Skip to content

Conversation

@duanwei33
Copy link
Contributor

This commit adds comprehensive e2e tests to verify that storage-related operators and controllers have the required network policy labels and that NetworkPolicy resources exist with correct pod selectors.

Changes:

  • Add namespace constants to helpers.go for reuse across storage tests
  • Add storage_networkpolicy.go with tests for CSO and CSI operators
  • Verify required network policy labels on deployments
  • Validate NetworkPolicy resources in storage namespaces

Something on-tracking:

  • The network policy in the hypershift management cluster control-plane namespace should be taken into an overall consideration, see discussion in slack

Test records:

$ ./openshift-tests run all --dry-run | grep -E "OCPFeature:StorageNetworkPolicy" | ./openshift-tests run -f -
passed: (15.5s) 2025-10-09T09:32:06 "[sig-storage][OCPFeature:StorageNetworkPolicy] Storage Network Policy should verify required labels for CSO related Operators"
passed: (16.7s) 2025-10-09T09:32:07 "[sig-storage][OCPFeature:StorageNetworkPolicy] Storage Network Policy should verify required labels for CSI related Operators"
passed: (17.7s) 2025-10-09T09:32:08 "[sig-storage][OCPFeature:StorageNetworkPolicy] Storage Network Policy should ensure required NetworkPolicies exist with correct labels"

@openshift-ci openshift-ci bot requested review from jsafrane and tsmetana October 9, 2025 10:44
@duanwei33
Copy link
Contributor Author

@mpatlasov @dobsonj Could you help take a look?
(cc @Phaow @chao007)

@openshift-trt
Copy link

openshift-trt bot commented Oct 9, 2025

Risk analysis has seen new tests most likely introduced by this PR.
Please ensure that new tests meet guidelines for naming and stability.

New Test Risks for sha: 92d160d

Job Name New Test Risk
pull-ci-openshift-origin-main-e2e-aws-ovn-microshift High - "[sig-storage][OCPFeature:StorageNetworkPolicy] Storage Network Policy should ensure required NetworkPolicies exist with correct labels [Suite:openshift/conformance/parallel]" is a new test that failed 1 time(s) against the current commit

New tests seen in this PR at sha: 92d160d

  • "[sig-storage][OCPFeature:StorageNetworkPolicy] Storage Network Policy should ensure required NetworkPolicies exist with correct labels [Suite:openshift/conformance/parallel]" [Total: 6, Pass: 5, Fail: 1, Flake: 0]
  • "[sig-storage][OCPFeature:StorageNetworkPolicy] Storage Network Policy should verify required labels for CSI related Operators [Suite:openshift/conformance/parallel]" [Total: 6, Pass: 6, Fail: 0, Flake: 0]
  • "[sig-storage][OCPFeature:StorageNetworkPolicy] Storage Network Policy should verify required labels for CSO related Operators [Suite:openshift/conformance/parallel]" [Total: 6, Pass: 6, Fail: 0, Flake: 0]

@duanwei33
Copy link
Contributor Author

/test verify

@duanwei33 duanwei33 force-pushed the storage-networkpolicy-e2e branch from 1b1417c to 81e1f58 Compare October 11, 2025 07:16
@openshift-trt
Copy link

openshift-trt bot commented Oct 11, 2025

Risk analysis has seen new tests most likely introduced by this PR.
Please ensure that new tests meet guidelines for naming and stability.

New Test Risks for sha: 81e1f58

Job Name New Test Risk
pull-ci-openshift-origin-main-e2e-aws-ovn-microshift High - "[sig-storage][OCPFeature:StorageNetworkPolicy] Storage Network Policy should ensure required NetworkPolicies exist with correct labels [Suite:openshift/conformance/parallel]" is a new test that failed 1 time(s) against the current commit

New tests seen in this PR at sha: 81e1f58

  • "[sig-storage][OCPFeature:StorageNetworkPolicy] Storage Network Policy should ensure required NetworkPolicies exist with correct labels [Suite:openshift/conformance/parallel]" [Total: 7, Pass: 6, Fail: 1, Flake: 0]
  • "[sig-storage][OCPFeature:StorageNetworkPolicy] Storage Network Policy should verify required labels for CSI related Operators [Suite:openshift/conformance/parallel]" [Total: 7, Pass: 7, Fail: 0, Flake: 0]
  • "[sig-storage][OCPFeature:StorageNetworkPolicy] Storage Network Policy should verify required labels for CSO related Operators [Suite:openshift/conformance/parallel]" [Total: 7, Pass: 7, Fail: 0, Flake: 0]

@duanwei33 duanwei33 force-pushed the storage-networkpolicy-e2e branch from a065245 to c1d5777 Compare October 14, 2025 06:39
@openshift-trt
Copy link

openshift-trt bot commented Oct 14, 2025

Risk analysis has seen new tests most likely introduced by this PR.
Please ensure that new tests meet guidelines for naming and stability.

