🌱 Migrate E2e NetworkPolicy tests to static analysis with `kube-score` and `conftest` #2393

pedjak · 2025-12-18T17:15:20Z

Replace the e2e NetworkPolicy tests with static analysis tools that validate
NetworkPolicy configurations at build time rather than runtime.

Tools:

kube-score: https://github.com/zegl/kube-score
conftest: https://www.conftest.dev/
OPA (Open Policy Agent): https://www.openpolicyagent.org/docs/latest/policy-language/

Changes:

Add kube-score for validating deployed NetworkPolicy resources
Add conftest for OPA-based policy validation of Helm charts
Add OPA policies to enforce NetworkPolicy requirements:
- Deny-all default policy must exist
- catalogd-controller-manager must allow ingress on ports 7443, 8443, 9443
- operator-controller-controller-manager must allow ingress on port 8443
- Both controllers must have general egress enabled
- Prometheus NetworkPolicy must allow ingress/egress (when deployed)
Add lint-helm target integration with conftest policy checks
Add lint-deployed-resources target for runtime validation with kube-score
Add conftest validation to manifest generation
Add CI workflow to detect NetworkPolicy changes in PRs and post a comment
Remove network_policy_test.go as tests are now covered by static analysis

This approach provides faster feedback by catching NetworkPolicy issues during
helm linting and manifest generation rather than requiring a full e2e test run.

Co-Authored-By: Claude noreply@anthropic.com

Reviewer Checklist

API Go Documentation
Tests: Unit Tests (and E2E Tests, if appropriate)
Comprehensive Commit Messages
Links to related GitHub Issue(s)

netlify · 2025-12-18T17:15:25Z

✅ Deploy Preview for olmv1 ready!

Name	Link
🔨 Latest commit	`bbe274b`
🔍 Latest deploy log	https://app.netlify.com/projects/olmv1/deploys/6945611a78aa5f0008bf337e
😎 Deploy Preview	https://deploy-preview-2393--olmv1.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

Copilot

Pull request overview

This PR replaces runtime E2E NetworkPolicy tests with static analysis tools that validate NetworkPolicy configurations at build time, providing faster feedback during development.

Key changes:

Removes test/e2e/network_policy_test.go (413 lines of runtime test code)
Adds OPA policies for conftest to validate NetworkPolicy requirements
Integrates kube-score and conftest into Makefile lint targets and manifest generation

Reviewed changes

Copilot reviewed 11 out of 12 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
test/e2e/network_policy_test.go	Removed E2E runtime tests (now covered by static analysis)
hack/conftest/policy/olm-networkpolicies.rego	OPA policy validating deny-all, catalogd, and operator-controller NetworkPolicies
hack/conftest/policy/prometheus-networkpolicies.rego	OPA policy validating Prometheus NetworkPolicy
hack/conftest/policy/README.md	Documentation for OPA policies and usage
Makefile	Integrated conftest into lint-helm and manifest generation; added lint-deployed-resources target
.github/workflows/files-diff.yaml	CI workflow to detect and alert on NetworkPolicy changes
.bingo/*	Added conftest, kube-score, and kube-linter tools via bingo

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2025-12-18T17:19:23Z

.github/workflows/files-diff.yaml

+      - name: Fail if NetworkPolicy files changed
+        if: steps.filter.outputs.networkpolicy == 'true'
+        run: |
+          echo "::error::NetworkPolicy files have been modified. See PR comment for details."
+          exit 1


This workflow step will always fail when NetworkPolicy files change, blocking PRs that legitimately need to modify NetworkPolicies. Consider removing the hard failure (exit 1) and instead rely on the PR comment to alert reviewers. Alternatively, add a way to bypass this check (e.g., with a specific label) for intentional NetworkPolicy changes.

Covered by previous step

So, do we want the comment, or do we want to fail? I'm not sure we should do both.

Copilot · 2025-12-18T17:19:24Z

.bingo/Variables.mk

+KUBE_LINTER := $(GOBIN)/kube-linter-v0.7.1
+$(KUBE_LINTER): $(BINGO_DIR)/kube-linter.mod
+	@# Install binary/ries using Go 1.14+ build command. This is using bwplotka/bingo-controlled, separate go module with pinned dependencies.
+	@echo "(re)installing $(GOBIN)/kube-linter-v0.7.1"
+	@cd $(BINGO_DIR) && GOWORK=off $(GO) build -mod=mod -modfile=kube-linter.mod -o=$(GOBIN)/kube-linter-v0.7.1 "golang.stackrox.io/kube-linter/cmd/kube-linter"


kube-linter is added to the bingo dependencies but is not mentioned in the PR description and doesn't appear to be used in any Makefile targets or documentation. If it's not needed for this PR, it should be removed. If it is needed, the PR description and documentation should be updated to mention it.

