fix: [NPM] adding unsupported translation check for windows NPM

npm/pkg/controlplane/controllers/v2/networkPolicyController.go

@@ -23,7 +23,10 @@ import (
 	"k8s.io/klog"
 )
 
-var errNetPolKeyFormat = errors.New("invalid network policy key format")
+var (
+	errNetPolKeyFormat          = errors.New("invalid network policy key format")
+	errNetPolTranslationFailure = errors.New("failed to translate network policy")
+)
 
 type NetworkPolicyController struct {
 	netPolLister netpollister.NetworkPolicyLister
@@ -255,7 +258,17 @@ func (c *NetworkPolicyController) syncAddAndUpdateNetPol(netPolObj *networkingv1
 	}
 
 	// install translated rules into kernel
-	npmNetPolObj := translation.TranslatePolicy(netPolObj)
+	npmNetPolObj, err := translation.TranslatePolicy(netPolObj)
+	if err != nil {
+		if errors.Is(err, translation.ErrUnsupportedNamedPort) || errors.Is(err, translation.ErrUnsupportedNegativeMatch) {
+			// We can safely suppress unsupported network policy because re-Queuing will result in same error
+			klog.Warningf("NetworkPolicy %s in namespace %s is not translated because it has unsupported translated features of Windows.", netPolObj.ObjectMeta.Name, netPolObj.ObjectMeta.Namespace)
+			return nil
+		}
+		klog.Errorf("Failed to translate podSelector in NetworkPolicy %s in namespace %s: %s", netPolObj.ObjectMeta.Name, netPolObj.ObjectMeta.Namespace, err.Error())
+		return errNetPolTranslationFailure
+	}
+
 	// install translated rules into Dataplane
 	// DP update policy call will check if this policy already exists in kernel
 	// if yes: then will delete old rules and program new rules

npm/pkg/controlplane/controllers/v2/podcontroller.go → npm/pkg/controlplane/controllers/v2/podController.go

@@ -603,6 +603,10 @@ func (c *PodController) cleanUpDeletedPod(cachedNpmPodKey string) error {
 // manageNamedPortIpsets helps with adding or deleting Pod namedPort IPsets.
 func (c *PodController) manageNamedPortIpsets(portList []corev1.ContainerPort, podKey,
 	podIP, nodeName string, namedPortOperation NamedPortOperation) error {
+	if util.IsWindowsDP() {
+		klog.Warningf("Windows Dataplane does not support NamedPort operations. Operation: %s portList is %+v", namedPortOperation, portList)
+		return nil
+	}
 	for _, port := range portList {
 		klog.Infof("port is %+v", port)
 		if port.Name == "" {

npm/pkg/controlplane/translation/parseSelector.go

@@ -230,7 +230,7 @@ func parseNSSelector(selector *metav1.LabelSelector) []labelSelector {
 // parsePodSelector parses podSelector and returns slice of labelSelector object
 // which includes operator, setType, ipset name and its members slice.
 // Members slice exists only if setType is only NestedLabelOfPod.
-func parsePodSelector(selector *metav1.LabelSelector) []labelSelector {
+func parsePodSelector(selector *metav1.LabelSelector) ([]labelSelector, error) {
 	parsedSelectors := newParsedSelectors()
 
 	// #1. MatchLabels
@@ -245,7 +245,11 @@ func parsePodSelector(selector *metav1.LabelSelector) []labelSelector {
 		var setName string
 		var setType ipsets.SetType
 		var members []string
-		switch op := req.Operator; op {
+		op := req.Operator
+		if unsupportedOpsInWindows(op) {
+			return nil, ErrUnsupportedNegativeMatch
+		}
+		switch op {
 		case metav1.LabelSelectorOpIn, metav1.LabelSelectorOpNotIn:
 			// "(!) + matchKey + : + matchVal" case
 			if len(req.Values) == 1 {
@@ -270,5 +274,10 @@ func parsePodSelector(selector *metav1.LabelSelector) []labelSelector {
 		parsedSelectors.addSelector(noNegativeOp, setType, setName, members...)
 	}
 
-	return parsedSelectors.labelSelectors
+	return parsedSelectors.labelSelectors, nil
+}
+
+func unsupportedOpsInWindows(op metav1.LabelSelectorOperator) bool {
+	return util.IsWindowsDP() &&
+		(op == metav1.LabelSelectorOpNotIn || op == metav1.LabelSelectorOpDoesNotExist)
 }