New tests seen in this PR at sha: c1d5777

  • "[sig-storage][OCPFeature:StorageNetworkPolicy] Storage Network Policy should ensure required NetworkPolicies exist with correct labels [Suite:openshift/conformance/parallel]" [Total: 6, Pass: 6, Fail: 0, Flake: 0]
  • "[sig-storage][OCPFeature:StorageNetworkPolicy] Storage Network Policy should verify required labels for CSI related Operators [Suite:openshift/conformance/parallel]" [Total: 6, Pass: 6, Fail: 0, Flake: 0]
  • "[sig-storage][OCPFeature:StorageNetworkPolicy] Storage Network Policy should verify required labels for CSO related Operators [Suite:openshift/conformance/parallel]" [Total: 6, Pass: 6, Fail: 0, Flake: 0]

@duanwei33 duanwei33 force-pushed the storage-networkpolicy-e2e branch from c1d5777 to 4580205 Compare October 14, 2025 13:15
@openshift-trt
Copy link

openshift-trt bot commented Oct 14, 2025

Risk analysis has seen new tests most likely introduced by this PR.
Please ensure that new tests meet guidelines for naming and stability.

New tests seen in this PR at sha: 4580205

  • "[sig-storage][OCPFeature:StorageNetworkPolicy] Storage Network Policy should ensure required NetworkPolicies exist with correct labels [Suite:openshift/conformance/parallel]" [Total: 6, Pass: 6, Fail: 0, Flake: 0]
  • "[sig-storage][OCPFeature:StorageNetworkPolicy] Storage Network Policy should verify required labels for CSI related Operators [Suite:openshift/conformance/parallel]" [Total: 6, Pass: 6, Fail: 0, Flake: 0]
  • "[sig-storage][OCPFeature:StorageNetworkPolicy] Storage Network Policy should verify required labels for CSO related Operators [Suite:openshift/conformance/parallel]" [Total: 6, Pass: 6, Fail: 0, Flake: 0]

@duanwei33
Copy link
Contributor Author

/retest

@openshift-trt
Copy link

openshift-trt bot commented Oct 16, 2025

Risk analysis has seen new tests most likely introduced by this PR.
Please ensure that new tests meet guidelines for naming and stability.

New Test Risks for sha: c514831

Job Name New Test Risk
pull-ci-openshift-origin-main-e2e-aws-ovn-fips High - "[sig-storage][OCPFeature:StorageNetworkPolicy] Storage Network Policy should ensure required NetworkPolicies exist with correct labels [Suite:openshift/conformance/parallel]" is a new test that was not present in all runs against the current commit.
pull-ci-openshift-origin-main-e2e-aws-ovn-fips High - "[sig-storage][OCPFeature:StorageNetworkPolicy] Storage Network Policy should verify required labels for CSI related Operators [Suite:openshift/conformance/parallel]" is a new test that was not present in all runs against the current commit.
pull-ci-openshift-origin-main-e2e-aws-ovn-fips High - "[sig-storage][OCPFeature:StorageNetworkPolicy] Storage Network Policy should verify required labels for CSO related Operators [Suite:openshift/conformance/parallel]" is a new test that was not present in all runs against the current commit.