Copilot · 2025-12-18T17:19:24Z

hack/conftest/policy/olm-networkpolicies.rego

+deny[msg] {
+	count(catalogd_policies) == 1
+	not catalogd_has_egress
+	msg := "Missing egress rules in catalogd-controller-manager NetworkPolicy. General egress is required to enables operator-controller to pull bundle images from arbitrary image registries, connect to catalogd's HTTPS server for metadata, and interact with the Kubernetes API server."


The error message incorrectly states "enables operator-controller to pull bundle images" but this is for the catalogd-controller-manager policy. The message should describe catalogd's need for egress, not operator-controller's needs. Consider: "General egress is required to permit catalogd to fetch catalog images from arbitrary container registries and communicate with the Kubernetes API server for its operational needs."

Suggested change

msg := "Missing egress rules in catalogd-controller-manager NetworkPolicy. General egress is required to enables operator-controller to pull bundle images from arbitrary image registries, connect to catalogd's HTTPS server for metadata, and interact with the Kubernetes API server."

msg := "Missing egress rules in catalogd-controller-manager NetworkPolicy. General egress is required to permit catalogd to fetch catalog images from arbitrary container registries and communicate with the Kubernetes API server for its operational needs."

Copilot · 2025-12-18T17:19:24Z

hack/conftest/policy/olm-networkpolicies.rego

+deny[msg] {
+	count(operator_controller_policies) == 1
+	not operator_controller_ingress_port_numbers[8443]
+	msg := "Allow traffic to port 8443 to allow Prometheus to scrape metrics from catalogd, which is essential for monitoring its performance and health."


The error message incorrectly states "to allow Prometheus to scrape metrics from catalogd" but this is for operator-controller-controller-manager on port 8443. The message should be: "Allow traffic to port 8443 to allow Prometheus to scrape metrics from operator-controller, which is crucial for monitoring its activity, reconciliations, and overall health."

Suggested change

msg := "Allow traffic to port 8443 to allow Prometheus to scrape metrics from catalogd, which is essential for monitoring its performance and health."

msg := "Allow traffic to port 8443 to allow Prometheus to scrape metrics from operator-controller, which is crucial for monitoring its activity, reconciliations, and overall health."

Copilot

Pull request overview

Copilot reviewed 11 out of 12 changed files in this pull request and generated 6 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2025-12-18T20:56:34Z

hack/conftest/policy/olm-networkpolicies.rego

+deny[msg] {
+	count(catalogd_policies) == 1
+	not catalogd_has_egress
+	msg := "Missing egress rules in catalogd-controller-manager NetworkPolicy. General egress is required to enables operator-controller to pull bundle images from arbitrary image registries, connect to catalogd's HTTPS server for metadata, and interact with the Kubernetes API server."


Grammar error: "to enables" should be "to enable" (singular form).

Suggested change

msg := "Missing egress rules in catalogd-controller-manager NetworkPolicy. General egress is required to enables operator-controller to pull bundle images from arbitrary image registries, connect to catalogd's HTTPS server for metadata, and interact with the Kubernetes API server."

msg := "Missing egress rules in catalogd-controller-manager NetworkPolicy. General egress is required to enable operator-controller to pull bundle images from arbitrary image registries, connect to catalogd's HTTPS server for metadata, and interact with the Kubernetes API server."

should be fine without connect to catalogd's HTTPS server for metadata

Copilot · 2025-12-18T20:56:35Z

hack/conftest/policy/olm-networkpolicies.rego

+deny[msg] {
+	count(operator_controller_policies) == 1
+	not operator_controller_has_egress
+	msg := "Missing egress rules in operator-controller-controller-manager NetworkPolicy. General egress is required to enables operator-controller to pull bundle images from arbitrary image registries, connect to catalogd's HTTPS server for metadata, and interact with the Kubernetes API server."


Grammar error: "to enables" should be "to enable" (singular form).

