STOR-2340: Add e2e tests for storage network policy #30359

duanwei33 · 2025-10-09T10:43:28Z

This commit adds comprehensive e2e tests to verify that storage-related operators and controllers have the required network policy labels and that NetworkPolicy resources exist with correct pod selectors.

Changes:

Add namespace constants to helpers.go for reuse across storage tests
Add storage_networkpolicy.go with tests for CSO and CSI operators
Verify required network policy labels on deployments
Validate NetworkPolicy resources in storage namespaces

Something on-tracking:

The network policy in the hypershift management cluster control-plane namespace should be taken into an overall consideration, see discussion in slack

Test records:

$ ./openshift-tests run all --dry-run | grep -E "OCPFeature:StorageNetworkPolicy" | ./openshift-tests run -f -
passed: (15.5s) 2025-10-09T09:32:06 "[sig-storage][OCPFeature:StorageNetworkPolicy] Storage Network Policy should verify required labels for CSO related Operators"
passed: (16.7s) 2025-10-09T09:32:07 "[sig-storage][OCPFeature:StorageNetworkPolicy] Storage Network Policy should verify required labels for CSI related Operators"
passed: (17.7s) 2025-10-09T09:32:08 "[sig-storage][OCPFeature:StorageNetworkPolicy] Storage Network Policy should ensure required NetworkPolicies exist with correct labels"

duanwei33 · 2025-10-09T10:47:14Z

@mpatlasov @dobsonj Could you help take a look?
(cc @Phaow @chao007)

openshift-trt · 2025-10-09T15:14:02Z

Risk analysis has seen new tests most likely introduced by this PR.
Please ensure that new tests meet guidelines for naming and stability.

New Test Risks for sha: 92d160d

Job Name	New Test Risk
pull-ci-openshift-origin-main-e2e-aws-ovn-microshift	High - "[sig-storage][OCPFeature:StorageNetworkPolicy] Storage Network Policy should ensure required NetworkPolicies exist with correct labels [Suite:openshift/conformance/parallel]" is a new test that failed 1 time(s) against the current commit

New tests seen in this PR at sha: 92d160d

"[sig-storage][OCPFeature:StorageNetworkPolicy] Storage Network Policy should ensure required NetworkPolicies exist with correct labels [Suite:openshift/conformance/parallel]" [Total: 6, Pass: 5, Fail: 1, Flake: 0]
"[sig-storage][OCPFeature:StorageNetworkPolicy] Storage Network Policy should verify required labels for CSI related Operators [Suite:openshift/conformance/parallel]" [Total: 6, Pass: 6, Fail: 0, Flake: 0]
"[sig-storage][OCPFeature:StorageNetworkPolicy] Storage Network Policy should verify required labels for CSO related Operators [Suite:openshift/conformance/parallel]" [Total: 6, Pass: 6, Fail: 0, Flake: 0]

duanwei33 · 2025-10-10T07:04:40Z

/test verify

openshift-trt · 2025-10-11T12:08:51Z

Risk analysis has seen new tests most likely introduced by this PR.
Please ensure that new tests meet guidelines for naming and stability.

New Test Risks for sha: 81e1f58

Job Name	New Test Risk
pull-ci-openshift-origin-main-e2e-aws-ovn-microshift	High - "[sig-storage][OCPFeature:StorageNetworkPolicy] Storage Network Policy should ensure required NetworkPolicies exist with correct labels [Suite:openshift/conformance/parallel]" is a new test that failed 1 time(s) against the current commit

New tests seen in this PR at sha: 81e1f58

"[sig-storage][OCPFeature:StorageNetworkPolicy] Storage Network Policy should ensure required NetworkPolicies exist with correct labels [Suite:openshift/conformance/parallel]" [Total: 7, Pass: 6, Fail: 1, Flake: 0]
"[sig-storage][OCPFeature:StorageNetworkPolicy] Storage Network Policy should verify required labels for CSI related Operators [Suite:openshift/conformance/parallel]" [Total: 7, Pass: 7, Fail: 0, Flake: 0]
"[sig-storage][OCPFeature:StorageNetworkPolicy] Storage Network Policy should verify required labels for CSO related Operators [Suite:openshift/conformance/parallel]" [Total: 7, Pass: 7, Fail: 0, Flake: 0]

openshift-trt · 2025-10-14T11:07:30Z

Risk analysis has seen new tests most likely introduced by this PR.
Please ensure that new tests meet guidelines for naming and stability.

