Bug 1967132: policy: handle NetworkPolicies single "from" multiple "ipBlock" #562

danwinship · 2021-06-02T13:22:29Z

backport of #530 ; we only handled NPs with multiple ipBlock entries if they were written in a particular way

/hold
Are there upgrade concerns here? Will this change leave stray ACLs around? Will they ever get cleaned up? (EDIT: Yes, Yes, No; fixed by second commit)

openshift-ci · 2021-06-02T13:22:39Z

@danwinship: This pull request references Bugzilla bug 1967132, which is valid. The bug has been moved to the POST state. The bug has been updated to refer to the pull request using the external bug tracker.

6 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target release (4.7.z) matches configured target release for branch (4.7.z)
bug is in the state NEW, which is one of the valid states (NEW, ASSIGNED, ON_DEV, POST, POST)
dependent bug Bugzilla bug 1953680 is in the state VERIFIED, which is one of the valid states (VERIFIED, RELEASE_PENDING, CLOSED (ERRATA), CLOSED (CURRENTRELEASE))
dependent Bugzilla bug 1953680 targets the "4.8.0" release, which is one of the valid target releases: 4.8.0
bug has dependents

No GitHub users were found matching the public email listed for the QA contact in Bugzilla (anusaxen@redhat.com), skipping review request.

In response to this:

Bug 1967132: policy: handle NetworkPolicies single "from" multiple "ipBlock"

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

trozet · 2021-06-02T17:41:43Z

@danwinship it looks like this could potentially be a problem. We update the acl using:

func (gp *gressPolicy) modifyACLAllow(oldMatch, newMatch string) error {
	uuid, stderr, err := util.RunOVNNbctl("--data=bare", "--no-heading",
		"--columns=_uuid", "find", "ACL", oldMatch,
		fmt.Sprintf("external-ids:namespace=%s", gp.policyNamespace),
		fmt.Sprintf("external-ids:policy=%s", gp.policyName),
		fmt.Sprintf("external-ids:%s_num=%d", gp.policyType, gp.idx),
		fmt.Sprintf("external-ids:policy_type=%s", gp.policyType))

basically using the old match to find the old policy and update it...not great. We probably need a sync method on upgrade to search for all the buggy acls, then call modifyACLAllow and fix them with the right match criteria

We were handling ingress: - from: - ipBlock: ... - from: - ipBlock: ... but not ingress: - from: - ipBlock: ... - ipBlock: ... Signed-off-by: Dan Winship <danwinship@redhat.com>

The previous change to support NetworkPolicies with multiple ipBlocks was not backward-compatible with existing clusters. Fix it to still use the old-style external-ids for policies with 0 or 1 ipBlock(s). Signed-off-by: Dan Winship <danwinship@redhat.com>

danwinship · 2021-07-27T14:25:22Z

/hold cancel
forgot to get back to this backport after we fixed the problem in master...

danwinship · 2021-07-30T14:19:51Z

/retest

squeed · 2021-08-02T13:27:20Z

/lgtm

openshift-ci · 2021-08-02T13:29:45Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: danwinship, squeed

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [danwinship,squeed]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci · 2021-08-02T14:47:13Z

@danwinship: This pull request references Bugzilla bug 1967132, which is valid.

6 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target release (4.7.z) matches configured target release for branch (4.7.z)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, ON_DEV, POST, POST)
dependent bug Bugzilla bug 1953680 is in the state CLOSED (ERRATA), which is one of the valid states (VERIFIED, RELEASE_PENDING, CLOSED (ERRATA), CLOSED (CURRENTRELEASE))
dependent Bugzilla bug 1953680 targets the "4.8.0" release, which is one of the valid target releases: 4.8.0, 4.8.z
bug has dependents

No GitHub users were found matching the public email listed for the QA contact in Bugzilla (anusaxen@redhat.com), skipping review request.

In response to this:

Bug 1967132: policy: handle NetworkPolicies single "from" multiple "ipBlock"

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-bot · 2021-08-02T14:54:46Z

/retest-required

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2021-08-02T15:20:46Z

/retest-required

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2021-08-02T16:37:58Z

/retest-required

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2021-08-02T17:03:57Z

/retest-required

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2021-08-02T17:42:58Z

/retest-required

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2021-08-02T19:52:58Z

/retest-required

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2021-08-02T21:10:58Z

/retest-required

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2021-08-02T22:28:59Z

/retest-required

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2021-08-02T23:20:58Z

/retest-required

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2021-08-04T02:05:24Z

/retest-required

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2021-08-04T02:17:24Z

/retest-required

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2021-08-04T02:29:25Z

/retest-required

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2021-08-04T04:00:34Z

/retest-required

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2021-08-04T04:13:27Z

/retest-required

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2021-08-04T09:33:21Z

/retest-required

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2021-08-04T09:45:21Z

/retest-required

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2021-08-04T10:45:21Z

/retest-required

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2021-08-04T10:57:20Z

/retest-required

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2021-08-04T14:33:20Z

/retest-required

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2021-08-04T14:57:21Z

/retest-required

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2021-08-04T15:45:22Z

/retest-required

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2021-08-04T16:21:22Z

/retest-required

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2021-08-04T16:57:24Z

/retest-required

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2021-08-04T18:34:20Z

/retest-required

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2021-08-04T18:58:27Z

/retest-required

Please review the full test history for this PR and help us cut down flakes.