Suggested change

msg := "Missing egress rules in operator-controller-controller-manager NetworkPolicy. General egress is required to enables operator-controller to pull bundle images from arbitrary image registries, connect to catalogd's HTTPS server for metadata, and interact with the Kubernetes API server."

msg := "Missing egress rules in operator-controller-controller-manager NetworkPolicy. General egress is required to enable operator-controller to pull bundle images from arbitrary image registries, connect to catalogd's HTTPS server for metadata, and interact with the Kubernetes API server."

Might want to fix this if other changes are required.

.github/workflows/files-diff.yaml

Copilot · 2025-12-18T20:56:35Z

.bingo/variables.env

+KUBE_LINTER="${GOBIN}/kube-linter-v0.7.1"
+


KUBE_LINTER is declared in variables.env but is not used anywhere in the project (not found in Makefile or Variables.mk). This appears to be an unused dependency that should either be integrated into the build or removed to avoid confusion.

Suggested change

KUBE_LINTER="${GOBIN}/kube-linter-v0.7.1"

Makefile

.github/workflows/files-diff.yaml

Copilot

Pull request overview

Copilot reviewed 14 out of 15 changed files in this pull request and generated 8 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

hack/conftest/policy/README.md

helm/olmv1/templates/e2e/pod-olmv1-system-e2e-coverage-copy-pod.yml

manifests/standard-e2e.yaml

Copilot · 2025-12-18T21:59:22Z

Makefile


 .PHONY: run-internal
-run-internal: docker-build kind-cluster kind-load kind-deploy wait
+run-internal: docker-build kind-cluster kind-load kind-deploy lint-deployed-resources wait


Adding lint-deployed-resources to the run-internal target means that every local development run will now attempt to lint all resources in the cluster. This could slow down the development workflow and may fail if the cluster is not fully ready or if resources don't exist yet. Consider moving this to a separate verification step or making it optional for development workflows.

Makefile

manifests/experimental-e2e.yaml

Copilot · 2025-12-18T21:59:23Z

.bingo/variables.env

+KUBE_LINTER="${GOBIN}/kube-linter-v0.7.1"
+


The KUBE_LINTER variable is declared in variables.env but there's no corresponding kube-linter.mod, kube-linter.sum, or Variables.mk entry to actually install this tool. Either this tool should be removed from variables.env if it's not needed, or the full bingo configuration should be added (including .mod, .sum files and Variables.mk target).

Suggested change

KUBE_LINTER="${GOBIN}/kube-linter-v0.7.1"

hack/conftest/policy/olm-networkpolicies.rego

codecov · 2025-12-18T22:04:23Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 72.97%. Comparing base (cc8ed2b) to head (bbe274b).
⚠️ Report is 4 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2393      +/-   ##
==========================================
+ Coverage   68.79%   72.97%   +4.17%     
==========================================
  Files         100      100              
  Lines        7641     7641              
==========================================
+ Hits         5257     5576     +319     
+ Misses       1948     1626     -322     
- Partials      436      439       +3

Flag	Coverage Δ
e2e	`43.78% <ø> (-0.12%)`	⬇️
experimental-e2e	`48.65% <ø> (+34.97%)`	⬆️
unit	`57.11% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

pedjak · 2025-12-18T22:26:04Z

helm/olmv1/templates/e2e/pod-olmv1-system-e2e-coverage-copy-pod.yml

      image: busybox:1.36
      name: tar
      securityContext:
+        readOnlyRootFilesystem: true


note to reviewers: kube-score detected this while working on this PR and was needed to add it.

Copilot

Pull request overview

Copilot reviewed 14 out of 15 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Makefile

