Add e2e test to detect named ports in NetworkPolicies

test/extended/networking/networkpolicy_validation.go

@@ -0,0 +1,73 @@
+package networking
+
+import (
+	"context"
+	"fmt"
+	"slices"
+
+	g "github.com/onsi/ginkgo/v2"
+	o "github.com/onsi/gomega"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/util/intstr"
+	e2e "k8s.io/kubernetes/test/e2e/framework"
+
+	exutil "github.com/openshift/origin/test/extended/util"
+)
+
+var _ = g.Describe("[sig-network] NetworkPolicy", func() {
+	oc := exutil.NewCLIWithoutNamespace("networkpolicy-validation")
+
+	// Known NetworkPolicies that still use named ports.
+	// Each entry is "namespace/name".
+	// TODO: remove entries as the owning teams fix them.
+	networkPoliciesToSkip := []string{
+		// https://issues.redhat.com/browse/OCPBUGS-XXXXX
+		"openshift-cluster-csi-drivers/allow-to-dns",
+		// https://issues.redhat.com/browse/OCPBUGS-XXXXX
+		"openshift-cluster-olm-operator/allow-egress-to-openshift-dns",
+		// https://issues.redhat.com/browse/OCPBUGS-XXXXX
+		"openshift-cluster-storage-operator/allow-to-dns",
+		// https://issues.redhat.com/browse/OCPBUGS-XXXXX
+		"openshift-ingress/router-default",
+		// https://issues.redhat.com/browse/OCPBUGS-XXXXX
+		"openshift-operator-lifecycle-manager/catalog-operator",
+		// https://issues.redhat.com/browse/OCPBUGS-XXXXX
+		"openshift-operator-lifecycle-manager/olm-operator",
+	}
+
+	// Sone CNI like OVN-Kubernetes do not support named ports in NetworkPolicies.
+	// When a named port is used, they may silently convert the rule
+	// into an allow-all, effectively bypassing the intended restriction.
+	g.It("should use numeric ports in all platform NetworkPolicies [apigroup:networking.k8s.io]", func() {
+		ctx := context.Background()
+
+		nps, err := oc.AdminKubeClient().NetworkingV1().NetworkPolicies("").List(ctx, metav1.ListOptions{})
+		o.Expect(err).NotTo(o.HaveOccurred(), "failed to list NetworkPolicies across all namespaces")
+		o.Expect(nps.Items).NotTo(o.BeEmpty(), "expected at least one NetworkPolicy on the cluster")
+
+		var violations []string
+		for _, np := range nps.Items {
+			key := fmt.Sprintf("%s/%s", np.Namespace, np.Name)
+			if slices.Contains(networkPoliciesToSkip, key) {
+				e2e.Logf("Skipping known exception %s", key)
+				continue
+			}
+			for _, rule := range np.Spec.Ingress {
+				for _, p := range rule.Ports {
+					if p.Port != nil && p.Port.Type != intstr.Int {
+						violations = append(violations, fmt.Sprintf("%s ingress has named port %q", key, p.Port.StrVal))
+					}
+				}
+			}
+			for _, rule := range np.Spec.Egress {
+				for _, p := range rule.Ports {
+					if p.Port != nil && p.Port.Type != intstr.Int {
+						violations = append(violations, fmt.Sprintf("%s egress has named port %q", key, p.Port.StrVal))
+					}
+				}
+			}
+		}
+		o.Expect(violations).To(o.BeEmpty(), "some NetworkPolicies use named ports instead of numeric")
+	})
+})