New tests seen in this PR at sha: c514831

  • "[sig-storage][OCPFeature:StorageNetworkPolicy] Storage Network Policy should ensure required NetworkPolicies exist with correct labels [Suite:openshift/conformance/parallel]" [Total: 8, Pass: 8, Fail: 0, Flake: 0]
  • "[sig-storage][OCPFeature:StorageNetworkPolicy] Storage Network Policy should verify required labels for CSI related Operators [Suite:openshift/conformance/parallel]" [Total: 8, Pass: 8, Fail: 0, Flake: 0]
  • "[sig-storage][OCPFeature:StorageNetworkPolicy] Storage Network Policy should verify required labels for CSO related Operators [Suite:openshift/conformance/parallel]" [Total: 8, Pass: 8, Fail: 0, Flake: 0]

@duanwei33 duanwei33 changed the title Add e2e tests for storage network policy STOR-2340: Add e2e tests for storage network policy Oct 16, 2025
@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Oct 16, 2025
@openshift-ci-robot
Copy link

openshift-ci-robot commented Oct 16, 2025

@duanwei33: This pull request references STOR-2340 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the epic to target either version "4.21." or "openshift-4.21.", but it targets "openshift-4.20" instead.

In response to this:

This commit adds comprehensive e2e tests to verify that storage-related operators and controllers have the required network policy labels and that NetworkPolicy resources exist with correct pod selectors.

Changes:

  • Add namespace constants to helpers.go for reuse across storage tests
  • Add storage_networkpolicy.go with tests for CSO and CSI operators
  • Verify required network policy labels on deployments
  • Validate NetworkPolicy resources in storage namespaces

Something on-tracking:

  • The network policy in the hypershift management cluster control-plane namespace should be taken into an overall consideration, see discussion in slack

Test records:

$ ./openshift-tests run all --dry-run | grep -E "OCPFeature:StorageNetworkPolicy" | ./openshift-tests run -f -
passed: (15.5s) 2025-10-09T09:32:06 "[sig-storage][OCPFeature:StorageNetworkPolicy] Storage Network Policy should verify required labels for CSO related Operators"
passed: (16.7s) 2025-10-09T09:32:07 "[sig-storage][OCPFeature:StorageNetworkPolicy] Storage Network Policy should verify required labels for CSI related Operators"
passed: (17.7s) 2025-10-09T09:32:08 "[sig-storage][OCPFeature:StorageNetworkPolicy] Storage Network Policy should ensure required NetworkPolicies exist with correct labels"

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@duanwei33 duanwei33 force-pushed the storage-networkpolicy-e2e branch from c514831 to 16c7f2c Compare October 16, 2025 07:23
@openshift-trt
Copy link

openshift-trt bot commented Oct 16, 2025

Risk analysis has seen new tests most likely introduced by this PR.
Please ensure that new tests meet guidelines for naming and stability.

New tests seen in this PR at sha: 16c7f2c

  • "[sig-storage][OCPFeature:StorageNetworkPolicy] Storage Network Policy should ensure required NetworkPolicies exist with correct labels [Suite:openshift/conformance/parallel]" [Total: 6, Pass: 6, Fail: 0, Flake: 0]
  • "[sig-storage][OCPFeature:StorageNetworkPolicy] Storage Network Policy should verify required labels for CSI related Operators [Suite:openshift/conformance/parallel]" [Total: 6, Pass: 6, Fail: 0, Flake: 0]
  • "[sig-storage][OCPFeature:StorageNetworkPolicy] Storage Network Policy should verify required labels for CSO related Operators [Suite:openshift/conformance/parallel]" [Total: 6, Pass: 6, Fail: 0, Flake: 0]

@mpatlasov
Copy link

FYI, go-verify-deps started failing because PR#70376 was merged recently.

@mpatlasov
Copy link

mpatlasov commented Oct 18, 2025

Hi @duanwei33 , thank you for reworking test case "should ensure required NetworkPolicies exist with correct labels", it looks great! I have only a couple of nits remaining (see my inline comments). They are minor, I'm ok to lgtm anyway. Let me know if you're going to address them. Otherwise we can go ahead with current code as-is.

Btw, how did you verify that e2e.TestContext.Provider gives reasonable string (not just empty "")? Setting env vars TEST_PROVIDER and TEST_CSI_DRIVER_FILES doesn't help for manual runs, and g.By() adds message to the logs only if test fails, so when it succeeds it's not clear whether it ran with empty currentPlatform or not.

@duanwei33
Copy link
Contributor Author

/retest-required

@duanwei33 duanwei33 force-pushed the storage-networkpolicy-e2e branch from 16c7f2c to 55b9a04 Compare October 20, 2025 01:44
This adds comprehensive e2e tests to verify that storage-related
operators and controllers have the required network policy labels and
that NetworkPolicy resources exist with correct pod selectors.

