Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Network policy: use shared pod selector address sets #3329

Merged
merged 5 commits into from
Mar 17, 2023
Merged

Network policy: use shared pod selector address sets #3329

merged 5 commits into from
Mar 17, 2023

Commits on Mar 16, 2023

  1. Unlock shared default deny port group early, when no db changes 

    required, to unlock other handlers from the same namespace.

Signed-off-by: Nadia Pinaeva <npinaeva@redhat.com>
    @npinaeva
    npinaeva committed Mar 16, 2023
    Configuration menu
    Copy the full SHA
    f6f3ed8 View commit details
    Browse the repository at this point in the history

  2. Add PodSelectorAddressSet object, that should be used to manage 

    address sets for pod selector (network policy object is only
responsible for local pods and peer namespace-only handlers).
The locking mechanism is copied from networkPolicy.

Update deletre logic for completed pods: match collided pod
not only by podSeelctor, but also by namespace selector.

PeerPod functions were moved from policy.go and gress_policy.go.

Update syncNetworkPolicies to cleanup policies based on acls, and not
address sets, since address sets are not created for policies without
peers with selectors, and it doesn't cleanup default deny port groups.
New sync is based on acls, it will only skip empty policies without
any gress rules. This should be fixed later with proper ownership
indexing for port groups.

Rename metrics from peer/network_policy to pod_selector_address_set.

Signed-off-by: Nadia Pinaeva <npinaeva@redhat.com>
    @npinaeva
    npinaeva committed Mar 16, 2023
    Configuration menu
    Copy the full SHA
    120140f View commit details
    Browse the repository at this point in the history

  3. Rework gressPolicy ACLs build: previously all gress policies with at 

    least one selector had peerAddressSet, and empty gress (allow all)
was identified by "gp.sizeOfAddressSet() > 0". Now we don't create
address sets like that, therefore a new hasPeerSelector field was added
to distinguish empty gress from the one that just doesn't have any
address sets added yet.

Previously l3Match for gress with namespace selector that doesn't select
anything looked like "ip4.src == {<empty address set>}", now it will be
"ip4.src == {}".

Signed-off-by: Nadia Pinaeva <npinaeva@redhat.com>

update 2

Signed-off-by: Nadia Pinaeva <npinaeva@redhat.com>
    @npinaeva
    npinaeva committed Mar 16, 2023
    Configuration menu
    Copy the full SHA
    ed34024 View commit details
    Browse the repository at this point in the history

  4. Add PodSelectorAddressSet tests. 

    Add new functions to FakeAddressSetFactory for more insight into
existing address sets.
Add tests for PodSelectorAddressSet

Update Netpol-owned address sets to be shared.
Add netpol test that verifies that default deny port groups and port
groups for policies without peer selectors (IpBlock) are cleaned up
on sync.

Move completed pod test from policy_test to pod_selector_address_set_test,
simplify the test and make sure ip will be removed when collided pod
is not selected by the address set.

Update policy sync tests with existing policy in every namespace
to make sure port groups won't be deleted as stale before being updated.

Signed-off-by: Nadia Pinaeva <npinaeva@redhat.com>
    @npinaeva
    npinaeva committed Mar 16, 2023
    Configuration menu
    Copy the full SHA
    7f4b409 View commit details
    Browse the repository at this point in the history

  5. don't create acl if no namespace address sets are selected. 

    Previously "ip4.dst == {}" match was created, and ovn-controller
throws an error on such acl

Signed-off-by: Nadia Pinaeva <npinaeva@redhat.com>
    @npinaeva
    npinaeva committed Mar 16, 2023
    Configuration menu
    Copy the full SHA
    54b67a3 View commit details
    Browse the repository at this point in the history