feat(netpol): refine NetworkPolicy controller and add E2E verification

- Add ate.dev/worker-pool label to NetworkPolicy metadata and remove Egress management to allow default egress behavior
- Define ateSystemNamespace and atenetRouterAppName constants for Ingress peer selectors
- Centralize deterministic NetworkPolicy naming logic (resources.NetworkPolicyName) and prevent trailing hyphens
- Add comprehensive E2E test suite for networkpolicy covering control plane reconciliation, positive data plane verification (authorized ingress via atenet-router), and negative data plane verification (unauthorized ingress blocking)

Author: haiyanmeng

cmd/atecontroller/internal/controllers/networkpolicy_controller.go

@@ -16,8 +16,6 @@ package controllers
 
 import (
 	"context"
-	"crypto/sha256"
-	"encoding/hex"
 	"fmt"
 
 	networkingv1 "k8s.io/api/networking/v1"
@@ -29,10 +27,15 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/log"
 
+	"github.com/agent-substrate/substrate/internal/resources"
 	atev1alpha1 "github.com/agent-substrate/substrate/pkg/api/v1alpha1"
 )
 
-const networkPolicyFieldOwner = "ate-networkpolicy"
+const (
+	networkPolicyFieldOwner = "ate-networkpolicy"
+	ateSystemNamespace      = "ate-system"
+	atenetRouterAppName     = "atenet-router"
+)
 
 type NetworkPolicyReconciler struct {
 	client.Client
@@ -84,7 +87,10 @@ func (r *NetworkPolicyReconciler) reconcileImpl(ctx context.Context, wp *atev1al
 }
 
 func buildNetworkPolicyApplyConfig(wp *atev1alpha1.WorkerPool) *networkingv1ac.NetworkPolicyApplyConfiguration {
-	np := networkingv1ac.NetworkPolicy(npName(wp.Name), wp.Namespace).
+	np := networkingv1ac.NetworkPolicy(resources.NetworkPolicyName(wp.Name), wp.Namespace).
+		WithLabels(map[string]string{
+			"ate.dev/worker-pool": wp.Name,
+		}).
 		WithOwnerReferences(metav1ac.OwnerReference().
 			WithAPIVersion(atev1alpha1.GroupVersion.String()).
 			WithKind("WorkerPool").
@@ -98,39 +104,25 @@ func buildNetworkPolicyApplyConfig(wp *atev1alpha1.WorkerPool) *networkingv1ac.N
 		WithSpec(networkingv1ac.NetworkPolicySpec().
 			WithPodSelector(metav1ac.LabelSelector().
 				WithMatchLabels(map[string]string{"ate.dev/worker-pool": wp.Name})).
-			WithPolicyTypes(networkingv1.PolicyTypeIngress, networkingv1.PolicyTypeEgress).
+			WithPolicyTypes(networkingv1.PolicyTypeIngress).
 			WithIngress(
 				networkingv1ac.NetworkPolicyIngressRule().
 					WithFrom(
 						networkingv1ac.NetworkPolicyPeer().
 							WithNamespaceSelector(metav1ac.LabelSelector().
-								WithMatchLabels(map[string]string{"kubernetes.io/metadata.name": "ate-system"})).
+								WithMatchLabels(map[string]string{"kubernetes.io/metadata.name": ateSystemNamespace})).
 							WithPodSelector(metav1ac.LabelSelector().
-								WithMatchLabels(map[string]string{"app": "atenet-router"})),
+								WithMatchLabels(map[string]string{"app": atenetRouterAppName})),
 					),
-			).
-			WithEgress(
-				networkingv1ac.NetworkPolicyEgressRule(),
 			))
 
-	// TODO: don't implement any Egress policy yet.
+	// Egress is left unmanaged by Kubernetes NetworkPolicy for now while waiting for
+	// further progress on Egress API designs and because some egress rules may not be
+	// expressible at the Kubernetes layer.
 
 	return np
 }
 
-func npName(wpName string) string {
-	sum := sha256.Sum256([]byte(wpName))
-	hash := hex.EncodeToString(sum[:])
-	if len(hash) > 5 {
-		hash = hash[:5]
-	}
-	truncated := wpName
-	if len(truncated) > 30 {
-		truncated = truncated[:30]
-	}
-	return fmt.Sprintf("substrate-%s-%s", truncated, hash)
-}
-
 func (r *NetworkPolicyReconciler) SetupWithManager(mgr ctrl.Manager) error {
 	return ctrl.NewControllerManagedBy(mgr).
 		Named("networkpolicy").