Changes:
- Add namespace constants to helpers.go for reuse across storage tests
- Add storage_networkpolicy.go with tests for CSO and CSI operators
- Verify required network policy labels on deployments
- Validate NetworkPolicy resources in storage namespaces
- Skip these tests on MicroShift clusters where they are not applicable
- Temporarily disabled ManilaCSINamespace check due to OCPBUGS-61175
@duanwei33 duanwei33 force-pushed the storage-networkpolicy-e2e branch from 55b9a04 to da3860c Compare October 20, 2025 02:41
@mpatlasov
Copy link

/lgtm
/approve

@openshift-ci openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Oct 20, 2025
@duanwei33
Copy link
Contributor Author

/retest

@duanwei33
Copy link
Contributor Author

The [Driver: nfs3] failures in the e2e-aws-ovn-microshift job are unrelated to this PR.

The new tests added here are skipped on Microshift anyway, so this is just a pre-existing flake. This failure can be safely ignored.

@dobsonj Could you help approve it?

@dobsonj
Copy link
Member

dobsonj commented Oct 28, 2025

/approve
/verified by CI

@openshift-ci-robot openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Oct 28, 2025
@openshift-ci-robot
Copy link

@dobsonj: This PR has been marked as verified by CI.

In response to this:

/approve
/verified by CI

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci
Copy link
Contributor

openshift-ci bot commented Oct 28, 2025

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dobsonj, duanwei33, mpatlasov

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Oct 28, 2025
@openshift-ci-robot
Copy link

/retest-required

Remaining retests: 0 against base HEAD f06eec0 and 2 for PR HEAD da3860c in total

@openshift-ci-robot
Copy link

/retest-required

Remaining retests: 0 against base HEAD 8a4ef2a and 1 for PR HEAD da3860c in total

@Phaow
Copy link
Contributor

Phaow commented Oct 29, 2025

/test e2e-aws-ovn-microshift

1 similar comment
@duanwei33
Copy link
Contributor Author

/test e2e-aws-ovn-microshift

@openshift-ci-robot
Copy link

/retest-required

Remaining retests: 0 against base HEAD f886e4e and 0 for PR HEAD da3860c in total

@openshift-ci-robot
Copy link

/hold

Revision da3860c was retested 3 times: holding

@openshift-ci openshift-ci bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Oct 29, 2025
@openshift-ci
Copy link
Contributor

openshift-ci bot commented Oct 29, 2025

@duanwei33: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/okd-scos-e2e-aws-ovn da3860c link false /test okd-scos-e2e-aws-ovn

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@mpatlasov
Copy link

/test e2e-aws-ovn-microshift

@mpatlasov
Copy link

/unhold

@openshift-ci openshift-ci bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Oct 29, 2025
@openshift-trt
Copy link

openshift-trt bot commented Oct 30, 2025

Risk analysis has seen new tests most likely introduced by this PR.
Please ensure that new tests meet guidelines for naming and stability.

New tests seen in this PR at sha: da3860c

  • "[sig-storage][OCPFeature:StorageNetworkPolicy] Storage Network Policy should ensure required NetworkPolicies exist with correct labels [Suite:openshift/conformance/parallel]" [Total: 17, Pass: 17, Fail: 0, Flake: 0]
  • "[sig-storage][OCPFeature:StorageNetworkPolicy] Storage Network Policy should verify required labels for CSI related Operators [Suite:openshift/conformance/parallel]" [Total: 17, Pass: 17, Fail: 0, Flake: 0]
  • "[sig-storage][OCPFeature:StorageNetworkPolicy] Storage Network Policy should verify required labels for CSO related Operators [Suite:openshift/conformance/parallel]" [Total: 17, Pass: 17, Fail: 0, Flake: 0]

@openshift-merge-bot openshift-merge-bot bot merged commit 1f66b70 into openshift:main Oct 30, 2025
20 of 21 checks passed
@duanwei33
Copy link
Contributor Author

/cherry-pick release-4.20

@openshift-cherrypick-robot

@duanwei33: new pull request created: #30441

In response to this:

/cherry-pick release-4.20

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. lgtm Indicates that a PR is ready to be merged. verified Signifies that the PR passed pre-merge verification criteria

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants