTestCases ¶ added in v0.2.4
func (e *BreadthGenerator) ActionTestCases() []*TestCase
func (*BreadthGenerator) GenerateTestCases ¶ added in v0.2.4
func (e *BreadthGenerator) GenerateTestCases() []*TestCase
func (*BreadthGenerator) Policies ¶ added in v0.2.4
func (e *BreadthGenerator) Policies() [][]Setter
type ConflictGenerator ¶ added in v0.0.10
type ConflictGenerator struct { AllowDNS bool Source *NetpolTarget Destination *NetpolTarget }
func (*ConflictGenerator) GenerateTestCases ¶ added in v0.1.0
func (c *ConflictGenerator) GenerateTestCases() []*TestCase
func (*ConflictGenerator) NetworkPolicies ¶ added in v0.0.10
func (c *ConflictGenerator) NetworkPolicies(source *NetpolTarget, dest *NetpolTarget) []*TestCase
type CreateNamespaceAction ¶ added in v0.2.4
type CreatePodAction ¶ added in v0.2.4
type CreatePolicyAction ¶ added in v0.1.0
type CreatePolicyAction struct {
Policy *networkingv1.NetworkPolicy
}
type DeleteNamespaceAction ¶ added in v0.2.4
type DeleteNamespaceAction struct {
Namespace string
}
type DeletePodAction ¶ added in v0.2.4
type DeletePolicyAction ¶ added in v0.1.0
type DepthGenerator ¶ added in v0.2.4
func NewDepthGenerator ¶ added in v0.2.4
func NewDepthGenerator(allowDNS bool, podIP string) *DepthGenerator
func (*DepthGenerator) GenerateTestCases ¶ added in v0.2.4
func (e *DepthGenerator) GenerateTestCases() []*TestCase
func (*DepthGenerator) Policies ¶ added in v0.2.4
func (e *DepthGenerator) Policies() []*Netpol
type DiscreteGenerator ¶ added in v0.2.1
type DiscreteGenerator struct { AllowDNS bool Ports []NetworkPolicyPort PodPeers []NetworkPolicyPeer Targets []metav1.LabelSelector Namespaces []string TypicalIngressPorts []NetworkPolicyPort TypicalIngressPeers []NetworkPolicyPeer TypicalIngressTarget []metav1.LabelSelector TypicalIngressNamespace []string TypicalEgressPorts []NetworkPolicyPort TypicalEgressPeers []NetworkPolicyPeer TypicalEgressTarget []metav1.LabelSelector TypicalEgressNamespace []string }
we want a background "typical" policy that will always pass on a CNI with an expected connectivity table,
but also will allow some traffic but deny others. Then the perturbations to that base policy should affect other pods.
func NewDefaultDiscreteGenerator ¶ added in v0.2.1
func NewDefaultDiscreteGenerator(allowDNS bool, podIP string) *DiscreteGenerator
func (*DiscreteGenerator) GenerateTestCases ¶ added in v0.2.1
func (g *DiscreteGenerator) GenerateTestCases() []*TestCase
func (*DiscreteGenerator) PeerSlices ¶ added in v0.2.1
func (g *DiscreteGenerator) PeerSlices() [][]NetworkPolicyPeer
func (*DiscreteGenerator) PortSlices ¶ added in v0.2.1
func (g *DiscreteGenerator) PortSlices() [][]NetworkPolicyPort
func (*DiscreteGenerator) RuleSlices ¶ added in v0.2.1
func (g *DiscreteGenerator) RuleSlices() [][]*Rule
func (*DiscreteGenerator) Rules ¶ added in v0.2.1
func (g *DiscreteGenerator) Rules() []*Rule
type ExampleGenerator ¶ added in v0.2.0
type ExampleGenerator struct{}
func (*ExampleGenerator) GenerateTestCases ¶ added in v0.2.0
func (e *ExampleGenerator) GenerateTestCases() []*TestCase
type FragmentGenerator ¶
type FragmentGenerator struct { AllowDNS bool // multidimensional generation Ports []NetworkPolicyPort PodPeers []NetworkPolicyPeer Targets []metav1.LabelSelector Namespaces []string // unidimensional typicals TypicalPorts []NetworkPolicyPort TypicalPeers []NetworkPolicyPeer TypicalTarget metav1.LabelSelector TypicalNamespace string }