cmd/atecontroller/internal/controllers/networkpolicy_controller_test.go

@@ -16,10 +16,13 @@ package controllers
 
 import (
 	"context"
+	"strings"
 	"testing"
 
 	networkingv1 "k8s.io/api/networking/v1"
 	"k8s.io/apimachinery/pkg/types"
+
+	"github.com/agent-substrate/substrate/internal/resources"
 )
 
 func TestWorkerPoolCreatesNetworkPolicy(t *testing.T) {
@@ -30,7 +33,7 @@ func TestWorkerPoolCreatesNetworkPolicy(t *testing.T) {
 	t.Cleanup(func() { k8sClient.Delete(testCtx, wp) }) //nolint:errcheck
 
 	eventually(t, func(ctx context.Context) (bool, error) {
-		npName := npName(wp.Name)
+		npName := resources.NetworkPolicyName(wp.Name)
 		np := &networkingv1.NetworkPolicy{}
 		err := k8sClient.Get(ctx, types.NamespacedName{Name: npName, Namespace: wp.Namespace}, np)
 		if err != nil {
@@ -42,23 +45,24 @@ func TestWorkerPoolCreatesNetworkPolicy(t *testing.T) {
 			return false, nil
 		}
 
+		// Verify metadata label matches the worker pool
+		if np.Labels == nil || np.Labels["ate.dev/worker-pool"] != wp.Name {
+			return false, nil
+		}
+
 		// Verify PodSelector matches the worker pool
 		if np.Spec.PodSelector.MatchLabels == nil || np.Spec.PodSelector.MatchLabels["ate.dev/worker-pool"] != wp.Name {
 			return false, nil
 		}
 
-		// Verify PolicyTypes contains Ingress and Egress
+		// Verify PolicyTypes contains Ingress
 		hasIngress := false
-		hasEgress := false
 		for _, pt := range np.Spec.PolicyTypes {
 			if pt == networkingv1.PolicyTypeIngress {
 				hasIngress = true
 			}
-			if pt == networkingv1.PolicyTypeEgress {
-				hasEgress = true
-			}
 		}
-		if !hasIngress || !hasEgress {
+		if !hasIngress {
 			return false, nil
 		}
 
@@ -71,23 +75,68 @@ func TestWorkerPoolCreatesNetworkPolicy(t *testing.T) {
 			return false, nil
 		}
 		fromPeer := ingressRule.From[0]
-		if fromPeer.NamespaceSelector == nil || fromPeer.NamespaceSelector.MatchLabels["kubernetes.io/metadata.name"] != "ate-system" {
+		if fromPeer.NamespaceSelector == nil || fromPeer.NamespaceSelector.MatchLabels["kubernetes.io/metadata.name"] != ateSystemNamespace {
 			return false, nil
 		}
-		if fromPeer.PodSelector == nil || fromPeer.PodSelector.MatchLabels["app"] != "atenet-router" {
+		if fromPeer.PodSelector == nil || fromPeer.PodSelector.MatchLabels["app"] != atenetRouterAppName {
 			return false, nil
 		}
 
-		// Verify Egress Rules:
-		// For now, we allow all egress.
-		if len(np.Spec.Egress) != 1 {
-			return false, nil
-		}
-		egressRule := np.Spec.Egress[0]
-		if len(egressRule.To) != 0 || len(egressRule.Ports) != 0 {
+		// Verify Egress Rules are unmanaged (empty)
+		if len(np.Spec.Egress) != 0 {
 			return false, nil
 		}
 
 		return true, nil
 	})
 }
+
+func TestNpName(t *testing.T) {
+	tests := []struct {
+		name       string
+		wpName     string
+		wantPrefix string
+	}{
+		{
+			name:       "short workerpool name",
+			wpName:     "my-wp",
+			wantPrefix: "substrate-my-wp-",
+		},
+		{
+			name:       "long workerpool name truncated cleanly",
+			wpName:     "a-very-long-workerpool-name-that-exceeds-30-chars",
+			wantPrefix: "substrate-a-very-long-workerpool-name-th-",
+		},
+		{
+			name:   "long workerpool name truncating right at a hyphen",
+			wpName: "this-is-a-long-worker-pool-n-with-hyphen-at-30",
+			// "this-is-a-long-worker-pool-n-" is 30 chars long, ending in a hyphen.
+			// Trimming trailing hyphens turns it into "this-is-a-long-worker-pool-n".
+			wantPrefix: "substrate-this-is-a-long-worker-pool-n-",
+		},
+		{
+			name:       "workerpool name ending with hyphens",
+			wpName:     "workerpool-name---",
+			wantPrefix: "substrate-workerpool-name-",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := resources.NetworkPolicyName(tt.wpName)
+
+			if !strings.HasPrefix(got, tt.wantPrefix) {
+				t.Errorf("npName(%q) = %q, want prefix %q", tt.wpName, got, tt.wantPrefix)
+			}
+
+			// Ensure no double hyphens before the hash
+			// The format is substrate-<truncated>-<hash>
+			parts := strings.Split(got, "-")
+			for i, part := range parts {
+				if part == "" && i > 0 && i < len(parts)-1 {
+					t.Errorf("npName(%q) = %q contains empty part (double hyphen)", tt.wpName, got)
+				}
+			}
+		})
+	}
+}