refactor: improve test reliability with conflict retries and constrain network egress DNS to kube-system namespace

Signed-off-by: Ankit Kr. Chowdhury <rakesh856100@gmail.com>

Author: gitcommitankit

config/network-policy/tenant-agent-isolation.yaml

@@ -59,9 +59,11 @@ spec:
         - port: 6443
           protocol: TCP
     # Allow CoreDNS resolution on UDP and TCP port 53.
-    # Matches cluster DNS pods in any namespace (e.g. kube-system).
+    # Matches cluster DNS pods in the kube-system namespace.
     - to:
-        - namespaceSelector: {}
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
           podSelector:
             matchExpressions:
               - key: k8s-app

docs/ARCHITECTURE.md

@@ -333,7 +333,7 @@ Agentrax maintains a **two-tier network policy model**:
 #### Ingress & Egress Invariants:
 
 - **Ingress**: Only TCP port `8080` from namespaces labeled `monitoring: enabled` (Prometheus scraping tenant agent metrics).
-- **Egress**: Only to the Kubernetes API server (`kube-apiserver` on TCP ports `443`/`6443`) and cluster CoreDNS (`UDP/TCP :53` in DNS pods). All cross-tenant and arbitrary external internet egress destinations remain blocked at the CNI layer.
+- **Egress**: Only to the Kubernetes API server (`kube-apiserver` on TCP ports `443`/`6443`) and cluster CoreDNS (`UDP/TCP :53` in `kube-system` DNS pods). All cross-tenant and arbitrary external internet egress destinations remain blocked at the CNI layer.
 - **Label Selector Binding**: The `tenant-agent-isolation` policy selects pods dynamically via `agentrax.io/agent: "true"`. The `AgentDeploymentReconciler` automatically stamps this label into the `PodTemplateSpec` of every managed `Deployment` via `agentLabels()`.
 
 ---

internal/controller/tenantquota_controller_test.go

@@ -136,12 +136,18 @@ var _ = Describe("TenantQuota Controller", func() {
 				g.Expect(fetched.Status.UsedAgents).To(BeNumerically("==", 1))
 			}, timeout, interval).Should(Succeed())
 
-			// Remove finalizer so we can delete immediately.
-			fetched := &agentraxv1alpha1.AgentDeployment{}
-			Expect(k8sClient.Get(ctx, namespacedName("ad-del-1", tqNS), fetched)).To(Succeed())
-			fetched.Finalizers = nil
-			Expect(k8sClient.Update(ctx, fetched)).To(Succeed())
-			Expect(k8sClient.Delete(ctx, fetched)).To(Succeed())
+			// Remove finalizer with conflict retry so deletion is not raced by the controller.
+			Expect(retry.RetryOnConflict(retry.DefaultRetry, func() error {
+				latest := &agentraxv1alpha1.AgentDeployment{}
+				if err := k8sClient.Get(ctx, namespacedName("ad-del-1", tqNS), latest); err != nil {
+					return err
+				}
+				latest.Finalizers = nil
+				return k8sClient.Update(ctx, latest)
+			})).To(Succeed())
+			Expect(k8sClient.Delete(ctx, &agentraxv1alpha1.AgentDeployment{
+				ObjectMeta: metav1.ObjectMeta{Name: "ad-del-1", Namespace: tqNS},
+			})).To(Succeed())
 
 			Eventually(func(g Gomega) {
 				tqFetched := &agentraxv1alpha1.TenantQuota{}
@@ -217,11 +223,17 @@ var _ = Describe("TenantQuota Controller", func() {
 			}, timeout, interval).Should(Succeed())
 
 			// Delete one AD → usage falls back to 1 == maxAgents; OverQuota clears.
-			ad1 := &agentraxv1alpha1.AgentDeployment{}
-			Expect(k8sClient.Get(ctx, namespacedName("ad-clearoq-1", tqNS), ad1)).To(Succeed())
-			ad1.Finalizers = nil
-			Expect(k8sClient.Update(ctx, ad1)).To(Succeed())
-			Expect(k8sClient.Delete(ctx, ad1)).To(Succeed())
+			Expect(retry.RetryOnConflict(retry.DefaultRetry, func() error {
+				latest := &agentraxv1alpha1.AgentDeployment{}
+				if err := k8sClient.Get(ctx, namespacedName("ad-clearoq-1", tqNS), latest); err != nil {
+					return err
+				}
+				latest.Finalizers = nil
+				return k8sClient.Update(ctx, latest)
+			})).To(Succeed())
+			Expect(k8sClient.Delete(ctx, &agentraxv1alpha1.AgentDeployment{
+				ObjectMeta: metav1.ObjectMeta{Name: "ad-clearoq-1", Namespace: tqNS},
+			})).To(Succeed())
 
 			Eventually(func(g Gomega) {
 				f := &agentraxv1alpha1.TenantQuota{}