/*
Copyright (c) 2020 SAP SE or an SAP affiliate company. All rights reserved. This file is licensed under the Apache Software License, v. 2 except as noted otherwise in the LICENSE file

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

     http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

// Code generated by netpol-gen. DO NOT EDIT.

package networkpolies

import (
	"context"
	"encoding/json"
	"flag"
	"fmt"
	"strings"
	"sync"
	"time"

	"github.com/gardener/gardener/extensions/test/e2e/framework/executor"
	networkpolicies "github.com/gardener/gardener/extensions/test/e2e/framework/networkpolicies"
	"github.com/gardener/gardener/pkg/apis/core/v1beta1"
	"github.com/gardener/gardener/pkg/client/kubernetes"
	"github.com/gardener/gardener/pkg/logger"
	gardenerframework "github.com/gardener/gardener/test/integration/framework"
	shootsframework "github.com/gardener/gardener/test/integration/shoots"
	. "github.com/onsi/ginkgo"
	. "github.com/onsi/gomega"
	"github.com/sirupsen/logrus"
	corev1 "k8s.io/api/core/v1"
	networkingv1 "k8s.io/api/networking/v1"
	"k8s.io/apimachinery/pkg/api/errors"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/apimachinery/pkg/labels"
	"k8s.io/apimachinery/pkg/types"
	"k8s.io/apimachinery/pkg/util/sets"
	"sigs.k8s.io/controller-runtime/pkg/client"
)

var (
	kubeconfig     = flag.String("garden-kubeconfig", "", "the path to the kubeconfig  of the garden cluster that will be used for integration tests")
	shootName      = flag.String("shootName", "", "the name of the shoot we want to test")
	shootNamespace = flag.String("shootNamespace", "", "the namespace name that the shoot resides in")
	logLevel       = flag.String("verbose", "", "verbosity level, when set, logging level will be DEBUG")
	cleanup        = flag.Bool("cleanup", false, "deletes all created e2e resources after the test suite is done")
)

const (
	InitializationTimeout = 10 * time.Minute
	FinalizationTimeout   = time.Minute
	DefaultTestTimeout    = 10 * time.Second
)

func validateFlags() {
	if !shootsframework.StringSet(*kubeconfig) {
		Fail("you need to specify the correct path for the kubeconfig")
	}

	if !shootsframework.FileExists(*kubeconfig) {
		Fail("kubeconfig path does not exist")
	}
}

var _ = Describe("Network Policy Testing", func() {

	var (
		shootGardenerTest   *gardenerframework.ShootGardenerTest
		shootTestOperations *gardenerframework.GardenerTestOperation
		shootAppTestLogger  *logrus.Logger
		sharedResources     networkpolicies.SharedResources

		agnostic   = &networkpolicies.Agnostic{}
		DefaultCIt = func(text string, body func(ctx context.Context)) {
			shootsframework.CIt(text, body, DefaultTestTimeout)
		}

		setGlobals = func(ctx context.Context) {

			validateFlags()
			shootAppTestLogger = logger.AddWriter(logger.NewLogger(*logLevel), GinkgoWriter)

			if shootsframework.StringSet(*shootName) {
				var err error
				shootGardenerTest, err = gardenerframework.NewShootGardenerTest(*kubeconfig, nil, shootAppTestLogger)
				Expect(err).NotTo(HaveOccurred())

				shoot := &v1beta1.Shoot{ObjectMeta: metav1.ObjectMeta{Namespace: *shootNamespace, Name: *shootName}}
				shootTestOperations, err = gardenerframework.NewGardenTestOperationWithShoot(ctx, shootGardenerTest.GardenClient, shootAppTestLogger, shoot)
				Expect(err).NotTo(HaveOccurred())
			}
		}

		getTargetPod = func(ctx context.Context, targetPod *networkpolicies.NamespacedTargetPod) *corev1.Pod {
			if !targetPod.Pod.CheckVersion(shootTestOperations.Shoot) {
				Skip("Target pod doesn't match Shoot version constraints. Skipping.")
			}
			if !targetPod.Pod.CheckSeedCluster(sharedResources.SeedCloudProvider) {
				Skip("Component doesn't match Seed Provider constraints. Skipping.")
			}
			By(fmt.Sprintf("Checking that target Pod: %s is running", targetPod.Pod.Name))
			err := shootTestOperations.WaitUntilPodIsRunningWithLabels(ctx, targetPod.Pod.Selector(), targetPod.Namespace, shootTestOperations.SeedClient)
			ExpectWithOffset(1, err).NotTo(HaveOccurred())

			By(fmt.Sprintf("Get target pod: %s", targetPod.Pod.Name))
			trgPod, err := shootTestOperations.GetFirstRunningPodWithLabels(ctx, targetPod.Pod.Selector(), targetPod.Namespace, shootTestOperations.SeedClient)
			ExpectWithOffset(1, err).NotTo(HaveOccurred())

			return trgPod
		}

		establishConnectionToHost = func(ctx context.Context, nsp *networkpolicies.NamespacedSourcePod, host string, port int32) (stdout, stderr string, err error) {
			if !nsp.Pod.CheckVersion(shootTestOperations.Shoot) {
				Skip("Source pod doesn't match Shoot version constraints. Skipping.")
			}
			if !nsp.Pod.CheckSeedCluster(sharedResources.SeedCloudProvider) {
				Skip("Component doesn't match Seed Provider constraints. Skipping.")
			}
			By(fmt.Sprintf("Checking for source Pod: %s is running", nsp.Pod.Name))
			ExpectWithOffset(1, shootTestOperations.WaitUntilPodIsRunningWithLabels(ctx, nsp.Pod.Selector(), nsp.Namespace, shootTestOperations.SeedClient)).NotTo(HaveOccurred())

			command := []string{"nc", "-vznw", "3", host, fmt.Sprint(port)}
			By(fmt.Sprintf("Executing connectivity command in %s/%s to %s", nsp.Namespace, nsp.Pod.Name, strings.Join(command, " ")))

			return executor.NewExecutor(shootTestOperations.SeedClient).
				ExecCommandInContainerWithFullOutput(ctx, nsp.Namespace, nsp.Pod.Name, "busybox-0", command...)
		}

		assertCannotConnectToHost = func(ctx context.Context, sourcePod *networkpolicies.NamespacedSourcePod, host string, port int32) {
			_, stderr, err := establishConnectionToHost(ctx, sourcePod, host, port)
			ExpectWithOffset(1, err).To(HaveOccurred())
			By("Connection message is timed out\n")
			ExpectWithOffset(1, stderr).To(SatisfyAny(ContainSubstring("Connection timed out"), ContainSubstring("nc: bad address")))
		}

		assertConnectToHost = func(ctx context.Context, sourcePod *networkpolicies.NamespacedSourcePod, targetHost *networkpolicies.Host, allowed bool) {
			_, stderr, err := establishConnectionToHost(ctx, sourcePod, targetHost.HostName, targetHost.Port)
			if allowed {
				ExpectWithOffset(1, err).NotTo(HaveOccurred())
			} else {
				ExpectWithOffset(1, err).To(HaveOccurred())
				ExpectWithOffset(1, stderr).To(SatisfyAny(BeEmpty(), ContainSubstring("Connection timed out"), ContainSubstring("nc: bad address")), "stderr has correct message")
			}
		}

		assertCannotConnectToPod = func(ctx context.Context, sourcePod *networkpolicies.NamespacedSourcePod, targetPod *networkpolicies.NamespacedTargetPod) {
			pod := getTargetPod(ctx, targetPod)
			assertCannotConnectToHost(ctx, sourcePod, pod.Status.PodIP, targetPod.Port.Port)
		}

		assertConnectToPod = func(ctx context.Context, sourcePod *networkpolicies.NamespacedSourcePod, targetPod *networkpolicies.NamespacedTargetPod, allowed bool) {
			pod := getTargetPod(ctx, targetPod)
			assertConnectToHost(ctx, sourcePod, &networkpolicies.Host{
				HostName: pod.Status.PodIP,
				Port:     targetPod.Port.Port,
			}, allowed)
		}

