hubble/correlation: Support deny policies

[gandro]

No description provided.

[michi-covalent]

just stopping by to say that i'm super excited about this. i'lll play around with it next week and let you know how it goes 🚀🙏

[gandro]

Did some local testing. Seems to work okay, given deny policy precedence (which is not always intuitive, but I have not found any discrepancies between what the policy engine does and what we correlate with) . Also extended the unit tests.

[michi-covalent]

cool! i'll try it out today. thanks sebastian!

[gandro]

/test

[michi-covalent]

✅ i did a quick manual test:

minikube start --network-plugin=cni --cni=false
helm install -n kube-system cilium oci://quay.io/cilium-charts-dev/cilium --version 1.16.0-dev-dev.347-HEAD-f2b193d01d
cat << EOF | kubectl apply -f -
apiVersion: "cilium.io/v2"
kind: CiliumNetworkPolicy
metadata:
  name: "deny-world"
spec:
  endpointSelector: {}
  egressDeny:
  - toEntities:
    - "world"
EOF

then

kubectl exec -n kube-system ds/cilium -c cilium-agent bash -- hubble observe -f -t policy-verdict -n default

and generate some traffic to world:

kubectl run -it --rm curl --image=badouralix/curl-jq  -- sh
curl 1.1.1.1

and i see:

    "egress_denied_by": [
      {
        "name": "deny-world",
        "namespace": "default",
        "labels": [
          "k8s:io.cilium.k8s.policy.derived-from=CiliumNetworkPolicy",
          "k8s:io.cilium.k8s.policy.name=deny-world",
          "k8s:io.cilium.k8s.policy.namespace=default",
          "k8s:io.cilium.k8s.policy.uid=e5165fac-a66b-48fd-b3e6-73ee414b371b"
        ],
        "revision": "2"
      }

i wasn't seeing this field yesterday because i forgot to re-compile the hubble CLI with the new protobuf definitions 👻

[gandro]

/test

[gandro]

Reviews are in, merging