初始提交：DSH 多租户平台（dshs）

poc/03-networkpolicy/run.sh

@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+NS=dsh-poc
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+pass() { echo "PASS: $*"; }
+fail() { echo "FAIL: $*"; exit 1; }
+
+kubectl create namespace "$NS" --dry-run=client -o yaml | kubectl apply -f - >/dev/null
+kubectl create configmap dsh-target-script --from-file="$HERE/target.mjs" -n "$NS" --dry-run=client -o yaml | kubectl apply -f - >/dev/null
+
+echo "== apply pods =="
+kubectl apply -f "$HERE/pods.yaml" >/dev/null
+kubectl wait -n "$NS" --for=condition=Ready pod/dsh-target --timeout=120s
+kubectl wait -n "$NS" --for=condition=Ready pod/controlplane --timeout=120s
+kubectl wait -n "$NS" --for=condition=Ready pod/attacker --timeout=120s
+
+echo "== apply NetworkPolicy (default-deny + allow control-plane) =="
+kubectl apply -f "$HERE/default-deny.yaml" >/dev/null
+kubectl apply -f "$HERE/allow-controlplane.yaml" >/dev/null
+sleep 2
+
+IP="$(kubectl get -n "$NS" pod dsh-target -o jsonpath='{.status.podIP}')"
+URL="http://$IP:8081/"
+echo "target pod IP: $IP"
+
+echo "== control-plane -> dsh (must succeed) =="
+if kubectl exec -n "$NS" controlplane -- wget -q -T 5 -O- "$URL" 2>/dev/null | grep -q 'dsh-ok'; then
+  pass "control-plane reaches dsh:8081"
+else
+  fail "control-plane could NOT reach dsh:8081 (policy or CNI not enforced as expected)"
+fi
+
+echo "== attacker -> dsh (must be blocked) =="
+if kubectl exec -n "$NS" attacker -- wget -q -T 5 -O- "$URL" >/dev/null 2>&1; then
+  fail "attacker reached dsh:8081 — NetworkPolicy NOT enforced (flannel? check CNI)"
+else
+  pass "attacker is blocked from dsh:8081 (default-deny enforced)"
+fi
+
+echo
+echo "ALL ITEM-3 CHECKS PASSED"