suite: test external-secrets networkpolicy
templates:
  - networkpolicy.yaml
tests:
  - it: should create a networkPolicy
    set:
      networkPolicy.enabled: true
    asserts:
      - equal:
          path: spec.policyTypes
          value:
            - Egress
            - Ingress
  - it: should not create a networkPolicy
    set:
      networkPolicy.enabled: false
    asserts:
      - hasDocuments:
          count: 0
  - it: should set correct pod selector
    set:
      networkPolicy.enabled: true
    asserts:
      - isNotEmpty:
          path: spec.podSelector.matchLabels
      - equal:
          path: spec.podSelector.matchLabels["app.kubernetes.io/name"]
          value: external-secrets
  - it: should apply default ingress ports
    set:
      networkPolicy.enabled: true
    asserts:
      - equal:
          path: spec.ingress[0].ports
          value:
            - protocol: TCP
              port: 8080
            - protocol: TCP
              port: 8082
  - it: should allow custom ingress CIDR blocks
    set:
      networkPolicy.enabled: true
      networkPolicy.ingress:
        - from:
            - ipBlock:
                cidr: 10.0.0.0/8
          ports:
            - protocol: TCP
              port: 8080
    asserts:
      - equal:
          path: spec.ingress[0].from[0].ipBlock.cidr
          value: 10.0.0.0/8
  - it: should allow custom ingress pod selector
    set:
      networkPolicy.enabled: true
      networkPolicy.ingress:
        - from:
            - podSelector:
                matchLabels:
                  app: prometheus
          ports:
            - protocol: TCP
              port: 8080
    asserts:
      - equal:
          path: spec.ingress[0].from[0].podSelector.matchLabels.app
          value: prometheus
  - it: should allow custom egress CIDR blocks
    set:
      networkPolicy.enabled: true
      networkPolicy.egress:
        - to:
            - ipBlock:
                cidr: 0.0.0.0/0
          ports:
            - protocol: TCP
              port: 443
    asserts:
      - equal:
          path: spec.egress[0].to[0].ipBlock.cidr
          value: 0.0.0.0/0
  - it: should allow custom egress pod selector
    set:
      networkPolicy.enabled: true
      networkPolicy.egress:
        - to:
            - podSelector:
                matchLabels:
                  k8s-app: kube-dns
          ports:
            - protocol: UDP
              port: 53
    asserts:
      - equal:
          path: spec.egress[0].to[0].podSelector.matchLabels["k8s-app"]
          value: kube-dns