From b222167aa51c50060bd372fa30eecb93b85287f6 Mon Sep 17 00:00:00 2001
From: Adrian Haas <haasad@users.noreply.github.com>
Date: Mon, 5 Aug 2024 14:30:15 +0200
Subject: [PATCH] Fix alertmanager allow-from-web networkpolicy

---
 component/networkpolicy.libsonnet                           | 2 --
 .../openshift4-monitoring/20_networkpolicy.yaml             | 6 +++---
 .../20_user_workload_networkpolicy.yaml                     | 6 +++---
 .../openshift4-monitoring/20_networkpolicy.yaml             | 6 +++---
 .../20_user_workload_networkpolicy.yaml                     | 6 +++---
 .../openshift4-monitoring/20_networkpolicy.yaml             | 6 +++---
 .../20_user_workload_networkpolicy.yaml                     | 6 +++---
 .../openshift4-monitoring/20_networkpolicy.yaml             | 6 +++---
 .../20_user_workload_networkpolicy.yaml                     | 6 +++---
 .../openshift4-monitoring/20_networkpolicy.yaml             | 6 +++---
 .../20_user_workload_networkpolicy.yaml                     | 6 +++---
 .../openshift4-monitoring/20_networkpolicy.yaml             | 6 +++---
 .../20_user_workload_networkpolicy.yaml                     | 6 +++---
 .../openshift4-monitoring/prometheus_rules.yaml             | 3 +++
 .../openshift4-monitoring/20_networkpolicy.yaml             | 6 +++---
 .../20_user_workload_networkpolicy.yaml                     | 6 +++---
 .../openshift4-monitoring/20_networkpolicy.yaml             | 6 +++---
 .../20_user_workload_networkpolicy.yaml                     | 6 +++---
 .../openshift4-monitoring/20_networkpolicy.yaml             | 6 +++---
 .../20_user_workload_networkpolicy.yaml                     | 6 +++---
 .../openshift4-monitoring/20_networkpolicy.yaml             | 6 +++---
 .../20_user_workload_networkpolicy.yaml                     | 6 +++---
 .../openshift4-monitoring/20_networkpolicy.yaml             | 6 +++---
 .../20_user_workload_networkpolicy.yaml                     | 6 +++---
 24 files changed, 69 insertions(+), 68 deletions(-)

diff --git a/component/networkpolicy.libsonnet b/component/networkpolicy.libsonnet
index adcde158..43ce83f7 100644
--- a/component/networkpolicy.libsonnet
+++ b/component/networkpolicy.libsonnet
@@ -36,8 +36,6 @@ local params = inv.parameters.openshift4_monitoring;
               port: 9097,
             },
           ],
-        },
-        {
           from: [
             {
               namespaceSelector: {},
diff --git a/tests/golden/capacity-alerts-with-node-labels/openshift4-monitoring/openshift4-monitoring/20_networkpolicy.yaml b/tests/golden/capacity-alerts-with-node-labels/openshift4-monitoring/openshift4-monitoring/20_networkpolicy.yaml
index b04b9f76..e7e81d7c 100644
--- a/tests/golden/capacity-alerts-with-node-labels/openshift4-monitoring/openshift4-monitoring/20_networkpolicy.yaml
+++ b/tests/golden/capacity-alerts-with-node-labels/openshift4-monitoring/openshift4-monitoring/20_networkpolicy.yaml
@@ -8,7 +8,9 @@ metadata:
   namespace: openshift-monitoring
 spec:
   ingress:
-    - ports:
+    - from:
+        - namespaceSelector: {}
+      ports:
         - port: 9092
           protocol: TCP
         - port: 9093
@@ -17,8 +19,6 @@ spec:
           protocol: TCP
         - port: 9097
           protocol: TCP
-    - from:
-        - namespaceSelector: {}
   podSelector:
     matchLabels:
       app.kubernetes.io/name: alertmanager
diff --git a/tests/golden/capacity-alerts-with-node-labels/openshift4-monitoring/openshift4-monitoring/20_user_workload_networkpolicy.yaml b/tests/golden/capacity-alerts-with-node-labels/openshift4-monitoring/openshift4-monitoring/20_user_workload_networkpolicy.yaml