		// generated targets
		CloudControllerManagerHttp = &networkpolicies.SourcePod{
			Pod: networkpolicies.Pod{
				Name: "cloud-controller-manager-http",
				Labels: labels.Set{
					"app":                     "kubernetes",
					"garden.sapcloud.io/role": "controlplane",
					"role":                    "cloud-controller-manager"},
				ShootVersionConstraint: "< 1.13",
				SeedClusterConstraints: sets.String(nil)},
			Ports: []networkpolicies.Port{
				networkpolicies.Port{
					Port: 10253,
					Name: ""}},
			ExpectedPolicies: sets.String{
				"allow-from-prometheus":    sets.Empty{},
				"allow-to-dns":             sets.Empty{},
				"allow-to-public-networks": sets.Empty{},
				"allow-to-shoot-apiserver": sets.Empty{},
				"deny-all":                 sets.Empty{}}}
		CloudControllerManagerHttp10253 = &networkpolicies.TargetPod{
			Pod: networkpolicies.Pod{
				Name: "cloud-controller-manager-http",
				Labels: labels.Set{
					"app":                     "kubernetes",
					"garden.sapcloud.io/role": "controlplane",
					"role":                    "cloud-controller-manager"},
				ShootVersionConstraint: "< 1.13",
				SeedClusterConstraints: sets.String(nil)},
			Port: networkpolicies.Port{
				Port: 10253,
				Name: ""}}
		CloudControllerManagerHttps = &networkpolicies.SourcePod{
			Pod: networkpolicies.Pod{
				Name: "cloud-controller-manager-https",
				Labels: labels.Set{
					"app":                     "kubernetes",
					"garden.sapcloud.io/role": "controlplane",
					"role":                    "cloud-controller-manager"},
				ShootVersionConstraint: ">= 1.13",
				SeedClusterConstraints: sets.String(nil)},
			Ports: []networkpolicies.Port{
				networkpolicies.Port{
					Port: 10258,
					Name: ""}},
			ExpectedPolicies: sets.String{
				"allow-from-prometheus":    sets.Empty{},
				"allow-to-dns":             sets.Empty{},
				"allow-to-public-networks": sets.Empty{},
				"allow-to-shoot-apiserver": sets.Empty{},
				"deny-all":                 sets.Empty{}}}
		CloudControllerManagerHttps10258 = &networkpolicies.TargetPod{
			Pod: networkpolicies.Pod{
				Name: "cloud-controller-manager-https",
				Labels: labels.Set{
					"app":                     "kubernetes",
					"garden.sapcloud.io/role": "controlplane",
					"role":                    "cloud-controller-manager"},
				ShootVersionConstraint: ">= 1.13",
				SeedClusterConstraints: sets.String(nil)},
			Port: networkpolicies.Port{
				Port: 10258,
				Name: ""}}
		DependencyWatchdog = &networkpolicies.SourcePod{
			Pod: networkpolicies.Pod{
				Name: "dependency-watchdog",
				Labels: labels.Set{
					"role": "dependency-watchdog"},
				ShootVersionConstraint: "",
				SeedClusterConstraints: sets.String(nil)},
			Ports: []networkpolicies.Port(nil),
			ExpectedPolicies: sets.String{
				"allow-to-dns":            sets.Empty{},
				"allow-to-seed-apiserver": sets.Empty{},
				"deny-all":                sets.Empty{}}}
		DependencyWatchdog8080 = &networkpolicies.TargetPod{
			Pod: networkpolicies.Pod{
				Name: "dependency-watchdog",
				Labels: labels.Set{
					"role": "dependency-watchdog"},
				ShootVersionConstraint: "",
				SeedClusterConstraints: sets.String(nil)},
			Port: networkpolicies.Port{
				Port: 8080,
				Name: "dummy"}}
		ElasticsearchLogging = &networkpolicies.SourcePod{
			Pod: networkpolicies.Pod{
				Name: "elasticsearch-logging",
				Labels: labels.Set{
					"app":                     "elasticsearch-logging",
					"garden.sapcloud.io/role": "logging",
					"role":                    "logging"},
				ShootVersionConstraint: "",
				SeedClusterConstraints: sets.String(nil)},
			Ports: []networkpolicies.Port{
				networkpolicies.Port{
					Port: 9200,
					Name: "http"},
				networkpolicies.Port{
					Port: 9114,
					Name: "metrics"}},
			ExpectedPolicies: sets.String{
				"allow-elasticsearch":   sets.Empty{},
				"allow-from-prometheus": sets.Empty{},
				"deny-all":              sets.Empty{}}}
		ElasticsearchLogging9114 = &networkpolicies.TargetPod{
			Pod: networkpolicies.Pod{
				Name: "elasticsearch-logging",
				Labels: labels.Set{
					"app":                     "elasticsearch-logging",
					"garden.sapcloud.io/role": "logging",
					"role":                    "logging"},
				ShootVersionConstraint: "",
				SeedClusterConstraints: sets.String(nil)},
			Port: networkpolicies.Port{
				Port: 9114,
				Name: "metrics"}}
		ElasticsearchLogging9200 = &networkpolicies.TargetPod{
			Pod: networkpolicies.Pod{
				Name: "elasticsearch-logging",
				Labels: labels.Set{
					"app":                     "elasticsearch-logging",
					"garden.sapcloud.io/role": "logging",
					"role":                    "logging"},
				ShootVersionConstraint: "",
				SeedClusterConstraints: sets.String(nil)},
			Port: networkpolicies.Port{
				Port: 9200,
				Name: "http"}}
		EtcdEvents = &networkpolicies.SourcePod{
			Pod: networkpolicies.Pod{
				Name: "etcd-events",
				Labels: labels.Set{
					"app":                     "etcd-statefulset",
					"garden.sapcloud.io/role": "controlplane",
					"role":                    "events"},
				ShootVersionConstraint: "",
				SeedClusterConstraints: sets.String(nil)},
			Ports: []networkpolicies.Port{
				networkpolicies.Port{
					Port: 2379,
					Name: ""}},
			ExpectedPolicies: sets.String{
				"allow-etcd":                sets.Empty{},
				"allow-to-dns":              sets.Empty{},
				"allow-to-private-networks": sets.Empty{},
				"allow-to-public-networks":  sets.Empty{},
				"deny-all":                  sets.Empty{}}}
		EtcdEvents2379 = &networkpolicies.TargetPod{
			Pod: networkpolicies.Pod{
				Name: "etcd-events",
				Labels: labels.Set{
					"app":                     "etcd-statefulset",
					"garden.sapcloud.io/role": "controlplane",
					"role":                    "events"},
				ShootVersionConstraint: "",
				SeedClusterConstraints: sets.String(nil)},
			Port: networkpolicies.Port{
				Port: 2379,
				Name: ""}}
		EtcdMain = &networkpolicies.SourcePod{
			Pod: networkpolicies.Pod{
				Name: "etcd-main",
				Labels: labels.Set{
					"app":                     "etcd-statefulset",
					"garden.sapcloud.io/role": "controlplane",
					"role":                    "main"},
				ShootVersionConstraint: "",
				SeedClusterConstraints: sets.String(nil)},
			Ports: []networkpolicies.Port{
				networkpolicies.Port{
					Port: 2379,
					Name: ""}},
			ExpectedPolicies: sets.String{
				"allow-etcd":                sets.Empty{},
				"allow-to-dns":              sets.Empty{},
				"allow-to-private-networks": sets.Empty{},
				"allow-to-public-networks":  sets.Empty{},
				"deny-all":                  sets.Empty{}}}
		EtcdMain2379 = &networkpolicies.TargetPod{
			Pod: networkpolicies.Pod{
				Name: "etcd-main",
				Labels: labels.Set{
					"app":                     "etcd-statefulset",
					"garden.sapcloud.io/role": "controlplane",
					"role":                    "main"},
				ShootVersionConstraint: "",
				SeedClusterConstraints: sets.String(nil)},
			Port: networkpolicies.Port{
				Port: 2379,
				Name: ""}}
		ExternalhostPort53 = &networkpolicies.Host{
			Description: "External host",
			HostName:    "8.8.8.8",
			Port:        53}
		GardenPrometheusPort80 = &networkpolicies.Host{
			Description: "Garden Prometheus",
			HostName:    "prometheus-web.garden",
			Port:        80}
		GardenerResourceManager = &networkpolicies.SourcePod{
			Pod: networkpolicies.Pod{
				Name: "gardener-resource-manager",
				Labels: labels.Set{
					"app":                     "gardener-resource-manager",
					"garden.sapcloud.io/role": "controlplane"},
				ShootVersionConstraint: "",
				SeedClusterConstraints: sets.String(nil)},
			Ports: []networkpolicies.Port(nil),
			ExpectedPolicies: sets.String{
				"allow-to-dns":             sets.Empty{},
				"allow-to-seed-apiserver":  sets.Empty{},
				"allow-to-shoot-apiserver": sets.Empty{},
				"deny-all":                 sets.Empty{}}}
		GardenerResourceManager8080 = &networkpolicies.TargetPod{
			Pod: networkpolicies.Pod{
				Name: "gardener-resource-manager",
				Labels: labels.Set{
					"app":                     "gardener-resource-manager",
					"garden.sapcloud.io/role": "controlplane"},
				ShootVersionConstraint: "",
				SeedClusterConstraints: sets.String(nil)},
			Port: networkpolicies.Port{
				Port: 8080,
				Name: "dummy"}}
		Grafana = &networkpolicies.SourcePod{
			Pod: networkpolicies.Pod{
				Name: "grafana",
				Labels: labels.Set{
					"component":               "grafana",
					"garden.sapcloud.io/role": "monitoring"},
				ShootVersionConstraint: "",
				SeedClusterConstraints: sets.String(nil)},
			Ports: []networkpolicies.Port{
				networkpolicies.Port{
					Port: 3000,
					Name: ""}},
			ExpectedPolicies: sets.String{
				"allow-grafana": sets.Empty{},
				"allow-to-dns":  sets.Empty{},
				"deny-all":      sets.Empty{}}}
		Grafana3000 = &networkpolicies.TargetPod{
			Pod: networkpolicies.Pod{
				Name: "grafana",
				Labels: labels.Set{
					"component":               "grafana",
					"garden.sapcloud.io/role": "monitoring"},
				ShootVersionConstraint: "",
				SeedClusterConstraints: sets.String(nil)},
			Port: networkpolicies.Port{
				Port: 3000,
				Name: ""}}
		KibanaLogging = &networkpolicies.SourcePod{
			Pod: networkpolicies.Pod{
				Name: "kibana-logging",
				Labels: labels.Set{
					"app":                     "kibana-logging",
					"garden.sapcloud.io/role": "logging",
					"role":                    "logging"},
				ShootVersionConstraint: "",
				SeedClusterConstraints: sets.String(nil)},
			Ports: []networkpolicies.Port{
				networkpolicies.Port{
					Port: 5601,
					Name: ""}},
			ExpectedPolicies: sets.String{
				"allow-kibana":           sets.Empty{},
				"allow-to-dns":           sets.Empty{},
				"allow-to-elasticsearch": sets.Empty{},
				"deny-all":               sets.Empty{}}}
		KibanaLogging5601 = &networkpolicies.TargetPod{
			Pod: networkpolicies.Pod{
				Name: "kibana-logging",
				Labels: labels.Set{
					"app":                     "kibana-logging",
					"garden.sapcloud.io/role": "logging",
					"role":                    "logging"},
				ShootVersionConstraint: "",
				SeedClusterConstraints: sets.String(nil)},
			Port: networkpolicies.Port{
				Port: 5601,
				Name: ""}}
		KubeApiserver = &networkpolicies.SourcePod{
			Pod: networkpolicies.Pod{
				Name: "kube-apiserver",
				Labels: labels.Set{
					"app":  "kubernetes",
					"role": "apiserver"},
				ShootVersionConstraint: "",
				SeedClusterConstraints: sets.String(nil)},
			Ports: []networkpolicies.Port{
				networkpolicies.Port{
					Port: 443,
					Name: ""}},
			ExpectedPolicies: sets.String{
				"allow-from-prometheus":     sets.Empty{},
				"allow-kube-apiserver":      sets.Empty{},
				"allow-to-dns":              sets.Empty{},
				"allow-to-private-networks": sets.Empty{},
				"allow-to-public-networks":  sets.Empty{},
				"allow-to-shoot-networks":   sets.Empty{},
				"deny-all":                  sets.Empty{}}}
		KubeApiserver443 = &networkpolicies.TargetPod{
			Pod: networkpolicies.Pod{
				Name: "kube-apiserver",
				Labels: labels.Set{
					"app":  "kubernetes",
					"role": "apiserver"},
				ShootVersionConstraint: "",
				SeedClusterConstraints: sets.String(nil)},
			Port: networkpolicies.Port{
				Port: 443,
				Name: ""}}
		KubeControllerManagerHttp = &networkpolicies.SourcePod{
			Pod: networkpolicies.Pod{
				Name: "kube-controller-manager-http",
				Labels: labels.Set{
					"app":                     "kubernetes",
					"garden.sapcloud.io/role": "controlplane",
					"role":                    "controller-manager"},
				ShootVersionConstraint: "< 1.13",
				SeedClusterConstraints: sets.String(nil)},
			Ports: []networkpolicies.Port{
				networkpolicies.Port{
					Port: 10252,
					Name: ""}},
			ExpectedPolicies: sets.String{
				"allow-from-prometheus":     sets.Empty{},
				"allow-to-blocked-cidrs":    sets.Empty{},
				"allow-to-dns":              sets.Empty{},
				"allow-to-private-networks": sets.Empty{},
				"allow-to-public-networks":  sets.Empty{},
				"allow-to-shoot-apiserver":  sets.Empty{},
				"deny-all":                  sets.Empty{}}}
		KubeControllerManagerHttp10252 = &networkpolicies.TargetPod{
			Pod: networkpolicies.Pod{
				Name: "kube-controller-manager-http",
				Labels: labels.Set{
					"app":                     "kubernetes",
					"garden.sapcloud.io/role": "controlplane",
					"role":                    "controller-manager"},
				ShootVersionConstraint: "< 1.13",
				SeedClusterConstraints: sets.String(nil)},
			Port: networkpolicies.Port{
				Port: 10252,
				Name: ""}}
		KubeControllerManagerHttps = &networkpolicies.SourcePod{
			Pod: networkpolicies.Pod{
				Name: "kube-controller-manager-https",
				Labels: labels.Set{
					"app":                     "kubernetes",
					"garden.sapcloud.io/role": "controlplane",
					"role":                    "controller-manager"},
				ShootVersionConstraint: ">= 1.13",
				SeedClusterConstraints: sets.String(nil)},
			Ports: []networkpolicies.Port{
				networkpolicies.Port{
					Port: 10257,
					Name: ""}},
			ExpectedPolicies: sets.String{
				"allow-from-prometheus":     sets.Empty{},
				"allow-to-blocked-cidrs":    sets.Empty{},
				"allow-to-dns":              sets.Empty{},
				"allow-to-private-networks": sets.Empty{},
				"allow-to-public-networks":  sets.Empty{},
				"allow-to-shoot-apiserver":  sets.Empty{},
				"deny-all":                  sets.Empty{}}}
		KubeControllerManagerHttps10257 = &networkpolicies.TargetPod{
			Pod: networkpolicies.Pod{
				Name: "kube-controller-manager-https",
				Labels: labels.Set{
					"app":                     "kubernetes",
					"garden.sapcloud.io/role": "controlplane",
					"role":                    "controller-manager"},
				ShootVersionConstraint: ">= 1.13",
				SeedClusterConstraints: sets.String(nil)},
			Port: networkpolicies.Port{
				Port: 10257,
				Name: ""}}
		KubeSchedulerHttp = &networkpolicies.SourcePod{
			Pod: networkpolicies.Pod{
				Name: "kube-scheduler-http",
				Labels: labels.Set{
					"app":                     "kubernetes",
					"garden.sapcloud.io/role": "controlplane",
					"role":                    "scheduler"},
				ShootVersionConstraint: "< 1.13",
				SeedClusterConstraints: sets.String(nil)},
			Ports: []networkpolicies.Port{
				networkpolicies.Port{
					Port: 10251,
					Name: ""}},
			ExpectedPolicies: sets.String{
				"allow-from-prometheus":    sets.Empty{},
				"allow-to-dns":             sets.Empty{},
				"allow-to-shoot-apiserver": sets.Empty{},
				"deny-all":                 sets.Empty{}}}
		KubeSchedulerHttp10251 = &networkpolicies.TargetPod{
			Pod: networkpolicies.Pod{
				Name: "kube-scheduler-http",
				Labels: labels.Set{
					"app":                     "kubernetes",
					"garden.sapcloud.io/role": "controlplane",
					"role":                    "scheduler"},
				ShootVersionConstraint: "< 1.13",
				SeedClusterConstraints: sets.String(nil)},
			Port: networkpolicies.Port{
				Port: 10251,
				Name: ""}}
		KubeSchedulerHttps = &networkpolicies.SourcePod{
			Pod: networkpolicies.Pod{
				Name: "kube-scheduler-https",
				Labels: labels.Set{
					"app":                     "kubernetes",
					"garden.sapcloud.io/role": "controlplane",
					"role":                    "scheduler"},
				ShootVersionConstraint: ">= 1.13",
				SeedClusterConstraints: sets.String(nil)},
			Ports: []networkpolicies.Port{
				networkpolicies.Port{
					Port: 10259,
					Name: ""}},
			ExpectedPolicies: sets.String{
				"allow-from-prometheus":    sets.Empty{},
				"allow-to-dns":             sets.Empty{},
				"allow-to-shoot-apiserver": sets.Empty{},
				"deny-all":                 sets.Empty{}}}
		KubeSchedulerHttps10259 = &networkpolicies.TargetPod{
			Pod: networkpolicies.Pod{
				Name: "kube-scheduler-https",
				Labels: labels.Set{
					"app":                     "kubernetes",
					"garden.sapcloud.io/role": "controlplane",
					"role":                    "scheduler"},
				ShootVersionConstraint: ">= 1.13",
				SeedClusterConstraints: sets.String(nil)},
			Port: networkpolicies.Port{
				Port: 10259,
				Name: ""}}
		KubeStateMetricsSeed = &networkpolicies.SourcePod{
			Pod: networkpolicies.Pod{
				Name: "kube-state-metrics-seed",
				Labels: labels.Set{
					"component":               "kube-state-metrics",
					"garden.sapcloud.io/role": "monitoring",
					"type":                    "seed"},
				ShootVersionConstraint: "",
				SeedClusterConstraints: sets.String(nil)},
			Ports: []networkpolicies.Port{
				networkpolicies.Port{
					Port: 8080,
					Name: ""}},
			ExpectedPolicies: sets.String{
				"allow-from-prometheus":   sets.Empty{},
				"allow-to-dns":            sets.Empty{},
				"allow-to-seed-apiserver": sets.Empty{},
				"deny-all":                sets.Empty{}}}
		KubeStateMetricsSeed8080 = &networkpolicies.TargetPod{
			Pod: networkpolicies.Pod{
				Name: "kube-state-metrics-seed",
				Labels: labels.Set{
					"component":               "kube-state-metrics",
					"garden.sapcloud.io/role": "monitoring",
					"type":                    "seed"},
				ShootVersionConstraint: "",
				SeedClusterConstraints: sets.String(nil)},
			Port: networkpolicies.Port{
				Port: 8080,
				Name: ""}}
		KubeStateMetricsShoot = &networkpolicies.SourcePod{
			Pod: networkpolicies.Pod{
				Name: "kube-state-metrics-shoot",
				Labels: labels.Set{
					"component":               "kube-state-metrics",
					"garden.sapcloud.io/role": "monitoring",
					"type":                    "shoot"},
				ShootVersionConstraint: "",
				SeedClusterConstraints: sets.String(nil)},
			Ports: []networkpolicies.Port{
				networkpolicies.Port{
					Port: 8080,
					Name: ""}},
			ExpectedPolicies: sets.String{
				"allow-from-prometheus":    sets.Empty{},
				"allow-to-dns":             sets.Empty{},
				"allow-to-shoot-apiserver": sets.Empty{},
				"deny-all":                 sets.Empty{}}}
		KubeStateMetricsShoot8080 = &networkpolicies.TargetPod{
			Pod: networkpolicies.Pod{
				Name: "kube-state-metrics-shoot",
				Labels: labels.Set{
					"component":               "kube-state-metrics",
					"garden.sapcloud.io/role": "monitoring",
					"type":                    "shoot"},
				ShootVersionConstraint: "",
				SeedClusterConstraints: sets.String(nil)},
			Port: networkpolicies.Port{
				Port: 8080,
				Name: ""}}
		MachineControllerManager = &networkpolicies.SourcePod{
			Pod: networkpolicies.Pod{
				Name: "machine-controller-manager",
				Labels: labels.Set{
					"app":                     "kubernetes",
					"garden.sapcloud.io/role": "controlplane",
					"role":                    "machine-controller-manager"},
				ShootVersionConstraint: "",
				SeedClusterConstraints: sets.String(nil)},
			Ports: []networkpolicies.Port{
				networkpolicies.Port{
					Port: 10258,
					Name: ""}},
			ExpectedPolicies: sets.String{
				"allow-from-prometheus":     sets.Empty{},
				"allow-to-dns":              sets.Empty{},
				"allow-to-private-networks": sets.Empty{},
				"allow-to-public-networks":  sets.Empty{},
				"allow-to-seed-apiserver":   sets.Empty{},
				"allow-to-shoot-apiserver":  sets.Empty{},
				"deny-all":                  sets.Empty{}}}
		MachineControllerManager10258 = &networkpolicies.TargetPod{
			Pod: networkpolicies.Pod{
				Name: "machine-controller-manager",
				Labels: labels.Set{
					"app":                     "kubernetes",
					"garden.sapcloud.io/role": "controlplane",
					"role":                    "machine-controller-manager"},
				ShootVersionConstraint: "",
				SeedClusterConstraints: sets.String(nil)},
			Port: networkpolicies.Port{
				Port: 10258,
				Name: ""}}
		MetadataservicePort80 = &networkpolicies.Host{
			Description: "Metadata service",
			HostName:    "169.254.169.254",
			Port:        80}
		Prometheus = &networkpolicies.SourcePod{
			Pod: networkpolicies.Pod{
				Name: "prometheus",
				Labels: labels.Set{
					"app":                     "prometheus",
					"garden.sapcloud.io/role": "monitoring",
					"role":                    "monitoring"},
				ShootVersionConstraint: "",
				SeedClusterConstraints: sets.String(nil)},
			Ports: []networkpolicies.Port{
				networkpolicies.Port{
					Port: 9090,
					Name: ""}},
			ExpectedPolicies: sets.String{
				"allow-prometheus":         sets.Empty{},
				"allow-to-dns":             sets.Empty{},
				"allow-to-public-networks": sets.Empty{},
				"allow-to-seed-apiserver":  sets.Empty{},
				"allow-to-shoot-apiserver": sets.Empty{},
				"allow-to-shoot-networks":  sets.Empty{},
				"deny-all":                 sets.Empty{}}}
		Prometheus9090 = &networkpolicies.TargetPod{
			Pod: networkpolicies.Pod{
				Name: "prometheus",
				Labels: labels.Set{
					"app":                     "prometheus",
					"garden.sapcloud.io/role": "monitoring",
					"role":                    "monitoring"},
				ShootVersionConstraint: "",
				SeedClusterConstraints: sets.String(nil)},
			Port: networkpolicies.Port{
				Port: 9090,
				Name: ""}}
		SeedKubeAPIServerPort443 = &networkpolicies.Host{
			Description: "Seed Kube APIServer",
			HostName:    "kubernetes.default",
			Port:        443}
	)

