diff --git a/pkg/agent/apiserver/handlers/networkpolicy/handler.go b/pkg/agent/apiserver/handlers/networkpolicy/handler.go index 2c8d48b4b24..eab3a30cb91 100644 --- a/pkg/agent/apiserver/handlers/networkpolicy/handler.go +++ b/pkg/agent/apiserver/handlers/networkpolicy/handler.go @@ -30,7 +30,7 @@ import ( // to query network policy rules in current agent. func HandleFunc(aq agentquerier.AgentQuerier) http.HandlerFunc { return func(w http.ResponseWriter, r *http.Request) { - npFilter, err := newFilterFromURLQuery(r.URL.Query()) + npFilter, pod, err := newFilterFromURLQuery(r.URL.Query()) if err != nil { http.Error(w, err.Error(), http.StatusBadRequest) return @@ -40,10 +40,11 @@ func HandleFunc(aq agentquerier.AgentQuerier) http.HandlerFunc { npq := aq.GetNetworkPolicyInfoQuerier() var nps []cpv1beta.NetworkPolicy - if npFilter.Pod != "" { - interfaces := aq.GetInterfaceStore().GetContainerInterfacesByPod(npFilter.Pod, npFilter.Namespace) + if pod != "" { + namespaceAndPodName := strings.Split(pod, "/") + interfaces := aq.GetInterfaceStore().GetContainerInterfacesByPod(namespaceAndPodName[1], namespaceAndPodName[0]) if len(interfaces) > 0 { - nps = npq.GetAppliedNetworkPolicies(npFilter.Pod, npFilter.Namespace, npFilter) + nps = npq.GetAppliedNetworkPolicies(namespaceAndPodName[1], namespaceAndPodName[0], npFilter) } } else { nps = npq.GetNetworkPolicies(npFilter) @@ -65,30 +66,29 @@ var mapToNetworkPolicyType = map[string]cpv1beta.NetworkPolicyType{ } // Create a Network Policy Filter from URL Query -func newFilterFromURLQuery(query url.Values) (*querier.NetworkPolicyQueryFilter, error) { - namespace := query.Get("namespace") - pod := query.Get("pod") - if pod != "" && namespace == "" { - return nil, fmt.Errorf("with a pod name, namespace must be provided") +func newFilterFromURLQuery(query url.Values) (*querier.NetworkPolicyQueryFilter, string, error) { + namespace, pod := query.Get("namespace"), query.Get("pod") + if pod != "" { + if !strings.Contains(pod, "/") { + return nil, "", fmt.Errorf("invalid pod option foramt. Expected format is podNamespace/podName") + } else if namespace != "" { + return nil, "", fmt.Errorf("namespace option should not be used with pod option") + } } - strSourceType := strings.ToUpper(query.Get("type")) npSourceType, ok := mapToNetworkPolicyType[strSourceType] if strSourceType != "" && !ok { - return nil, fmt.Errorf("invalid reference type. It should be K8sNP, ACNP or ANP") + return nil, "", fmt.Errorf("invalid policy source type. Valid values are K8sNP, ACNP and ANP") } - source := query.Get("source") name := query.Get("name") if name != "" && (source != "" || namespace != "" || pod != "" || strSourceType != "") { - return nil, fmt.Errorf("with a name, none of the other fields can be set") + return nil, "", fmt.Errorf("with a policy name, none of the other options should be set") } - return &querier.NetworkPolicyQueryFilter{ Name: name, SourceName: source, Namespace: namespace, - Pod: pod, SourceType: npSourceType, - }, nil + }, pod, nil } diff --git a/pkg/agent/controller/networkpolicy/cache.go b/pkg/agent/controller/networkpolicy/cache.go index 1adc8866423..32011eaf8cd 100644 --- a/pkg/agent/controller/networkpolicy/cache.go +++ b/pkg/agent/controller/networkpolicy/cache.go @@ -220,6 +220,7 @@ func (c *ruleCache) getAppliedNetworkPolicies(pod, namespace string, npFilter *q } if c.networkPolicyMatchFilter(npFilter, np) { policies = append(policies, *np) + policyKeys.Insert(string(rule.PolicyUID)) } } } diff --git a/pkg/antctl/antctl.go b/pkg/antctl/antctl.go index aaa0b1f9877..7a58b19a907 100644 --- a/pkg/antctl/antctl.go +++ b/pkg/antctl/antctl.go @@ -148,7 +148,7 @@ var CommandList = &commandList{ Get the list of control plane NetworkPolicies with a specific source Type (supported by agent only) $ antctl get networkpolicy -T acnp Get the list of control plane NetworkPolicies applied to a Pod (supported by agent only) - $ antctl get networkpolicy -p pod1 -n ns1`, + $ antctl get networkpolicy -p ns1/pod1`, commandGroup: get, controllerEndpoint: &endpoint{ resourceEndpoint: &resourceEndpoint{ @@ -177,7 +177,7 @@ var CommandList = &commandList{ }, { name: "pod", - usage: "Get NetworkPolicies applied to the Pod. If present, Namespace must be provided.", + usage: "Get NetworkPolicies applied to the Pod. Pod format is podNamespace/podName.", shorthand: "p", }, { diff --git a/pkg/querier/querier.go b/pkg/querier/querier.go index 9b4fbfe413e..29b9ebb3fad 100644 --- a/pkg/querier/querier.go +++ b/pkg/querier/querier.go @@ -87,8 +87,6 @@ type NetworkPolicyQueryFilter struct { SourceName string // The namespace of the original Namespace that the internal NetworkPolicy is created for. Namespace string - // Name of the pod that the network policy is applied on. - Pod string // The type of the original NetworkPolicy that the internal NetworkPolicy is created for.(K8sNP, CNP, ANP) SourceType cpv1beta.NetworkPolicyType }