test(policy): add extra testing of the matching algorithm

pkg/plugins/policies/core/matchers/testdata/matchedpolicies/fromrules/multiple-policies-lexicog-order.dataplane.yaml

@@ -0,0 +1,10 @@
+type: Dataplane
+mesh: default
+name: dp-1
+networking:
+  address: 1.1.1.1
+  inbound:
+    - port: 8080
+      tags:
+        k8s.kuma.io/service-name: demo-app
+        kuma.io/service: foo

pkg/plugins/policies/core/matchers/testdata/matchedpolicies/fromrules/multiple-policies-lexicog-order.golden.yaml

@@ -0,0 +1,71 @@
+Rules:
+  1.1.1.1:8080:
+    - Conf:
+        action: Allow
+      Origin:
+        - creationTime: "0001-01-01T00:00:00Z"
+          mesh: default
+          modificationTime: "0001-01-01T00:00:00Z"
+          name: rule-a
+          type: MeshTrafficPermission
+        - creationTime: "0001-01-01T00:00:00Z"
+          mesh: default
+          modificationTime: "0001-01-01T00:00:00Z"
+          name: rule-b
+          type: MeshTrafficPermission
+      Subset:
+        - Key: app.kubernetes.io/name
+          Not: false
+          Value: ui
+    - Conf:
+        action: Allow
+      Origin:
+        - creationTime: "0001-01-01T00:00:00Z"
+          mesh: default
+          modificationTime: "0001-01-01T00:00:00Z"
+          name: rule-a
+          type: MeshTrafficPermission
+        - creationTime: "0001-01-01T00:00:00Z"
+          mesh: default
+          modificationTime: "0001-01-01T00:00:00Z"
+          name: rule-b
+          type: MeshTrafficPermission
+      Subset:
+        - Key: app.kubernetes.io/name
+          Not: false
+          Value: service-payment
+    - Conf:
+        action: Allow
+      Origin:
+        - creationTime: "0001-01-01T00:00:00Z"
+          mesh: default
+          modificationTime: "0001-01-01T00:00:00Z"
+          name: rule-a
+          type: MeshTrafficPermission
+        - creationTime: "0001-01-01T00:00:00Z"
+          mesh: default
+          modificationTime: "0001-01-01T00:00:00Z"
+          name: rule-b
+          type: MeshTrafficPermission
+      Subset:
+        - Key: app.kubernetes.io/name
+          Not: false
+          Value: service-order
+    - Conf:
+        action: Deny
+      Origin:
+        - creationTime: "0001-01-01T00:00:00Z"
+          mesh: default
+          modificationTime: "0001-01-01T00:00:00Z"
+          name: rule-a
+          type: MeshTrafficPermission
+      Subset:
+        - Key: app.kubernetes.io/name
+          Not: true
+          Value: service-order
+        - Key: app.kubernetes.io/name
+          Not: true
+          Value: service-payment
+        - Key: app.kubernetes.io/name
+          Not: true
+          Value: ui

pkg/plugins/policies/core/matchers/testdata/matchedpolicies/fromrules/multiple-policies-lexicog-order.policies.yaml

@@ -0,0 +1,43 @@
+# When using multiple policies with the same top level targetRef the lexicographic order of the policy should be maintained
+type: MeshTrafficPermission
+mesh: default
+name: rule-b
+spec:
+  targetRef:
+    kind: MeshSubset
+    tags:
+      k8s.kuma.io/service-name: demo-app
+  from:
+    - default:
+        action: Allow
+      targetRef:
+        kind: MeshSubset
+        tags:
+          app.kubernetes.io/name: ui
+    - default:
+        action: Allow
+      targetRef:
+        kind: MeshSubset
+        tags:
+          app.kubernetes.io/name: service-order
+    - default:
+        action: Allow
+      targetRef:
+        kind: MeshSubset
+        tags:
+          app.kubernetes.io/name: service-payment
+---
+type: MeshTrafficPermission
+mesh: default
+name: rule-a
+spec:
+  targetRef:
+    kind: MeshSubset
+    tags:
+      k8s.kuma.io/service-name: demo-app
+  from:
+    - default:
+        action: Deny
+      targetRef:
+        kind: Mesh
+

pkg/plugins/policies/core/rules/testdata/rules/from/mtp-overrides-faulty.golden.yaml

@@ -0,0 +1,71 @@
+Rules:
+  127.0.0.1:80:
+    - Conf:
+        action: Deny
+      Origin:
+        - creationTime: "0001-01-01T00:00:00Z"
+          mesh: default
+          modificationTime: "0001-01-01T00:00:00Z"
+          name: default-demo-app
+          type: MeshTrafficPermission
+        - creationTime: "0001-01-01T00:00:00Z"
+          mesh: default
+          modificationTime: "0001-01-01T00:00:00Z"
+          name: default-demo-app-a
+          type: MeshTrafficPermission
+      Subset:
+        - Key: app.kubernetes.io/name
+          Not: false
+          Value: ui
+    - Conf:
+        action: Deny
+      Origin:
+        - creationTime: "0001-01-01T00:00:00Z"
+          mesh: default
+          modificationTime: "0001-01-01T00:00:00Z"
+          name: default-demo-app
+          type: MeshTrafficPermission
+        - creationTime: "0001-01-01T00:00:00Z"
+          mesh: default
+          modificationTime: "0001-01-01T00:00:00Z"
+          name: default-demo-app-a
+          type: MeshTrafficPermission
+      Subset:
+        - Key: app.kubernetes.io/name
+          Not: false
+          Value: service-payment
+    - Conf:
+        action: Deny
+      Origin:
+        - creationTime: "0001-01-01T00:00:00Z"
+          mesh: default
+          modificationTime: "0001-01-01T00:00:00Z"
+          name: default-demo-app
+          type: MeshTrafficPermission
+        - creationTime: "0001-01-01T00:00:00Z"
+          mesh: default
+          modificationTime: "0001-01-01T00:00:00Z"
+          name: default-demo-app-a
+          type: MeshTrafficPermission
+      Subset:
+        - Key: app.kubernetes.io/name
+          Not: false
+          Value: service-order
+    - Conf:
+        action: Deny
+      Origin:
+        - creationTime: "0001-01-01T00:00:00Z"
+          mesh: default
+          modificationTime: "0001-01-01T00:00:00Z"
+          name: default-demo-app
+          type: MeshTrafficPermission
+      Subset:
+        - Key: app.kubernetes.io/name
+          Not: true
+          Value: service-order
+        - Key: app.kubernetes.io/name
+          Not: true
+          Value: service-payment
+        - Key: app.kubernetes.io/name
+          Not: true
+          Value: ui

pkg/plugins/policies/core/rules/testdata/rules/from/mtp-overrides-faulty.input.yaml

@@ -0,0 +1,43 @@
+# first policy is most specific it doesn't take precedence #8484
+# Ideally the output of this should be a single rule as the conf is always the same (DENY everything)
+type: MeshTrafficPermission
+mesh: default
+name: default-demo-app-a
+spec:
+  targetRef:
+    kind: MeshSubset
+    tags:
+      k8s.kuma.io/service-name: demo-app
+  from:
+    - default:
+        action: Allow
+      targetRef:
+        kind: MeshSubset
+        tags:
+          app.kubernetes.io/name: ui
+    - default:
+        action: Allow
+      targetRef:
+        kind: MeshSubset
+        tags:
+          app.kubernetes.io/name: service-order
+    - default:
+        action: Allow
+      targetRef:
+        kind: MeshSubset
+        tags:
+          app.kubernetes.io/name: service-payment
+---
+type: MeshTrafficPermission
+mesh: default
+name: default-demo-app
+spec:
+  targetRef:
+    kind: MeshSubset
+    tags:
+      k8s.kuma.io/service-name: demo-app
+  from:
+    - default:
+        action: Deny
+      targetRef:
+        kind: Mesh

pkg/plugins/policies/core/rules/testdata/rules/from/mtp-overrides.golden.yaml

@@ -0,0 +1,71 @@
+Rules:
+  127.0.0.1:80:
+    - Conf:
+        action: Allow
+      Origin:
+        - creationTime: "0001-01-01T00:00:00Z"
+          mesh: default
+          modificationTime: "0001-01-01T00:00:00Z"
+          name: default-demo-app
+          type: MeshTrafficPermission
+        - creationTime: "0001-01-01T00:00:00Z"
+          mesh: default
+          modificationTime: "0001-01-01T00:00:00Z"
+          name: default-demo-app-a
+          type: MeshTrafficPermission
+      Subset:
+        - Key: app.kubernetes.io/name
+          Not: false
+          Value: ui
+    - Conf:
+        action: Allow
+      Origin:
+        - creationTime: "0001-01-01T00:00:00Z"
+          mesh: default
+          modificationTime: "0001-01-01T00:00:00Z"
+          name: default-demo-app
+          type: MeshTrafficPermission
+        - creationTime: "0001-01-01T00:00:00Z"
+          mesh: default
+          modificationTime: "0001-01-01T00:00:00Z"
+          name: default-demo-app-a
+          type: MeshTrafficPermission
+      Subset:
+        - Key: app.kubernetes.io/name
+          Not: false
+          Value: service-payment
+    - Conf:
+        action: Allow
+      Origin:
+        - creationTime: "0001-01-01T00:00:00Z"
+          mesh: default
+          modificationTime: "0001-01-01T00:00:00Z"
+          name: default-demo-app
+          type: MeshTrafficPermission
+        - creationTime: "0001-01-01T00:00:00Z"
+          mesh: default
+          modificationTime: "0001-01-01T00:00:00Z"
+          name: default-demo-app-a
+          type: MeshTrafficPermission
+      Subset:
+        - Key: app.kubernetes.io/name
+          Not: false
+          Value: service-order
+    - Conf:
+        action: Deny
+      Origin:
+        - creationTime: "0001-01-01T00:00:00Z"
+          mesh: default
+          modificationTime: "0001-01-01T00:00:00Z"
+          name: default-demo-app
+          type: MeshTrafficPermission
+      Subset:
+        - Key: app.kubernetes.io/name
+          Not: true
+          Value: service-order
+        - Key: app.kubernetes.io/name
+          Not: true
+          Value: service-payment
+        - Key: app.kubernetes.io/name
+          Not: true
+          Value: ui

pkg/plugins/policies/core/rules/testdata/rules/from/mtp-overrides.input.yaml

@@ -0,0 +1,42 @@
+# first policy is most specific it doesn't take precedence #8484
+type: MeshTrafficPermission
+mesh: default
+name: default-demo-app
+spec:
+  targetRef:
+    kind: MeshSubset
+    tags:
+      k8s.kuma.io/service-name: demo-app
+  from:
+    - default:
+        action: Deny
+      targetRef:
+        kind: Mesh
+---
+type: MeshTrafficPermission
+mesh: default
+name: default-demo-app-a
+spec:
+  targetRef:
+    kind: MeshSubset
+    tags:
+      k8s.kuma.io/service-name: demo-app
+  from:
+    - default:
+        action: Allow
+      targetRef:
+        kind: MeshSubset
+        tags:
+          app.kubernetes.io/name: ui
+    - default:
+        action: Allow
+      targetRef:
+        kind: MeshSubset
+        tags:
+          app.kubernetes.io/name: service-order
+    - default:
+        action: Allow
+      targetRef:
+        kind: MeshSubset
+        tags:
+          app.kubernetes.io/name: service-payment