	SynchronizedBeforeSuite(func() []byte {
		ctx, cancel := context.WithTimeout(context.TODO(), InitializationTimeout)
		defer cancel()

		setGlobals(ctx)
		var err error

		By("Getting Seed Cloud Provider")
		sharedResources.SeedCloudProvider = shootTestOperations.Seed.Spec.Provider.Type

		By("Creating namespace for Ingress testing")
		ns := &corev1.Namespace{
			ObjectMeta: metav1.ObjectMeta{
				GenerateName: "gardener-e2e-network-policies-",
				Labels: map[string]string{
					"gardener-e2e-test": "networkpolicies",
				},
			},
		}
		err = shootTestOperations.SeedClient.Client().Create(ctx, ns)
		Expect(err).NotTo(HaveOccurred())

		sharedResources.External = ns.GetName()

		By("Creating mirror namespace for pod2pod network testing")
		mirrorNamespace := &corev1.Namespace{
			ObjectMeta: metav1.ObjectMeta{
				GenerateName: "gardener-e2e-mirror-network-policies-",
				Labels: map[string]string{
					"gardener-e2e-test": "networkpolicies",
				},
			},
		}
		err = shootTestOperations.SeedClient.Client().Create(ctx, mirrorNamespace)
		Expect(err).NotTo(HaveOccurred())

		sharedResources.Mirror = mirrorNamespace.GetName()

		By(fmt.Sprintf("Getting all network policies in namespace %q", shootTestOperations.ShootSeedNamespace()))
		list := &networkingv1.NetworkPolicyList{}
		err = shootTestOperations.SeedClient.Client().List(ctx, list, client.InNamespace(shootTestOperations.ShootSeedNamespace()))
		Expect(err).ToNot(HaveOccurred())

		sharedResources.Policies = list.Items

		for _, netPol := range sharedResources.Policies {
			cpy := &networkingv1.NetworkPolicy{}
			cpy.Name = netPol.Name
			cpy.Namespace = sharedResources.Mirror
			cpy.Spec = *netPol.Spec.DeepCopy()
			By(fmt.Sprintf("Copying network policy %s in namespace %q", netPol.Name, sharedResources.Mirror))
			err = shootTestOperations.SeedClient.Client().Create(ctx, cpy)
			Expect(err).NotTo(HaveOccurred())
		}

		By("Getting the current CloudProvider")
		currentProvider := shootTestOperations.Shoot.Spec.Provider.Type

		getFirstNodeInternalIP := func(ctx context.Context, cl kubernetes.Interface) (string, error) {
			nodes := &corev1.NodeList{}
			err := cl.Client().List(ctx, nodes, client.Limit(1))
			if err != nil {
				return "", err
			}

			if len(nodes.Items) > 0 {
				firstNode := nodes.Items[0]
				for _, address := range firstNode.Status.Addresses {
					if address.Type == corev1.NodeInternalIP {
						return address.Address, nil
					}
				}
			}

			return "", gardenerframework.ErrNoInternalIPsForNodeWasFound
		}

		By("Getting fist running node")
		sharedResources.SeedNodeIP, err = getFirstNodeInternalIP(ctx, shootTestOperations.SeedClient)
		Expect(err).NotTo(HaveOccurred())

		if currentProvider != "gcp" {
			Fail(fmt.Sprintf("Not supported cloud provider %s", currentProvider))
		}

		createBusyBox := func(ctx context.Context, sourcePod *networkpolicies.NamespacedSourcePod, ports ...corev1.ContainerPort) {
			if len(ports) == 0 {
				Fail(fmt.Sprintf("No ports found for SourcePod %+v", *sourcePod.SourcePod))
			}
			containers := []corev1.Container{}
			for i, port := range ports {
				containers = append(containers, corev1.Container{
					Args:  []string{"nc", "-lk", "-p", fmt.Sprint(port.ContainerPort), "-e", "/bin/echo", "-s", "0.0.0.0"},
					Image: "busybox",
					Name:  fmt.Sprintf("busybox-%d", i),
					Ports: ports,
				})
			}
			pod := &corev1.Pod{
				ObjectMeta: metav1.ObjectMeta{
					Name:      sourcePod.Pod.Name,
					Namespace: sourcePod.Namespace,
					Labels:    sourcePod.Pod.Labels,
				},
				Spec: corev1.PodSpec{
					Containers: containers,
				},
			}

			By(fmt.Sprintf("Creating Pod %s/%s", sourcePod.Namespace, sourcePod.Name))
			err := shootTestOperations.SeedClient.Client().Create(ctx, pod)
			Expect(err).NotTo(HaveOccurred())

			By(fmt.Sprintf("Waiting foo Pod %s/%s to be running", sourcePod.Namespace, sourcePod.Name))
			err = shootTestOperations.WaitUntilPodIsRunning(ctx, pod.GetName(), sourcePod.Namespace, shootTestOperations.SeedClient)
			if err != nil {
				Fail(fmt.Sprintf("Couldn't find running busybox %s/%s", sourcePod.Namespace, pod.GetName()))
			}
		}

		sources := []*networkpolicies.SourcePod{
			GardenerResourceManager,
			CloudControllerManagerHttp,
			CloudControllerManagerHttps,
			DependencyWatchdog,
			ElasticsearchLogging,
			EtcdEvents,
			EtcdMain,
			Grafana,
			KibanaLogging,
			KubeApiserver,
			KubeControllerManagerHttp,
			KubeControllerManagerHttps,
			KubeSchedulerHttps,
			KubeSchedulerHttp,
			KubeStateMetricsSeed,
			KubeStateMetricsShoot,
			MachineControllerManager,
			Prometheus,
		}

		var wg sync.WaitGroup
		// one extra for the busybox Pod bellow.
		wg.Add(len(sources) + 1)

		for _, s := range sources {
			go func(pi *networkpolicies.SourcePod) {
				defer GinkgoRecover()
				defer wg.Done()
				if !pi.Pod.CheckVersion(shootTestOperations.Shoot) || !pi.Pod.CheckSeedCluster(sharedResources.SeedCloudProvider) {
					return
				}
				pod, err := shootTestOperations.GetFirstRunningPodWithLabels(ctx, pi.Pod.Selector(), shootTestOperations.ShootSeedNamespace(), shootTestOperations.SeedClient)
				if err != nil {
					Fail(fmt.Sprintf("Couldn't find running Pod %s/%s with labels: %+v", shootTestOperations.ShootSeedNamespace(), pi.Pod.Name, pi.Pod.Labels))
				}
				cpy := *pi

				targetLabels := make(map[string]string)

				for k, v := range pod.Labels {
					targetLabels[k] = v
				}

				cpy.Pod.Labels = targetLabels
				By(fmt.Sprintf("Mirroring Pod %s to namespace %s", cpy.Pod.Labels.String(), sharedResources.Mirror))

				expectedPorts := sets.Int64{}
				actualPorts := sets.Int64{}
				for _, p := range pi.Ports {
					expectedPorts.Insert(int64(p.Port))
				}
				containerPorts := []corev1.ContainerPort{}
				for _, container := range pod.Spec.Containers {
					if len(container.Ports) > 0 {
						for _, p := range container.Ports {
							actualPorts.Insert(int64(p.ContainerPort))
						}
						containerPorts = append(containerPorts, container.Ports...)
					}
				}

				if !actualPorts.HasAll(expectedPorts.List()...) {
					Fail(fmt.Sprintf("Pod %s doesn't have all ports. Expected %+v, actual %+v", pi.Pod.Name, expectedPorts.List(), actualPorts.List()))
				}
				if len(containerPorts) == 0 {
					// Dummy port for containers which don't have any ports.
					containerPorts = append(containerPorts, corev1.ContainerPort{ContainerPort: 8080})
				}
				createBusyBox(ctx, networkpolicies.NewNamespacedSourcePod(&cpy, sharedResources.Mirror), containerPorts...)
			}(s)
		}
		go func() {
			defer GinkgoRecover()
			defer wg.Done()
			createBusyBox(ctx, networkpolicies.NewNamespacedSourcePod(agnostic.Busybox(), ns.GetName()), corev1.ContainerPort{ContainerPort: 8080})
		}()

		wg.Wait()

		b, err := json.Marshal(sharedResources)
		Expect(err).NotTo(HaveOccurred())

		return b
	}, func(data []byte) {
		ctx, cancel := context.WithTimeout(context.TODO(), InitializationTimeout)
		defer cancel()

		sr := &networkpolicies.SharedResources{}
		err := json.Unmarshal(data, sr)
		Expect(err).NotTo(HaveOccurred())

		setGlobals(ctx)

		sharedResources = *sr
	})

	SynchronizedAfterSuite(func() {
		if !*cleanup {
			return
		}

		ctx, cancel := context.WithTimeout(context.TODO(), FinalizationTimeout)
		defer cancel()

		setGlobals(ctx)

		namespaces := &corev1.NamespaceList{}
		selector := labels.SelectorFromSet(labels.Set{
			"gardener-e2e-test": "networkpolicies",
		})
		err := shootTestOperations.SeedClient.Client().List(ctx, namespaces, client.MatchingLabelsSelector{Selector: selector})
		Expect(err).NotTo(HaveOccurred())

		for _, ns := range namespaces.Items {
			err = shootTestOperations.SeedClient.Client().Delete(ctx, &ns)
			if err != nil && !errors.IsConflict(err) {
				Expect(err).NotTo(HaveOccurred())
			}
		}
	}, func() {})

	Context("Deprecated old policies are removed", func() {

		const (
			deprecatedKubeAPIServerPolicy = "kube-apiserver-default"
			deprecatedMetadataAppPolicy   = "cloud-metadata-service-deny-blacklist-app"
			deprecatedMetadataRolePolicy  = "cloud-metadata-service-deny-blacklist-role"
			deprecatedKibanaLogging       = "kibana-logging"
		)

		var (
			assertPolicyIsGone = func(policyName string) func(ctx context.Context) {
				return func(ctx context.Context) {
					By(fmt.Sprintf("Getting network policy %q in namespace %q", policyName, shootTestOperations.ShootSeedNamespace()))
					getErr := shootTestOperations.SeedClient.Client().Get(ctx, types.NamespacedName{Name: policyName, Namespace: shootTestOperations.ShootSeedNamespace()}, &networkingv1.NetworkPolicy{})
					Expect(getErr).To(HaveOccurred())
					By("error is NotFound")
					Expect(errors.IsNotFound(getErr)).To(BeTrue())
				}
			}
		)

		DefaultCIt(deprecatedKubeAPIServerPolicy, assertPolicyIsGone(deprecatedKubeAPIServerPolicy))
		DefaultCIt(deprecatedMetadataAppPolicy, assertPolicyIsGone(deprecatedMetadataAppPolicy))
		DefaultCIt(deprecatedMetadataRolePolicy, assertPolicyIsGone(deprecatedMetadataRolePolicy))
		DefaultCIt(deprecatedMetadataRolePolicy, assertPolicyIsGone(deprecatedKibanaLogging))
	})

	Context("components are selected by correct policies", func() {
		var (
			assertHasNetworkPolicy = func(sourcePod *networkpolicies.SourcePod) func(context.Context) {
				return func(ctx context.Context) {
					if !sourcePod.Pod.CheckVersion(shootTestOperations.Shoot) {
						Skip("Component doesn't match Shoot version constraints. Skipping.")
					}
					if !sourcePod.Pod.CheckSeedCluster(sharedResources.SeedCloudProvider) {
						Skip("Component doesn't match Seed Provider constraints. Skipping.")
					}

					matched := sets.NewString()
					var podLabelSet labels.Set

					By(fmt.Sprintf("Getting first running pod with selectors %q in namespace %q", sourcePod.Pod.Labels, shootTestOperations.ShootSeedNamespace()))
					pod, err := shootTestOperations.GetFirstRunningPodWithLabels(ctx, sourcePod.Pod.Selector(), shootTestOperations.ShootSeedNamespace(), shootTestOperations.SeedClient)
					podLabelSet = pod.GetLabels()
					Expect(err).NotTo(HaveOccurred())

					for _, netPol := range sharedResources.Policies {
						netPolSelector, err := metav1.LabelSelectorAsSelector(&netPol.Spec.PodSelector)
						Expect(err).NotTo(HaveOccurred())

						if netPolSelector.Matches(podLabelSet) {
							matched.Insert(netPol.GetName())
						}
					}
					By(fmt.Sprintf("Matching actual network policies against expected %s", sourcePod.ExpectedPolicies.List()))
					Expect(matched.List()).Should(ConsistOf(sourcePod.ExpectedPolicies.List()))
				}
			}
		)
		DefaultCIt(`kube-apiserver`, assertHasNetworkPolicy(KubeApiserver))
		DefaultCIt(`etcd-main`, assertHasNetworkPolicy(EtcdMain))
		DefaultCIt(`etcd-events`, assertHasNetworkPolicy(EtcdEvents))
		DefaultCIt(`cloud-controller-manager-http`, assertHasNetworkPolicy(CloudControllerManagerHttp))
		DefaultCIt(`cloud-controller-manager-https`, assertHasNetworkPolicy(CloudControllerManagerHttps))
		DefaultCIt(`dependency-watchdog`, assertHasNetworkPolicy(DependencyWatchdog))
		DefaultCIt(`elasticsearch-logging`, assertHasNetworkPolicy(ElasticsearchLogging))
		DefaultCIt(`grafana`, assertHasNetworkPolicy(Grafana))
		DefaultCIt(`kibana-logging`, assertHasNetworkPolicy(KibanaLogging))
		DefaultCIt(`gardener-resource-manager`, assertHasNetworkPolicy(GardenerResourceManager))
		DefaultCIt(`kube-controller-manager-http`, assertHasNetworkPolicy(KubeControllerManagerHttp))
		DefaultCIt(`kube-controller-manager-https`, assertHasNetworkPolicy(KubeControllerManagerHttps))
		DefaultCIt(`kube-scheduler-http`, assertHasNetworkPolicy(KubeSchedulerHttp))
		DefaultCIt(`kube-scheduler-https`, assertHasNetworkPolicy(KubeSchedulerHttps))
		DefaultCIt(`kube-state-metrics-shoot`, assertHasNetworkPolicy(KubeStateMetricsShoot))
		DefaultCIt(`kube-state-metrics-seed`, assertHasNetworkPolicy(KubeStateMetricsSeed))
		DefaultCIt(`machine-controller-manager`, assertHasNetworkPolicy(MachineControllerManager))
		DefaultCIt(`prometheus`, assertHasNetworkPolicy(Prometheus))
	})

