Add Node Selector in ACNP/ANP ingress/egress rules #3038

wenqiq · 2021-11-19T01:45:46Z

Support nodeSelector in ACNP/ANP ingress/egress rules.

Add nodeSelector field in ACNP/ANP ingress/egress rules to restrict traffic from/to particular Nodes.
Add Node info in the output of antctl get addressgroup.
For example:

antctl get addressgroup       
NAME                                 POD-IPS                                NODE-IPS                  
5e1bbf8e-67a3-5384-b2bf-e42e93bd68aa <NONE>                                 192.168.0.1, 10.176.27.105
f8c56571-d6db-51ec-9352-a9a47476a9a0 192.168.0.70,192.168.1.38,192.168.1.39 <NONE>  

antctl get addressgroup -oyaml
- name: 5e1bbf8e-67a3-5384-b2bf-e42e93bd68aa
  nodes:
  - ip: 192.168.0.1, 10.176.27.105
    node:
      name: wenqiq01-1
- name: f8c56571-d6db-51ec-9352-a9a47476a9a0
  pods:
  - ip: 192.168.1.38
    pod:
      name: iperf3-55bcff667d-v495l
      namespace: demo
  - ip: 192.168.1.39
    pod:
      name: iperf3-55bcff667d-c74ll
      namespace: demo
  - ip: 192.168.0.70
    pod:
      name: iperf3-55bcff667d-pz2d2
      namespace: demo

Fixes: #3023

Signed-off-by: Wenqi Qiu wenqiq@vmware.com

codecov-commenter · 2021-11-19T01:51:14Z

Codecov Report

Merging #3038 (4b06963) into main (c8a3544) will decrease coverage by 3.75%.
The diff coverage is 70.09%.

@@            Coverage Diff             @@
##             main    #3038      +/-   ##
==========================================
- Coverage   65.75%   62.00%   -3.76%     
==========================================
  Files         277      277              
  Lines       27264    37635   +10371     
==========================================
+ Hits        17927    23334    +5407     
- Misses       7439    12363    +4924     
- Partials     1898     1938      +40

Flag	Coverage Δ
e2e-tests	`54.26% <55.60%> (?)`
kind-e2e-tests	`40.11% <8.49%> (-15.99%)`	⬇️
unit-tests	`43.19% <66.43%> (+0.10%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files	Coverage Δ
...ntroller/networkpolicy/networkpolicy_controller.go	`68.20% <ø> (-3.45%)`	⬇️
...gent/controller/noderoute/node_route_controller.go	`57.69% <0.00%> (+1.95%)`	⬆️
pkg/antctl/transform/common/transform.go	`0.00% <0.00%> (ø)`
pkg/apis/controlplane/types.go	`100.00% <ø> (ø)`
pkg/controller/networkpolicy/validate.go	`73.88% <25.00%> (-6.74%)`	⬇️
...g/controller/networkpolicy/clusternetworkpolicy.go	`76.47% <35.00%> (-4.83%)`	⬇️
pkg/util/k8s/node.go	`76.28% <81.15%> (+11.28%)`	⬆️
pkg/controller/types/group.go	`85.00% <92.30%> (+4.23%)`	⬆️
...ntroller/networkpolicy/networkpolicy_controller.go	`80.63% <97.67%> (-3.41%)`	⬇️
pkg/controller/egress/controller.go	`62.19% <100.00%> (-26.26%)`	⬇️
... and 250 more

tnqn · 2021-11-26T15:11:33Z

docs/antrea-network-policy.md

@@ -526,6 +526,9 @@ since Pod IPs are ephemeral and unpredictable.
 select Fully Qualified Domain Names (FQDNs), specified either by exact name or wildcard
 expressions, when defining `egress` rules.

+**nodeSelector**: This selects certain Node IPs as ingress from address or egress to address.
+It is applicable only to the `from` section in an `ingress` block or the `to` section in an `egress` block.


