-
Notifications
You must be signed in to change notification settings - Fork 463
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add support for 'except' feature of network policy rule #543
Add support for 'except' feature of network policy rule #543
Conversation
c16d568
to
eb63d8d
Compare
eb63d8d
to
f1a3e2d
Compare
@jimmy-zh |
@sohel2020 The CIDR with zero prefix size is supported both in k8s network policy rule defination and iptables -s or -d option while it isn't supported in ipset (#529). I also just realized that. @murali-reddy @roffe |
@jimmy-zh thanks for your PR. With this i think network policies should be complaint with network policies spec. I am stealing idea from somewhere, don't know if it actually works. split
|
@murali-reddy thanks for your idea. Splitting |
@murali-reddy I have modified this PR to support the CIDR with zero prefix size and verified the effectiveness of the above skill. Please check this when you are free. Thanks. |
thanks @jimmy-zh i tested @sohel2020 would be be able to quickly verify with current patch? |
@murali-reddy Now how should write the following snippet ?
|
@sohel2020 you don't have to change any thing in network policies. Just try out which ever you are planning to test out. Its only implementation detail that had to be adopted to overcome ipset issue. |
@jimmy-zh Thanks for this PR. @murali-reddy It works as expected. |
@jimmy-zh thanks for your great contributions. AFAICS, network policy implementation in kube-router is complete? Do you still see any gaps? |
@murali-reddy Sorry for the late reply. It seems that the named port (#338) has not been implemented. So far, I have not observed any other gaps. |
Add support for
except
feature of network policy rule.Solve #326 based on #529
I have completed the following test cases:
except
rule.except
rules.