Skip to content

feat: Migrate from cyclonus to policy-assistant for network policy testing#508

Open
dap0am wants to merge 1 commit into
aws:mainfrom
dap0am:migrate-cyclonus-to-policy-assistant
Open

feat: Migrate from cyclonus to policy-assistant for network policy testing#508
dap0am wants to merge 1 commit into
aws:mainfrom
dap0am:migrate-cyclonus-to-policy-assistant

Conversation

@dap0am

@dap0am dap0am commented Jan 17, 2026

Copy link
Copy Markdown

Description

This PR migrates the network policy test suite from cyclonus to policy-assistant, following the upstream recommendation mentioned in issue #507.

Changes

Test Script Updates (scripts/lib/tests.sh)

  • ✅ Updated Kubernetes Job to use policy-assistant instead of cyclonus
  • ✅ Changed image repository from mfenwick100/cyclonus:v0.5.4 to registry.k8s.io/networking-e2e-test-images/policy-assistant:latest
  • ✅ Renamed primary function from run_cyclonus_tests() to run_policy_assistant_tests()
  • ✅ Added backwards compatibility alias to maintain existing script compatibility
  • ✅ Updated service accounts and cluster role bindings to use policy-assistant
  • ✅ Added documentation comments explaining the migration and image requirements

Documentation Updates (scripts/README.md)

  • ✅ Updated conformance test description to reference policy-assistant
  • ✅ Documented that policy-assistant is the successor to cyclonus
  • ✅ Noted additional test capabilities including AdminNetworkPolicy tests

Benefits

  1. Comprehensive Testing: Policy-assistant provides more tests beyond the original cyclonus suite
  2. AdminNetworkPolicy Support: Includes AdminNP tests (may require adaptation for NPA's separate CRD structure)
  3. Upstream Alignment: Follows the recommendation from kubernetes-sigs/network-policy-api
  4. Future-Proof: Migrates to actively maintained testing framework

Compatibility

  • ✅ Backwards compatible: Added run_cyclonus_tests() alias that calls the new function
  • ✅ Existing scripts like run-cyclonus-tests.sh continue to work without modification
  • ✅ Test output format remains compatible with existing validation scripts

Important Note

Container Image

The policy-assistant project does not yet have an official published container image. The PR assumes the image will be available at registry.k8s.io/networking-e2e-test-images/policy-assistant:latest (following the same pattern as cyclonus).

Options if image is not available:

  1. Build from source: Use the kubernetes-sigs/network-policy-api repository to build the image
  2. Temporary registry: Use a custom test registry until official image is published
  3. Request publication: Coordinate with kubernetes-sigs maintainers to publish the image

See comments in scripts/lib/tests.sh for details.

Testing

  • Tests will need to be run in a cluster environment with the policy-assistant image available
  • The test suite maintains the same validation logic as before

Related Issues

Resolves #507


Note: This migration aligns with the upstream evolution where cyclonus functionality has been incorporated into policy-assistant as part of the kubernetes-sigs/network-policy-api project.

…sting

Migrate the network policy test suite from cyclonus to policy-assistant,
following the upstream migration to kubernetes-sigs/network-policy-api.

Changes:
- Update test Job to use policy-assistant instead of cyclonus
- Update image repository from mfenwick100/cyclonus to registry.k8s.io/networking-e2e-test-images/policy-assistant
- Rename functions from run_cyclonus_tests to run_policy_assistant_tests
- Add backwards compatibility alias for run_cyclonus_tests
- Update service accounts and cluster role bindings
- Update documentation to reflect the migration

Benefits:
- Access to more comprehensive test suite beyond cyclonus
- Includes AdminNetworkPolicy tests (may need adaptation for NPA CRDs)
- Follows upstream recommendation to use policy-assistant

Note: The policy-assistant image should be published to the specified
registry. If not available, it can be built from source using the
kubernetes-sigs/network-policy-api repository.

Resolves aws#507
@dap0am dap0am requested a review from a team as a code owner January 17, 2026 17:06
@jaydeokar

Copy link
Copy Markdown
Contributor

@dap0am thanks for the contribution. Can you post the run results as well ?

@jaydeokar

Copy link
Copy Markdown
Contributor

Please add the test results so that we can take the PR forward

@jaydeokar jaydeokar added the stale label Jul 7, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Move from cyclonus to policy-assistant

2 participants