perdasilva · 2025-12-19T12:58:35Z

.github/workflows/files-diff.yaml

+            ${{ steps.filter.outputs.networkpolicy_files }}
+            ```
+
+            **Please ensure:**


Nice! Thank you!

perdasilva · 2025-12-19T13:00:47Z

Makefile

+		--ignore-test container-resources \
+		--ignore-test container-image-pull-policy \
+		--ignore-test container-ephemeral-storage-request-and-limit \
+		--ignore-test container-security-context-user-group-id


is it worth calling out why we're ignoring these tests?

perdasilva · 2025-12-19T13:06:28Z

hack/conftest/policy/olm-networkpolicies.rego

@@ -0,0 +1,160 @@
+package main


just a tangent: rego seems really cool and could provide a nice basis for policy-based approval of revisions...

I haven't looked at rego in a while... Open Policy Agent...

perdasilva · 2025-12-19T14:20:23Z

Makefile

+			echo "---" ; \
+		done \
+	done) | $(KUBE_SCORE) score - \
+		`# TODO: currently these checks are failing, decide if resources should be fixed those to pass` \


Let me create a ticket here

Makefile

…d conftest Replace the e2e NetworkPolicy tests with static analysis tools that validate NetworkPolicy configurations at build time rather than runtime. Tools: - kube-score: https://github.com/zegl/kube-score - conftest: https://www.conftest.dev/ - OPA (Open Policy Agent): https://www.openpolicyagent.org/docs/latest/policy-language/ Changes: - Add kube-score via bingo for validating deployed NetworkPolicy resources - Add conftest via bingo for OPA-based policy validation of Helm charts - Add OPA policies to enforce NetworkPolicy requirements: - Deny-all default policy must exist - catalogd-controller-manager must allow ingress on ports 7443, 8443, 9443 - operator-controller-controller-manager must allow ingress on port 8443 - Both controllers must have general egress enabled - Prometheus NetworkPolicy must allow ingress/egress (when deployed) - Add lint-helm target integration with conftest policy checks - Add lint-deployed-resources target for runtime validation with kube-score - Add conftest validation to manifest generation - Add CI workflow to detect NetworkPolicy changes in PRs and post a comment - Remove network_policy_test.go as tests are now covered by static analysis This approach provides faster feedback by catching NetworkPolicy issues during helm linting and manifest generation rather than requiring a full e2e test run. Co-Authored-By: Claude <noreply@anthropic.com>

Copilot

Pull request overview

Copilot reviewed 14 out of 15 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2025-12-19T14:34:29Z

Makefile

+lint-helm: $(HELM) $(CONFTEST) #HELP Run helm linter
 	helm lint helm/olmv1
 	helm lint helm/prometheus
+	(helm template olmv1 helm/olmv1; helm template prometheus helm/prometheus) | $(CONFTEST) test --policy hack/conftest/policy/ --combine -n main -n prometheus -


The subshell combining helm templates from both charts could fail silently if the first command succeeds but the second fails. Consider using set -o pipefail within the subshell or separating into individual commands to ensure both helm template operations complete successfully before piping to conftest.

Suggested change

(helm template olmv1 helm/olmv1; helm template prometheus helm/prometheus) | $(CONFTEST) test --policy hack/conftest/policy/ --combine -n main -n prometheus -

( set -euo pipefail; helm template olmv1 helm/olmv1 && helm template prometheus helm/prometheus ) | $(CONFTEST) test --policy hack/conftest/policy/ --combine -n main -n prometheus -

perdasilva · 2025-12-19T14:40:53Z

/approve

tmshort · 2025-12-19T21:35:31Z

Makefile

+
+.PHONY: lint-deployed-resources
+lint-deployed-resources: $(KUBE_SCORE) #HELP Lint deployed resources.
+	(for ns in $$(printf "olmv1-system\n%s\n" "$(CATD_NAMESPACE)" | uniq); do \


This seems to be overloading this variable (CATD_NAMESPACE), which is defined several hundred lines below this. I'm also noticing the definition of a NAMESPACE variable elsewhere, and I think we just need to clean up our use of namespaces in the Makefile... so probably not this PR, but something I noticed during the review of this.

ankitathomas

Great work! Looks mostly good, just a few small suggestions

ankitathomas · 2025-12-19T21:15:52Z

.github/workflows/files-diff.yaml

+      - name: Fail if NetworkPolicy files changed
+        if: steps.filter.outputs.networkpolicy == 'true'
+        run: |
+          echo "::error::NetworkPolicy files have been modified. See PR comment for details."
+          exit 1


Covered by previous step

ankitathomas · 2025-12-19T21:18:05Z

Makefile

+lint-helm: $(HELM) $(CONFTEST) #HELP Run helm linter
 	helm lint helm/olmv1
 	helm lint helm/prometheus
