From fc4d244975febaf6b6e457e18358fb7063100bc9 Mon Sep 17 00:00:00 2001
From: Scot Wells <wells.scot@gmail.com>
Date: Fri, 14 Aug 2026 10:24:19 -0500
Subject: [PATCH] test(e2e): prove a network's presence reaches the cell
 serving a location

A NetworkContext written on the Karmada hub in a project's downstream
namespace must arrive on the POP cell for that location carrying the fields
the cell acts on, and must go away again when it is withdrawn.

infra keeps a hand-maintained fork of NSO's propagation policy rather than
consuming NSO's copy, so a selector NSO adds on its side can be inert on ours
with nothing to say so: the policy looks right, the CRD exists, and the object
reaches nowhere. This suite is the regression guard for that class of silent
failure.

The environment applies NSO's real propagation policy from the module cache,
so the selectors under test are the ones production runs. Delivery is asserted
on spec.ipFamilies and spec.mtu by value rather than on the object's mere
existence, because those are what a cell's claim reconciler reads; a copy
without them is indistinguishable downstream from one that never arrived. The
companion assertion that hub status does not cross is what keeps that honest,
and is why both fields have to live in spec.

The context is created directly on the hub rather than reconciled from a
NetworkBinding, and claim readiness is left alone: no NSO controller-manager
runs here, and that path belongs to NSO's own e2e against a real IPAM.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .../chainsaw-test.yaml                        | 244 ++++++++++++++++++
 1 file changed, 244 insertions(+)
 create mode 100644 test/e2e/network-context-propagation/chainsaw-test.yaml

