conformance: add pod selector tests for CNP subjects and peers by vpbh · Pull Request #409 · kubernetes-sigs/network-policy-api

vpbh · 2026-09-27T06:34:50Z

Every podSelector in the suite matches on conformance-house, which every pod in a namespace carries, so pod selection was never exercised beyond namespace granularity: any implementation that ignored podSelector would pass the suite.

Add CNPAdminTierPodSelector and CNPBaselineTierPodSelector, each driven by one manifest with two policies:

The first selects its subject by pod label alone, with namespaceSelector omitted so that an ignored podSelector would widen the subject to every pod in the cluster, and denies traffic to and from peers selected both by pod label alone and by pod name within a namespace.
The second uses a single-pod subject. Probes assert that the selected pods are enforced while same-namespace siblings and non-subject pods are not.

netlify · 2026-09-27T06:34:57Z

✅ Deploy Preview for kubernetes-sigs-network-policy-api ready!

Name	Link
🔨 Latest commit	`c159ab2`
🔍 Latest deploy log	https://app.netlify.com/projects/kubernetes-sigs-network-policy-api/deploys/6ac518352d47e600082820d3
😎 Deploy Preview	https://deploy-preview-409--kubernetes-sigs-network-policy-api.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

kubernetes-prow · 2026-09-27T06:35:01Z

Hi @vpbh. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Tip

We noticed you've done this a few times! Consider joining the org to skip this step and gain /lgtm and other bot rights. We recommend asking approvers on your previous PRs to sponsor you.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

Copilot

Copilot review overview

🟢 Approval recommended

The manifests and probes consistently validate positive and negative pod-selection behavior across both tiers.

Review effort: Balanced
Findings: None

What changed in this PR

Adds conformance coverage ensuring CNP pod selectors are enforced independently of namespace selection.

Changes:

Adds Admin and Baseline tier pod-selector tests.
Adds manifests covering pod-label and pod-name selection for subjects and peers.

File	Description
`conformance/tests/baseline-admin-network-policy-standard-pod-selector-rules.go`	Tests Baseline tier selectors.
`conformance/tests/admin-network-policy-standard-pod-selector-rules.go`	Tests Admin tier selectors.
`conformance/base/baseline_tier/standard-pod-selector-rules.yaml`	Defines Baseline test policies.
`conformance/base/admin_tier/standard-pod-selector-rules.yaml`	Defines Admin test policies.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

vpbh · 2026-10-06T15:33:48Z

@netlify retry

tssurya · 2026-10-06T15:35:31Z

/ok-to-test

tssurya · 2026-10-06T15:37:16Z

@vpbh probably easiest to rebase on master since the netlify fixes landed (to retrigger the website lanes)

Every podSelector in the suite matches on conformance-house, which every pod in a namespace carries, so pod selection was never exercised beyond namespace granularity: an implementation that ignored podSelector would pass the suite. Add CNPAdminTierPodSelector and CNPBaselineTierPodSelector, each driven by one manifest with two policies. The first selects its subject by pod label alone, with namespaceSelector omitted so that an ignored podSelector would widen the subject to every pod in the cluster, and denies traffic to and from peers selected both by pod label alone and by pod name within a namespace. The second uses a single-pod subject. Probes assert that the selected pods are enforced while same-namespace siblings and non-subject pods are not. Signed-off-by: Vinay Pai <vinaypaibh@gmail.com>

tssurya

overall LGTM, some comments

tssurya · 2026-10-16T06:19:59Z

+  priority: 20
+  subject:
+    # namespaceSelector is omitted on purpose: the subject is selected by pod label alone, across all
+    # namespaces. An implementation that ignored podSelector would apply this policy to every pod.