index 683bc044..ad572958 100644
--- a/tests/golden/capacity-alerts-with-node-labels/openshift4-monitoring/openshift4-monitoring/20_user_workload_networkpolicy.yaml
+++ b/tests/golden/capacity-alerts-with-node-labels/openshift4-monitoring/openshift4-monitoring/20_user_workload_networkpolicy.yaml
@@ -8,7 +8,9 @@ metadata:
   namespace: openshift-user-workload-monitoring
 spec:
   ingress:
-    - ports:
+    - from:
+        - namespaceSelector: {}
+      ports:
         - port: 9092
           protocol: TCP
         - port: 9093
@@ -17,8 +19,6 @@ spec:
           protocol: TCP
         - port: 9097
           protocol: TCP
-    - from:
-        - namespaceSelector: {}
   podSelector:
     matchLabels:
       app.kubernetes.io/name: alertmanager
diff --git a/tests/golden/capacity-alerts/openshift4-monitoring/openshift4-monitoring/20_networkpolicy.yaml b/tests/golden/capacity-alerts/openshift4-monitoring/openshift4-monitoring/20_networkpolicy.yaml
index b04b9f76..e7e81d7c 100644
--- a/tests/golden/capacity-alerts/openshift4-monitoring/openshift4-monitoring/20_networkpolicy.yaml
+++ b/tests/golden/capacity-alerts/openshift4-monitoring/openshift4-monitoring/20_networkpolicy.yaml
@@ -8,7 +8,9 @@ metadata:
   namespace: openshift-monitoring
 spec:
   ingress:
-    - ports:
+    - from:
+        - namespaceSelector: {}
+      ports:
         - port: 9092
           protocol: TCP
         - port: 9093
@@ -17,8 +19,6 @@ spec:
           protocol: TCP
         - port: 9097
           protocol: TCP
-    - from:
-        - namespaceSelector: {}
   podSelector:
     matchLabels:
       app.kubernetes.io/name: alertmanager
diff --git a/tests/golden/capacity-alerts/openshift4-monitoring/openshift4-monitoring/20_user_workload_networkpolicy.yaml b/tests/golden/capacity-alerts/openshift4-monitoring/openshift4-monitoring/20_user_workload_networkpolicy.yaml
index 683bc044..ad572958 100644
--- a/tests/golden/capacity-alerts/openshift4-monitoring/openshift4-monitoring/20_user_workload_networkpolicy.yaml
+++ b/tests/golden/capacity-alerts/openshift4-monitoring/openshift4-monitoring/20_user_workload_networkpolicy.yaml
@@ -8,7 +8,9 @@ metadata:
   namespace: openshift-user-workload-monitoring
 spec:
   ingress:
-    - ports:
+    - from:
+        - namespaceSelector: {}
+      ports:
         - port: 9092
           protocol: TCP
         - port: 9093
@@ -17,8 +19,6 @@ spec:
           protocol: TCP
         - port: 9097
           protocol: TCP
-    - from:
-        - namespaceSelector: {}
   podSelector:
     matchLabels:
       app.kubernetes.io/name: alertmanager
diff --git a/tests/golden/custom-rules/openshift4-monitoring/openshift4-monitoring/20_networkpolicy.yaml b/tests/golden/custom-rules/openshift4-monitoring/openshift4-monitoring/20_networkpolicy.yaml
index b04b9f76..e7e81d7c 100644
--- a/tests/golden/custom-rules/openshift4-monitoring/openshift4-monitoring/20_networkpolicy.yaml
+++ b/tests/golden/custom-rules/openshift4-monitoring/openshift4-monitoring/20_networkpolicy.yaml
@@ -8,7 +8,9 @@ metadata:
   namespace: openshift-monitoring
 spec:
   ingress:
-    - ports:
+    - from:
+        - namespaceSelector: {}
+      ports:
         - port: 9092
           protocol: TCP
         - port: 9093
@@ -17,8 +19,6 @@ spec:
           protocol: TCP
         - port: 9097
           protocol: TCP
-    - from:
-        - namespaceSelector: {}
   podSelector:
     matchLabels:
       app.kubernetes.io/name: alertmanager