Please refer to the existing doc for podSelector and namespaceSelector fields

tnqn · 2021-11-26T15:15:08Z

docs/antrea-network-policy.md

@@ -1062,6 +1065,37 @@ spec:
      - fqdn: "svcA.default.svc.cluster.local"
 ```

+## Node Selector 
+
+NodeSelector selects certain Nodes which match the label selector. Add Node IPs to address group memberSet.


Suggested change

NodeSelector selects certain Nodes which match the label selector. Add Node IPs to address group memberSet.

NodeSelector selects certain Nodes which match the label selector. It adds Node IPs to address group memberSet.

And this is user facing doc, I'm not sure if users can understand "address group memberSet". At least there is no other fields mentioning it. Could you aligh with the description of other similar fields?

tnqn · 2021-11-26T15:15:25Z

docs/antrea-network-policy.md

+## Node Selector 
+
+NodeSelector selects certain Nodes which match the label selector. Add Node IPs to address group memberSet.
+The following rule applied to Pods with label `app=antrea-test-app` and will `Drop` egress traffic to 


Suggested change

The following rule applied to Pods with label `app=antrea-test-app` and will `Drop` egress traffic to

The following rule applies to Pods with label `app=antrea-test-app` and will `Drop` egress traffic to

tnqn · 2021-11-26T15:15:53Z

docs/antrea-network-policy.md

+
+NodeSelector selects certain Nodes which match the label selector. Add Node IPs to address group memberSet.
+The following rule applied to Pods with label `app=antrea-test-app` and will `Drop` egress traffic to 
+Nodes which has labels `kubernetes.io/hostname=kind-control-plane`.


Suggested change

Nodes which has labels `kubernetes.io/hostname=kind-control-plane`.

Nodes which have the labels `kubernetes.io/hostname=kind-control-plane`.

docs/antrea-network-policy.md

tnqn · 2021-11-26T15:19:33Z

docs/antrea-network-policy.md

+              - key: kubernetes.io/hostname
+                operator: In
+                values:
+                  - kind-control-plane


Maybe a more proper example for your use case is:

matchExpressions: - key: node-role.kubernetes.io/control-plane operator: Exists

as hostname can only match a single host.

tnqn · 2021-11-26T15:21:15Z

pkg/apis/crd/v1alpha1/types.go

@@ -15,6 +15,7 @@
 package v1alpha1

 import (
+	_ "github.com/golang/mock/mockgen/model"


why is this change?

Forget to delete this. It is used in make codegen. Done.

tnqn · 2021-11-26T15:21:56Z

pkg/apis/crd/v1alpha1/types.go

@@ -434,6 +435,11 @@ type NetworkPolicyPeer struct {
 	//  Exact FQDNs, i.e. "google.com", "db-svc.default.svc.cluster.local"
 	//  Wildcard expressions, i.e. "*wayfair.com".
 	FQDN string `json:"fqdn,omitempty"`
+	// Select certain Nodes which match the label selector,
+	// if no nodeSelector is specified, then all Nodes will be selected
+	// in the cluster.


I don't think this behavior is expected. It basically breaks compaibility of existing rules.

tnqn · 2022-02-16T02:24:12Z

docs/antrea-network-policy.md

@@ -538,6 +539,10 @@ with `namespaces` field.
 specifies both namespaceSelector and podSelector selects particular Pods within
 particular Namespaces.

+**nodeSelector**: This selects particular Nodes in cluster.
+The selected Node's IPs will set as "sources" if `nodeSelector` set in `ingress` section, or as "destinations" if set in


Could you align this lines?

pkg/apis/crd/v1alpha1/types.go

tnqn · 2022-02-16T02:37:20Z

pkg/controller/networkpolicy/clusternetworkpolicy.go

+	for _, addressGroupObj := range addressGroupObjs {
