don't remove representative peers in any-namespace

pkg/netpol/connlist/connlist_test.go

@@ -940,4 +940,17 @@ var goodPathTests = []struct {
 		exposureAnalysis: true,
 		outputFormats:    ExposureValidFormats,
 	},
+	{
+		// following test resources : contains two pods in different namespaces, and two policies, one for each namespace
+		// first policy captures: hello-world/workload-a and exposes it on Ingress to all pods in backend namespace
+		// second policy captures: backend/backend-app and denies all egress from it
+		// so as result hello-world/workload-a is actually exposed to all backend pods except for backend-app
+		// @TODO: following exposure line in output :
+		// `hello-world/workload-a[Deployment]      <=      backend/[all pods] : TCP 8050`
+		// should be replaced with :
+		// `hello-world/workload-a[Deployment]      <=      backend/[all pods except backend/backend-app] : TCP 8050`
+		testDirName:      "test_exposure_to_namespace_except_specific_pod",
+		exposureAnalysis: true,
+		outputFormats:    ExposureValidFormats,
+	},
 }

test_outputs/connlist/exposure_test_exposure_to_namespace_except_specific_pod_connlist_output.dot

@@ -0,0 +1,20 @@
+digraph {
+	subgraph "cluster_backend" {
+		color="black"
+		fontcolor="black"
+		"all pods_in_backend" [label="all pods" color="red2" fontcolor="red2"]
+		"backend/backend-app[Deployment]" [label="backend-app[Deployment]" color="blue" fontcolor="blue"]
+		label="backend"
+	}
+	subgraph "cluster_hello_world" {
+		color="black"
+		fontcolor="black"
+		"hello-world/workload-a[Deployment]" [label="workload-a[Deployment]" color="blue" fontcolor="blue"]
+		label="hello-world"
+	}
+	"0.0.0.0-255.255.255.255" [label="0.0.0.0-255.255.255.255" color="red2" fontcolor="red2"]
+	"entire-cluster" [label="entire-cluster" color="red2" fontcolor="red2" shape=diamond]
+	"0.0.0.0-255.255.255.255" -> "backend/backend-app[Deployment]" [label="All Connections" color="gold2" fontcolor="darkgreen"]
+	"all pods_in_backend" -> "hello-world/workload-a[Deployment]" [label="TCP 8050" color="gold2" fontcolor="darkgreen" weight=1]
+	"entire-cluster" -> "backend/backend-app[Deployment]" [label="All Connections" color="gold2" fontcolor="darkgreen" weight=1]
+}

test_outputs/connlist/exposure_test_exposure_to_namespace_except_specific_pod_connlist_output.txt

@@ -0,0 +1,11 @@
+0.0.0.0-255.255.255.255 => backend/backend-app[Deployment] : All Connections
+
+Exposure Analysis Result:
+
+Ingress Exposure:
+backend/backend-app[Deployment]    	<= 	0.0.0.0-255.255.255.255 : All Connections
+backend/backend-app[Deployment]    	<= 	entire-cluster : All Connections
+hello-world/workload-a[Deployment] 	<= 	backend/[all pods] : TCP 8050
+
+Workloads not protected by network policies:
+backend/backend-app[Deployment] is not protected on Ingress

tests/test_exposure_to_namespace_except_specific_pod/backend.yaml

@@ -0,0 +1,40 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: backend-app
+  namespace: backend
+spec:
+  selector:
+    matchLabels:
+      app: backend-app
+  template:
+    metadata:
+      labels:
+        app: backend-app
+    spec:
+      containers:
+      - name: server
+        image: backend-app
+        ports:
+        - containerPort: 9090
+        readinessProbe:
+          initialDelaySeconds: 10
+          httpGet:
+            path: "/_healthz"
+            port: 9090
+        livenessProbe:
+          initialDelaySeconds: 10
+          httpGet:
+            path: "/_healthz"
+            port: 9090
+        env:
+        - name: PORT
+          value: "9090"
+        resources:
+          requests:
+            cpu: 100m
+            memory: 64Mi
+          limits:
+            cpu: 200m
+            memory: 128Mi

tests/test_exposure_to_namespace_except_specific_pod/backend_netpol.yaml

@@ -0,0 +1,15 @@
+# this policy denies any egress from backend/backend-app
+# however hello_world_netpol.yaml allows ingress to hello-world/workload-a from all pods in backend
+# so the result we should see is that hello-world/workload-a is exposed on Ingress to backend/[all pods except backend-app]
+
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: deny-egress-from-backend-app
+  namespace: backend
+spec:
+  podSelector:
+    matchLabels:
+      app: backend-app
+  policyTypes:
+  - Egress

tests/test_exposure_to_namespace_except_specific_pod/hello_world_netpol.yaml

@@ -0,0 +1,20 @@
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: allow-ingress-to-backend-ns
+  namespace: hello-world
+spec:
+  podSelector:
+    matchLabels:
+      app: a-app
+  policyTypes:
+  - Ingress
+  - Egress
+  ingress:
+  - from:
+    - namespaceSelector: 
+        matchLabels:
+            kubernetes.io/metadata.name: backend
+    ports:
+    - port: 8050
+      protocol: TCP

tests/test_exposure_to_namespace_except_specific_pod/ns_and_deployments.yaml

@@ -0,0 +1,31 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: hello-world
+spec: {}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: workload-a
+  namespace: hello-world
+  labels:
+    app: a-app
+spec:
+  selector:
+    matchLabels:
+      app: a-app
+  template:
+    metadata:
+      labels:
+        app: a-app
+    spec:
+      containers:
+      - name: hello-world
+        image: quay.io/shfa/hello-world:latest
+        ports:
+        - containerPort: 8000  # containerport1
+        - containerPort: 8050  # containerport2
+        - containerPort: 8090  # containerport3
+---