From ed7697bc77c950ee8f27c621d54358a89ed8bf2d Mon Sep 17 00:00:00 2001
From: Anatolii Bazko <abazko@redhat.com>
Date: Mon, 12 Oct 2026 11:08:42 +0200
Subject: [PATCH] fix: do not mutate defaultConfig in GetDefaultNetworkPolicy

Remove the assignment to defaultConfig.Workspace.NetworkPolicy from
GetDefaultNetworkPolicy.

GetDefaultNetworkPolicy is a public helper intended to return the
default ingress/egress rules for network policies, and modifying the
package-level defaultConfig was an unintended side effect. The default
network policy configuration on defaultConfig is already initialized by
setDefaultNetworkPolicy.

Signed-off-by: Anatolii Bazko <abazko@redhat.com>
---
 pkg/config/defaults.go      |  5 ----
 pkg/config/defaults_test.go | 55 +++++++++++++++++++++++++++++++++++++
 2 files changed, 55 insertions(+), 5 deletions(-)
 create mode 100644 pkg/config/defaults_test.go

diff --git a/pkg/config/defaults.go b/pkg/config/defaults.go
index 5ce3710bd..571eecfb8 100644
--- a/pkg/config/defaults.go
+++ b/pkg/config/defaults.go
@@ -269,10 +269,5 @@ func GetDefaultNetworkPolicy(operatorNamespace string) (
 		ingressPolicyRules = defaultKubernetesIngressPolicyRules
 	}
 
-	defaultConfig.Workspace.NetworkPolicy = &v1alpha1.NetworkPolicyConfig{
-		Enabled: pointer.Bool(constants.DefaultNetworkPolicyEnabled),
-		Ingress: ingressPolicyRules,
-		Egress:  defaultEgressPolicyRules,
-	}
 	return ingressPolicyRules, defaultEgressPolicyRules, nil
 }
diff --git a/pkg/config/defaults_test.go b/pkg/config/defaults_test.go
new file mode 100644
index 000000000..26f3883ce
--- /dev/null
+++ b/pkg/config/defaults_test.go
@@ -0,0 +1,55 @@
+// Copyright (c) 2019-2026 Red Hat, Inc.
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package config
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/devfile/devworkspace-operator/pkg/infrastructure"
+)
+
+func TestGetDefaultNetworkPolicyDoesNotMutateDefaultConfig(t *testing.T) {
+	setupForTest(t)
+
+	defaultConfig.Workspace.NetworkPolicy = nil
+
+	_, _, err := GetDefaultNetworkPolicy("test-namespace")
+	assert.NoError(t, err)
+
+	assert.Nil(t, defaultConfig.Workspace.NetworkPolicy, "GetDefaultNetworkPolicy should not mutate defaultConfig")
+}
+
+func TestGetDefaultNetworkPolicy(t *testing.T) {
+	t.Run("on Kubernetes", func(t *testing.T) {
+		setupForTest(t)
+		infrastructure.InitializeForTesting(infrastructure.Kubernetes)
+
+		ingress, egress, err := GetDefaultNetworkPolicy("test-namespace")
+		assert.NoError(t, err)
+		assert.Equal(t, defaultKubernetesIngressPolicyRules, ingress)
+		assert.Equal(t, defaultEgressPolicyRules, egress)
+	})
+
+	t.Run("on OpenShift", func(t *testing.T) {
+		setupForTest(t)
+		infrastructure.InitializeForTesting(infrastructure.OpenShiftv4)
+
+		ingress, egress, err := GetDefaultNetworkPolicy("test-namespace")
+		assert.NoError(t, err)
+		assert.Len(t, ingress, len(defaultOpenShiftIngressPolicyRules)+1)
+		assert.Equal(t, defaultEgressPolicyRules, egress)
+	})
+}