fix: [NPM] niche multi-value pod selector bug

[huntergregory]

Fixes a niche bug in NPM v2, where netpol behavior becomes inaccurate if 2+ network policies have the exact same multi-value pod selector, and one of those policies is deleted.

Currently, can mitigate by re-adding one of the existing policies with that pod selector.

Fix

NestedLabelOfPod ipsets must have a different ipset name for each policy.

Example

Using this network policy

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: nestedlabel-policy
  namespace: x
spec:
  ingress:
  - from:
    ports:
    - port: 81
      protocol: TCP
  podSelector:
    matchExpressions:
    - key: pod
      operator: In
      values:
      - a
      - b
  policyTypes:
  - Ingress

and the agnhost pods from here. You'll need to label a node with the vm=0.

The ./connect-agnhosts.sh script can be found here.

$ kubectl apply -f nestedlabel-policy.yaml 
networkpolicy.networking.k8s.io/nestedlabel-policy created

$ ./connect-agnhosts.sh x a x b -r 81
TIMEOUT
command terminated with exit code 1
Connection failed from x/a to x/b via tcp on port 81.
# CORRECTLY BLOCK TRAFFIC

$ kubectl exec -it -n kube-system azure-npm-84v79 -- ipset -L azure-npm-2682470511
Name: azure-npm-2682470511 # nestedlabel-pod:a:b
Type: list:set
Revision: 3
Header: size 8
Size in memory: 176
References: 1
Number of entries: 2
Members:
azure-npm-3922407721 # podlabel-pod:a
azure-npm-3872074864 # podlabel-pod b
# IPSET HAS 2 MEMBERS

$ kubectl apply -f test-policies/nestedlabel-policy-copy.yaml 
networkpolicy.networking.k8s.io/nestedlabel-policy-copy created

$ kubectl exec -it -n kube-system azure-npm-84v79 -- ipset -L azure-npm-2682470511
Name: azure-npm-2682470511 # nestedlabel-pod:a:b
Type: list:set
Revision: 3
Header: size 8
Size in memory: 176
References: 2
Number of entries: 2
Members:
azure-npm-3922407721 # podlabel-pod a
azure-npm-3872074864 # podlabel-pod b
# IPSET HAS SAME 2 MEMBERS

$ kubectl delete netpol -n x nestedlabel-policy-copy
networkpolicy.networking.k8s.io "nestedlabel-policy-copy" deleted

$ kubectl exec -it -n kube-system azure-npm-84v79 -- ipset -L azure-npm-2682470511
Name: azure-npm-2682470511
Type: list:set
Revision: 3
Header: size 8
Size in memory: 80
References: 1
Number of entries: 0
Members:
# IPSET HAS NO MEMBERS NOW

$ ./connect-agnhosts.sh x a x b -r 81
Successfully connected from x/a to x/b via tcp on port 81.
# INCORRECTLY ALLOW TRAFFIC after deleting the network policy with the same multi-label pod selector

[huntergregory]

/azp run

[huntergregory]

/azp run

[azure-pipelines]

Azure Pipelines successfully started running 2 pipeline(s).