+		addressGroup := addressGroupObj.(*antreatypes.AddressGroup)
+		nS := addressGroup.Selector.NodeSelector
+		if nS == nil && !addressGroup.SpanMeta.Has(node.Name) {


Why the addressGroup's span must contain this Node?
For example, if an addressGroup which contains Node A is applied to a Pod running on Node B, the addressGroup's span should contain only Node B.

pkg/controller/networkpolicy/clusternetworkpolicy.go

pkg/controller/networkpolicy/networkpolicy_controller.go

pkg/controller/types/group.go

tnqn · 2022-02-16T03:20:20Z

pkg/controller/types/group.go

+		groupSelector.NamespaceSelector, _ = metav1.LabelSelectorAsSelector(nsSelector)
+	}
+
+	if len(nodeSelectors) > 0 && nodeSelectors[0] != nil {


this is a proof why variadic function doesn't apply here.

tnqn · 2022-02-16T03:22:32Z

pkg/controller/types/group.go

+	}
+
+	if len(nodeSelectors) > 0 && nodeSelectors[0] != nil {
+		groupSelector.NodeSelector, _ = metav1.LabelSelectorAsSelector(nodeSelectors[0])


I think when nodeSelector is present, no other fields including "Namespace" should be set to avoid ambiguity

tnqn · 2022-02-16T03:23:46Z

pkg/controller/types/group.go

 // the following format: "namespace=NamespaceName And podSelector=normalizedPodSelector".
 // Note: Namespace and nsSelector may or may not be set depending on the
 // selector. However, they cannot be set simultaneously.
-func generateNormalizedName(namespace string, podSelector, nsSelector, eeSelector labels.Selector) string {
+func GenerateNormalizedName(namespace string, podSelector, nsSelector, eeSelector labels.Selector, nodeSelectors ...labels.Selector) string {


docs/antrea-network-policy.md

Dyanngg · 2022-03-08T00:10:24Z

docs/antrea-network-policy.md

+NodeSelector selects certain Nodes which match the label selector. It adds Node IPs to egress rules in `to` field
+or ingress rules in `from` filed.
+The following rule applies to Pods with label `app=antrea-test-app` and will `Drop` egress traffic to
+Nodes which have the labels `node-role.kubernetes.io/control-plane`.


nit: on TCP port 6443

Dyanngg · 2022-03-08T00:28:59Z

pkg/controller/networkpolicy/clusternetworkpolicy.go

+	oldIPs, err := k8s.GetNodeAddrs(oldNode)
+	if err != nil {
+		return false, err
+	}


Suggested change

oldIPs, err := k8s.GetNodeAddrs(oldNode)

if err != nil {

return false, err

}

if oldIPs, err := k8s.GetNodeAddrs(oldNode); err != nil {

return false, err

}

Dyanngg · 2022-03-08T00:30:06Z

pkg/controller/networkpolicy/crd_utils.go

@@ -115,10 +115,14 @@ func (n *NetworkPolicyController) toAntreaPeerForCRD(peers []v1alpha1.NetworkPol
 		} else if peer.FQDN != "" {
 			fqdns = append(fqdns, peer.FQDN)
 		} else if peer.ServiceAccount != nil {
-			normalizedUID := n.createAddressGroup(peer.ServiceAccount.Namespace, serviceAccountNameToPodSelector(peer.ServiceAccount.Name), nil, nil)
+			normalizedUID := n.createAddressGroup(peer.ServiceAccount.Namespace, serviceAccountNameToPodSelector(peer.ServiceAccount.Name), nil, nil, nil)


not entirely related to your PR but comment on L98 needs update

Dyanngg · 2022-03-08T00:34:18Z

test/e2e/utils/cnpspecbuilder.go

+		Name:      name,
+		AppliedTo: appliedTos,
+	}
+	b.Spec.Egress = append(b.Spec.Egress, newRule)


Is nodeSelector only supported for egress?

Thanks for reviewing. Both egress and ingress rules, and will add more e2e test cases.

docs/antrea-network-policy.md

jianjuns · 2022-03-09T21:41:11Z

docs/antrea-network-policy.md

@@ -1102,6 +1107,35 @@ spec:
      - fqdn: "svcA.default.svc.cluster.local"
 ```