Test cases:
1 policy with ingress:
- empty ingress
- ingress with 1 rule
- empty
- 1 port
- empty
- protocol
- port
- port + protocol
- 2 ports
- 1 from
- 8 combos: (nil + nil => might mean ipblock must be non-nil)
- pod sel: nil, empty, non-empty
- ns sel: nil, empty, non-empty
- ipblock
- no except
- yes except
- 2 froms
- 1 pod/ns, 1 ipblock
- 2 pod/ns
- 2 ipblocks
- 1 port, 1 from
- 2 ports, 2 froms
- ingress with 2 rules
- ingress with 3 rules
2 policies with ingress 1 policy with egress 2 policies with egress 1 policy with both ingress and egress 2 policies with both ingress and egress
func NewDefaultFragmentGenerator ¶ added in v0.0.9
func NewDefaultFragmentGenerator(allowDNS bool, namespaces []string, podIP string) *FragmentGenerator
func (*FragmentGenerator) EgressPolicies ¶
func (g *FragmentGenerator) EgressPolicies() []*NetworkPolicy
func (*FragmentGenerator) FragmentEgressPolicies ¶ added in v0.0.9
func (g *FragmentGenerator) FragmentEgressPolicies() []*NetworkPolicy
func (*FragmentGenerator) FragmentIngressPolicies ¶ added in v0.0.9
func (g *FragmentGenerator) FragmentIngressPolicies() []*NetworkPolicy
func (*FragmentGenerator) FragmentPolicies ¶ added in v0.0.9
func (g *FragmentGenerator) FragmentPolicies() []*NetworkPolicy
func (*FragmentGenerator) GenerateTestCases ¶ added in v0.1.0
func (g *FragmentGenerator) GenerateTestCases() []*TestCase
func (*FragmentGenerator) IngressEgressPolicies ¶
func (g *FragmentGenerator) IngressEgressPolicies(allowDNS bool) []*NetworkPolicy
func (*FragmentGenerator) IngressPolicies ¶
func (g *FragmentGenerator) IngressPolicies() []*NetworkPolicy
func (*FragmentGenerator) PeerSlices ¶
func (g *FragmentGenerator) PeerSlices() [][]NetworkPolicyPeer
func (*FragmentGenerator) PortSlices ¶
func (g *FragmentGenerator) PortSlices() [][]NetworkPolicyPort
func (*FragmentGenerator) RuleSlices ¶
func (g *FragmentGenerator) RuleSlices() [][]*Rule
func (*FragmentGenerator) Rules ¶
func (g *FragmentGenerator) Rules() []*Rule
type Netpol ¶
type Netpol struct { Name string Description string Target *NetpolTarget Ingress *NetpolPeers Egress *NetpolPeers }
Netpol helps us to avoid the To/From Ingress/Egress dance. By splitting a NetworkPolicy into Target and Peers, it makes them easier to manipulate.
func AllowAllEgressDenyAllIngress ¶ added in v0.0.10
func AllowAllEgressDenyAllIngress(source *NetpolTarget, dest *NetpolTarget) []*Netpol
func AllowAllIngressDenyAllEgress ¶ added in v0.0.10
func AllowAllIngressDenyAllEgress(source *NetpolTarget, dest *NetpolTarget) []*Netpol
func AllowDNSPolicy ¶ added in v0.1.0
func AllowDNSPolicy(source *NetpolTarget) *Netpol
func BuildPolicy ¶ added in v0.2.1
func DenyAllEgressAllowAllEgress ¶ added in v0.0.10
func DenyAllEgressAllowAllEgress(source *NetpolTarget) []*Netpol
func DenyAllEgressAllowAllEgressByIP ¶ added in v0.0.10
func DenyAllEgressAllowAllEgressByIP(source *NetpolTarget) []*Netpol
func DenyAllEgressAllowAllEgressByPod ¶ added in v0.0.10
func DenyAllEgressAllowAllEgressByPod(source *NetpolTarget) []*Netpol
func DenyAllEgressByIP ¶ added in v0.0.10
func DenyAllEgressByIP(source *NetpolTarget) []*Netpol
func DenyAllEgressByIPAllowAllEgressByPod ¶ added in v0.0.10
func DenyAllEgressByIPAllowAllEgressByPod(source *NetpolTarget) []*Netpol