diff --git a/tests/golden/custom-rules/openshift4-monitoring/openshift4-monitoring/20_user_workload_networkpolicy.yaml b/tests/golden/custom-rules/openshift4-monitoring/openshift4-monitoring/20_user_workload_networkpolicy.yaml
index 683bc044..ad572958 100644
--- a/tests/golden/custom-rules/openshift4-monitoring/openshift4-monitoring/20_user_workload_networkpolicy.yaml
+++ b/tests/golden/custom-rules/openshift4-monitoring/openshift4-monitoring/20_user_workload_networkpolicy.yaml
@@ -8,7 +8,9 @@ metadata:
   namespace: openshift-user-workload-monitoring
 spec:
   ingress:
-    - ports:
+    - from:
+        - namespaceSelector: {}
+      ports:
         - port: 9092
           protocol: TCP
         - port: 9093
@@ -17,8 +19,6 @@ spec:
           protocol: TCP
         - port: 9097
           protocol: TCP
-    - from:
-        - namespaceSelector: {}
   podSelector:
     matchLabels:
       app.kubernetes.io/name: alertmanager
diff --git a/tests/golden/ovn-kubernetes/openshift4-monitoring/openshift4-monitoring/20_networkpolicy.yaml b/tests/golden/ovn-kubernetes/openshift4-monitoring/openshift4-monitoring/20_networkpolicy.yaml
index b04b9f76..e7e81d7c 100644
--- a/tests/golden/ovn-kubernetes/openshift4-monitoring/openshift4-monitoring/20_networkpolicy.yaml
+++ b/tests/golden/ovn-kubernetes/openshift4-monitoring/openshift4-monitoring/20_networkpolicy.yaml
@@ -8,7 +8,9 @@ metadata:
   namespace: openshift-monitoring
 spec:
   ingress:
-    - ports:
+    - from:
+        - namespaceSelector: {}
+      ports:
         - port: 9092
           protocol: TCP
         - port: 9093
@@ -17,8 +19,6 @@ spec:
           protocol: TCP
         - port: 9097
           protocol: TCP
-    - from:
-        - namespaceSelector: {}
   podSelector:
     matchLabels:
       app.kubernetes.io/name: alertmanager
diff --git a/tests/golden/ovn-kubernetes/openshift4-monitoring/openshift4-monitoring/20_user_workload_networkpolicy.yaml b/tests/golden/ovn-kubernetes/openshift4-monitoring/openshift4-monitoring/20_user_workload_networkpolicy.yaml
index 683bc044..ad572958 100644
--- a/tests/golden/ovn-kubernetes/openshift4-monitoring/openshift4-monitoring/20_user_workload_networkpolicy.yaml
+++ b/tests/golden/ovn-kubernetes/openshift4-monitoring/openshift4-monitoring/20_user_workload_networkpolicy.yaml
@@ -8,7 +8,9 @@ metadata:
   namespace: openshift-user-workload-monitoring
 spec:
   ingress:
-    - ports:
+    - from:
+        - namespaceSelector: {}
+      ports:
         - port: 9092
           protocol: TCP
         - port: 9093
@@ -17,8 +19,6 @@ spec:
           protocol: TCP
         - port: 9097
           protocol: TCP
-    - from:
-        - namespaceSelector: {}
   podSelector:
     matchLabels:
       app.kubernetes.io/name: alertmanager
diff --git a/tests/golden/release-4.13/openshift4-monitoring/openshift4-monitoring/20_networkpolicy.yaml b/tests/golden/release-4.13/openshift4-monitoring/openshift4-monitoring/20_networkpolicy.yaml
index b04b9f76..e7e81d7c 100644
--- a/tests/golden/release-4.13/openshift4-monitoring/openshift4-monitoring/20_networkpolicy.yaml
+++ b/tests/golden/release-4.13/openshift4-monitoring/openshift4-monitoring/20_networkpolicy.yaml
@@ -8,7 +8,9 @@ metadata:
   namespace: openshift-monitoring
 spec:
   ingress:
-    - ports:
+    - from:
+        - namespaceSelector: {}
+      ports:
         - port: 9092
           protocol: TCP
         - port: 9093
@@ -17,8 +19,6 @@ spec:
           protocol: TCP
         - port: 9097
           protocol: TCP
-    - from:
-        - namespaceSelector: {}
   podSelector:
     matchLabels:
       app.kubernetes.io/name: alertmanager