+## Node Selector
+
+NodeSelector selects certain Nodes which match the label selector. It adds Node IPs to egress rules in `to` field


How about:

When used in the to field of an egress rule, it adds the Node IPs to the rule's destination address group; when used in the from field of an ingress rule, it adds the Node IPs to the rule's source address group.

jianjuns · 2022-03-09T21:44:23Z

docs/antrea-network-policy.md

@@ -545,6 +546,10 @@ with `namespaces` field.
 specifies both namespaceSelector and podSelector selects particular Pods within
 particular Namespaces.

+**nodeSelector**: This selects particular Nodes in cluster. The selected Node's
+IPs will set as "sources" if `nodeSelector` set in `ingress` section, or as


will set as -> will be used as

set in -> is set in the

jianjuns · 2022-03-09T21:46:33Z

pkg/apis/crd/v1alpha1/types.go

@@ -439,6 +439,12 @@ type NetworkPolicyPeer struct {
 	// Cannot be set with any other selector.
 	// +optional
 	ServiceAccount *NamespacedName `json:"serviceAccount,omitempty"`
+	// Select certain Nodes which match the label selector,
+	// if no nodeSelector is specified, then no additional Nodes IPs will be added


I feel we can remove this sentence (line 443 - 444), as it does add useful information.

Good catch, done.

jianjuns · 2022-03-09T21:46:52Z

pkg/apis/crd/v1alpha1/types.go

@@ -439,6 +439,12 @@ type NetworkPolicyPeer struct {
 	// Cannot be set with any other selector.
 	// +optional
 	ServiceAccount *NamespacedName `json:"serviceAccount,omitempty"`
+	// Select certain Nodes which match the label selector,


jianjuns · 2022-03-09T21:47:52Z

pkg/controller/types/group.go

@@ -49,27 +49,36 @@ type GroupSelector struct {
 	// If Namespace and NamespaceSelector both are unset, it selects the ExternalEntities in all the Namespaces.
 	// TODO: Add validation in API to not allow externalEntitySelector and podSelector in the same group.
 	ExternalEntitySelector labels.Selector
+
+	// This is a label selector which selects certain Node IPs. Within a group NodeSelector cannot be set concurrently with


concurrently -> together

jianjuns · 2022-03-09T21:48:52Z

pkg/util/k8s/node.go

@@ -57,3 +58,26 @@ func GetNodeAddrs(node *v1.Node) (*ip.DualStackIPs, error) {
 	}
 	return nodeAddrs, nil
 }
+
+// GetNodeAddressFromAnnotations gets available IPs from the Node Annotation, the annotations are set by Antrea, includes


Node Annotation, the -> Node Annotation. The

includes -> including

tnqn · 2022-03-10T14:50:58Z

pkg/agent/agent.go

@@ -641,6 +641,20 @@ func (i *Initializer) setupGatewayInterface() error {
 		return err
 	}

+	// Update the Node Antrea gateway IP address in Node's annotation.
+	gwIPv4Addr, gwIPv6Addr := i.nodeConfig.GatewayConfig.IPv4, i.nodeConfig.GatewayConfig.IPv6


I remember we reach a consensus in the community meeting that we could just "predict" the gateway IPs as some implementation already does it.

pkg/controller/networkpolicy/clusternetworkpolicy.go

tnqn · 2022-03-10T15:01:28Z

pkg/controller/networkpolicy/clusternetworkpolicy.go

+	}
+	if newIPs, err = k8s.GetNodeAddrs(newNode); err != nil {
+		return
+	}


It should return early if change is already identified.
And I think if there is an error, we should return changed as true. Imagine this scenario:
A Node doesn't have a valid Node IP because of a bug or it's not reported yet, after it gets an valid IP, why we don't reconcile the policy with the new IP?

Good catch. Updated.

Second thought, which might make more sense:
We don't need to care whether there is an error when getting oldIPs and newIPs. We should just focus on whether there is a change. If both get error, oldIPs and newIPs are both nil, there is no point to reconcile the rule as well. So the code could just be:

oldIPs, _ = k8s.GetNodeAddrs(oldNode) newIPs, _ = k8s.GetNodeAddrs(newNode) !reflect.DeepEqual(newIPs, oldIPs) { return true }

pkg/controller/networkpolicy/crd_utils.go

tnqn · 2022-03-10T15:34:58Z

pkg/controller/networkpolicy/networkpolicy_controller.go

@@ -1091,18 +1061,36 @@ func (n *NetworkPolicyController) syncAddressGroup(key string) error {
 		utilsets.MergeString(addrGroupNodeNames, internalNP.SpanMeta.NodeNames)
 	}
 	memberSet := n.getAddressGroupMemberSet(addressGroup)
+	if addressGroup.Selector.NodeSelector != nil {
+		ms, nodes := n.addNodeSelectorMemberSet(addressGroup.Selector.NodeSelector)
+		memberSet = memberSet.Union(ms)