+	(helm template olmv1 helm/olmv1; helm template prometheus helm/prometheus) | $(CONFTEST) test --policy hack/conftest/policy/ --combine -n main -n prometheus -


ankitathomas · 2025-12-19T21:30:23Z

hack/conftest/policy/README.md

+
+```bash
+# Run all policies (main + prometheus namespaces)
+helm template olmv1 helm/olmv1 | conftest test --policy hack/conftest/policy/ --combine -n main -n prometheus -


Does this require templating helm/prometheus as well?

ankitathomas · 2025-12-19T21:36:46Z

hack/conftest/policy/olm-networkpolicies.rego

+deny[msg] {
+	count(catalogd_policies) == 1
+	not catalogd_has_egress
+	msg := "Missing egress rules in catalogd-controller-manager NetworkPolicy. General egress is required to enables operator-controller to pull bundle images from arbitrary image registries, connect to catalogd's HTTPS server for metadata, and interact with the Kubernetes API server."


should be fine without connect to catalogd's HTTPS server for metadata

openshift-ci · 2025-12-19T21:39:20Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ankitathomas, perdasilva

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [perdasilva]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

tmshort · 2025-12-19T21:50:12Z

hack/conftest/policy/README.md

+- `make lint-helm` - Validates both helm/olmv1 and helm/prometheus charts (runs `main` and `prometheus` packages)
+- `make manifests` - Generates and validates core OLM manifests using only `main` package policies 
+   (Prometheus policies are intentionally skipped here, even if manifests include Prometheus resources; 
+   they are validated via `make lint-helm`)


No mention of make lint-deployed-resources?

tmshort · 2025-12-19T21:50:43Z

Makefile

+	(helm template olmv1 helm/olmv1; helm template prometheus helm/prometheus) | $(CONFTEST) test --policy hack/conftest/policy/ --combine -n main -n prometheus -
+
+.PHONY: lint-deployed-resources
+lint-deployed-resources: $(KUBE_SCORE) #HELP Lint deployed resources.


This should probably be in extended help...

Suggested change

lint-deployed-resources: $(KUBE_SCORE) #HELP Lint deployed resources.

lint-deployed-resources: $(KUBE_SCORE) #EXHELP Lint deployed resources.

Copilot AI review requested due to automatic review settings December 18, 2025 17:15

openshift-ci bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Dec 18, 2025

Copilot started reviewing on behalf of pedjak December 18, 2025 17:15 View session

pedjak changed the title ~~Migrate E2e NetworkPolicy tests to static analysis with kube-score and conftest~~ 🌱 Migrate E2e NetworkPolicy tests to static analysis with kube-score and conftest Dec 18, 2025

Copilot AI reviewed Dec 18, 2025

View reviewed changes

pedjak force-pushed the migrate-network-policy-tests branch from 26f3f91 to 0d17f25 Compare December 18, 2025 20:47

Copilot AI review requested due to automatic review settings December 18, 2025 20:49

pedjak force-pushed the migrate-network-policy-tests branch from 0d17f25 to 3f2af72 Compare December 18, 2025 20:49

Copilot started reviewing on behalf of pedjak December 18, 2025 20:49 View session

Copilot AI reviewed Dec 18, 2025

View reviewed changes

pedjak force-pushed the migrate-network-policy-tests branch from 3f2af72 to 12252d5 Compare December 18, 2025 21:03

Copilot AI review requested due to automatic review settings December 18, 2025 21:50

pedjak force-pushed the migrate-network-policy-tests branch from 12252d5 to 0f0027d Compare December 18, 2025 21:50

Copilot started reviewing on behalf of pedjak December 18, 2025 21:50 View session

Copilot AI reviewed Dec 18, 2025

View reviewed changes

pedjak force-pushed the migrate-network-policy-tests branch from 0f0027d to 7fa3d04 Compare December 18, 2025 22:04

pedjak commented Dec 18, 2025

View reviewed changes

pedjak marked this pull request as ready for review December 18, 2025 22:26

pedjak requested a review from a team as a code owner December 18, 2025 22:26

Copilot AI review requested due to automatic review settings December 18, 2025 22:26

openshift-ci bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Dec 18, 2025

openshift-ci bot requested review from ankitathomas and tmshort December 18, 2025 22:26

Copilot started reviewing on behalf of pedjak December 18, 2025 22:27 View session

pedjak requested review from perdasilva and removed request for tmshort December 18, 2025 22:27

Copilot AI reviewed Dec 18, 2025

View reviewed changes

Makefile Outdated Show resolved Hide resolved

pedjak requested a review from joelanford December 18, 2025 22:46

perdasilva reviewed Dec 19, 2025

View reviewed changes

.github/workflows/files-diff.yaml

${{ steps.filter.outputs.networkpolicy_files }}