	Context("ingress from other namespaces", func() {

		var (
			assertBlockIngress = func(to *networkpolicies.TargetPod, allowed bool) func(context.Context) {
				return func(ctx context.Context) {
					assertConnectToPod(ctx, networkpolicies.NewNamespacedSourcePod(agnostic.Busybox(), sharedResources.External), networkpolicies.NewNamespacedTargetPod(to, shootTestOperations.ShootSeedNamespace()), allowed)
				}
			}
		)

		DefaultCIt(`should block connection to Pod "gardener-resource-manager" at port 8080`, assertBlockIngress(GardenerResourceManager8080, false))
		DefaultCIt(`should block connection to Pod "cloud-controller-manager-http" at port 10253`, assertBlockIngress(CloudControllerManagerHttp10253, false))
		DefaultCIt(`should block connection to Pod "cloud-controller-manager-https" at port 10258`, assertBlockIngress(CloudControllerManagerHttps10258, false))
		DefaultCIt(`should block connection to Pod "dependency-watchdog" at port 8080`, assertBlockIngress(DependencyWatchdog8080, false))
		DefaultCIt(`should block connection to Pod "elasticsearch-logging" at port 9200`, assertBlockIngress(ElasticsearchLogging9200, false))
		DefaultCIt(`should block connection to Pod "elasticsearch-logging" at port 9114`, assertBlockIngress(ElasticsearchLogging9114, false))
		DefaultCIt(`should block connection to Pod "etcd-events" at port 2379`, assertBlockIngress(EtcdEvents2379, false))
		DefaultCIt(`should block connection to Pod "etcd-main" at port 2379`, assertBlockIngress(EtcdMain2379, false))
		DefaultCIt(`should block connection to Pod "grafana" at port 3000`, assertBlockIngress(Grafana3000, false))
		DefaultCIt(`should block connection to Pod "kibana-logging" at port 5601`, assertBlockIngress(KibanaLogging5601, false))
		DefaultCIt(`should allow connection to Pod "kube-apiserver" at port 443`, assertBlockIngress(KubeApiserver443, true))
		DefaultCIt(`should block connection to Pod "kube-controller-manager-http" at port 10252`, assertBlockIngress(KubeControllerManagerHttp10252, false))
		DefaultCIt(`should block connection to Pod "kube-controller-manager-https" at port 10257`, assertBlockIngress(KubeControllerManagerHttps10257, false))
		DefaultCIt(`should block connection to Pod "kube-scheduler-https" at port 10259`, assertBlockIngress(KubeSchedulerHttps10259, false))
		DefaultCIt(`should block connection to Pod "kube-scheduler-http" at port 10251`, assertBlockIngress(KubeSchedulerHttp10251, false))
		DefaultCIt(`should block connection to Pod "kube-state-metrics-seed" at port 8080`, assertBlockIngress(KubeStateMetricsSeed8080, false))
		DefaultCIt(`should block connection to Pod "kube-state-metrics-shoot" at port 8080`, assertBlockIngress(KubeStateMetricsShoot8080, false))
		DefaultCIt(`should block connection to Pod "machine-controller-manager" at port 10258`, assertBlockIngress(MachineControllerManager10258, false))
		DefaultCIt(`should block connection to Pod "prometheus" at port 9090`, assertBlockIngress(Prometheus9090, false))
	})

	Context("egress to other namespaces", func() {

		var (
			assertBlockEgresss = func(from *networkpolicies.SourcePod) func(context.Context) {
				return func(ctx context.Context) {
					assertCannotConnectToPod(ctx, networkpolicies.NewNamespacedSourcePod(from, sharedResources.Mirror), networkpolicies.NewNamespacedTargetPod(agnostic.Busybox().DummyPort(), sharedResources.External))
				}
			}
		)

		DefaultCIt(`should block connectivity from kube-apiserver to busybox`, assertBlockEgresss(KubeApiserver))
		DefaultCIt(`should block connectivity from etcd-main to busybox`, assertBlockEgresss(EtcdMain))
		DefaultCIt(`should block connectivity from etcd-events to busybox`, assertBlockEgresss(EtcdEvents))
		DefaultCIt(`should block connectivity from cloud-controller-manager-http to busybox`, assertBlockEgresss(CloudControllerManagerHttp))
		DefaultCIt(`should block connectivity from cloud-controller-manager-https to busybox`, assertBlockEgresss(CloudControllerManagerHttps))
		DefaultCIt(`should block connectivity from dependency-watchdog to busybox`, assertBlockEgresss(DependencyWatchdog))
		DefaultCIt(`should block connectivity from elasticsearch-logging to busybox`, assertBlockEgresss(ElasticsearchLogging))
		DefaultCIt(`should block connectivity from grafana to busybox`, assertBlockEgresss(Grafana))
		DefaultCIt(`should block connectivity from kibana-logging to busybox`, assertBlockEgresss(KibanaLogging))
		DefaultCIt(`should block connectivity from gardener-resource-manager to busybox`, assertBlockEgresss(GardenerResourceManager))
		DefaultCIt(`should block connectivity from kube-controller-manager-http to busybox`, assertBlockEgresss(KubeControllerManagerHttp))
		DefaultCIt(`should block connectivity from kube-controller-manager-https to busybox`, assertBlockEgresss(KubeControllerManagerHttps))
		DefaultCIt(`should block connectivity from kube-scheduler-http to busybox`, assertBlockEgresss(KubeSchedulerHttp))
		DefaultCIt(`should block connectivity from kube-scheduler-https to busybox`, assertBlockEgresss(KubeSchedulerHttps))
		DefaultCIt(`should block connectivity from kube-state-metrics-shoot to busybox`, assertBlockEgresss(KubeStateMetricsShoot))
		DefaultCIt(`should block connectivity from kube-state-metrics-seed to busybox`, assertBlockEgresss(KubeStateMetricsSeed))
		DefaultCIt(`should block connectivity from machine-controller-manager to busybox`, assertBlockEgresss(MachineControllerManager))
		DefaultCIt(`should block connectivity from prometheus to busybox`, assertBlockEgresss(Prometheus))
	})

	Context("egress to Seed nodes", func() {

		var (
			assertBlockToSeedNodes = func(from *networkpolicies.SourcePod) func(context.Context) {
				return func(ctx context.Context) {
					assertCannotConnectToHost(ctx, networkpolicies.NewNamespacedSourcePod(from, sharedResources.Mirror), sharedResources.SeedNodeIP, 10250)
				}
			}
		)

		DefaultCIt(`should block connectivity from kube-apiserver`, assertBlockToSeedNodes(KubeApiserver))
		DefaultCIt(`should block connectivity from etcd-main`, assertBlockToSeedNodes(EtcdMain))
		DefaultCIt(`should block connectivity from etcd-events`, assertBlockToSeedNodes(EtcdEvents))
		DefaultCIt(`should block connectivity from cloud-controller-manager-http`, assertBlockToSeedNodes(CloudControllerManagerHttp))
		DefaultCIt(`should block connectivity from cloud-controller-manager-https`, assertBlockToSeedNodes(CloudControllerManagerHttps))
		DefaultCIt(`should block connectivity from dependency-watchdog`, assertBlockToSeedNodes(DependencyWatchdog))
		DefaultCIt(`should block connectivity from elasticsearch-logging`, assertBlockToSeedNodes(ElasticsearchLogging))
		DefaultCIt(`should block connectivity from grafana`, assertBlockToSeedNodes(Grafana))
		DefaultCIt(`should block connectivity from kibana-logging`, assertBlockToSeedNodes(KibanaLogging))
		DefaultCIt(`should block connectivity from gardener-resource-manager`, assertBlockToSeedNodes(GardenerResourceManager))
		DefaultCIt(`should block connectivity from kube-controller-manager-http`, assertBlockToSeedNodes(KubeControllerManagerHttp))
		DefaultCIt(`should block connectivity from kube-controller-manager-https`, assertBlockToSeedNodes(KubeControllerManagerHttps))
		DefaultCIt(`should block connectivity from kube-scheduler-http`, assertBlockToSeedNodes(KubeSchedulerHttp))
		DefaultCIt(`should block connectivity from kube-scheduler-https`, assertBlockToSeedNodes(KubeSchedulerHttps))
		DefaultCIt(`should block connectivity from kube-state-metrics-shoot`, assertBlockToSeedNodes(KubeStateMetricsShoot))
		DefaultCIt(`should block connectivity from kube-state-metrics-seed`, assertBlockToSeedNodes(KubeStateMetricsSeed))
		DefaultCIt(`should block connectivity from machine-controller-manager`, assertBlockToSeedNodes(MachineControllerManager))
		DefaultCIt(`should block connectivity from prometheus`, assertBlockToSeedNodes(Prometheus))
	})

	Context("egress for mirrored pods", func() {

		var (
			from *networkpolicies.NamespacedSourcePod

			assertEgresssToMirroredPod = func(to *networkpolicies.TargetPod, allowed bool) func(context.Context) {
				return func(ctx context.Context) {
					assertConnectToPod(ctx, from, networkpolicies.NewNamespacedTargetPod(to, sharedResources.Mirror), allowed)
				}
			}

			assertEgresssToHost = func(to *networkpolicies.Host, allowed bool) func(context.Context) {
				return func(ctx context.Context) {
					assertConnectToHost(ctx, from, to, allowed)
				}
			}
		)

		Context("kube-apiserver", func() {

			BeforeEach(func() {
				from = networkpolicies.NewNamespacedSourcePod(KubeApiserver, sharedResources.Mirror)
			})

			DefaultCIt(`should block connection to Pod "gardener-resource-manager" at port 8080`, assertEgresssToMirroredPod(GardenerResourceManager8080, false))
			DefaultCIt(`should block connection to Pod "cloud-controller-manager-http" at port 10253`, assertEgresssToMirroredPod(CloudControllerManagerHttp10253, false))
			DefaultCIt(`should block connection to Pod "cloud-controller-manager-https" at port 10258`, assertEgresssToMirroredPod(CloudControllerManagerHttps10258, false))
			DefaultCIt(`should block connection to Pod "dependency-watchdog" at port 8080`, assertEgresssToMirroredPod(DependencyWatchdog8080, false))
			DefaultCIt(`should block connection to Pod "elasticsearch-logging" at port 9200`, assertEgresssToMirroredPod(ElasticsearchLogging9200, false))
			DefaultCIt(`should block connection to Pod "elasticsearch-logging" at port 9114`, assertEgresssToMirroredPod(ElasticsearchLogging9114, false))
			DefaultCIt(`should allow connection to Pod "etcd-events" at port 2379`, assertEgresssToMirroredPod(EtcdEvents2379, true))
			DefaultCIt(`should allow connection to Pod "etcd-main" at port 2379`, assertEgresssToMirroredPod(EtcdMain2379, true))
			DefaultCIt(`should block connection to Pod "grafana" at port 3000`, assertEgresssToMirroredPod(Grafana3000, false))
			DefaultCIt(`should block connection to Pod "kibana-logging" at port 5601`, assertEgresssToMirroredPod(KibanaLogging5601, false))
			DefaultCIt(`should block connection to Pod "kube-controller-manager-http" at port 10252`, assertEgresssToMirroredPod(KubeControllerManagerHttp10252, false))
			DefaultCIt(`should block connection to Pod "kube-controller-manager-https" at port 10257`, assertEgresssToMirroredPod(KubeControllerManagerHttps10257, false))
			DefaultCIt(`should block connection to Pod "kube-scheduler-https" at port 10259`, assertEgresssToMirroredPod(KubeSchedulerHttps10259, false))
			DefaultCIt(`should block connection to Pod "kube-scheduler-http" at port 10251`, assertEgresssToMirroredPod(KubeSchedulerHttp10251, false))
			DefaultCIt(`should block connection to Pod "kube-state-metrics-seed" at port 8080`, assertEgresssToMirroredPod(KubeStateMetricsSeed8080, false))
			DefaultCIt(`should block connection to Pod "kube-state-metrics-shoot" at port 8080`, assertEgresssToMirroredPod(KubeStateMetricsShoot8080, false))
			DefaultCIt(`should block connection to Pod "machine-controller-manager" at port 10258`, assertEgresssToMirroredPod(MachineControllerManager10258, false))
			DefaultCIt(`should block connection to Pod "prometheus" at port 9090`, assertEgresssToMirroredPod(Prometheus9090, false))
			DefaultCIt(`should block connection to "Metadata service" 169.254.169.254:80`, assertEgresssToHost(MetadataservicePort80, false))
			DefaultCIt(`should allow connection to "External host" 8.8.8.8:53`, assertEgresssToHost(ExternalhostPort53, true))
			DefaultCIt(`should block connection to "Garden Prometheus" prometheus-web.garden:80`, assertEgresssToHost(GardenPrometheusPort80, false))
			DefaultCIt(`should allow connection to "Seed Kube APIServer" kubernetes.default:443`, assertEgresssToHost(SeedKubeAPIServerPort443, true))
		})

		Context("etcd-main", func() {

			BeforeEach(func() {
				from = networkpolicies.NewNamespacedSourcePod(EtcdMain, sharedResources.Mirror)
			})