diff --git a/tests/golden/release-4.13/openshift4-monitoring/openshift4-monitoring/20_user_workload_networkpolicy.yaml b/tests/golden/release-4.13/openshift4-monitoring/openshift4-monitoring/20_user_workload_networkpolicy.yaml
index 683bc044..ad572958 100644
--- a/tests/golden/release-4.13/openshift4-monitoring/openshift4-monitoring/20_user_workload_networkpolicy.yaml
+++ b/tests/golden/release-4.13/openshift4-monitoring/openshift4-monitoring/20_user_workload_networkpolicy.yaml
@@ -8,7 +8,9 @@ metadata:
   namespace: openshift-user-workload-monitoring
 spec:
   ingress:
-    - ports:
+    - from:
+        - namespaceSelector: {}
+      ports:
         - port: 9092
           protocol: TCP
         - port: 9093
@@ -17,8 +19,6 @@ spec:
           protocol: TCP
         - port: 9097
           protocol: TCP
-    - from:
-        - namespaceSelector: {}
   podSelector:
     matchLabels:
       app.kubernetes.io/name: alertmanager
diff --git a/tests/golden/release-4.14/openshift4-monitoring/openshift4-monitoring/20_networkpolicy.yaml b/tests/golden/release-4.14/openshift4-monitoring/openshift4-monitoring/20_networkpolicy.yaml
index b04b9f76..e7e81d7c 100644
--- a/tests/golden/release-4.14/openshift4-monitoring/openshift4-monitoring/20_networkpolicy.yaml
+++ b/tests/golden/release-4.14/openshift4-monitoring/openshift4-monitoring/20_networkpolicy.yaml
@@ -8,7 +8,9 @@ metadata:
   namespace: openshift-monitoring
 spec:
   ingress:
-    - ports:
+    - from:
+        - namespaceSelector: {}
+      ports:
         - port: 9092
           protocol: TCP
         - port: 9093
@@ -17,8 +19,6 @@ spec:
           protocol: TCP
         - port: 9097
           protocol: TCP
-    - from:
-        - namespaceSelector: {}
   podSelector:
     matchLabels:
       app.kubernetes.io/name: alertmanager
diff --git a/tests/golden/release-4.14/openshift4-monitoring/openshift4-monitoring/20_user_workload_networkpolicy.yaml b/tests/golden/release-4.14/openshift4-monitoring/openshift4-monitoring/20_user_workload_networkpolicy.yaml
index 683bc044..ad572958 100644
--- a/tests/golden/release-4.14/openshift4-monitoring/openshift4-monitoring/20_user_workload_networkpolicy.yaml
+++ b/tests/golden/release-4.14/openshift4-monitoring/openshift4-monitoring/20_user_workload_networkpolicy.yaml
@@ -8,7 +8,9 @@ metadata:
   namespace: openshift-user-workload-monitoring
 spec:
   ingress:
-    - ports:
+    - from:
+        - namespaceSelector: {}
+      ports:
         - port: 9092
           protocol: TCP
         - port: 9093
@@ -17,8 +19,6 @@ spec:
           protocol: TCP
         - port: 9097
           protocol: TCP
-    - from:
-        - namespaceSelector: {}
   podSelector:
     matchLabels:
       app.kubernetes.io/name: alertmanager
diff --git a/tests/golden/release-4.14/openshift4-monitoring/openshift4-monitoring/prometheus_rules.yaml b/tests/golden/release-4.14/openshift4-monitoring/openshift4-monitoring/prometheus_rules.yaml
index 3ef75985..b82453d0 100644
--- a/tests/golden/release-4.14/openshift4-monitoring/openshift4-monitoring/prometheus_rules.yaml
+++ b/tests/golden/release-4.14/openshift4-monitoring/openshift4-monitoring/prometheus_rules.yaml
@@ -2022,6 +2022,7 @@ spec:
             description: Prometheus {{$labels.namespace}}/{{$labels.pod}} failed to
               send {{ printf "%.1f" $value }}% of the samples to {{ $labels.remote_name}}:{{
               $labels.url }}
+            runbook_url: https://github.com/openshift/runbooks/blob/master/alerts/cluster-monitoring-operator/PrometheusRemoteStorageFailures.md
             summary: Prometheus fails to send samples to remote storage.