No, I think the API is already designed in this way. You should just update getAddressGroupMemberSet to get node IPs when NodeSelector is not nil, instead of still trying to get pod members first.

pkg/controller/networkpolicy/networkpolicy_controller.go

pkg/controller/networkpolicy/networkpolicy_controller_test.go

pkg/controller/networkpolicy/networkpolicy_controller.go

wenqiq · 2022-03-15T03:01:09Z

/test-all

wenqiq · 2022-03-15T05:19:19Z

/test-ipv6-all
/test-ipv6-only-all
/test-windows-all

tnqn · 2022-03-21T03:56:21Z

The PR changes 171 files, please revert unrelated changes

wenqiq · 2022-03-21T04:23:25Z

The PR changes 171 files, please revert unrelated changes

I have executed make codegen and it seems that this changed all the Copyright YEAR info in the generated files.

wenqiq · 2022-03-21T08:11:42Z

Updated.
/test-all
/test-ipv6-all
/test-ipv6-only-all
/test-windows-all

tnqn

LGTM overall

pkg/antctl/command_definition_test.go

pkg/antctl/transform/addressgroup/transform.go

pkg/controller/networkpolicy/store/addressgroup.go

pkg/util/k8s/node.go

docs/antrea-network-policy.md

pkg/controller/networkpolicy/networkpolicy_controller.go

docs/antrea-network-policy.md

pkg/controller/networkpolicy/networkpolicy_controller.go

pkg/controller/networkpolicy/networkpolicy_controller_test.go

test/e2e/antreapolicy_test.go

docs/antrea-network-policy.md

tnqn

LGTM, one nit

docs/antrea-network-policy.md

wenqiq · 2022-03-23T15:33:05Z

/test-all-features-conformance
/test-conformance
/test-e2e
/test-flexible-ipam-e2e
/test-ipv6-conformance
/test-ipv6-e2e
/test-ipv6-networkpolicy
/test-ipv6-only-conformance
/test-ipv6-only-e2e
/test-ipv6-only-networkpolicy
/test-multicluster-e2e
/test-networkpolicy
/test-windows-conformance
/test-windows-e2e
/test-windows-networkpolicy
/test-windows-proxyall-e2e

docs/antrea-network-policy.md

tnqn · 2022-03-24T05:45:05Z

docs/antrea-network-policy.md

+3. The transport IP (the IP address of the interface used for tunneling or routing the traffic across Nodes) if it's different from Node IP
+
+Traffic to/from other IPs of the Node will be ignored.
+Meanwhile, `NodeSelector` doesn’t affect the traffic from Node to Pods running on that Node. Such traffic will always be allowed to make sure that [agents on a Node (e.g. system daemons, kubelet) can communicate with all Pods on that Node](https://kubernetes.io/docs/concepts/services-networking/#the-kubernetes-network-model) to perform liveness and readiness probes. For more information, see [https://github.com/antrea-io/antrea/pull/104](https://github.com/antrea-io/antrea/pull/104).


Please break the line into multiple lines, aligning with other lines

tnqn · 2022-03-24T05:49:55Z

test/e2e/antreapolicy_test.go

+				Connected,
+			},
+			{
+				Pod("z/" + clientName1),


With or without NodeSelector, this client can access this server, what does it validate?