diff --git a/test/e2e/network-context-propagation/chainsaw-test.yaml b/test/e2e/network-context-propagation/chainsaw-test.yaml
new file mode 100644
index 00000000..565d4c7d
--- /dev/null
+++ b/test/e2e/network-context-propagation/chainsaw-test.yaml
@@ -0,0 +1,244 @@
+apiVersion: chainsaw.kyverno.io/v1alpha1
+kind: Test
+metadata:
+  name: network-context-propagation
+spec:
+  description: |
+    A network's presence reaches the cell a workload runs in.
+
+    A NetworkContext written on the Karmada hub, in a project's downstream
+    namespace, arrives on the POP cell serving that location carrying the fields
+    the cell needs to act on it.
+
+    Why this suite exists
+    ─────────────────────
+    infra keeps a hand-maintained fork of NSO's propagation policy rather than
+    consuming NSO's copy. When NSO added the NetworkContext selector to its own
+    policy, the change was inert: nothing read that path, so nothing noticed.
+    This is the regression guard for exactly that class of silent failure — a
+    policy that looks right, a CRD that exists, and an object that reaches
+    nowhere. Every part is individually plausible, the whole delivers nothing,
+    and there is no error and no event to say so.
+
+    The environment applies NSO's real config/federation/clusterpropagationpolicy.yaml
+    from the Go module cache rather than a compute-authored stand-in, so the
+    selectors under test are the ones production runs.
+
+    What is deliberately NOT asserted
+    ─────────────────────────────────
+    No NSO controller-manager runs here. Nothing reconciles a NetworkBinding into
+    a NetworkContext, and nothing serves a NetworkInterfaceClaim. The context is
+    therefore written directly on the hub, and the suite stops at delivery.
+    Whether a cell can then satisfy a claim from it belongs to NSO's own e2e,
+    which runs against a real IPAM.
+
+    Prerequisites: `task e2e:env:up`. The compute operators are not involved —
+    this is Karmada propagation end to end.
+
+  template: true
+
+  steps:
+  - name: setup-hub-namespace
+    description: |
+      Create the hub namespace the context lives in, carrying the identity labels
+      compute's federator stamps on the ns-<uid> namespaces it creates. NSO's
+      policy selects namespaces on upstream-namespace, so this one object is also
+      what causes the namespace to exist on the cell — a context cannot land in a
+      namespace that was never carried.
+    try:
+    - script:
+        content: |
+          kubectl get namespace "$NAMESPACE" \
+            -o template='{{printf "ns-%s" .metadata.uid}}'
+        outputs:
+        - name: hubNS
+          value: ($stdout)
+    - script:
+        env:
+        - name: HUB_NS
+          value: ($hubNS)
+        content: |
+          kubectl --kubeconfig=../../../tmp/e2e/kubeconfigs/downstream.yaml apply -f - <<EOF
+          apiVersion: v1
+          kind: Namespace
+          metadata:
+            name: ${HUB_NS}
+            labels:
+              meta.datumapis.com/upstream-cluster-name: cluster-single
+              meta.datumapis.com/upstream-namespace: ${HUB_NS}
+          EOF
+    cleanup:
+    - script:
+        env:
+        - name: HUB_NS
+          value: ($hubNS)
+        content: |
+          kubectl --kubeconfig=../../../tmp/e2e/kubeconfigs/downstream.yaml \
+            delete namespace "$HUB_NS" --ignore-not-found --wait=false
+    - script:
+        env:
+        - name: HUB_NS
+          value: ($hubNS)
+        content: |
+          kubectl --kubeconfig=../../../tmp/e2e/kubeconfigs/pop-dfw.yaml \
+            delete namespace "$HUB_NS" --ignore-not-found --wait=false
+
+  - name: create-network-context-on-hub
+    description: |
+      Write the NetworkContext on the hub, then give it a status no controller
+      would produce. The distinctive status is what the later step uses to prove
+      status does not cross: a copy whose status merely looks unremarkable proves
+      nothing, because the CRD defaults conditions on whichever cluster stores it.
+    try:
+    - script:
+        content: |
+          kubectl get namespace "$NAMESPACE" \
+            -o template='{{printf "ns-%s" .metadata.uid}}'
+        outputs:
+        - name: hubNS
+          value: ($stdout)
+    - script:
+        env:
+        - name: HUB_NS
+          value: ($hubNS)
+        content: |
+          kubectl --kubeconfig=../../../tmp/e2e/kubeconfigs/downstream.yaml apply -f - <<EOF
+          apiVersion: networking.datumapis.com/v1alpha
+          kind: NetworkContext
+          metadata:
+            name: test-network-presence
+            namespace: ${HUB_NS}
+            labels:
+              # NSO's policy selects NetworkContexts on this label alone. An
+              # unlabelled context is stored on the hub and goes nowhere.
+              meta.datumapis.com/upstream-cluster-name: cluster-single
+          spec:
+            network:
+              name: test-network
+            location:
+              name: dfw
+            # The two fields a cell's claim reconciler reads off the context.
+            ipFamilies:
+            - IPv4
+            mtu: 1500
+          EOF
+    - script:
+        env:
+        - name: HUB_NS
+          value: ($hubNS)
+        content: |
+          kubectl --kubeconfig=../../../tmp/e2e/kubeconfigs/downstream.yaml \
+            -n "$HUB_NS" patch networkcontext test-network-presence \
+            --subresource=status --type=merge -p '{"status":{"conditions":[{"type":"Programmed","status":"True","reason":"HubOnlyStatusMarker","message":"set on the hub, must not cross to a cell","lastTransitionTime":"2026-01-01T00:00:00Z"}]}}'
+
+  - name: assert-context-reaches-pop-dfw
+    description: |
+      The context arrives on the cell with spec.ipFamilies and spec.mtu verbatim.
+
+      These two are asserted by value rather than by mere existence because they
+      are what a cell's claim reconciler actually reads: a copy that arrives
+      without them is, to everything downstream, indistinguishable from one that
+      never arrived at all.
+    cluster: pop-dfw
+    try:
+    - script:
+        content: |
+          kubectl --kubeconfig=../../../tmp/e2e/kubeconfigs/control-plane.yaml \
+            get namespace "$NAMESPACE" \
+            -o template='{{printf "ns-%s" .metadata.uid}}'
+        outputs:
+        - name: hubNS
+          value: ($stdout)
+    - assert:
+        # Karmada must carry the namespace first and the context into it second,
+        # so this waits on two propagations rather than one.
+        timeout: 120s
+        resource:
+          apiVersion: networking.datumapis.com/v1alpha
+          kind: NetworkContext
+          metadata:
+            namespace: ($hubNS)
+            name: test-network-presence
+          spec:
+            network:
+              name: test-network
+            location:
+              name: dfw
+            ipFamilies:
+            - IPv4
+            mtu: 1500
+
+  - name: assert-hub-status-did-not-cross
+    description: |
+      The hub's status did not come with it.
+
+      Karmada strips status, ownerReferences, finalizers and uid when it carries
+      an object to a member cluster. Asserting that is what keeps the previous
+      step honest: it is the standing proof that nothing can be handed to a cell
+      through status, and therefore that ipFamilies and mtu have to live in spec.
+      Were someone to move them, the delivery assertion alone would keep passing
+      while the cell silently received nothing.
+    cluster: pop-dfw
+    try:
+    - script:
+        content: |
+          kubectl --kubeconfig=../../../tmp/e2e/kubeconfigs/control-plane.yaml \
+            get namespace "$NAMESPACE" \
+            -o template='{{printf "ns-%s" .metadata.uid}}'
+        outputs:
+        - name: hubNS
+          value: ($stdout)
+    - assert:
+        timeout: 30s
+        resource:
+          apiVersion: networking.datumapis.com/v1alpha
+          kind: NetworkContext
+          metadata:
+            namespace: ($hubNS)
+            name: test-network-presence
+          # The cell's own apiserver defaults conditions when it stores the copy,
+          # so the copy has a status; the marker set on the hub is what must be
+          # absent from it.
+          (status.conditions[?reason == 'HubOnlyStatusMarker'] | length(@)): 0
+
+  - name: delete-context-on-hub
+    description: Remove the hub context — the network is no longer present in this location.
+    try:
+    - script:
+        content: |
+          kubectl get namespace "$NAMESPACE" \
+            -o template='{{printf "ns-%s" .metadata.uid}}'
+        outputs:
+        - name: hubNS
+          value: ($stdout)
+    - script:
+        env:
+        - name: HUB_NS
+          value: ($hubNS)
+        content: |
+          kubectl --kubeconfig=../../../tmp/e2e/kubeconfigs/downstream.yaml \
+            -n "$HUB_NS" delete networkcontext test-network-presence
+
+  - name: assert-context-removed-from-pop-dfw
+    description: |
+      The cell copy goes with it. Withdrawal matters as much as delivery: a cell
+      left holding a context for a network no longer present there would keep
+      serving addresses on a network the project has stopped using.
+    cluster: pop-dfw
+    try:
+    - script:
+        content: |
+          kubectl --kubeconfig=../../../tmp/e2e/kubeconfigs/control-plane.yaml \
+            get namespace "$NAMESPACE" \
+            -o template='{{printf "ns-%s" .metadata.uid}}'
+        outputs:
+        - name: hubNS
+          value: ($stdout)
+    - wait:
+        apiVersion: networking.datumapis.com/v1alpha
+        kind: NetworkContext
+        namespace: ($hubNS)
+        name: test-network-presence
+        timeout: 60s
+        for:
+          deletion: {}