Suggested change

# namespaces. An implementation that ignored podSelector would apply this policy to every pod.

# namespaces.

This second comment is confusing, - would apply this to every pod in full cluster? or maybe to the namespaces they selected etc right? its subjective to what setting the implementation did, - maybe we can skip that sentence

tssurya · 2026-10-16T06:31:59Z

+
+			// egress rule at index 1 (deny-to-cedric-diggory-0) selects a single pod by name within hufflepuff -> DENIED
+			serverPod = kubernetes.GetPod(t, s.Client, "network-policy-conformance-hufflepuff", "cedric-diggory-0", s.TimeoutConfig.GetTimeout)
+			kubernetes.PokeServer(t, s.ClientSet, &s.KubeConfig, "network-policy-conformance-gryffindor", "harry-potter-0", "tcp",


nit: maybe use harry-potter-1 here to ensure both pods were selected by pod selector in subject

tssurya · 2026-10-16T06:38:03Z

+				serverPod.Status.PodIP, int32(80), s.TimeoutConfig, true)
+		})
+	},
+}


these are good tests - but would be also better to have "Allow" action and "Pass" action tested with pod selector than just "Deny" rules in both ingress and egress to mix it up - same for add a protocol/port range variation perhaps - i.e one rule can stay plain L3, but other rules can be L4 matches - otherwise we don't want to add too many duplicate tests again for those specially
If you want to do them in add-on PRs as FUP that's fine.

tssurya · 2026-10-16T06:39:31Z

+	)
+}
+
+var CNPBaselineTierPodSelector = suite.ConformanceTest{


I think these tests are a good first start

I see baseline more interesting in combo with Network Policy - we dont need to do those here, but we need to maybe do a tracker to edit/tweak https://github.com/kubernetes-sigs/network-policy-api/blob/main/conformance/tests/admin-network-policy-standard-integration.go to include a podselector test in combo with NetworkPolicy - as a TODO for future

tssurya · 2026-10-16T06:41:06Z

+				serverPod.Status.PodIP, int32(80), s.TimeoutConfig, true)
+		})
+	},
+}


Is it that the PR is fixing #104 (comment) ?

What about #111 ? - since its easy to swap/change labels I don't mind if we just get it done in one go - like it should be super easy to include the label changes here itself - I think the start/stop matching , lets cover those too in one go - then easier for you for reviews as well (if we finish both in one go)

kubernetes-prow · 2026-10-16T06:41:31Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: vpbh
Once this PR has been reviewed and has the lgtm label, please ask for approval from tssurya. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

kubernetes-prow Bot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Sep 27, 2026

kubernetes-prow Bot requested review from aojea and danwinship September 27, 2026 06:35

kubernetes-prow Bot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label Sep 27, 2026

tssurya requested a balanced review from Copilot October 6, 2026 15:25

Copilot started reviewing on behalf of tssurya October 6, 2026 15:26

View session

Copilot AI reviewed Oct 6, 2026

View reviewed changes

kubernetes-prow Bot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Oct 6, 2026

vpbh force-pushed the conformance/issue-104 branch from 11ab4fb to c159ab2 Compare October 6, 2026 15:48

tssurya self-assigned this Oct 6, 2026

tssurya requested changes Oct 16, 2026

View reviewed changes

	# namespaces. An implementation that ignored podSelector would apply this policy to every pod.
	# namespaces.

Conversation

vpbh commented Sep 27, 2026

Uh oh!

netlify Bot commented Sep 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for kubernetes-sigs-network-policy-api ready!

Uh oh!

kubernetes-prow Bot commented Sep 27, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟢 Approval recommended

Uh oh!

vpbh commented Oct 6, 2026

Uh oh!

tssurya commented Oct 6, 2026

Uh oh!

tssurya commented Oct 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

tssurya left a comment

Choose a reason for hiding this comment

Uh oh!

tssurya Oct 16, 2026

Choose a reason for hiding this comment

Uh oh!

tssurya Oct 16, 2026

Choose a reason for hiding this comment

Uh oh!

tssurya Oct 16, 2026

Choose a reason for hiding this comment

Uh oh!

tssurya Oct 16, 2026

Choose a reason for hiding this comment

Uh oh!

tssurya Oct 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kubernetes-prow Bot commented Oct 16, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

netlify Bot commented Sep 27, 2026 •

edited

Loading

tssurya commented Oct 6, 2026 •

edited

Loading

tssurya Oct 16, 2026 •

edited

Loading