			DefaultCIt(`should block connection to Pod "gardener-resource-manager" at port 8080`, assertEgresssToMirroredPod(GardenerResourceManager8080, false))
			DefaultCIt(`should block connection to Pod "cloud-controller-manager-http" at port 10253`, assertEgresssToMirroredPod(CloudControllerManagerHttp10253, false))
			DefaultCIt(`should block connection to Pod "cloud-controller-manager-https" at port 10258`, assertEgresssToMirroredPod(CloudControllerManagerHttps10258, false))
			DefaultCIt(`should block connection to Pod "dependency-watchdog" at port 8080`, assertEgresssToMirroredPod(DependencyWatchdog8080, false))
			DefaultCIt(`should block connection to Pod "elasticsearch-logging" at port 9200`, assertEgresssToMirroredPod(ElasticsearchLogging9200, false))
			DefaultCIt(`should block connection to Pod "elasticsearch-logging" at port 9114`, assertEgresssToMirroredPod(ElasticsearchLogging9114, false))
			DefaultCIt(`should block connection to Pod "etcd-events" at port 2379`, assertEgresssToMirroredPod(EtcdEvents2379, false))
			DefaultCIt(`should block connection to Pod "grafana" at port 3000`, assertEgresssToMirroredPod(Grafana3000, false))
			DefaultCIt(`should block connection to Pod "kibana-logging" at port 5601`, assertEgresssToMirroredPod(KibanaLogging5601, false))
			DefaultCIt(`should block connection to Pod "kube-apiserver" at port 443`, assertEgresssToMirroredPod(KubeApiserver443, false))
			DefaultCIt(`should block connection to Pod "kube-controller-manager-http" at port 10252`, assertEgresssToMirroredPod(KubeControllerManagerHttp10252, false))
			DefaultCIt(`should block connection to Pod "kube-controller-manager-https" at port 10257`, assertEgresssToMirroredPod(KubeControllerManagerHttps10257, false))
			DefaultCIt(`should block connection to Pod "kube-scheduler-https" at port 10259`, assertEgresssToMirroredPod(KubeSchedulerHttps10259, false))
			DefaultCIt(`should block connection to Pod "kube-scheduler-http" at port 10251`, assertEgresssToMirroredPod(KubeSchedulerHttp10251, false))
			DefaultCIt(`should block connection to Pod "kube-state-metrics-seed" at port 8080`, assertEgresssToMirroredPod(KubeStateMetricsSeed8080, false))
			DefaultCIt(`should block connection to Pod "kube-state-metrics-shoot" at port 8080`, assertEgresssToMirroredPod(KubeStateMetricsShoot8080, false))
			DefaultCIt(`should block connection to Pod "machine-controller-manager" at port 10258`, assertEgresssToMirroredPod(MachineControllerManager10258, false))
			DefaultCIt(`should block connection to Pod "prometheus" at port 9090`, assertEgresssToMirroredPod(Prometheus9090, false))
			DefaultCIt(`should block connection to "Metadata service" 169.254.169.254:80`, assertEgresssToHost(MetadataservicePort80, false))
			DefaultCIt(`should allow connection to "External host" 8.8.8.8:53`, assertEgresssToHost(ExternalhostPort53, true))
			DefaultCIt(`should block connection to "Garden Prometheus" prometheus-web.garden:80`, assertEgresssToHost(GardenPrometheusPort80, false))
		})

		Context("etcd-events", func() {

			BeforeEach(func() {
				from = networkpolicies.NewNamespacedSourcePod(EtcdEvents, sharedResources.Mirror)
			})

			DefaultCIt(`should block connection to Pod "gardener-resource-manager" at port 8080`, assertEgresssToMirroredPod(GardenerResourceManager8080, false))
			DefaultCIt(`should block connection to Pod "cloud-controller-manager-http" at port 10253`, assertEgresssToMirroredPod(CloudControllerManagerHttp10253, false))
			DefaultCIt(`should block connection to Pod "cloud-controller-manager-https" at port 10258`, assertEgresssToMirroredPod(CloudControllerManagerHttps10258, false))
			DefaultCIt(`should block connection to Pod "dependency-watchdog" at port 8080`, assertEgresssToMirroredPod(DependencyWatchdog8080, false))
			DefaultCIt(`should block connection to Pod "elasticsearch-logging" at port 9200`, assertEgresssToMirroredPod(ElasticsearchLogging9200, false))
			DefaultCIt(`should block connection to Pod "elasticsearch-logging" at port 9114`, assertEgresssToMirroredPod(ElasticsearchLogging9114, false))
			DefaultCIt(`should block connection to Pod "etcd-main" at port 2379`, assertEgresssToMirroredPod(EtcdMain2379, false))
			DefaultCIt(`should block connection to Pod "grafana" at port 3000`, assertEgresssToMirroredPod(Grafana3000, false))
			DefaultCIt(`should block connection to Pod "kibana-logging" at port 5601`, assertEgresssToMirroredPod(KibanaLogging5601, false))
			DefaultCIt(`should block connection to Pod "kube-apiserver" at port 443`, assertEgresssToMirroredPod(KubeApiserver443, false))
			DefaultCIt(`should block connection to Pod "kube-controller-manager-http" at port 10252`, assertEgresssToMirroredPod(KubeControllerManagerHttp10252, false))
			DefaultCIt(`should block connection to Pod "kube-controller-manager-https" at port 10257`, assertEgresssToMirroredPod(KubeControllerManagerHttps10257, false))
			DefaultCIt(`should block connection to Pod "kube-scheduler-https" at port 10259`, assertEgresssToMirroredPod(KubeSchedulerHttps10259, false))
			DefaultCIt(`should block connection to Pod "kube-scheduler-http" at port 10251`, assertEgresssToMirroredPod(KubeSchedulerHttp10251, false))
			DefaultCIt(`should block connection to Pod "kube-state-metrics-seed" at port 8080`, assertEgresssToMirroredPod(KubeStateMetricsSeed8080, false))
			DefaultCIt(`should block connection to Pod "kube-state-metrics-shoot" at port 8080`, assertEgresssToMirroredPod(KubeStateMetricsShoot8080, false))
			DefaultCIt(`should block connection to Pod "machine-controller-manager" at port 10258`, assertEgresssToMirroredPod(MachineControllerManager10258, false))
			DefaultCIt(`should block connection to Pod "prometheus" at port 9090`, assertEgresssToMirroredPod(Prometheus9090, false))
			DefaultCIt(`should block connection to "Metadata service" 169.254.169.254:80`, assertEgresssToHost(MetadataservicePort80, false))
			DefaultCIt(`should allow connection to "External host" 8.8.8.8:53`, assertEgresssToHost(ExternalhostPort53, true))
			DefaultCIt(`should block connection to "Garden Prometheus" prometheus-web.garden:80`, assertEgresssToHost(GardenPrometheusPort80, false))
		})

		Context("cloud-controller-manager-http", func() {

			BeforeEach(func() {
				from = networkpolicies.NewNamespacedSourcePod(CloudControllerManagerHttp, sharedResources.Mirror)
			})

			DefaultCIt(`should block connection to Pod "gardener-resource-manager" at port 8080`, assertEgresssToMirroredPod(GardenerResourceManager8080, false))
			DefaultCIt(`should block connection to Pod "cloud-controller-manager-https" at port 10258`, assertEgresssToMirroredPod(CloudControllerManagerHttps10258, false))
			DefaultCIt(`should block connection to Pod "dependency-watchdog" at port 8080`, assertEgresssToMirroredPod(DependencyWatchdog8080, false))
			DefaultCIt(`should block connection to Pod "elasticsearch-logging" at port 9200`, assertEgresssToMirroredPod(ElasticsearchLogging9200, false))
			DefaultCIt(`should block connection to Pod "elasticsearch-logging" at port 9114`, assertEgresssToMirroredPod(ElasticsearchLogging9114, false))
			DefaultCIt(`should block connection to Pod "etcd-events" at port 2379`, assertEgresssToMirroredPod(EtcdEvents2379, false))
			DefaultCIt(`should block connection to Pod "etcd-main" at port 2379`, assertEgresssToMirroredPod(EtcdMain2379, false))
			DefaultCIt(`should block connection to Pod "grafana" at port 3000`, assertEgresssToMirroredPod(Grafana3000, false))
			DefaultCIt(`should block connection to Pod "kibana-logging" at port 5601`, assertEgresssToMirroredPod(KibanaLogging5601, false))
			DefaultCIt(`should allow connection to Pod "kube-apiserver" at port 443`, assertEgresssToMirroredPod(KubeApiserver443, true))
			DefaultCIt(`should block connection to Pod "kube-controller-manager-http" at port 10252`, assertEgresssToMirroredPod(KubeControllerManagerHttp10252, false))
			DefaultCIt(`should block connection to Pod "kube-controller-manager-https" at port 10257`, assertEgresssToMirroredPod(KubeControllerManagerHttps10257, false))
			DefaultCIt(`should block connection to Pod "kube-scheduler-https" at port 10259`, assertEgresssToMirroredPod(KubeSchedulerHttps10259, false))
			DefaultCIt(`should block connection to Pod "kube-scheduler-http" at port 10251`, assertEgresssToMirroredPod(KubeSchedulerHttp10251, false))
			DefaultCIt(`should block connection to Pod "kube-state-metrics-seed" at port 8080`, assertEgresssToMirroredPod(KubeStateMetricsSeed8080, false))
			DefaultCIt(`should block connection to Pod "kube-state-metrics-shoot" at port 8080`, assertEgresssToMirroredPod(KubeStateMetricsShoot8080, false))
			DefaultCIt(`should block connection to Pod "machine-controller-manager" at port 10258`, assertEgresssToMirroredPod(MachineControllerManager10258, false))
			DefaultCIt(`should block connection to Pod "prometheus" at port 9090`, assertEgresssToMirroredPod(Prometheus9090, false))
			DefaultCIt(`should block connection to "Metadata service" 169.254.169.254:80`, assertEgresssToHost(MetadataservicePort80, false))
			DefaultCIt(`should allow connection to "External host" 8.8.8.8:53`, assertEgresssToHost(ExternalhostPort53, true))
			DefaultCIt(`should block connection to "Garden Prometheus" prometheus-web.garden:80`, assertEgresssToHost(GardenPrometheusPort80, false))
		})

		Context("cloud-controller-manager-https", func() {

			BeforeEach(func() {
				from = networkpolicies.NewNamespacedSourcePod(CloudControllerManagerHttps, sharedResources.Mirror)
			})

			DefaultCIt(`should block connection to Pod "gardener-resource-manager" at port 8080`, assertEgresssToMirroredPod(GardenerResourceManager8080, false))
			DefaultCIt(`should block connection to Pod "cloud-controller-manager-http" at port 10253`, assertEgresssToMirroredPod(CloudControllerManagerHttp10253, false))
			DefaultCIt(`should block connection to Pod "dependency-watchdog" at port 8080`, assertEgresssToMirroredPod(DependencyWatchdog8080, false))
			DefaultCIt(`should block connection to Pod "elasticsearch-logging" at port 9200`, assertEgresssToMirroredPod(ElasticsearchLogging9200, false))
			DefaultCIt(`should block connection to Pod "elasticsearch-logging" at port 9114`, assertEgresssToMirroredPod(ElasticsearchLogging9114, false))
			DefaultCIt(`should block connection to Pod "etcd-events" at port 2379`, assertEgresssToMirroredPod(EtcdEvents2379, false))
			DefaultCIt(`should block connection to Pod "etcd-main" at port 2379`, assertEgresssToMirroredPod(EtcdMain2379, false))
			DefaultCIt(`should block connection to Pod "grafana" at port 3000`, assertEgresssToMirroredPod(Grafana3000, false))
			DefaultCIt(`should block connection to Pod "kibana-logging" at port 5601`, assertEgresssToMirroredPod(KibanaLogging5601, false))
			DefaultCIt(`should allow connection to Pod "kube-apiserver" at port 443`, assertEgresssToMirroredPod(KubeApiserver443, true))
			DefaultCIt(`should block connection to Pod "kube-controller-manager-http" at port 10252`, assertEgresssToMirroredPod(KubeControllerManagerHttp10252, false))
			DefaultCIt(`should block connection to Pod "kube-controller-manager-https" at port 10257`, assertEgresssToMirroredPod(KubeControllerManagerHttps10257, false))
			DefaultCIt(`should block connection to Pod "kube-scheduler-https" at port 10259`, assertEgresssToMirroredPod(KubeSchedulerHttps10259, false))
			DefaultCIt(`should block connection to Pod "kube-scheduler-http" at port 10251`, assertEgresssToMirroredPod(KubeSchedulerHttp10251, false))
			DefaultCIt(`should block connection to Pod "kube-state-metrics-seed" at port 8080`, assertEgresssToMirroredPod(KubeStateMetricsSeed8080, false))
			DefaultCIt(`should block connection to Pod "kube-state-metrics-shoot" at port 8080`, assertEgresssToMirroredPod(KubeStateMetricsShoot8080, false))
			DefaultCIt(`should block connection to Pod "machine-controller-manager" at port 10258`, assertEgresssToMirroredPod(MachineControllerManager10258, false))
			DefaultCIt(`should block connection to Pod "prometheus" at port 9090`, assertEgresssToMirroredPod(Prometheus9090, false))
			DefaultCIt(`should block connection to "Metadata service" 169.254.169.254:80`, assertEgresssToHost(MetadataservicePort80, false))
			DefaultCIt(`should allow connection to "External host" 8.8.8.8:53`, assertEgresssToHost(ExternalhostPort53, true))
			DefaultCIt(`should block connection to "Garden Prometheus" prometheus-web.garden:80`, assertEgresssToHost(GardenPrometheusPort80, false))
		})

		Context("dependency-watchdog", func() {

			BeforeEach(func() {
				from = networkpolicies.NewNamespacedSourcePod(DependencyWatchdog, sharedResources.Mirror)
			})