New tests seen in this PR at sha: c1d5777

"[sig-storage][OCPFeature:StorageNetworkPolicy] Storage Network Policy should ensure required NetworkPolicies exist with correct labels [Suite:openshift/conformance/parallel]" [Total: 6, Pass: 6, Fail: 0, Flake: 0]
"[sig-storage][OCPFeature:StorageNetworkPolicy] Storage Network Policy should verify required labels for CSI related Operators [Suite:openshift/conformance/parallel]" [Total: 6, Pass: 6, Fail: 0, Flake: 0]
"[sig-storage][OCPFeature:StorageNetworkPolicy] Storage Network Policy should verify required labels for CSO related Operators [Suite:openshift/conformance/parallel]" [Total: 6, Pass: 6, Fail: 0, Flake: 0]

openshift-trt · 2025-10-14T17:12:37Z

Risk analysis has seen new tests most likely introduced by this PR.
Please ensure that new tests meet guidelines for naming and stability.

New tests seen in this PR at sha: 4580205

"[sig-storage][OCPFeature:StorageNetworkPolicy] Storage Network Policy should ensure required NetworkPolicies exist with correct labels [Suite:openshift/conformance/parallel]" [Total: 6, Pass: 6, Fail: 0, Flake: 0]
"[sig-storage][OCPFeature:StorageNetworkPolicy] Storage Network Policy should verify required labels for CSI related Operators [Suite:openshift/conformance/parallel]" [Total: 6, Pass: 6, Fail: 0, Flake: 0]
"[sig-storage][OCPFeature:StorageNetworkPolicy] Storage Network Policy should verify required labels for CSO related Operators [Suite:openshift/conformance/parallel]" [Total: 6, Pass: 6, Fail: 0, Flake: 0]

test/extended/storage/storage_networkpolicy.go

duanwei33 · 2025-10-16T00:59:42Z

/retest

openshift-trt · 2025-10-16T05:13:06Z

Risk analysis has seen new tests most likely introduced by this PR.
Please ensure that new tests meet guidelines for naming and stability.

New Test Risks for sha: c514831

Job Name	New Test Risk
pull-ci-openshift-origin-main-e2e-aws-ovn-fips	High - "[sig-storage][OCPFeature:StorageNetworkPolicy] Storage Network Policy should ensure required NetworkPolicies exist with correct labels [Suite:openshift/conformance/parallel]" is a new test that was not present in all runs against the current commit.
pull-ci-openshift-origin-main-e2e-aws-ovn-fips	High - "[sig-storage][OCPFeature:StorageNetworkPolicy] Storage Network Policy should verify required labels for CSI related Operators [Suite:openshift/conformance/parallel]" is a new test that was not present in all runs against the current commit.
pull-ci-openshift-origin-main-e2e-aws-ovn-fips	High - "[sig-storage][OCPFeature:StorageNetworkPolicy] Storage Network Policy should verify required labels for CSO related Operators [Suite:openshift/conformance/parallel]" is a new test that was not present in all runs against the current commit.

New tests seen in this PR at sha: c514831

"[sig-storage][OCPFeature:StorageNetworkPolicy] Storage Network Policy should ensure required NetworkPolicies exist with correct labels [Suite:openshift/conformance/parallel]" [Total: 8, Pass: 8, Fail: 0, Flake: 0]
"[sig-storage][OCPFeature:StorageNetworkPolicy] Storage Network Policy should verify required labels for CSI related Operators [Suite:openshift/conformance/parallel]" [Total: 8, Pass: 8, Fail: 0, Flake: 0]
"[sig-storage][OCPFeature:StorageNetworkPolicy] Storage Network Policy should verify required labels for CSO related Operators [Suite:openshift/conformance/parallel]" [Total: 8, Pass: 8, Fail: 0, Flake: 0]

openshift-ci-robot · 2025-10-16T06:54:32Z

@duanwei33: This pull request references STOR-2340 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the epic to target either version "4.21." or "openshift-4.21.", but it targets "openshift-4.20" instead.

In response to this:

This commit adds comprehensive e2e tests to verify that storage-related operators and controllers have the required network policy labels and that NetworkPolicy resources exist with correct pod selectors.