             syn_component: openshift4-monitoring
           expr: |
@@ -2097,6 +2098,7 @@ spec:
             description: Prometheus {{$labels.namespace}}/{{$labels.pod}} has failed
               {{ printf "%.0f" $value }} scrapes in the last 5m because some targets
               exceeded the configured body_size_limit.
+            runbook_url: https://github.com/openshift/runbooks/blob/master/alerts/cluster-monitoring-operator/PrometheusScrapeBodySizeLimitHit.md
             summary: Prometheus has dropped some targets that exceeded body size limit.
             syn_component: openshift4-monitoring
           expr: |
@@ -2210,6 +2212,7 @@ spec:
             description: Prometheus operator in {{ $labels.namespace }} namespace
               rejected {{ printf "%0.0f" $value }} {{ $labels.controller }}/{{ $labels.resource
               }} resources.
+            runbook_url: https://github.com/openshift/runbooks/blob/master/alerts/cluster-monitoring-operator/PrometheusOperatorRejectedResources.md
             summary: Resources rejected by Prometheus operator
             syn_component: openshift4-monitoring
           expr: |
diff --git a/tests/golden/release-4.15/openshift4-monitoring/openshift4-monitoring/20_networkpolicy.yaml b/tests/golden/release-4.15/openshift4-monitoring/openshift4-monitoring/20_networkpolicy.yaml
index b04b9f76..e7e81d7c 100644
--- a/tests/golden/release-4.15/openshift4-monitoring/openshift4-monitoring/20_networkpolicy.yaml
+++ b/tests/golden/release-4.15/openshift4-monitoring/openshift4-monitoring/20_networkpolicy.yaml
@@ -8,7 +8,9 @@ metadata:
   namespace: openshift-monitoring
 spec:
   ingress:
-    - ports:
+    - from:
+        - namespaceSelector: {}
+      ports:
         - port: 9092
           protocol: TCP
         - port: 9093
@@ -17,8 +19,6 @@ spec:
           protocol: TCP
         - port: 9097
           protocol: TCP
-    - from:
-        - namespaceSelector: {}
   podSelector:
     matchLabels:
       app.kubernetes.io/name: alertmanager
diff --git a/tests/golden/release-4.15/openshift4-monitoring/openshift4-monitoring/20_user_workload_networkpolicy.yaml b/tests/golden/release-4.15/openshift4-monitoring/openshift4-monitoring/20_user_workload_networkpolicy.yaml
index 683bc044..ad572958 100644
--- a/tests/golden/release-4.15/openshift4-monitoring/openshift4-monitoring/20_user_workload_networkpolicy.yaml
+++ b/tests/golden/release-4.15/openshift4-monitoring/openshift4-monitoring/20_user_workload_networkpolicy.yaml
@@ -8,7 +8,9 @@ metadata:
   namespace: openshift-user-workload-monitoring
 spec:
   ingress:
-    - ports:
+    - from:
+        - namespaceSelector: {}
+      ports:
         - port: 9092
           protocol: TCP
         - port: 9093
@@ -17,8 +19,6 @@ spec:
           protocol: TCP
         - port: 9097
           protocol: TCP
-    - from:
-        - namespaceSelector: {}
   podSelector:
     matchLabels:
       app.kubernetes.io/name: alertmanager
diff --git a/tests/golden/remote-write/openshift4-monitoring/openshift4-monitoring/20_networkpolicy.yaml b/tests/golden/remote-write/openshift4-monitoring/openshift4-monitoring/20_networkpolicy.yaml
index b04b9f76..e7e81d7c 100644
--- a/tests/golden/remote-write/openshift4-monitoring/openshift4-monitoring/20_networkpolicy.yaml
+++ b/tests/golden/remote-write/openshift4-monitoring/openshift4-monitoring/20_networkpolicy.yaml
@@ -8,7 +8,9 @@ metadata:
   namespace: openshift-monitoring
 spec:
   ingress:
-    - ports:
+    - from:
+        - namespaceSelector: {}
+      ports:
         - port: 9092
           protocol: TCP
         - port: 9093
@@ -17,8 +19,6 @@ spec:
           protocol: TCP
         - port: 9097
           protocol: TCP
-    - from:
-        - namespaceSelector: {}
   podSelector:
     matchLabels:
       app.kubernetes.io/name: alertmanager
diff --git a/tests/golden/remote-write/openshift4-monitoring/openshift4-monitoring/20_user_workload_networkpolicy.yaml b/tests/golden/remote-write/openshift4-monitoring/openshift4-monitoring/20_user_workload_networkpolicy.yaml
index 683bc044..ad572958 100644
--- a/tests/golden/remote-write/openshift4-monitoring/openshift4-monitoring/20_user_workload_networkpolicy.yaml
+++ b/tests/golden/remote-write/openshift4-monitoring/openshift4-monitoring/20_user_workload_networkpolicy.yaml
@@ -8,7 +8,9 @@ metadata:
   namespace: openshift-user-workload-monitoring
 spec:
   ingress:
-    - ports:
+    - from:
+        - namespaceSelector: {}
+      ports:
         - port: 9092
           protocol: TCP
         - port: 9093
@@ -17,8 +19,6 @@ spec:
           protocol: TCP
         - port: 9097
           protocol: TCP
-    - from:
-        - namespaceSelector: {}
   podSelector:
     matchLabels:
       app.kubernetes.io/name: alertmanager
diff --git a/tests/golden/team-routing/openshift4-monitoring/openshift4-monitoring/20_networkpolicy.yaml b/tests/golden/team-routing/openshift4-monitoring/openshift4-monitoring/20_networkpolicy.yaml
index b04b9f76..e7e81d7c 100644
--- a/tests/golden/team-routing/openshift4-monitoring/openshift4-monitoring/20_networkpolicy.yaml
+++ b/tests/golden/team-routing/openshift4-monitoring/openshift4-monitoring/20_networkpolicy.yaml
@@ -8,7 +8,9 @@ metadata:
   namespace: openshift-monitoring
 spec:
   ingress:
-    - ports:
+    - from:
+        - namespaceSelector: {}
+      ports:
         - port: 9092
           protocol: TCP
         - port: 9093
@@ -17,8 +19,6 @@ spec:
           protocol: TCP
         - port: 9097
           protocol: TCP
-    - from:
-        - namespaceSelector: {}
   podSelector:
     matchLabels:
       app.kubernetes.io/name: alertmanager
diff --git a/tests/golden/team-routing/openshift4-monitoring/openshift4-monitoring/20_user_workload_networkpolicy.yaml b/tests/golden/team-routing/openshift4-monitoring/openshift4-monitoring/20_user_workload_networkpolicy.yaml
index 683bc044..ad572958 100644
--- a/tests/golden/team-routing/openshift4-monitoring/openshift4-monitoring/20_user_workload_networkpolicy.yaml
+++ b/tests/golden/team-routing/openshift4-monitoring/openshift4-monitoring/20_user_workload_networkpolicy.yaml
@@ -8,7 +8,9 @@ metadata:
   namespace: openshift-user-workload-monitoring
 spec:
   ingress:
-    - ports:
+    - from:
+        - namespaceSelector: {}
+      ports:
         - port: 9092
           protocol: TCP
         - port: 9093
@@ -17,8 +19,6 @@ spec:
           protocol: TCP
         - port: 9097
           protocol: TCP
-    - from:
-        - namespaceSelector: {}
   podSelector:
     matchLabels:
       app.kubernetes.io/name: alertmanager
diff --git a/tests/golden/user-workload-monitoring/openshift4-monitoring/openshift4-monitoring/20_networkpolicy.yaml b/tests/golden/user-workload-monitoring/openshift4-monitoring/openshift4-monitoring/20_networkpolicy.yaml
index b04b9f76..e7e81d7c 100644