ecordell · 2021-08-04T19:24:43Z

[patch-manager] 🚀 Approved for z-stream by score: 1.50

picked

openshift-bot · 2021-08-04T19:34:22Z

/retest-required

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2021-08-04T19:46:22Z

/retest-required

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2021-08-04T20:24:23Z

/retest-required

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2021-08-04T22:29:52Z

/retest-required

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2021-08-04T22:54:53Z

/retest-required

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2021-08-04T23:06:54Z

/retest-required

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2021-08-04T23:42:54Z

/retest-required

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2021-08-04T23:54:54Z

/retest-required

Please review the full test history for this PR and help us cut down flakes.

openshift-ci · 2021-08-04T23:59:20Z

@danwinship: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Rerun command
ci/prow/okd-e2e-gcp-ovn	`05380a4`	link	`/test okd-e2e-gcp-ovn`

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

openshift-bot · 2021-08-05T00:18:53Z

/retest-required

Please review the full test history for this PR and help us cut down flakes.

openshift-ci · 2021-08-05T01:40:16Z

@danwinship: All pull requests linked via external trackers have merged:

openshift/ovn-kubernetes#562

Bugzilla bug 1967132 has been moved to the MODIFIED state.

In response to this:

Bug 1967132: policy: handle NetworkPolicies single "from" multiple "ipBlock"

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

danwinship requested review from trozet and dcbw June 2, 2021 13:22

openshift-ci bot requested review from abhat and squeed June 2, 2021 13:22

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jun 2, 2021

danwinship added 2 commits July 27, 2021 10:20

policy: handle NetworkPolicies single "from" multiple "ipBlock"

f5a3441

We were handling ingress: - from: - ipBlock: ... - from: - ipBlock: ... but not ingress: - from: - ipBlock: ... - ipBlock: ... Signed-off-by: Dan Winship <danwinship@redhat.com>

danwinship force-pushed the ipblock-parsing-4.7 branch from ba301eb to 05380a4 Compare July 27, 2021 14:24

openshift-ci bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jul 27, 2021

openshift-ci bot assigned squeed Aug 2, 2021

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Aug 2, 2021

ecordell added the cherry-pick-approved Indicates a cherry-pick PR into a release branch has been approved by the release branch manager. label Aug 4, 2021

openshift-ci bot merged commit 82f63de into openshift:release-4.7 Aug 5, 2021

Bug 1967132: policy: handle NetworkPolicies single "from" multiple "ipBlock" #562

Bug 1967132: policy: handle NetworkPolicies single "from" multiple "ipBlock" #562

Conversation

danwinship commented Jun 2, 2021 • edited Loading

openshift-ci bot commented Jun 2, 2021

trozet commented Jun 2, 2021

danwinship commented Jul 27, 2021

danwinship commented Jul 30, 2021

squeed commented Aug 2, 2021

openshift-ci bot commented Aug 2, 2021

openshift-ci bot commented Aug 2, 2021

openshift-bot commented Aug 2, 2021

openshift-bot commented Aug 2, 2021

openshift-bot commented Aug 2, 2021

openshift-bot commented Aug 2, 2021

openshift-bot commented Aug 2, 2021

openshift-bot commented Aug 2, 2021

openshift-bot commented Aug 2, 2021

openshift-bot commented Aug 2, 2021

openshift-bot commented Aug 2, 2021

openshift-bot commented Aug 4, 2021

openshift-bot commented Aug 4, 2021

openshift-bot commented Aug 4, 2021

openshift-bot commented Aug 4, 2021

openshift-bot commented Aug 4, 2021

openshift-bot commented Aug 4, 2021

openshift-bot commented Aug 4, 2021

openshift-bot commented Aug 4, 2021

openshift-bot commented Aug 4, 2021

openshift-bot commented Aug 4, 2021

openshift-bot commented Aug 4, 2021

openshift-bot commented Aug 4, 2021

openshift-bot commented Aug 4, 2021

openshift-bot commented Aug 4, 2021

openshift-bot commented Aug 4, 2021

openshift-bot commented Aug 4, 2021

ecordell commented Aug 4, 2021

openshift-bot commented Aug 4, 2021

openshift-bot commented Aug 4, 2021

openshift-bot commented Aug 4, 2021

openshift-bot commented Aug 4, 2021

openshift-bot commented Aug 4, 2021

openshift-bot commented Aug 4, 2021

openshift-bot commented Aug 4, 2021

openshift-bot commented Aug 4, 2021

openshift-ci bot commented Aug 4, 2021 • edited Loading

openshift-bot commented Aug 5, 2021

openshift-ci bot commented Aug 5, 2021

danwinship commented Jun 2, 2021 •

edited

Loading

openshift-ci bot commented Aug 4, 2021 •

edited

Loading