🌱 Testing: Add unit tests for NetworkPolicy controller, fetcher, webhook, proactive restart, and negative signature verification - #191
Merged
Conversation
…ive restart, and negative signature verification Signed-off-by: Kevin Cogan <kevin.s.cogan@gmail.com>
pdettori
moved this from Backlog
to In review / Needs Testing
in Rossoctl Issue Prioritization
pdettori
approved these changes
Mar 4, 2026
pdettori
left a comment
pdettori
left a comment
Member
There was a problem hiding this comment.
Review Summary
Solid set of tests (941 lines) covering critical paths: signature verification (positive/negative), network policy enforcement (permissive/restrictive/disabled), proactive restart logic, and webhook validation. Well-structured with appropriate frameworks (Ginkgo+envtest for controller tests, standard testing.T for pure functions) and good isolation with cleanup hooks and unique resource names.
Areas reviewed: Go tests, Security, Conventions
Commits: 1 commit, signed-off ✓
CI status: passing ✓
A few suggestions below for consistency and maintainability, but nothing blocking merge.
…oncileTwice comment, magic number - Add Apache 2.0 license header to agentcard_webhook_test.go - Remove ctx := context.Background() shadows in favor of suite-level ctx - Use apierrors.IsNotFound for deletion verification in NetworkPolicy test - Add doc comment explaining reconcileTwice double-reconcile pattern - Replace 5*time.Minute magic number with DefaultSVIDExpiryGracePeriod/6 Signed-off-by: Kevin Cogan <kevin.s.cogan@gmail.com>
Contributor
Author
|
Thanks @pdettori! All five addressed in the latest push:
All tests pass too. |
github-project-automation
Bot
moved this from In review / Needs Testing
to Done
in Rossoctl Issue Prioritization
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
AgentCardNetworkPolicyReconcilercovering enforcement toggle, permissive/restrictive policy creation, identity binding, policy status transitions, deletion cleanup, and missing workload handlingDefaultFetchercovering A2A card fetch, unsupported protocol, HTTP error codes, invalid JSON, andGetServiceURLformattingAgentCardValidatorwebhook covering create/update/delete validation with and withouttargetRef, and wrong object type rejectionRelated issue(s)
Closes test coverage gaps identified in the AgentCard design review for the NetworkPolicy controller, fetcher, webhook, proactive restart, and signature verification paths.
(Optional) Testing Instructions
Fast unit tests (fetcher + webhook)
go test ./internal/agentcard/... ./internal/webhook/... -v -count=1Controller integration tests (requires envtest binaries)
go test ./internal/controller/... -v -count=1 -timeout 120s