--- a/tests/golden/user-workload-monitoring/openshift4-monitoring/openshift4-monitoring/20_networkpolicy.yaml
+++ b/tests/golden/user-workload-monitoring/openshift4-monitoring/openshift4-monitoring/20_networkpolicy.yaml
@@ -8,7 +8,9 @@ metadata:
   namespace: openshift-monitoring
 spec:
   ingress:
-    - ports:
+    - from:
+        - namespaceSelector: {}
+      ports:
         - port: 9092
           protocol: TCP
         - port: 9093
@@ -17,8 +19,6 @@ spec:
           protocol: TCP
         - port: 9097
           protocol: TCP
-    - from:
-        - namespaceSelector: {}
   podSelector:
     matchLabels:
       app.kubernetes.io/name: alertmanager
diff --git a/tests/golden/user-workload-monitoring/openshift4-monitoring/openshift4-monitoring/20_user_workload_networkpolicy.yaml b/tests/golden/user-workload-monitoring/openshift4-monitoring/openshift4-monitoring/20_user_workload_networkpolicy.yaml
index 683bc044..ad572958 100644
--- a/tests/golden/user-workload-monitoring/openshift4-monitoring/openshift4-monitoring/20_user_workload_networkpolicy.yaml
+++ b/tests/golden/user-workload-monitoring/openshift4-monitoring/openshift4-monitoring/20_user_workload_networkpolicy.yaml
@@ -8,7 +8,9 @@ metadata:
   namespace: openshift-user-workload-monitoring
 spec:
   ingress:
-    - ports:
+    - from:
+        - namespaceSelector: {}
+      ports:
         - port: 9092
           protocol: TCP
         - port: 9093
@@ -17,8 +19,6 @@ spec:
           protocol: TCP
         - port: 9097
           protocol: TCP
-    - from:
-        - namespaceSelector: {}
   podSelector:
     matchLabels:
       app.kubernetes.io/name: alertmanager
diff --git a/tests/golden/vsphere/openshift4-monitoring/openshift4-monitoring/20_networkpolicy.yaml b/tests/golden/vsphere/openshift4-monitoring/openshift4-monitoring/20_networkpolicy.yaml
index b04b9f76..e7e81d7c 100644
--- a/tests/golden/vsphere/openshift4-monitoring/openshift4-monitoring/20_networkpolicy.yaml
+++ b/tests/golden/vsphere/openshift4-monitoring/openshift4-monitoring/20_networkpolicy.yaml
@@ -8,7 +8,9 @@ metadata:
   namespace: openshift-monitoring
 spec:
   ingress:
-    - ports:
+    - from:
+        - namespaceSelector: {}
+      ports:
         - port: 9092
           protocol: TCP
         - port: 9093
@@ -17,8 +19,6 @@ spec:
           protocol: TCP
         - port: 9097
           protocol: TCP
-    - from:
-        - namespaceSelector: {}
   podSelector:
     matchLabels:
       app.kubernetes.io/name: alertmanager
diff --git a/tests/golden/vsphere/openshift4-monitoring/openshift4-monitoring/20_user_workload_networkpolicy.yaml b/tests/golden/vsphere/openshift4-monitoring/openshift4-monitoring/20_user_workload_networkpolicy.yaml
index 683bc044..ad572958 100644
--- a/tests/golden/vsphere/openshift4-monitoring/openshift4-monitoring/20_user_workload_networkpolicy.yaml
+++ b/tests/golden/vsphere/openshift4-monitoring/openshift4-monitoring/20_user_workload_networkpolicy.yaml
@@ -8,7 +8,9 @@ metadata:
   namespace: openshift-user-workload-monitoring
 spec:
   ingress:
-    - ports:
+    - from:
+        - namespaceSelector: {}
+      ports:
         - port: 9092
           protocol: TCP
         - port: 9093
@@ -17,8 +19,6 @@ spec:
           protocol: TCP
         - port: 9097
           protocol: TCP
-    - from:
-        - namespaceSelector: {}
   podSelector:
     matchLabels:
       app.kubernetes.io/name: alertmanager