			DefaultCIt(`should block connection to Pod "gardener-resource-manager" at port 8080`, assertEgresssToMirroredPod(GardenerResourceManager8080, false))
			DefaultCIt(`should block connection to Pod "cloud-controller-manager-http" at port 10253`, assertEgresssToMirroredPod(CloudControllerManagerHttp10253, false))
			DefaultCIt(`should block connection to Pod "cloud-controller-manager-https" at port 10258`, assertEgresssToMirroredPod(CloudControllerManagerHttps10258, false))
			DefaultCIt(`should block connection to Pod "elasticsearch-logging" at port 9200`, assertEgresssToMirroredPod(ElasticsearchLogging9200, false))
			DefaultCIt(`should block connection to Pod "elasticsearch-logging" at port 9114`, assertEgresssToMirroredPod(ElasticsearchLogging9114, false))
			DefaultCIt(`should block connection to Pod "etcd-events" at port 2379`, assertEgresssToMirroredPod(EtcdEvents2379, false))
			DefaultCIt(`should block connection to Pod "etcd-main" at port 2379`, assertEgresssToMirroredPod(EtcdMain2379, false))
			DefaultCIt(`should block connection to Pod "grafana" at port 3000`, assertEgresssToMirroredPod(Grafana3000, false))
			DefaultCIt(`should block connection to Pod "kibana-logging" at port 5601`, assertEgresssToMirroredPod(KibanaLogging5601, false))
			DefaultCIt(`should block connection to Pod "kube-apiserver" at port 443`, assertEgresssToMirroredPod(KubeApiserver443, false))
			DefaultCIt(`should block connection to Pod "kube-controller-manager-http" at port 10252`, assertEgresssToMirroredPod(KubeControllerManagerHttp10252, false))
			DefaultCIt(`should block connection to Pod "kube-controller-manager-https" at port 10257`, assertEgresssToMirroredPod(KubeControllerManagerHttps10257, false))
			DefaultCIt(`should block connection to Pod "kube-scheduler-https" at port 10259`, assertEgresssToMirroredPod(KubeSchedulerHttps10259, false))
			DefaultCIt(`should block connection to Pod "kube-scheduler-http" at port 10251`, assertEgresssToMirroredPod(KubeSchedulerHttp10251, false))
			DefaultCIt(`should block connection to Pod "kube-state-metrics-seed" at port 8080`, assertEgresssToMirroredPod(KubeStateMetricsSeed8080, false))
			DefaultCIt(`should block connection to Pod "kube-state-metrics-shoot" at port 8080`, assertEgresssToMirroredPod(KubeStateMetricsShoot8080, false))
			DefaultCIt(`should block connection to Pod "machine-controller-manager" at port 10258`, assertEgresssToMirroredPod(MachineControllerManager10258, false))
			DefaultCIt(`should block connection to Pod "prometheus" at port 9090`, assertEgresssToMirroredPod(Prometheus9090, false))
			DefaultCIt(`should block connection to "Metadata service" 169.254.169.254:80`, assertEgresssToHost(MetadataservicePort80, false))
			DefaultCIt(`should allow connection to "External host" 8.8.8.8:53`, assertEgresssToHost(ExternalhostPort53, true))
			DefaultCIt(`should block connection to "Garden Prometheus" prometheus-web.garden:80`, assertEgresssToHost(GardenPrometheusPort80, false))
			DefaultCIt(`should allow connection to "Seed Kube APIServer" kubernetes.default:443`, assertEgresssToHost(SeedKubeAPIServerPort443, true))
		})

		Context("elasticsearch-logging", func() {

			BeforeEach(func() {
				from = networkpolicies.NewNamespacedSourcePod(ElasticsearchLogging, sharedResources.Mirror)
			})

			DefaultCIt(`should block connection to Pod "gardener-resource-manager" at port 8080`, assertEgresssToMirroredPod(GardenerResourceManager8080, false))
			DefaultCIt(`should block connection to Pod "cloud-controller-manager-http" at port 10253`, assertEgresssToMirroredPod(CloudControllerManagerHttp10253, false))
			DefaultCIt(`should block connection to Pod "cloud-controller-manager-https" at port 10258`, assertEgresssToMirroredPod(CloudControllerManagerHttps10258, false))
			DefaultCIt(`should block connection to Pod "dependency-watchdog" at port 8080`, assertEgresssToMirroredPod(DependencyWatchdog8080, false))
			DefaultCIt(`should block connection to Pod "etcd-events" at port 2379`, assertEgresssToMirroredPod(EtcdEvents2379, false))
			DefaultCIt(`should block connection to Pod "etcd-main" at port 2379`, assertEgresssToMirroredPod(EtcdMain2379, false))
			DefaultCIt(`should block connection to Pod "grafana" at port 3000`, assertEgresssToMirroredPod(Grafana3000, false))
			DefaultCIt(`should block connection to Pod "kibana-logging" at port 5601`, assertEgresssToMirroredPod(KibanaLogging5601, false))
			DefaultCIt(`should block connection to Pod "kube-apiserver" at port 443`, assertEgresssToMirroredPod(KubeApiserver443, false))
			DefaultCIt(`should block connection to Pod "kube-controller-manager-http" at port 10252`, assertEgresssToMirroredPod(KubeControllerManagerHttp10252, false))
			DefaultCIt(`should block connection to Pod "kube-controller-manager-https" at port 10257`, assertEgresssToMirroredPod(KubeControllerManagerHttps10257, false))
			DefaultCIt(`should block connection to Pod "kube-scheduler-https" at port 10259`, assertEgresssToMirroredPod(KubeSchedulerHttps10259, false))
			DefaultCIt(`should block connection to Pod "kube-scheduler-http" at port 10251`, assertEgresssToMirroredPod(KubeSchedulerHttp10251, false))
			DefaultCIt(`should block connection to Pod "kube-state-metrics-seed" at port 8080`, assertEgresssToMirroredPod(KubeStateMetricsSeed8080, false))
			DefaultCIt(`should block connection to Pod "kube-state-metrics-shoot" at port 8080`, assertEgresssToMirroredPod(KubeStateMetricsShoot8080, false))
			DefaultCIt(`should block connection to Pod "machine-controller-manager" at port 10258`, assertEgresssToMirroredPod(MachineControllerManager10258, false))
			DefaultCIt(`should block connection to Pod "prometheus" at port 9090`, assertEgresssToMirroredPod(Prometheus9090, false))
			DefaultCIt(`should block connection to "Metadata service" 169.254.169.254:80`, assertEgresssToHost(MetadataservicePort80, false))
			DefaultCIt(`should block connection to "External host" 8.8.8.8:53`, assertEgresssToHost(ExternalhostPort53, false))
			DefaultCIt(`should block connection to "Garden Prometheus" prometheus-web.garden:80`, assertEgresssToHost(GardenPrometheusPort80, false))
		})

		Context("grafana", func() {

			BeforeEach(func() {
				from = networkpolicies.NewNamespacedSourcePod(Grafana, sharedResources.Mirror)
			})

			DefaultCIt(`should block connection to Pod "gardener-resource-manager" at port 8080`, assertEgresssToMirroredPod(GardenerResourceManager8080, false))
			DefaultCIt(`should block connection to Pod "cloud-controller-manager-http" at port 10253`, assertEgresssToMirroredPod(CloudControllerManagerHttp10253, false))
			DefaultCIt(`should block connection to Pod "cloud-controller-manager-https" at port 10258`, assertEgresssToMirroredPod(CloudControllerManagerHttps10258, false))
			DefaultCIt(`should block connection to Pod "dependency-watchdog" at port 8080`, assertEgresssToMirroredPod(DependencyWatchdog8080, false))
			DefaultCIt(`should block connection to Pod "elasticsearch-logging" at port 9200`, assertEgresssToMirroredPod(ElasticsearchLogging9200, false))
			DefaultCIt(`should block connection to Pod "elasticsearch-logging" at port 9114`, assertEgresssToMirroredPod(ElasticsearchLogging9114, false))
			DefaultCIt(`should block connection to Pod "etcd-events" at port 2379`, assertEgresssToMirroredPod(EtcdEvents2379, false))
			DefaultCIt(`should block connection to Pod "etcd-main" at port 2379`, assertEgresssToMirroredPod(EtcdMain2379, false))
			DefaultCIt(`should block connection to Pod "kibana-logging" at port 5601`, assertEgresssToMirroredPod(KibanaLogging5601, false))
			DefaultCIt(`should block connection to Pod "kube-apiserver" at port 443`, assertEgresssToMirroredPod(KubeApiserver443, false))
			DefaultCIt(`should block connection to Pod "kube-controller-manager-http" at port 10252`, assertEgresssToMirroredPod(KubeControllerManagerHttp10252, false))
			DefaultCIt(`should block connection to Pod "kube-controller-manager-https" at port 10257`, assertEgresssToMirroredPod(KubeControllerManagerHttps10257, false))
			DefaultCIt(`should block connection to Pod "kube-scheduler-https" at port 10259`, assertEgresssToMirroredPod(KubeSchedulerHttps10259, false))
			DefaultCIt(`should block connection to Pod "kube-scheduler-http" at port 10251`, assertEgresssToMirroredPod(KubeSchedulerHttp10251, false))
			DefaultCIt(`should block connection to Pod "kube-state-metrics-seed" at port 8080`, assertEgresssToMirroredPod(KubeStateMetricsSeed8080, false))
			DefaultCIt(`should block connection to Pod "kube-state-metrics-shoot" at port 8080`, assertEgresssToMirroredPod(KubeStateMetricsShoot8080, false))
			DefaultCIt(`should block connection to Pod "machine-controller-manager" at port 10258`, assertEgresssToMirroredPod(MachineControllerManager10258, false))
			DefaultCIt(`should allow connection to Pod "prometheus" at port 9090`, assertEgresssToMirroredPod(Prometheus9090, true))
			DefaultCIt(`should block connection to "Metadata service" 169.254.169.254:80`, assertEgresssToHost(MetadataservicePort80, false))
			DefaultCIt(`should block connection to "External host" 8.8.8.8:53`, assertEgresssToHost(ExternalhostPort53, false))
			DefaultCIt(`should block connection to "Garden Prometheus" prometheus-web.garden:80`, assertEgresssToHost(GardenPrometheusPort80, false))
		})

		Context("kibana-logging", func() {

			BeforeEach(func() {
				from = networkpolicies.NewNamespacedSourcePod(KibanaLogging, sharedResources.Mirror)
			})

			DefaultCIt(`should block connection to Pod "gardener-resource-manager" at port 8080`, assertEgresssToMirroredPod(GardenerResourceManager8080, false))
			DefaultCIt(`should block connection to Pod "cloud-controller-manager-http" at port 10253`, assertEgresssToMirroredPod(CloudControllerManagerHttp10253, false))
			DefaultCIt(`should block connection to Pod "cloud-controller-manager-https" at port 10258`, assertEgresssToMirroredPod(CloudControllerManagerHttps10258, false))
			DefaultCIt(`should block connection to Pod "dependency-watchdog" at port 8080`, assertEgresssToMirroredPod(DependencyWatchdog8080, false))
			DefaultCIt(`should allow connection to Pod "elasticsearch-logging" at port 9200`, assertEgresssToMirroredPod(ElasticsearchLogging9200, true))
			DefaultCIt(`should block connection to Pod "elasticsearch-logging" at port 9114`, assertEgresssToMirroredPod(ElasticsearchLogging9114, false))
			DefaultCIt(`should block connection to Pod "etcd-events" at port 2379`, assertEgresssToMirroredPod(EtcdEvents2379, false))
			DefaultCIt(`should block connection to Pod "etcd-main" at port 2379`, assertEgresssToMirroredPod(EtcdMain2379, false))
			DefaultCIt(`should block connection to Pod "grafana" at port 3000`, assertEgresssToMirroredPod(Grafana3000, false))
			DefaultCIt(`should block connection to Pod "kube-apiserver" at port 443`, assertEgresssToMirroredPod(KubeApiserver443, false))
			DefaultCIt(`should block connection to Pod "kube-controller-manager-http" at port 10252`, assertEgresssToMirroredPod(KubeControllerManagerHttp10252, false))
			DefaultCIt(`should block connection to Pod "kube-controller-manager-https" at port 10257`, assertEgresssToMirroredPod(KubeControllerManagerHttps10257, false))
			DefaultCIt(`should block connection to Pod "kube-scheduler-https" at port 10259`, assertEgresssToMirroredPod(KubeSchedulerHttps10259, false))
			DefaultCIt(`should block connection to Pod "kube-scheduler-http" at port 10251`, assertEgresssToMirroredPod(KubeSchedulerHttp10251, false))
			DefaultCIt(`should block connection to Pod "kube-state-metrics-seed" at port 8080`, assertEgresssToMirroredPod(KubeStateMetricsSeed8080, false))
			DefaultCIt(`should block connection to Pod "kube-state-metrics-shoot" at port 8080`, assertEgresssToMirroredPod(KubeStateMetricsShoot8080, false))
			DefaultCIt(`should block connection to Pod "machine-controller-manager" at port 10258`, assertEgresssToMirroredPod(MachineControllerManager10258, false))
			DefaultCIt(`should block connection to Pod "prometheus" at port 9090`, assertEgresssToMirroredPod(Prometheus9090, false))
			DefaultCIt(`should block connection to "Metadata service" 169.254.169.254:80`, assertEgresssToHost(MetadataservicePort80, false))
			DefaultCIt(`should block connection to "External host" 8.8.8.8:53`, assertEgresssToHost(ExternalhostPort53, false))
			DefaultCIt(`should block connection to "Garden Prometheus" prometheus-web.garden:80`, assertEgresssToHost(GardenPrometheusPort80, false))
		})

		Context("gardener-resource-manager", func() {

			BeforeEach(func() {
				from = networkpolicies.NewNamespacedSourcePod(GardenerResourceManager, sharedResources.Mirror)
			})

			DefaultCIt(`should block connection to Pod "cloud-controller-manager-http" at port 10253`, assertEgresssToMirroredPod(CloudControllerManagerHttp10253, false))
			DefaultCIt(`should block connection to Pod "cloud-controller-manager-https" at port 10258`, assertEgresssToMirroredPod(CloudControllerManagerHttps10258, false))
			DefaultCIt(`should block connection to Pod "dependency-watchdog" at port 8080`, assertEgresssToMirroredPod(DependencyWatchdog8080, false))
			DefaultCIt(`should block connection to Pod "elasticsearch-logging" at port 9200`, assertEgresssToMirroredPod(ElasticsearchLogging9200, false))
			DefaultCIt(`should block connection to Pod "elasticsearch-logging" at port 9114`, assertEgresssToMirroredPod(ElasticsearchLogging9114, false))
			DefaultCIt(`should block connection to Pod "etcd-events" at port 2379`, assertEgresssToMirroredPod(EtcdEvents2379, false))
			DefaultCIt(`should block connection to Pod "etcd-main" at port 2379`, assertEgresssToMirroredPod(EtcdMain2379, false))
			DefaultCIt(`should block connection to Pod "grafana" at port 3000`, assertEgresssToMirroredPod(Grafana3000, false))
			DefaultCIt(`should block connection to Pod "kibana-logging" at port 5601`, assertEgresssToMirroredPod(KibanaLogging5601, false))
			DefaultCIt(`should allow connection to Pod "kube-apiserver" at port 443`, assertEgresssToMirroredPod(KubeApiserver443, true))
			DefaultCIt(`should block connection to Pod "kube-controller-manager-http" at port 10252`, assertEgresssToMirroredPod(KubeControllerManagerHttp10252, false))
			DefaultCIt(`should block connection to Pod "kube-controller-manager-https" at port 10257`, assertEgresssToMirroredPod(KubeControllerManagerHttps10257, false))
			DefaultCIt(`should block connection to Pod "kube-scheduler-https" at port 10259`, assertEgresssToMirroredPod(KubeSchedulerHttps10259, false))
			DefaultCIt(`should block connection to Pod "kube-scheduler-http" at port 10251`, assertEgresssToMirroredPod(KubeSchedulerHttp10251, false))
			DefaultCIt(`should block connection to Pod "kube-state-metrics-seed" at port 8080`, assertEgresssToMirroredPod(KubeStateMetricsSeed8080, false))
			DefaultCIt(`should block connection to Pod "kube-state-metrics-shoot" at port 8080`, assertEgresssToMirroredPod(KubeStateMetricsShoot8080, false))
			DefaultCIt(`should block connection to Pod "machine-controller-manager" at port 10258`, assertEgresssToMirroredPod(MachineControllerManager10258, false))
			DefaultCIt(`should block connection to Pod "prometheus" at port 9090`, assertEgresssToMirroredPod(Prometheus9090, false))
			DefaultCIt(`should block connection to "Metadata service" 169.254.169.254:80`, assertEgresssToHost(MetadataservicePort80, false))
			DefaultCIt(`should allow connection to "External host" 8.8.8.8:53`, assertEgresssToHost(ExternalhostPort53, true))
			DefaultCIt(`should block connection to "Garden Prometheus" prometheus-web.garden:80`, assertEgresssToHost(GardenPrometheusPort80, false))
			DefaultCIt(`should allow connection to "Seed Kube APIServer" kubernetes.default:443`, assertEgresssToHost(SeedKubeAPIServerPort443, true))
		})

