test(#537): pin locked-down egress rule count

[LukasWodka]

Fast-follow to #537 — @saqlainsyed007's test-robustness nit

Your suggestion on #537: assert the locked-down egress shape directly (lengthEqual on spec.egress) so a stray appended rule is caught, not just an index shift. Applied to both locked-down cases (deferred at merge to keep the approval).

One correction worth flagging: you suggested count: 3 for the pure locked-down case (DNS + MySQL + requests-proxy). It's actually 4 — egressProxy.enabled defaults true in values.yaml (only routeWorkloads defaults false), so the egress-proxy permit rule renders even when the case doesn't set it: DNS + MySQL + requests-proxy + egress-proxy. Both locked-down cases therefore assert count: 4, and I added a comment explaining the default so the next reader isn't surprised.

helm unittest — netpol suite 13/13, full chart 322/322.

Targets develop.

🤖 Generated with Claude Code

---

Note

Low Risk
Test-only changes to Helm unit tests; no runtime or template behavior is modified.

Overview
Helm unittest hardening for locked-down training NetworkPolicy cases: both tests now assert spec.egress has exactly 4 rules via lengthEqual, so an extra egress rule can’t land without failing the suite (follow-up to review on #537).

Comments document why the count is 4 (DNS, MySQL, requests-proxy, egress-proxy): egressProxy.enabled defaults true in chart values, so the egress-proxy permit rule is present even when a test case doesn’t set egressProxy.

^{Reviewed by Cursor Bugbot for commit 2a18e5c. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 2a18e5c. Configure here.}

[saqlainsyed007]

APPROVE — clean.

Verified the fast-follow against the template and values.yaml at head:

• egressProxy.enabled does default true in values.yaml (only routeWorkloads defaults false), so your suggested count: 3 was indeed off by one — the egress-proxy permit rule (template rule 5, gated on .Values.egressProxy.enabled) renders even in the case that doesn't set egressProxy. count: 4 (DNS + MySQL + requests-proxy + egress-proxy) is the correct pin for both locked-down cases. Good catch on the correction, and the inline comment documenting the default is exactly the right call for the next reader.
• The lengthEqual on spec.egress exercises the real rendered policy (not vacuous), and the counts are consistent with rule 2 dropping when allowExternalHttps: false (MySQL shifts to egress[1], requests-proxy to egress[2], egress-proxy at egress[3]).
• Positional identity is pinned across the two cases (egress[1]=mysql, egress[2]=requests-proxy, egress[3]=egress-proxy), so the count assertion complements the identity checks rather than replacing them — a swapped rule at a pinned index still fails. No brittleness-vs-value gap worth blocking.

Consistent with the #537 change it follows. Ship it.

[LukasWodka]

/fr-pass