func DenyAllEgressByPod ¶ added in v0.0.10
func DenyAllEgressByPod(source *NetpolTarget) []*Netpol
func DenyAllEgressByPodAllowAllEgressByIP ¶ added in v0.0.10
func DenyAllEgressByPodAllowAllEgressByIP(source *NetpolTarget) []*Netpol
func DenyAllIngressAllowAllIngress ¶ added in v0.0.10
func DenyAllIngressAllowAllIngress(dest *NetpolTarget) []*Netpol
func DenyAllIngressAllowAllIngressByIP ¶ added in v0.0.10
func DenyAllIngressAllowAllIngressByIP(source *NetpolTarget) []*Netpol
func DenyAllIngressAllowAllIngressByPod ¶ added in v0.0.10
func DenyAllIngressAllowAllIngressByPod(source *NetpolTarget) []*Netpol
func DenyAllIngressByIP ¶ added in v0.0.10
func DenyAllIngressByIP(source *NetpolTarget) []*Netpol
func DenyAllIngressByIPAllowAllIngressByPod ¶ added in v0.0.10
func DenyAllIngressByIPAllowAllIngressByPod(source *NetpolTarget) []*Netpol
func DenyAllIngressByPod ¶ added in v0.0.10
func DenyAllIngressByPod(source *NetpolTarget) []*Netpol
func DenyAllIngressByPodAllowAllIngressByIP ¶ added in v0.0.10
func DenyAllIngressByPodAllowAllIngressByIP(source *NetpolTarget) []*Netpol
func (*Netpol) NetworkPolicy ¶
func (n *Netpol) NetworkPolicy() *NetworkPolicy
func (*Netpol) NetworkPolicySpec ¶ added in v0.0.10
func (n *Netpol) NetworkPolicySpec() *NetworkPolicySpec
type NetpolPeers ¶ added in v0.0.10
type NetpolPeers struct {
Rules []*Rule
}
type NetpolTarget ¶ added in v0.0.10
type NetpolTarget struct { Namespace string PodSelector metav1.LabelSelector }
func NewNetpolTarget ¶ added in v0.1.0
func NewNetpolTarget(namespace string, matchLabels map[string]string, matchExpressions []metav1.LabelSelectorRequirement) *NetpolTarget
type NetpolTraverser ¶ added in v0.2.4
type NetpolTraverser struct {
// contains filtered or unexported fields
}
type PortProtocol ¶ added in v0.2.0
type PortProtocol struct { Protocol v1.Protocol Port intstr.IntOrString }
type ProbeConfig ¶ added in v0.2.0
type ProbeConfig struct { AllAvailable bool PortProtocol *PortProtocol }
ProbeConfig: exactly one field must be non-null (or, in AllAvailable's case, non-false). This
models a discriminated union (sum type).
type ReadNetworkPoliciesAction ¶ added in v0.1.0
type ReadNetworkPoliciesAction struct {
Namespaces []string
}
type SetNamespaceLabelsAction ¶ added in v0.1.0
type SetPodLabelsAction ¶ added in v0.1.0
type Setter ¶ added in v0.2.4
type Setter func(policy *Netpol)
func SetDescription ¶ added in v0.2.4
func SetNamespace ¶ added in v0.2.1
func SetPodSelector ¶ added in v0.2.1
func SetPodSelector(sel metav1.LabelSelector) Setter
type TestCase ¶ added in v0.1.0
func NewSingleStepTestCase ¶ added in v0.1.0
func NewSingleStepTestCase(description string, pp *ProbeConfig, actions ...*Action) *TestCase
func NewTestCase ¶ added in v0.1.0
type TestCaseGenerator ¶ added in v0.1.0
type TestCaseGenerator interface {
GenerateTestCases() []*TestCase
}
type TestStep ¶ added in v0.1.0
type TestStep struct { Probe *ProbeConfig Actions []*Action }
func NewTestStep ¶ added in v0.1.0
func NewTestStep(pp *ProbeConfig, actions ...*Action) *TestStep
type UpdatePolicyAction ¶ added in v0.1.0
type UpdatePolicyAction struct {
Policy *networkingv1.NetworkPolicy
}
type UpstreamE2EGenerator ¶ added in v0.1.0
type UpstreamE2EGenerator struct{}
func (*UpstreamE2EGenerator) GenerateTestCases ¶ added in v0.1.0
func (u *UpstreamE2EGenerator) GenerateTestCases() []*TestCase