Connectivity test option --namespace-labels is not applied to all spawned namespaces

[BroderPeters]

Bug report

General Information

• Cilium CLI version (run cilium version) v0.18.9
• Orchestration system version in use (e.g. kubectl version, ...) v1.35.0+k3s1
• Platform / infrastructure information (e.g. AWS / Azure / GCP, image / kernel versions) 6.8.0-90-generic, Ubuntu 24.04.3 LTS
• Link to relevant artifacts (policies, deployments scripts, ...)
• Generate and upload a system zip: cilium sysdump

How to reproduce the issue

1. run cilium connectivity test --namespace-labels "pod-security.kubernetes.io/enforce=privileged"
2. namespaces cilium-test-ccnp1 and cilium-test-ccnp2 don't have the label set, cilium-test-1 does

Probably related to them not being created using the deployNamespace method.

[tklauser]

Probably related to them not being created using the deployNamespace method.

Yeah, looks like this is the case. I think the fix would be to refactor deployNamespace to take the namespace name as a parameter and then use deployNamespace from deployCCNPTestEnv as well. Want to send a PR?

[BroderPeters]

Would be happy to! Although it might take some days to get to it.

[tklauser]

Thanks! No hurry with the PR. Feel free to tag me on it for review once you get to it...

[harshakumar25]

@tklauser i will glade to work on this issue
thanks !

[tklauser]

@harshakumar25 thanks for offering to help with this. However, based on #3173 (comment) I think @BroderPeters will work on this.

[harshakumar25]

@tklauser no worry for this i have raise pr cilium/cilium#44075 could you please review that once .
i am open for guidance and help.
thanks !

[BroderPeters]

Started working on it now, but will happily add you as reviewer @harshakumar25 once I'm done!

[BroderPeters]

Wasn't able to add reviewers myself and still need to look into tests, but my proposal is already there and was manually tested: cilium/cilium#44083