Add tests to check for psa privileged label on system namespaces

test/config/config.go

@@ -168,7 +168,7 @@ func (c *Config) ExpectedPromRules() {
 // ExpectedNamespaces returns a slice of all the namespaces
 // that are expected to be in the cluster.
 func (c *Config) ExpectedNamespaces() {
-	c.Namespaces = append(c.Namespaces, "cert-manager", "ingress-controllers", "logging", "monitoring", "gatekeeper-system", "velero")
+	c.Namespaces = append(c.Namespaces, "calico-apiserver", "calico-system", "cert-manager", "gatekeeper-system", "kube-system", "kuberos", "ingress-controllers", "logging", "monitoring", "tigera-operator", "trivy-system", "velero")
 }
 
 // ExpectedServices returns a slice of all the Services

test/namespaces_test.go

@@ -2,6 +2,7 @@ package integration_tests
 
 import (
 	"context"
+	"fmt"
 	"html/template"
 	"strings"
 
@@ -174,6 +175,30 @@ var _ = Describe("Namespaces", func() {
 			}
 		})
 	})
+	Context("when checking current system namespaces", func() {
+		GinkgoWriter.Printf("Getting list of namespaces\n")
+		namespaces, err := c.Client.Clientset.CoreV1().Namespaces().List(context.TODO(), metav1.ListOptions{})
+		Expect(err).To(BeNil())
+
+		// All system namespaces must have the appropriate psa labels for things like
+		// monitoring. This test checks all system namespaces for label "pod-security.kubernetes.io/enforce=privileged".
+		//  If the label is missing or wrong, it will fail.
+		It("must have the psa privileged label", func() {
+			for _, namespace := range namespaces.Items {
+				// Get the labels
+				labels := namespace.GetLabels()
+				// Check if the label is present
+				if _, ok := labels["pod-security.kubernetes.io/enforce"]; ok {
+					// Check if the label value is correct
+					Expect(labels["pod-security.kubernetes.io/enforce"]).To(Equal("privileged"))
+				} else {
+					// If the label is missing, fail the test
+					Fail(fmt.Sprintf("Namespace %s missing pod-security.kubernetes.io/enforce label", namespace.GetName()))
+				}
+
+			}
+		})
+	})
 })
 
 // canIPerformAction is a wrapper for the Terratest kubectl command. It should return a bool dependant on the