		Context("kube-controller-manager-http", func() {

			BeforeEach(func() {
				from = networkpolicies.NewNamespacedSourcePod(KubeControllerManagerHttp, sharedResources.Mirror)
			})

			DefaultCIt(`should block connection to Pod "gardener-resource-manager" at port 8080`, assertEgresssToMirroredPod(GardenerResourceManager8080, false))
			DefaultCIt(`should block connection to Pod "cloud-controller-manager-http" at port 10253`, assertEgresssToMirroredPod(CloudControllerManagerHttp10253, false))
			DefaultCIt(`should block connection to Pod "cloud-controller-manager-https" at port 10258`, assertEgresssToMirroredPod(CloudControllerManagerHttps10258, false))
			DefaultCIt(`should block connection to Pod "dependency-watchdog" at port 8080`, assertEgresssToMirroredPod(DependencyWatchdog8080, false))
			DefaultCIt(`should block connection to Pod "elasticsearch-logging" at port 9200`, assertEgresssToMirroredPod(ElasticsearchLogging9200, false))
			DefaultCIt(`should block connection to Pod "elasticsearch-logging" at port 9114`, assertEgresssToMirroredPod(ElasticsearchLogging9114, false))
			DefaultCIt(`should block connection to Pod "etcd-events" at port 2379`, assertEgresssToMirroredPod(EtcdEvents2379, false))
			DefaultCIt(`should block connection to Pod "etcd-main" at port 2379`, assertEgresssToMirroredPod(EtcdMain2379, false))
			DefaultCIt(`should block connection to Pod "grafana" at port 3000`, assertEgresssToMirroredPod(Grafana3000, false))
			DefaultCIt(`should block connection to Pod "kibana-logging" at port 5601`, assertEgresssToMirroredPod(KibanaLogging5601, false))
			DefaultCIt(`should allow connection to Pod "kube-apiserver" at port 443`, assertEgresssToMirroredPod(KubeApiserver443, true))
			DefaultCIt(`should block connection to Pod "kube-controller-manager-https" at port 10257`, assertEgresssToMirroredPod(KubeControllerManagerHttps10257, false))
			DefaultCIt(`should block connection to Pod "kube-scheduler-https" at port 10259`, assertEgresssToMirroredPod(KubeSchedulerHttps10259, false))
			DefaultCIt(`should block connection to Pod "kube-scheduler-http" at port 10251`, assertEgresssToMirroredPod(KubeSchedulerHttp10251, false))
			DefaultCIt(`should block connection to Pod "kube-state-metrics-seed" at port 8080`, assertEgresssToMirroredPod(KubeStateMetricsSeed8080, false))
			DefaultCIt(`should block connection to Pod "kube-state-metrics-shoot" at port 8080`, assertEgresssToMirroredPod(KubeStateMetricsShoot8080, false))
			DefaultCIt(`should block connection to Pod "machine-controller-manager" at port 10258`, assertEgresssToMirroredPod(MachineControllerManager10258, false))
			DefaultCIt(`should block connection to Pod "prometheus" at port 9090`, assertEgresssToMirroredPod(Prometheus9090, false))
			DefaultCIt(`should allow connection to "Metadata service" 169.254.169.254:80`, assertEgresssToHost(MetadataservicePort80, true))
			DefaultCIt(`should allow connection to "External host" 8.8.8.8:53`, assertEgresssToHost(ExternalhostPort53, true))
			DefaultCIt(`should block connection to "Garden Prometheus" prometheus-web.garden:80`, assertEgresssToHost(GardenPrometheusPort80, false))
		})

		Context("kube-controller-manager-https", func() {

			BeforeEach(func() {
				from = networkpolicies.NewNamespacedSourcePod(KubeControllerManagerHttps, sharedResources.Mirror)
			})

			DefaultCIt(`should block connection to Pod "gardener-resource-manager" at port 8080`, assertEgresssToMirroredPod(GardenerResourceManager8080, false))
			DefaultCIt(`should block connection to Pod "cloud-controller-manager-http" at port 10253`, assertEgresssToMirroredPod(CloudControllerManagerHttp10253, false))
			DefaultCIt(`should block connection to Pod "cloud-controller-manager-https" at port 10258`, assertEgresssToMirroredPod(CloudControllerManagerHttps10258, false))
			DefaultCIt(`should block connection to Pod "dependency-watchdog" at port 8080`, assertEgresssToMirroredPod(DependencyWatchdog8080, false))
			DefaultCIt(`should block connection to Pod "elasticsearch-logging" at port 9200`, assertEgresssToMirroredPod(ElasticsearchLogging9200, false))
			DefaultCIt(`should block connection to Pod "elasticsearch-logging" at port 9114`, assertEgresssToMirroredPod(ElasticsearchLogging9114, false))
			DefaultCIt(`should block connection to Pod "etcd-events" at port 2379`, assertEgresssToMirroredPod(EtcdEvents2379, false))
			DefaultCIt(`should block connection to Pod "etcd-main" at port 2379`, assertEgresssToMirroredPod(EtcdMain2379, false))
			DefaultCIt(`should block connection to Pod "grafana" at port 3000`, assertEgresssToMirroredPod(Grafana3000, false))
			DefaultCIt(`should block connection to Pod "kibana-logging" at port 5601`, assertEgresssToMirroredPod(KibanaLogging5601, false))
			DefaultCIt(`should allow connection to Pod "kube-apiserver" at port 443`, assertEgresssToMirroredPod(KubeApiserver443, true))
			DefaultCIt(`should block connection to Pod "kube-controller-manager-http" at port 10252`, assertEgresssToMirroredPod(KubeControllerManagerHttp10252, false))
			DefaultCIt(`should block connection to Pod "kube-scheduler-https" at port 10259`, assertEgresssToMirroredPod(KubeSchedulerHttps10259, false))
			DefaultCIt(`should block connection to Pod "kube-scheduler-http" at port 10251`, assertEgresssToMirroredPod(KubeSchedulerHttp10251, false))
			DefaultCIt(`should block connection to Pod "kube-state-metrics-seed" at port 8080`, assertEgresssToMirroredPod(KubeStateMetricsSeed8080, false))
			DefaultCIt(`should block connection to Pod "kube-state-metrics-shoot" at port 8080`, assertEgresssToMirroredPod(KubeStateMetricsShoot8080, false))
			DefaultCIt(`should block connection to Pod "machine-controller-manager" at port 10258`, assertEgresssToMirroredPod(MachineControllerManager10258, false))
			DefaultCIt(`should block connection to Pod "prometheus" at port 9090`, assertEgresssToMirroredPod(Prometheus9090, false))
			DefaultCIt(`should allow connection to "Metadata service" 169.254.169.254:80`, assertEgresssToHost(MetadataservicePort80, true))
			DefaultCIt(`should allow connection to "External host" 8.8.8.8:53`, assertEgresssToHost(ExternalhostPort53, true))
			DefaultCIt(`should block connection to "Garden Prometheus" prometheus-web.garden:80`, assertEgresssToHost(GardenPrometheusPort80, false))
		})

		Context("kube-scheduler-http", func() {

			BeforeEach(func() {
				from = networkpolicies.NewNamespacedSourcePod(KubeSchedulerHttp, sharedResources.Mirror)
			})

			DefaultCIt(`should block connection to Pod "gardener-resource-manager" at port 8080`, assertEgresssToMirroredPod(GardenerResourceManager8080, false))
			DefaultCIt(`should block connection to Pod "cloud-controller-manager-http" at port 10253`, assertEgresssToMirroredPod(CloudControllerManagerHttp10253, false))
			DefaultCIt(`should block connection to Pod "cloud-controller-manager-https" at port 10258`, assertEgresssToMirroredPod(CloudControllerManagerHttps10258, false))
			DefaultCIt(`should block connection to Pod "dependency-watchdog" at port 8080`, assertEgresssToMirroredPod(DependencyWatchdog8080, false))
			DefaultCIt(`should block connection to Pod "elasticsearch-logging" at port 9200`, assertEgresssToMirroredPod(ElasticsearchLogging9200, false))
			DefaultCIt(`should block connection to Pod "elasticsearch-logging" at port 9114`, assertEgresssToMirroredPod(ElasticsearchLogging9114, false))
			DefaultCIt(`should block connection to Pod "etcd-events" at port 2379`, assertEgresssToMirroredPod(EtcdEvents2379, false))
			DefaultCIt(`should block connection to Pod "etcd-main" at port 2379`, assertEgresssToMirroredPod(EtcdMain2379, false))
			DefaultCIt(`should block connection to Pod "grafana" at port 3000`, assertEgresssToMirroredPod(Grafana3000, false))
			DefaultCIt(`should block connection to Pod "kibana-logging" at port 5601`, assertEgresssToMirroredPod(KibanaLogging5601, false))
			DefaultCIt(`should allow connection to Pod "kube-apiserver" at port 443`, assertEgresssToMirroredPod(KubeApiserver443, true))
			DefaultCIt(`should block connection to Pod "kube-controller-manager-http" at port 10252`, assertEgresssToMirroredPod(KubeControllerManagerHttp10252, false))
			DefaultCIt(`should block connection to Pod "kube-controller-manager-https" at port 10257`, assertEgresssToMirroredPod(KubeControllerManagerHttps10257, false))
			DefaultCIt(`should block connection to Pod "kube-scheduler-https" at port 10259`, assertEgresssToMirroredPod(KubeSchedulerHttps10259, false))
			DefaultCIt(`should block connection to Pod "kube-state-metrics-seed" at port 8080`, assertEgresssToMirroredPod(KubeStateMetricsSeed8080, false))
			DefaultCIt(`should block connection to Pod "kube-state-metrics-shoot" at port 8080`, assertEgresssToMirroredPod(KubeStateMetricsShoot8080, false))
			DefaultCIt(`should block connection to Pod "machine-controller-manager" at port 10258`, assertEgresssToMirroredPod(MachineControllerManager10258, false))
			DefaultCIt(`should block connection to Pod "prometheus" at port 9090`, assertEgresssToMirroredPod(Prometheus9090, false))
			DefaultCIt(`should block connection to "Metadata service" 169.254.169.254:80`, assertEgresssToHost(MetadataservicePort80, false))
			DefaultCIt(`should block connection to "External host" 8.8.8.8:53`, assertEgresssToHost(ExternalhostPort53, false))
			DefaultCIt(`should block connection to "Garden Prometheus" prometheus-web.garden:80`, assertEgresssToHost(GardenPrometheusPort80, false))
		})

		Context("kube-scheduler-https", func() {

			BeforeEach(func() {
				from = networkpolicies.NewNamespacedSourcePod(KubeSchedulerHttps, sharedResources.Mirror)
			})

			DefaultCIt(`should block connection to Pod "gardener-resource-manager" at port 8080`, assertEgresssToMirroredPod(GardenerResourceManager8080, false))
			DefaultCIt(`should block connection to Pod "cloud-controller-manager-http" at port 10253`, assertEgresssToMirroredPod(CloudControllerManagerHttp10253, false))
			DefaultCIt(`should block connection to Pod "cloud-controller-manager-https" at port 10258`, assertEgresssToMirroredPod(CloudControllerManagerHttps10258, false))
			DefaultCIt(`should block connection to Pod "dependency-watchdog" at port 8080`, assertEgresssToMirroredPod(DependencyWatchdog8080, false))
			DefaultCIt(`should block connection to Pod "elasticsearch-logging" at port 9200`, assertEgresssToMirroredPod(ElasticsearchLogging9200, false))
			DefaultCIt(`should block connection to Pod "elasticsearch-logging" at port 9114`, assertEgresssToMirroredPod(ElasticsearchLogging9114, false))
			DefaultCIt(`should block connection to Pod "etcd-events" at port 2379`, assertEgresssToMirroredPod(EtcdEvents2379, false))
			DefaultCIt(`should block connection to Pod "etcd-main" at port 2379`, assertEgresssToMirroredPod(EtcdMain2379, false))
			DefaultCIt(`should block connection to Pod "grafana" at port 3000`, assertEgresssToMirroredPod(Grafana3000, false))
			DefaultCIt(`should block connection to Pod "kibana-logging" at port 5601`, assertEgresssToMirroredPod(KibanaLogging5601, false))
			DefaultCIt(`should allow connection to Pod "kube-apiserver" at port 443`, assertEgresssToMirroredPod(KubeApiserver443, true))
			DefaultCIt(`should block connection to Pod "kube-controller-manager-http" at port 10252`, assertEgresssToMirroredPod(KubeControllerManagerHttp10252, false))
			DefaultCIt(`should block connection to Pod "kube-controller-manager-https" at port 10257`, assertEgresssToMirroredPod(KubeControllerManagerHttps10257, false))
			DefaultCIt(`should block connection to Pod "kube-scheduler-http" at port 10251`, assertEgresssToMirroredPod(KubeSchedulerHttp10251, false))
			DefaultCIt(`should block connection to Pod "kube-state-metrics-seed" at port 8080`, assertEgresssToMirroredPod(KubeStateMetricsSeed8080, false))
			DefaultCIt(`should block connection to Pod "kube-state-metrics-shoot" at port 8080`, assertEgresssToMirroredPod(KubeStateMetricsShoot8080, false))
			DefaultCIt(`should block connection to Pod "machine-controller-manager" at port 10258`, assertEgresssToMirroredPod(MachineControllerManager10258, false))
			DefaultCIt(`should block connection to Pod "prometheus" at port 9090`, assertEgresssToMirroredPod(Prometheus9090, false))
			DefaultCIt(`should block connection to "Metadata service" 169.254.169.254:80`, assertEgresssToHost(MetadataservicePort80, false))
			DefaultCIt(`should block connection to "External host" 8.8.8.8:53`, assertEgresssToHost(ExternalhostPort53, false))
			DefaultCIt(`should block connection to "Garden Prometheus" prometheus-web.garden:80`, assertEgresssToHost(GardenPrometheusPort80, false))
		})

		Context("kube-state-metrics-shoot", func() {

			BeforeEach(func() {
				from = networkpolicies.NewNamespacedSourcePod(KubeStateMetricsShoot, sharedResources.Mirror)
			})

			DefaultCIt(`should block connection to Pod "gardener-resource-manager" at port 8080`, assertEgresssToMirroredPod(GardenerResourceManager8080, false))
			DefaultCIt(`should block connection to Pod "cloud-controller-manager-http" at port 10253`, assertEgresssToMirroredPod(CloudControllerManagerHttp10253, false))
			DefaultCIt(`should block connection to Pod "cloud-controller-manager-https" at port 10258`, assertEgresssToMirroredPod(CloudControllerManagerHttps10258, false))
			DefaultCIt(`should block connection to Pod "dependency-watchdog" at port 8080`, assertEgresssToMirroredPod(DependencyWatchdog8080, false))
			DefaultCIt(`should block connection to Pod "elasticsearch-logging" at port 9200`, assertEgresssToMirroredPod(ElasticsearchLogging9200, false))
			DefaultCIt(`should block connection to Pod "elasticsearch-logging" at port 9114`, assertEgresssToMirroredPod(ElasticsearchLogging9114, false))
			DefaultCIt(`should block connection to Pod "etcd-events" at port 2379`, assertEgresssToMirroredPod(EtcdEvents2379, false))
			DefaultCIt(`should block connection to Pod "etcd-main" at port 2379`, assertEgresssToMirroredPod(EtcdMain2379, false))
			DefaultCIt(`should block connection to Pod "grafana" at port 3000`, assertEgresssToMirroredPod(Grafana3000, false))
			DefaultCIt(`should block connection to Pod "kibana-logging" at port 5601`, assertEgresssToMirroredPod(KibanaLogging5601, false))
			DefaultCIt(`should allow connection to Pod "kube-apiserver" at port 443`, assertEgresssToMirroredPod(KubeApiserver443, true))
			DefaultCIt(`should block connection to Pod "kube-controller-manager-http" at port 10252`, assertEgresssToMirroredPod(KubeControllerManagerHttp10252, false))
			DefaultCIt(`should block connection to Pod "kube-controller-manager-https" at port 10257`, assertEgresssToMirroredPod(KubeControllerManagerHttps10257, false))
			DefaultCIt(`should block connection to Pod "kube-scheduler-https" at port 10259`, assertEgresssToMirroredPod(KubeSchedulerHttps10259, false))
			DefaultCIt(`should block connection to Pod "kube-scheduler-http" at port 10251`, assertEgresssToMirroredPod(KubeSchedulerHttp10251, false))
			DefaultCIt(`should block connection to Pod "kube-state-metrics-seed" at port 8080`, assertEgresssToMirroredPod(KubeStateMetricsSeed8080, false))
			DefaultCIt(`should block connection to Pod "machine-controller-manager" at port 10258`, assertEgresssToMirroredPod(MachineControllerManager10258, false))
			DefaultCIt(`should block connection to Pod "prometheus" at port 9090`, assertEgresssToMirroredPod(Prometheus9090, false))
			DefaultCIt(`should block connection to "Metadata service" 169.254.169.254:80`, assertEgresssToHost(MetadataservicePort80, false))
			DefaultCIt(`should block connection to "External host" 8.8.8.8:53`, assertEgresssToHost(ExternalhostPort53, false))
			DefaultCIt(`should block connection to "Garden Prometheus" prometheus-web.garden:80`, assertEgresssToHost(GardenPrometheusPort80, false))
		})

		Context("kube-state-metrics-seed", func() {

			BeforeEach(func() {
				from = networkpolicies.NewNamespacedSourcePod(KubeStateMetricsSeed, sharedResources.Mirror)
			})

			DefaultCIt(`should block connection to Pod "gardener-resource-manager" at port 8080`, assertEgresssToMirroredPod(GardenerResourceManager8080, false))
			DefaultCIt(`should block connection to Pod "cloud-controller-manager-http" at port 10253`, assertEgresssToMirroredPod(CloudControllerManagerHttp10253, false))
			DefaultCIt(`should block connection to Pod "cloud-controller-manager-https" at port 10258`, assertEgresssToMirroredPod(CloudControllerManagerHttps10258, false))
			DefaultCIt(`should block connection to Pod "dependency-watchdog" at port 8080`, assertEgresssToMirroredPod(DependencyWatchdog8080, false))
			DefaultCIt(`should block connection to Pod "elasticsearch-logging" at port 9200`, assertEgresssToMirroredPod(ElasticsearchLogging9200, false))
			DefaultCIt(`should block connection to Pod "elasticsearch-logging" at port 9114`, assertEgresssToMirroredPod(ElasticsearchLogging9114, false))
			DefaultCIt(`should block connection to Pod "etcd-events" at port 2379`, assertEgresssToMirroredPod(EtcdEvents2379, false))
			DefaultCIt(`should block connection to Pod "etcd-main" at port 2379`, assertEgresssToMirroredPod(EtcdMain2379, false))
			DefaultCIt(`should block connection to Pod "grafana" at port 3000`, assertEgresssToMirroredPod(Grafana3000, false))
			DefaultCIt(`should block connection to Pod "kibana-logging" at port 5601`, assertEgresssToMirroredPod(KibanaLogging5601, false))
			DefaultCIt(`should block connection to Pod "kube-apiserver" at port 443`, assertEgresssToMirroredPod(KubeApiserver443, false))
			DefaultCIt(`should block connection to Pod "kube-controller-manager-http" at port 10252`, assertEgresssToMirroredPod(KubeControllerManagerHttp10252, false))
			DefaultCIt(`should block connection to Pod "kube-controller-manager-https" at port 10257`, assertEgresssToMirroredPod(KubeControllerManagerHttps10257, false))
			DefaultCIt(`should block connection to Pod "kube-scheduler-https" at port 10259`, assertEgresssToMirroredPod(KubeSchedulerHttps10259, false))
			DefaultCIt(`should block connection to Pod "kube-scheduler-http" at port 10251`, assertEgresssToMirroredPod(KubeSchedulerHttp10251, false))
			DefaultCIt(`should block connection to Pod "kube-state-metrics-shoot" at port 8080`, assertEgresssToMirroredPod(KubeStateMetricsShoot8080, false))
			DefaultCIt(`should block connection to Pod "machine-controller-manager" at port 10258`, assertEgresssToMirroredPod(MachineControllerManager10258, false))
			DefaultCIt(`should block connection to Pod "prometheus" at port 9090`, assertEgresssToMirroredPod(Prometheus9090, false))
			DefaultCIt(`should block connection to "Metadata service" 169.254.169.254:80`, assertEgresssToHost(MetadataservicePort80, false))
			DefaultCIt(`should allow connection to "External host" 8.8.8.8:53`, assertEgresssToHost(ExternalhostPort53, true))
			DefaultCIt(`should block connection to "Garden Prometheus" prometheus-web.garden:80`, assertEgresssToHost(GardenPrometheusPort80, false))
			DefaultCIt(`should allow connection to "Seed Kube APIServer" kubernetes.default:443`, assertEgresssToHost(SeedKubeAPIServerPort443, true))
		})

		Context("machine-controller-manager", func() {

			BeforeEach(func() {
				from = networkpolicies.NewNamespacedSourcePod(MachineControllerManager, sharedResources.Mirror)
			})

			DefaultCIt(`should block connection to Pod "gardener-resource-manager" at port 8080`, assertEgresssToMirroredPod(GardenerResourceManager8080, false))
			DefaultCIt(`should block connection to Pod "cloud-controller-manager-http" at port 10253`, assertEgresssToMirroredPod(CloudControllerManagerHttp10253, false))
			DefaultCIt(`should block connection to Pod "cloud-controller-manager-https" at port 10258`, assertEgresssToMirroredPod(CloudControllerManagerHttps10258, false))
			DefaultCIt(`should block connection to Pod "dependency-watchdog" at port 8080`, assertEgresssToMirroredPod(DependencyWatchdog8080, false))
			DefaultCIt(`should block connection to Pod "elasticsearch-logging" at port 9200`, assertEgresssToMirroredPod(ElasticsearchLogging9200, false))
			DefaultCIt(`should block connection to Pod "elasticsearch-logging" at port 9114`, assertEgresssToMirroredPod(ElasticsearchLogging9114, false))
			DefaultCIt(`should block connection to Pod "etcd-events" at port 2379`, assertEgresssToMirroredPod(EtcdEvents2379, false))
			DefaultCIt(`should block connection to Pod "etcd-main" at port 2379`, assertEgresssToMirroredPod(EtcdMain2379, false))
			DefaultCIt(`should block connection to Pod "grafana" at port 3000`, assertEgresssToMirroredPod(Grafana3000, false))
			DefaultCIt(`should block connection to Pod "kibana-logging" at port 5601`, assertEgresssToMirroredPod(KibanaLogging5601, false))
			DefaultCIt(`should allow connection to Pod "kube-apiserver" at port 443`, assertEgresssToMirroredPod(KubeApiserver443, true))
			DefaultCIt(`should block connection to Pod "kube-controller-manager-http" at port 10252`, assertEgresssToMirroredPod(KubeControllerManagerHttp10252, false))
			DefaultCIt(`should block connection to Pod "kube-controller-manager-https" at port 10257`, assertEgresssToMirroredPod(KubeControllerManagerHttps10257, false))
			DefaultCIt(`should block connection to Pod "kube-scheduler-https" at port 10259`, assertEgresssToMirroredPod(KubeSchedulerHttps10259, false))
			DefaultCIt(`should block connection to Pod "kube-scheduler-http" at port 10251`, assertEgresssToMirroredPod(KubeSchedulerHttp10251, false))
			DefaultCIt(`should block connection to Pod "kube-state-metrics-seed" at port 8080`, assertEgresssToMirroredPod(KubeStateMetricsSeed8080, false))
			DefaultCIt(`should block connection to Pod "kube-state-metrics-shoot" at port 8080`, assertEgresssToMirroredPod(KubeStateMetricsShoot8080, false))
			DefaultCIt(`should block connection to Pod "prometheus" at port 9090`, assertEgresssToMirroredPod(Prometheus9090, false))
			DefaultCIt(`should block connection to "Metadata service" 169.254.169.254:80`, assertEgresssToHost(MetadataservicePort80, false))
			DefaultCIt(`should allow connection to "External host" 8.8.8.8:53`, assertEgresssToHost(ExternalhostPort53, true))
			DefaultCIt(`should block connection to "Garden Prometheus" prometheus-web.garden:80`, assertEgresssToHost(GardenPrometheusPort80, false))
			DefaultCIt(`should allow connection to "Seed Kube APIServer" kubernetes.default:443`, assertEgresssToHost(SeedKubeAPIServerPort443, true))
		})

		Context("prometheus", func() {

			BeforeEach(func() {
				from = networkpolicies.NewNamespacedSourcePod(Prometheus, sharedResources.Mirror)
			})

			DefaultCIt(`should block connection to Pod "gardener-resource-manager" at port 8080`, assertEgresssToMirroredPod(GardenerResourceManager8080, false))
			DefaultCIt(`should allow connection to Pod "cloud-controller-manager-http" at port 10253`, assertEgresssToMirroredPod(CloudControllerManagerHttp10253, true))
			DefaultCIt(`should allow connection to Pod "cloud-controller-manager-https" at port 10258`, assertEgresssToMirroredPod(CloudControllerManagerHttps10258, true))
			DefaultCIt(`should block connection to Pod "dependency-watchdog" at port 8080`, assertEgresssToMirroredPod(DependencyWatchdog8080, false))
			DefaultCIt(`should block connection to Pod "elasticsearch-logging" at port 9200`, assertEgresssToMirroredPod(ElasticsearchLogging9200, false))
			DefaultCIt(`should allow connection to Pod "elasticsearch-logging" at port 9114`, assertEgresssToMirroredPod(ElasticsearchLogging9114, true))
			DefaultCIt(`should allow connection to Pod "etcd-events" at port 2379`, assertEgresssToMirroredPod(EtcdEvents2379, true))
			DefaultCIt(`should allow connection to Pod "etcd-main" at port 2379`, assertEgresssToMirroredPod(EtcdMain2379, true))
			DefaultCIt(`should block connection to Pod "grafana" at port 3000`, assertEgresssToMirroredPod(Grafana3000, false))
			DefaultCIt(`should block connection to Pod "kibana-logging" at port 5601`, assertEgresssToMirroredPod(KibanaLogging5601, false))
			DefaultCIt(`should allow connection to Pod "kube-apiserver" at port 443`, assertEgresssToMirroredPod(KubeApiserver443, true))
			DefaultCIt(`should allow connection to Pod "kube-controller-manager-http" at port 10252`, assertEgresssToMirroredPod(KubeControllerManagerHttp10252, true))
			DefaultCIt(`should allow connection to Pod "kube-controller-manager-https" at port 10257`, assertEgresssToMirroredPod(KubeControllerManagerHttps10257, true))
			DefaultCIt(`should allow connection to Pod "kube-scheduler-https" at port 10259`, assertEgresssToMirroredPod(KubeSchedulerHttps10259, true))
			DefaultCIt(`should allow connection to Pod "kube-scheduler-http" at port 10251`, assertEgresssToMirroredPod(KubeSchedulerHttp10251, true))
			DefaultCIt(`should allow connection to Pod "kube-state-metrics-seed" at port 8080`, assertEgresssToMirroredPod(KubeStateMetricsSeed8080, true))
			DefaultCIt(`should allow connection to Pod "kube-state-metrics-shoot" at port 8080`, assertEgresssToMirroredPod(KubeStateMetricsShoot8080, true))
			DefaultCIt(`should allow connection to Pod "machine-controller-manager" at port 10258`, assertEgresssToMirroredPod(MachineControllerManager10258, true))
			DefaultCIt(`should block connection to "Metadata service" 169.254.169.254:80`, assertEgresssToHost(MetadataservicePort80, false))
			DefaultCIt(`should allow connection to "External host" 8.8.8.8:53`, assertEgresssToHost(ExternalhostPort53, true))
			DefaultCIt(`should allow connection to "Garden Prometheus" prometheus-web.garden:80`, assertEgresssToHost(GardenPrometheusPort80, true))
			DefaultCIt(`should allow connection to "Seed Kube APIServer" kubernetes.default:443`, assertEgresssToHost(SeedKubeAPIServerPort443, true))
		})
	})
})