From cacc1907648ba63f0287bbabf74e0594407da58c Mon Sep 17 00:00:00 2001
From: Martynas Pumputis <martynasp@gmail.com>
Date: Mon, 13 Nov 2017 09:40:07 +0200
Subject: [PATCH] npc: Extend NetworkPolicy test cases in 840

- Add a test case for default allow all ingress traffic.
- Fix misleading comment.
---
 test/840_weave_kube_3_test.sh | 25 +++++++++++++++++++++++--
 1 file changed, 23 insertions(+), 2 deletions(-)

diff --git a/test/840_weave_kube_3_test.sh b/test/840_weave_kube_3_test.sh
index 1736dc17..e45fe476 100755
--- a/test/840_weave_kube_3_test.sh
+++ b/test/840_weave_kube_3_test.sh
@@ -170,12 +170,12 @@ assert_raises 'wait_for_x check_all_pods_communicate pods'
 # nettest-deny should still not be able to reach nettest pods
 assert_raises "! $SSH $HOST1 $KUBECTL exec $denyPodName -- curl -s -S -f -m 2 http://$DOMAIN:8080/status >/dev/null"
 
-# allow access for all
+# allow access for nettest-deny
 run_on $HOST1 "$KUBECTL apply -f -" <<EOF
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
-  name: nettest-misc
+  name: allow-nettest-deny
   namespace: default
 spec:
   podSelector:
@@ -190,6 +190,27 @@ EOF
 
 assert_raises "$SSH $HOST1 $KUBECTL exec $denyPodName -- curl -s -S -f -m 2 http://$DOMAIN:8080/status >/dev/null"
 
+# remove the access for nettest-deny
+run_on $HOST1 "$KUBECTL delete netpol allow-nettest-deny"
+
+# nettest-deny should still not be able to reach nettest pods
+assert_raises "! $SSH $HOST1 $KUBECTL exec $denyPodName -- curl -s -S -f -m 2 http://$DOMAIN:8080/status >/dev/null"
+
+# allow access for all
+run_on $HOST1 "$KUBECTL apply -f -" <<EOF
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-nettest-deny
+  namespace: default
+spec:
+  podSelector: {}
+  ingress:
+    - {}
+EOF
+
+assert_raises "$SSH $HOST1 $KUBECTL exec $denyPodName -- curl -s -S -f -m 2 http://$DOMAIN:8080/status >/dev/null"
+
 tear_down_kubeadm
 
 # Destroy our test ipset, and implicitly check it is still there