ROX-23967: Add fake-service and fake-client helm charts, some basic t…

…ests

.openshift-ci/e2e-runtime/Dockerfile

@@ -35,6 +35,11 @@ RUN curl -L --retry 10 --silent --show-error --fail -o "/usr/local/bin/ocm" \
     "https://github.com/openshift-online/ocm-cli/releases/download/v${OCM_VERSION}/ocm-linux-amd64" && \
     chmod +x /usr/local/bin/ocm
 
+RUN curl -L --retry 10 --silent --show-error --fail -o /usr/local/bin/helm \
+    "https://mirror.openshift.com/pub/openshift-v4/clients/helm/latest/helm-linux-amd64" && \
+    chmod +x /usr/local/bin/helm && \
+    helm version
+
 RUN mkdir /src $GOPATH
 WORKDIR /src
 

.openshift-ci/tests/e2e.sh

@@ -115,6 +115,10 @@ if [[ "$SPAWN_LOGGER" == "true" ]]; then
 fi
 
 FAIL=0
+if ! "${GITROOT}/.openshift-ci/tests/netpol-test.sh"; then
+    FAIL=1
+fi
+
 if ! "${GITROOT}/.openshift-ci/tests/e2e-test.sh"; then
     FAIL=1
 fi

.openshift-ci/tests/netpol-test.sh

@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+set -eo pipefail
+
+GITROOT="$(git rev-parse --show-toplevel)"
+export GITROOT
+# shellcheck source=/dev/null
+source "${GITROOT}/dev/env/scripts/lib.sh"
+
+CENTRAL_NS="rhacs-fake-service"
+SCANNER_NS="rhacs-fake-client"
+
+helm install fake-central "${GITROOT}/test/network-policy/fake-service" --namespace "${CENTRAL_NS}" --create-namespace
+$KUBECTL -n "${CENTRAL_NS}" wait --for=condition=Available deployment/central
+
+helm install fake-scanner "${GITROOT}/test/network-policy/fake-client" --namespace "${SCANNER_NS}" --create-namespace
+$KUBECTL -n "${SCANNER_NS}" wait --for=condition=Available deployment/scanner
+
+helm install scanner-netpol "${GITROOT}/fleetshard/pkg/central/charts/data/tenant-resources" --namespace "${SCANNER_NS}" --set secureTenantNetwork=true
+$KUBECTL -n "${SCANNER_NS}" wait --for=condition=Available=false deployment/scanner
+
+helm uninstall scanner-netpol --namespace "${SCANNER_NS}"
+$KUBECTL -n "${SCANNER_NS}" wait --for=condition=Available deployment/scanner
+
+helm install central-netpol "${GITROOT}/fleetshard/pkg/central/charts/data/tenant-resources" --namespace "${CENTRAL_NS}" --set secureTenantNetwork=true
+$KUBECTL -n "${SCANNER_NS}" wait --for=condition=Available=false deployment/scanner
+
+$KUBECTL delete ns "${CENTRAL_NS}"
+$KUBECTL delete ns "${SCANNER_NS}"

test/network-policy/fake-client/Chart.yaml

@@ -0,0 +1,6 @@
+# Chart.yaml
+apiVersion: v2
+name: fake-client
+description: A Helm chart for deploying a configurable client deployment, for testing connectivity
+version: 0.1.0
+appVersion: "1.0"

test/network-policy/fake-client/templates/deployment.yaml

@@ -0,0 +1,41 @@
+# templates/deployment.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .Values.name }}
+  namespace: {{ .Release.namespace }}
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: {{ .Values.name }}
+  template:
+    metadata:
+      labels:
+        app: {{ .Values.name }}
+    spec:
+      containers:
+        - name: {{ .Values.name }}
+          image: curlimages/curl
+          command: ["sh", "-c"]
+          args: [
+            "while true; do \
+            response=$(curl --connect-timeout 10 -sf -w '%{http_code}' {{ .Values.service.host }}:{{ .Values.service.port }} -o /dev/null); \
+            status=$?; \
+            if [ $status -ne 0 ]; then \
+              echo \"Connection failed with error $status, retrying in 1 second...\"; \
+              rm -rf /tmp/ready; \
+              sleep 1; \
+              continue; \
+            fi; \
+            echo 'Connection successful'; \
+            touch /tmp/ready; \
+            sleep 1; \
+          done"
+          ]
+          readinessProbe:
+            exec:
+              command:
+                - cat
+                - /tmp/ready
+            periodSeconds: 1

test/network-policy/fake-client/values.yaml

@@ -0,0 +1,5 @@
+# values.yaml
+name: scanner
+service:
+  host: central-service.rhacs-fake-service.svc.cluster.local
+  port: 8443

test/network-policy/fake-service/Chart.yaml

@@ -0,0 +1,6 @@
+# Chart.yaml
+apiVersion: v2
+name: fake-service
+description: A Helm chart for deploying a fake service with nginx
+version: 0.1.0
+appVersion: "1.0"

test/network-policy/fake-service/templates/configmap.yaml

@@ -0,0 +1,27 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ .Values.name }}-nginx-config
+  namespace: {{ .Release.namespace }}
+data:
+  nginx.conf: '
+worker_processes auto;
+pid /tmp/nginx.pid;
+
+events {
+    worker_connections  1024;
+}
+
+http {
+    default_type  application/octet-stream;
+
+    server {
+        listen       8443;
+        server_name  localhost;
+
+        location / {
+            return 200 "rhacs-fake-service reply";
+        }
+    }
+}
+'

test/network-policy/fake-service/templates/deployment.yaml

@@ -0,0 +1,37 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .Values.name }}
+  namespace: {{ .Release.namespace }}
+  labels:
+    app: {{ .Values.name }}
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: {{ .Values.name }}
+  template:
+    metadata:
+      labels:
+        app: {{ .Values.name }}
+    spec:
+      containers:
+        - image: nginx:latest
+          name: nginx
+          ports:
+            - containerPort: {{ .Values.port }}
+              name: web
+          volumeMounts:
+            - name: config-vol
+              mountPath: /etc/nginx/
+            - name: cache-volume
+              mountPath: /var/cache/nginx
+      volumes:
+        - name: config-vol
+          configMap:
+            name: {{ .Values.name }}-nginx-config
+            items:
+              - key: nginx.conf
+                path: nginx.conf
+        - name: cache-volume
+          emptyDir: {}

test/network-policy/fake-service/templates/service.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .Values.name }}-service
+  namespace: {{ .Release.namespace }}
+  labels:
+    app: {{ .Values.name }}
+spec:
+  type: ClusterIP
+  ports:
+    - port: {{ .Values.port }}
+      targetPort: {{ .Values.port }}
+      protocol: TCP
+  selector:
+    app: {{ .Values.name }}

test/network-policy/fake-service/values.yaml

@@ -0,0 +1,5 @@
+# values.yaml
+name: central
+labels:
+  app: central
+port: 8443