connectivity: Add more tests for Ingress Controller

This commit is to add two more tests related to Ingress Controller:

- Deny policy on reserve:ingress identity
- Deny policy on backend service of ingress (e.g. echo-same-node)

Relates: cilium#2015

connectivity/check/deployment.go

@@ -1017,6 +1017,7 @@ func (ct *ConnectivityTest) deploy(ctx context.Context) error {
 					return fmt.Errorf("unable to create deployment %s: %s", echoExternalNodeDeploymentName, err)
 				}
 			}
+
 		} else {
 			ct.Infof("Skipping tests that require a node Without Cilium")
 		}

connectivity/manifests/deny-ingress-backend.yaml

@@ -0,0 +1,10 @@
+apiVersion: "cilium.io/v2"
+kind: CiliumNetworkPolicy
+metadata:
+  name: "ingress-backend-deny"
+spec:
+  endpointSelector: {}
+  egressDeny:
+    - toEndpoints:
+        - matchLabels:
+            kind: echo

connectivity/manifests/deny-ingress-entity.yaml

@@ -0,0 +1,9 @@
+apiVersion: "cilium.io/v2"
+kind: CiliumNetworkPolicy
+metadata:
+  name: "ingress-entity-deny"
+spec:
+  endpointSelector: {}
+  egressDeny:
+    - toEntities:
+        - ingress

connectivity/suite.go

@@ -41,6 +41,12 @@ var (
 	//go:embed manifests/deny-all-entities.yaml
 	denyAllEntitiesPolicyYAML string
 
+	//go:embed manifests/deny-ingress-entity.yaml
+	denyIngressIdentityPolicyYAML string
+
+	//go:embed manifests/deny-ingress-backend.yaml
+	denyIngressBackendPolicyYAML string
+
 	//go:embed manifests/allow-cluster-entity.yaml
 	allowClusterEntityPolicyYAML string
 
@@ -1043,6 +1049,26 @@ func Run(ctx context.Context, ct *check.ConnectivityTest, addExtraTests func(*ch
 			return check.ResultDefaultDenyEgressDrop, check.ResultNone
 		})
 
+	ct.NewTest("pod-to-ingress-service-deny-ingress-identity").
+		WithFeatureRequirements(features.RequireEnabled(features.IngressController)).
+		WithCiliumPolicy(denyIngressIdentityPolicyYAML).
+		WithScenarios(
+			tests.PodToIngress(),
+		).
+		WithExpectations(func(a *check.Action) (egress check.Result, ingress check.Result) {
+			return check.ResultDefaultDenyEgressDrop, check.ResultNone
+		})
+
+	ct.NewTest("pod-to-ingress-service-deny-backend-service").
+		WithFeatureRequirements(features.RequireEnabled(features.IngressController)).
+		WithCiliumPolicy(denyIngressBackendPolicyYAML).
+		WithScenarios(
+			tests.PodToIngress(),
+		).
+		WithExpectations(func(a *check.Action) (egress check.Result, ingress check.Result) {
+			return check.ResultDefaultDenyEgressDrop, check.ResultNone
+		})
+
 	ct.NewTest("pod-to-ingress-service-allow-ingress-identity").
 		WithFeatureRequirements(features.RequireEnabled(features.IngressController)).
 		WithCiliumPolicy(denyAllIngressPolicyYAML).