This case verified that the other Node to Pod traffic will not be affected by the nodeSelector rule.
However, using the third Node to verify this is more appropriate.
Meanwhile, it seems that there is no test case about local Node traffic to Pod, from this point of view, the test case makes sense?

testDefaultDenyIngressPolicy tests probe traffic

1. Add `nodeSelector` field in ACNP/ANP ingress/egress rules to restrict traffic to/from particular Nodes. 2. Add Node IPs info in the output of `antctl get addressgroup`. For example: ``` antctl get addressgroup NAME POD-IPS NODE-IPS 5e1bbf8e-67a3-5384-b2bf-e42e93bd68aa <NONE> 192.168.0.1, 10.176.27.105 f8c56571-d6db-51ec-9352-a9a47476a9a0 192.168.0.70,192.168.1.38,192.168.1.39 <NONE> antctl get addressgroup -oyaml - name: 5e1bbf8e-67a3-5384-b2bf-e42e93bd68aa nodes: - ip: 192.168.0.1, 10.176.27.105 node: name: wenqiq01-1 - name: f8c56571-d6db-51ec-9352-a9a47476a9a0 pods: - ip: 192.168.1.38 pod: name: iperf3-55bcff667d-v495l namespace: demo - ip: 192.168.1.39 pod: name: iperf3-55bcff667d-c74ll namespace: demo - ip: 192.168.0.70 pod: name: iperf3-55bcff667d-pz2d2 namespace: demo ``` Fixes: antrea-io#3023 Signed-off-by: Wenqi Qiu <wenqiq@vmware.com> Co-authored-by: Quan Tian <qtian@vmware.com>

wenqiq · 2022-03-24T06:43:56Z

Rebase and squash the commits.

Signed-off-by: Wenqi Qiu <wenqiq@vmware.com>

tnqn

LGTM

tnqn · 2022-03-24T10:56:07Z

/test-all
/test-ipv6-all
/test-ipv6-only-all
/test-windows-all

wenqiq · 2022-03-24T11:50:06Z

unit-test failed:

ok  	antrea.io/antrea/pkg/support	1.388s
I0324 11:35:21.314426    4204 channel.go:83] "Starting SubscribableChannel" name="foo"
--- FAIL: TestSubscribe (0.54s)
    channel_test.go:74: 
        	Error Trace:	channel_test.go:74
        	Error:      	Received unexpected error:
        	            	timed out waiting for the condition
        	Test:       	TestSubscribe
        	Messages:   	Receiver 0 failed to receive all events, expected 1000 events, got 935 events
I0324 11:35:21.857609    4204 channel.go:87] "Stopping SubscribableChannel" name="foo"
E0324 11:35:22.858412    4204 channel.go:77] "Failed to send event to channel, will discard it" name="foo" event="foo"
FAIL
FAIL	antrea.io/antrea/pkg/util/channel	1.587s

tnqn reviewed Nov 26, 2021

View reviewed changes

wenqiq force-pushed the anp-nodeselector branch from cdd18cd to fb11075 Compare December 1, 2021 05:50

wenqiq force-pushed the anp-nodeselector branch from fb11075 to 99e08ee Compare January 29, 2022 02:04

wenqiq force-pushed the anp-nodeselector branch 3 times, most recently from 456d0c7 to f674958 Compare February 16, 2022 00:59

tnqn reviewed Feb 16, 2022

View reviewed changes

wenqiq force-pushed the anp-nodeselector branch 3 times, most recently from 01279b8 to 67cc539 Compare February 21, 2022 06:34

jianjuns reviewed Feb 25, 2022

View reviewed changes

docs/antrea-network-policy.md Outdated Show resolved Hide resolved

wenqiq force-pushed the anp-nodeselector branch 3 times, most recently from 6f3842f to 275530d Compare March 3, 2022 15:46

