Validation, etcd, strategy UTs for NetworkPolicy

pkg/apis/extensions/validation/validation_test.go

@@ -1674,6 +1674,244 @@ func TestValidatePSPVolumes(t *testing.T) {
 	}
 }
 
+func TestValidateNetworkPolicy(t *testing.T) {
+	successCases := []extensions.NetworkPolicy{
+		{
+			ObjectMeta: api.ObjectMeta{Name: "foo", Namespace: "bar"},
+			Spec: extensions.NetworkPolicySpec{
+				PodSelector: unversioned.LabelSelector{
+					MatchLabels: map[string]string{"a": "b"},
+				},
+				Ingress: []extensions.NetworkPolicyIngressRule{},
+			},
+		},
+		{
+			ObjectMeta: api.ObjectMeta{Name: "foo", Namespace: "bar"},
+			Spec: extensions.NetworkPolicySpec{
+				PodSelector: unversioned.LabelSelector{
+					MatchLabels: map[string]string{"a": "b"},
+				},
+				Ingress: []extensions.NetworkPolicyIngressRule{
+					{
+						From:  []extensions.NetworkPolicyPeer{},
+						Ports: []extensions.NetworkPolicyPort{},
+					},
+				},
+			},
+		},
+		{
+			ObjectMeta: api.ObjectMeta{Name: "foo", Namespace: "bar"},
+			Spec: extensions.NetworkPolicySpec{
+				PodSelector: unversioned.LabelSelector{
+					MatchLabels: map[string]string{"a": "b"},
+				},
+				Ingress: []extensions.NetworkPolicyIngressRule{
+					{
+						From: []extensions.NetworkPolicyPeer{
+							{
+								PodSelector: &unversioned.LabelSelector{
+									MatchLabels: map[string]string{"c": "d"},
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+		{
+			ObjectMeta: api.ObjectMeta{Name: "foo", Namespace: "bar"},
+			Spec: extensions.NetworkPolicySpec{
+				PodSelector: unversioned.LabelSelector{
+					MatchLabels: map[string]string{"a": "b"},
+				},
+				Ingress: []extensions.NetworkPolicyIngressRule{
+					{
+						From: []extensions.NetworkPolicyPeer{
+							{
+								NamespaceSelector: &unversioned.LabelSelector{
+									MatchLabels: map[string]string{"c": "d"},
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+
+	// Success cases are expected to pass validation.
+	for k, v := range successCases {
+		if errs := ValidateNetworkPolicy(&v); len(errs) != 0 {
+			t.Errorf("Expected success for %d, got %v", k, errs)
+		}
+	}
+
+	invalidSelector := map[string]string{"NoUppercaseOrSpecialCharsLike=Equals": "b"}
+	errorCases := map[string]extensions.NetworkPolicy{
+		"namespaceSelector and podSelector": {
+			ObjectMeta: api.ObjectMeta{Name: "foo", Namespace: "bar"},
+			Spec: extensions.NetworkPolicySpec{
+				PodSelector: unversioned.LabelSelector{
+					MatchLabels: map[string]string{"a": "b"},
+				},
+				Ingress: []extensions.NetworkPolicyIngressRule{
+					{
+						From: []extensions.NetworkPolicyPeer{
+							{
+								PodSelector: &unversioned.LabelSelector{
+									MatchLabels: map[string]string{"c": "d"},
+								},
+								NamespaceSelector: &unversioned.LabelSelector{
+									MatchLabels: map[string]string{"c": "d"},
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+		"invalid spec.podSelector": {
+			ObjectMeta: api.ObjectMeta{Name: "foo", Namespace: "bar"},
+			Spec: extensions.NetworkPolicySpec{
+				PodSelector: unversioned.LabelSelector{
+					MatchLabels: invalidSelector,
+				},
+				Ingress: []extensions.NetworkPolicyIngressRule{
+					{
+						From: []extensions.NetworkPolicyPeer{
+							{
+								NamespaceSelector: &unversioned.LabelSelector{
+									MatchLabels: map[string]string{"c": "d"},
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+		"invalid ingress.from.podSelector": {
+			ObjectMeta: api.ObjectMeta{Name: "foo", Namespace: "bar"},
+			Spec: extensions.NetworkPolicySpec{
+				PodSelector: unversioned.LabelSelector{},