Changes:

Add namespace constants to helpers.go for reuse across storage tests

Add storage_networkpolicy.go with tests for CSO and CSI operators

Verify required network policy labels on deployments

Validate NetworkPolicy resources in storage namespaces

Something on-tracking:

The network policy in the hypershift management cluster control-plane namespace should be taken into an overall consideration, see discussion in slack

Test records:
$ ./openshift-tests run all --dry-run | grep -E "OCPFeature:StorageNetworkPolicy" | ./openshift-tests run -f -
passed: (15.5s) 2025-10-09T09:32:06 "[sig-storage][OCPFeature:StorageNetworkPolicy] Storage Network Policy should verify required labels for CSO related Operators"
passed: (16.7s) 2025-10-09T09:32:07 "[sig-storage][OCPFeature:StorageNetworkPolicy] Storage Network Policy should verify required labels for CSI related Operators"
passed: (17.7s) 2025-10-09T09:32:08 "[sig-storage][OCPFeature:StorageNetworkPolicy] Storage Network Policy should ensure required NetworkPolicies exist with correct labels"

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-trt · 2025-10-16T12:12:36Z

Risk analysis has seen new tests most likely introduced by this PR.
Please ensure that new tests meet guidelines for naming and stability.

New tests seen in this PR at sha: 16c7f2c

"[sig-storage][OCPFeature:StorageNetworkPolicy] Storage Network Policy should ensure required NetworkPolicies exist with correct labels [Suite:openshift/conformance/parallel]" [Total: 6, Pass: 6, Fail: 0, Flake: 0]
"[sig-storage][OCPFeature:StorageNetworkPolicy] Storage Network Policy should verify required labels for CSI related Operators [Suite:openshift/conformance/parallel]" [Total: 6, Pass: 6, Fail: 0, Flake: 0]
"[sig-storage][OCPFeature:StorageNetworkPolicy] Storage Network Policy should verify required labels for CSO related Operators [Suite:openshift/conformance/parallel]" [Total: 6, Pass: 6, Fail: 0, Flake: 0]

mpatlasov · 2025-10-17T21:18:25Z

FYI, go-verify-deps started failing because PR#70376 was merged recently.

test/extended/storage/storage_networkpolicy.go

mpatlasov · 2025-10-18T00:31:13Z

Hi @duanwei33 , thank you for reworking test case "should ensure required NetworkPolicies exist with correct labels", it looks great! I have only a couple of nits remaining (see my inline comments). They are minor, I'm ok to lgtm anyway. Let me know if you're going to address them. Otherwise we can go ahead with current code as-is.

Btw, how did you verify that e2e.TestContext.Provider gives reasonable string (not just empty "")? Setting env vars TEST_PROVIDER and TEST_CSI_DRIVER_FILES doesn't help for manual runs, and g.By() adds message to the logs only if test fails, so when it succeeds it's not clear whether it ran with empty currentPlatform or not.

duanwei33 · 2025-10-20T01:17:10Z

/retest-required

This adds comprehensive e2e tests to verify that storage-related operators and controllers have the required network policy labels and that NetworkPolicy resources exist with correct pod selectors. Changes: - Add namespace constants to helpers.go for reuse across storage tests - Add storage_networkpolicy.go with tests for CSO and CSI operators - Verify required network policy labels on deployments - Validate NetworkPolicy resources in storage namespaces - Skip these tests on MicroShift clusters where they are not applicable - Temporarily disabled ManilaCSINamespace check due to OCPBUGS-61175

mpatlasov · 2025-10-20T22:45:28Z

/lgtm
/approve

openshift-ci · 2025-10-20T22:45:48Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: duanwei33, mpatlasov
Once this PR has been reviewed and has the lgtm label, please assign tsmetana for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

test/extended/storage/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

duanwei33 · 2025-10-22T02:37:35Z

/retest

openshift-ci · 2025-10-22T06:01:33Z

@duanwei33: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-ovn-microshift	`da3860c`	link	false	`/test e2e-aws-ovn-microshift`
ci/prow/okd-scos-e2e-aws-ovn	`da3860c`	link	false	`/test okd-scos-e2e-aws-ovn`
ci/prow/e2e-aws-ovn-microshift-serial	`da3860c`	link	false	`/test e2e-aws-ovn-microshift-serial`

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

duanwei33 · 2025-10-22T06:07:47Z

The [Driver: nfs3] failures in the e2e-aws-ovn-microshift job are unrelated to this PR.

The new tests added here are skipped on Microshift anyway, so this is just a pre-existing flake. This failure can be safely ignored.

@dobsonj Could you help approve it?

openshift-trt · 2025-10-22T06:11:05Z

Risk analysis has seen new tests most likely introduced by this PR.
Please ensure that new tests meet guidelines for naming and stability.