Dyanngg reviewed Mar 8, 2022

View reviewed changes

wenqiq force-pushed the anp-nodeselector branch 2 times, most recently from bbf96b4 to 90e87b5 Compare March 9, 2022 10:51

tnqn added this to the Antrea v1.6 release milestone Mar 9, 2022

tnqn added the action/release-note Indicates a PR that should be included in release notes. label Mar 9, 2022

jianjuns reviewed Mar 9, 2022

View reviewed changes

tnqn reviewed Mar 10, 2022

View reviewed changes

pkg/controller/networkpolicy/networkpolicy_controller.go Show resolved Hide resolved

wenqiq force-pushed the anp-nodeselector branch from a618ab7 to 80fb279 Compare March 11, 2022 08:41

wenqiq force-pushed the anp-nodeselector branch 2 times, most recently from 275530d to 8a014a0 Compare March 18, 2022 07:34

wenqiq force-pushed the anp-nodeselector branch from 8e26562 to 8e9146f Compare March 21, 2022 00:58

wenqiq force-pushed the anp-nodeselector branch from 8e9146f to b3f2fcc Compare March 21, 2022 04:13

wenqiq force-pushed the anp-nodeselector branch from b3f2fcc to 64bb552 Compare March 21, 2022 05:36

wenqiq force-pushed the anp-nodeselector branch from 64bb552 to c61fb19 Compare March 21, 2022 09:59

tnqn reviewed Mar 21, 2022

View reviewed changes

wenqiq force-pushed the anp-nodeselector branch from c61fb19 to 8fad6f7 Compare March 21, 2022 19:41

wenqiq commented Mar 22, 2022

View reviewed changes

pkg/controller/networkpolicy/networkpolicy_controller.go Show resolved Hide resolved

wenqiq force-pushed the anp-nodeselector branch from ae7d793 to f7721e6 Compare March 22, 2022 09:45

tnqn reviewed Mar 22, 2022

View reviewed changes

wenqiq force-pushed the anp-nodeselector branch from fbb0126 to 8adb079 Compare March 23, 2022 01:43

tnqn reviewed Mar 23, 2022

View reviewed changes

docs/antrea-network-policy.md Outdated Show resolved Hide resolved

tnqn previously approved these changes Mar 23, 2022

View reviewed changes

wenqiq dismissed stale reviews from tnqn via bb8fd20 March 23, 2022 03:32

wenqiq commented Mar 23, 2022

View reviewed changes

docs/antrea-network-policy.md Show resolved Hide resolved

tnqn reviewed Mar 24, 2022

View reviewed changes

docs/antrea-network-policy.md Outdated Show resolved Hide resolved

tnqn reviewed Mar 24, 2022

View reviewed changes

wenqiq force-pushed the anp-nodeselector branch from 54bb043 to 37b5c92 Compare March 24, 2022 06:42

Update test case

4b06963

Signed-off-by: Wenqi Qiu <wenqiq@vmware.com>

tnqn approved these changes Mar 24, 2022

View reviewed changes

tnqn merged commit 073f5ab into antrea-io:main Mar 24, 2022

	NodeSelector selects certain Nodes which match the label selector. Add Node IPs to address group memberSet.
	NodeSelector selects certain Nodes which match the label selector. It adds Node IPs to address group memberSet.

	The following rule applied to Pods with label `app=antrea-test-app` and will `Drop` egress traffic to
	The following rule applies to Pods with label `app=antrea-test-app` and will `Drop` egress traffic to

	Nodes which has labels `kubernetes.io/hostname=kind-control-plane`.
	Nodes which have the labels `kubernetes.io/hostname=kind-control-plane`.

Add Node Selector in ACNP/ANP ingress/egress rules #3038

Add Node Selector in ACNP/ANP ingress/egress rules #3038

Conversation

wenqiq commented Nov 19, 2021 • edited

codecov-commenter commented Nov 19, 2021 • edited

Codecov Report

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

wenqiq commented Mar 15, 2022

wenqiq commented Mar 15, 2022

tnqn commented Mar 21, 2022

wenqiq commented Mar 21, 2022

wenqiq commented Mar 21, 2022

tnqn left a comment

Choose a reason for hiding this comment

tnqn left a comment

Choose a reason for hiding this comment

wenqiq commented Mar 23, 2022

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

wenqiq Mar 24, 2022 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

wenqiq commented Mar 24, 2022

tnqn left a comment

Choose a reason for hiding this comment

tnqn commented Mar 24, 2022

wenqiq commented Mar 24, 2022

wenqiq commented Nov 19, 2021 •

edited

codecov-commenter commented Nov 19, 2021 •

edited

wenqiq Mar 24, 2022 •

edited