```

**Please ensure:**

Copy link

Contributor

perdasilva Dec 19, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice! Thank you!

perdasilva reviewed Dec 19, 2025

View reviewed changes

pedjak force-pushed the migrate-network-policy-tests branch from 7fa3d04 to 65b1c29 Compare December 19, 2025 14:00

perdasilva reviewed Dec 19, 2025

View reviewed changes

perdasilva mentioned this pull request Dec 19, 2025

Address failing kube-score tests #2398

Open

perdasilva reviewed Dec 19, 2025

View reviewed changes

Makefile Outdated Show resolved Hide resolved

Copilot AI review requested due to automatic review settings December 19, 2025 14:27

Copilot started reviewing on behalf of pedjak December 19, 2025 14:28 View session

pedjak force-pushed the migrate-network-policy-tests branch from 54eb789 to bbe274b Compare December 19, 2025 14:28

Copilot AI reviewed Dec 19, 2025

View reviewed changes

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Dec 19, 2025

tmshort reviewed Dec 19, 2025

View reviewed changes

ankitathomas approved these changes Dec 19, 2025

View reviewed changes

openshift-ci bot assigned ankitathomas Dec 19, 2025

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Dec 19, 2025

openshift-merge-bot bot merged commit 08436e0 into operator-framework:main Dec 19, 2025
28 checks passed

tmshort reviewed Dec 19, 2025

View reviewed changes

	msg := "Missing egress rules in catalogd-controller-manager NetworkPolicy. General egress is required to enables operator-controller to pull bundle images from arbitrary image registries, connect to catalogd's HTTPS server for metadata, and interact with the Kubernetes API server."
	msg := "Missing egress rules in catalogd-controller-manager NetworkPolicy. General egress is required to permit catalogd to fetch catalog images from arbitrary container registries and communicate with the Kubernetes API server for its operational needs."

	msg := "Allow traffic to port 8443 to allow Prometheus to scrape metrics from catalogd, which is essential for monitoring its performance and health."
	msg := "Allow traffic to port 8443 to allow Prometheus to scrape metrics from operator-controller, which is crucial for monitoring its activity, reconciliations, and overall health."

	msg := "Missing egress rules in operator-controller-controller-manager NetworkPolicy. General egress is required to enables operator-controller to pull bundle images from arbitrary image registries, connect to catalogd's HTTPS server for metadata, and interact with the Kubernetes API server."
	msg := "Missing egress rules in operator-controller-controller-manager NetworkPolicy. General egress is required to enable operator-controller to pull bundle images from arbitrary image registries, connect to catalogd's HTTPS server for metadata, and interact with the Kubernetes API server."

	(helm template olmv1 helm/olmv1; helm template prometheus helm/prometheus) \| $(CONFTEST) test --policy hack/conftest/policy/ --combine -n main -n prometheus -
	( set -euo pipefail; helm template olmv1 helm/olmv1 && helm template prometheus helm/prometheus ) \| $(CONFTEST) test --policy hack/conftest/policy/ --combine -n main -n prometheus -

	lint-deployed-resources: $(KUBE_SCORE) #HELP Lint deployed resources.
	lint-deployed-resources: $(KUBE_SCORE) #EXHELP Lint deployed resources.

🌱 Migrate E2e NetworkPolicy tests to static analysis with kube-score and conftest #2393

🌱 Migrate E2e NetworkPolicy tests to static analysis with kube-score and conftest #2393

Uh oh!

Conversation

pedjak commented Dec 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviewer Checklist

Uh oh!

netlify bot commented Dec 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for olmv1 ready!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Dec 18, 2025

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 18, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 18, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 18, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Dec 18, 2025

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 18, 2025

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI Dec 18, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI Dec 18, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI Dec 18, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

codecov bot commented Dec 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

pedjak Dec 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

🌱 Migrate E2e NetworkPolicy tests to static analysis with `kube-score` and `conftest` #2393

🌱 Migrate E2e NetworkPolicy tests to static analysis with `kube-score` and `conftest` #2393

pedjak commented Dec 18, 2025 •

edited

Loading

netlify bot commented Dec 18, 2025 •

edited

Loading

codecov bot commented Dec 18, 2025 •

edited

Loading

pedjak Dec 18, 2025 •

edited

Loading