New tests seen in this PR at sha: da3860c

"[sig-storage][OCPFeature:StorageNetworkPolicy] Storage Network Policy should ensure required NetworkPolicies exist with correct labels [Suite:openshift/conformance/parallel]" [Total: 7, Pass: 7, Fail: 0, Flake: 0]
"[sig-storage][OCPFeature:StorageNetworkPolicy] Storage Network Policy should verify required labels for CSI related Operators [Suite:openshift/conformance/parallel]" [Total: 7, Pass: 7, Fail: 0, Flake: 0]
"[sig-storage][OCPFeature:StorageNetworkPolicy] Storage Network Policy should verify required labels for CSO related Operators [Suite:openshift/conformance/parallel]" [Total: 7, Pass: 7, Fail: 0, Flake: 0]

openshift-ci bot requested review from jsafrane and tsmetana October 9, 2025 10:44

duanwei33 force-pushed the storage-networkpolicy-e2e branch from 1b1417c to 81e1f58 Compare October 11, 2025 07:16

duanwei33 force-pushed the storage-networkpolicy-e2e branch from a065245 to c1d5777 Compare October 14, 2025 06:39

duanwei33 force-pushed the storage-networkpolicy-e2e branch from c1d5777 to 4580205 Compare October 14, 2025 13:15

mpatlasov reviewed Oct 14, 2025

View reviewed changes

test/extended/storage/storage_networkpolicy.go Outdated Show resolved Hide resolved

mpatlasov reviewed Oct 14, 2025

View reviewed changes

test/extended/storage/storage_networkpolicy.go Show resolved Hide resolved

mpatlasov reviewed Oct 14, 2025

View reviewed changes

test/extended/storage/storage_networkpolicy.go Show resolved Hide resolved

mpatlasov reviewed Oct 14, 2025

View reviewed changes

test/extended/storage/storage_networkpolicy.go Show resolved Hide resolved

duanwei33 changed the title ~~Add e2e tests for storage network policy~~ STOR-2340: Add e2e tests for storage network policy Oct 16, 2025

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Oct 16, 2025

duanwei33 force-pushed the storage-networkpolicy-e2e branch from c514831 to 16c7f2c Compare October 16, 2025 07:23

mpatlasov reviewed Oct 17, 2025

View reviewed changes

test/extended/storage/storage_networkpolicy.go Show resolved Hide resolved

duanwei33 force-pushed the storage-networkpolicy-e2e branch from 16c7f2c to 55b9a04 Compare October 20, 2025 01:44

duanwei33 force-pushed the storage-networkpolicy-e2e branch from 55b9a04 to da3860c Compare October 20, 2025 02:41

openshift-ci bot assigned mpatlasov Oct 20, 2025

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Oct 20, 2025

STOR-2340: Add e2e tests for storage network policy #30359

Are you sure you want to change the base?

STOR-2340: Add e2e tests for storage network policy #30359

Conversation

duanwei33 commented Oct 9, 2025

Uh oh!

duanwei33 commented Oct 9, 2025

Uh oh!

openshift-trt bot commented Oct 9, 2025

Uh oh!

duanwei33 commented Oct 10, 2025

Uh oh!

openshift-trt bot commented Oct 11, 2025

Uh oh!

openshift-trt bot commented Oct 14, 2025

Uh oh!

openshift-trt bot commented Oct 14, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

duanwei33 commented Oct 16, 2025

Uh oh!

openshift-trt bot commented Oct 16, 2025

Uh oh!

openshift-ci-robot commented Oct 16, 2025 • edited by openshift-ci bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-trt bot commented Oct 16, 2025

Uh oh!

mpatlasov commented Oct 17, 2025

Uh oh!

Uh oh!

mpatlasov commented Oct 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

duanwei33 commented Oct 20, 2025

Uh oh!

mpatlasov commented Oct 20, 2025

Uh oh!

openshift-ci bot commented Oct 20, 2025

Uh oh!

duanwei33 commented Oct 22, 2025

Uh oh!

openshift-ci bot commented Oct 22, 2025

Uh oh!

duanwei33 commented Oct 22, 2025

Uh oh!

openshift-trt bot commented Oct 22, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

openshift-ci-robot commented Oct 16, 2025 •

edited by openshift-ci bot

Loading

mpatlasov commented Oct 18, 2025 •

edited

Loading