+				Ingress: []extensions.NetworkPolicyIngressRule{
+					{
+						From: []extensions.NetworkPolicyPeer{
+							{
+								PodSelector: &unversioned.LabelSelector{
+									MatchLabels: invalidSelector,
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+		"invalid ingress.from.namespaceSelector": {
+			ObjectMeta: api.ObjectMeta{Name: "foo", Namespace: "bar"},
+			Spec: extensions.NetworkPolicySpec{
+				PodSelector: unversioned.LabelSelector{},
+				Ingress: []extensions.NetworkPolicyIngressRule{
+					{
+						From: []extensions.NetworkPolicyPeer{
+							{
+								NamespaceSelector: &unversioned.LabelSelector{
+									MatchLabels: invalidSelector,
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+
+	// Error cases are not expected to pass validation.
+	for testName, networkPolicy := range errorCases {
+		if errs := ValidateNetworkPolicy(&networkPolicy); len(errs) == 0 {
+			t.Errorf("Expected failure for test: %s", testName)
+		}
+	}
+}
+
+func TestValidateNetworkPolicyUpdate(t *testing.T) {
+	type npUpdateTest struct {
+		old    extensions.NetworkPolicy
+		update extensions.NetworkPolicy
+	}
+	successCases := []npUpdateTest{
+		{
+			old: extensions.NetworkPolicy{
+				ObjectMeta: api.ObjectMeta{Name: "foo", Namespace: "bar"},
+				Spec: extensions.NetworkPolicySpec{
+					PodSelector: unversioned.LabelSelector{
+						MatchLabels: map[string]string{"a": "b"},
+					},
+					Ingress: []extensions.NetworkPolicyIngressRule{},
+				},
+			},
+			update: extensions.NetworkPolicy{
+				ObjectMeta: api.ObjectMeta{Name: "foo", Namespace: "bar"},
+				Spec: extensions.NetworkPolicySpec{
+					PodSelector: unversioned.LabelSelector{
+						MatchLabels: map[string]string{"a": "b"},
+					},
+					Ingress: []extensions.NetworkPolicyIngressRule{},
+				},
+			},
+		},
+	}
+
+	for _, successCase := range successCases {
+		successCase.old.ObjectMeta.ResourceVersion = "1"
+		successCase.update.ObjectMeta.ResourceVersion = "1"
+		if errs := ValidateNetworkPolicyUpdate(&successCase.update, &successCase.old); len(errs) != 0 {
+			t.Errorf("expected success: %v", errs)
+		}
+	}
+	errorCases := map[string]npUpdateTest{
+		"change name": {
+			old: extensions.NetworkPolicy{
+				ObjectMeta: api.ObjectMeta{Name: "foo", Namespace: "bar"},
+				Spec: extensions.NetworkPolicySpec{
+					PodSelector: unversioned.LabelSelector{},
+					Ingress:     []extensions.NetworkPolicyIngressRule{},
+				},
+			},
+			update: extensions.NetworkPolicy{
+				ObjectMeta: api.ObjectMeta{Name: "baz", Namespace: "bar"},
+				Spec: extensions.NetworkPolicySpec{
+					PodSelector: unversioned.LabelSelector{},
+					Ingress:     []extensions.NetworkPolicyIngressRule{},
+				},
+			},
+		},
+		"change spec": {
+			old: extensions.NetworkPolicy{
+				ObjectMeta: api.ObjectMeta{Name: "foo", Namespace: "bar"},
+				Spec: extensions.NetworkPolicySpec{
+					PodSelector: unversioned.LabelSelector{},
+					Ingress:     []extensions.NetworkPolicyIngressRule{},
+				},
+			},
+			update: extensions.NetworkPolicy{
+				ObjectMeta: api.ObjectMeta{Name: "foo", Namespace: "bar"},
+				Spec: extensions.NetworkPolicySpec{
+					PodSelector: unversioned.LabelSelector{
+						MatchLabels: map[string]string{"a": "b"},
+					},
+					Ingress: []extensions.NetworkPolicyIngressRule{},
+				},
+			},
+		},
+	}
+
+	for testName, errorCase := range errorCases {
+		if errs := ValidateNetworkPolicyUpdate(&errorCase.update, &errorCase.old); len(errs) == 0 {
+			t.Errorf("expected failure: %s", testName)
+		}
+	}
+}
+
 func newBool(val bool) *bool {
 	p := new(bool)
 	*p = val