Skip to content

Commit 43746bc

Browse files
jaer-tsunjaer-tsun
authored
apply policies in a way where the network policy may seem order agnostic (#462)
1 parent 71e71d5 commit 43746bc

File tree

2 files changed

+47
-37
lines changed

2 files changed

+47
-37
lines changed

‎npm/translatePolicy.go‎

Lines changed: 22 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -144,9 +144,10 @@ func craftPartialIptablesCommentFromSelector(ns string, selector *metav1.LabelSe
144144

145145
func translateIngress(ns string, targetSelector metav1.LabelSelector, rules []networkingv1.NetworkPolicyIngressRule) ([]string, []string, []*iptm.IptEntry) {
146146
var (
147-
sets []string // ipsets with type: net:hash
148-
lists []string // ipsets with type: list:set
149-
entries []*iptm.IptEntry
147+
sets []string // ipsets with type: net:hash
148+
lists []string // ipsets with type: list:set
149+
entries []*iptm.IptEntry
150+
fromRuleEntries []*iptm.IptEntry
150151
addedIngressFromEntry, addedPortEntry bool // add drop entries at the end of the chain when there are non ALLOW-ALL* rules
151152
)
152153

@@ -264,7 +265,7 @@ func translateIngress(ns string, targetSelector metav1.LabelSelector, rules []ne
264265
"DROP-"+except+
265266
"-TO-"+targetSelectorComment,
266267
)
267-
entries = append(entries, exceptEntry)
268+
fromRuleEntries = append(fromRuleEntries, exceptEntry)
268269
}
269270
addedIngressFromEntry = true
270271
}
@@ -295,7 +296,7 @@ func translateIngress(ns string, targetSelector metav1.LabelSelector, rules []ne
295296
"-:-"+craftPartialIptablesCommentFromPort(portRule, util.IptablesDstPortFlag)+
296297
"-TO-"+targetSelectorComment,
297298
)
298-
entries = append(entries, entry)
299+
fromRuleEntries = append(fromRuleEntries, entry)
299300
}
300301
} else {
301302
cidrEntry := &iptm.IptEntry{
@@ -317,7 +318,7 @@ func translateIngress(ns string, targetSelector metav1.LabelSelector, rules []ne
317318
"ALLOW-"+fromRule.IPBlock.CIDR+
318319
"-TO-"+targetSelectorComment,
319320
)
320-
entries = append(entries, cidrEntry)
321+
fromRuleEntries = append(fromRuleEntries, cidrEntry)
321322
addedIngressFromEntry = true
322323
}
323324
}
@@ -569,6 +570,10 @@ func translateIngress(ns string, targetSelector metav1.LabelSelector, rules []ne
569570
}
570571
}
571572

573+
if len(fromRuleEntries) > 0 {
574+
entries = append(entries, fromRuleEntries...)
575+
}
576+
572577
if addedPortEntry && !addedIngressFromEntry {
573578
entry := &iptm.IptEntry{
574579
Chain: util.IptablesAzureIngressPortChain,
@@ -627,9 +632,10 @@ func translateIngress(ns string, targetSelector metav1.LabelSelector, rules []ne
627632

628633
func translateEgress(ns string, targetSelector metav1.LabelSelector, rules []networkingv1.NetworkPolicyEgressRule) ([]string, []string, []*iptm.IptEntry) {
629634
var (
630-
sets []string // ipsets with type: net:hash
631-
lists []string // ipsets with type: list:set
632-
entries []*iptm.IptEntry
635+
sets []string // ipsets with type: net:hash
636+
lists []string // ipsets with type: list:set
637+
entries []*iptm.IptEntry
638+
toRuleEntries []*iptm.IptEntry
633639
addedEgressToEntry, addedPortEntry bool // add drop entry when there are non ALLOW-ALL* rules
634640
)
635641

@@ -742,7 +748,7 @@ func translateEgress(ns string, targetSelector metav1.LabelSelector, rules []net
742748
"DROP-"+except+
743749
"-FROM-"+targetSelectorComment,
744750
)
745-
entries = append(entries, exceptEntry)
751+
toRuleEntries = append(toRuleEntries, exceptEntry)
746752
}
747753
addedEgressToEntry = true
748754
}
@@ -773,7 +779,7 @@ func translateEgress(ns string, targetSelector metav1.LabelSelector, rules []net
773779
"-:-"+craftPartialIptablesCommentFromPort(portRule, util.IptablesDstPortFlag)+
774780
"-FROM-"+targetSelectorComment,
775781
)
776-
entries = append(entries, entry)
782+
toRuleEntries = append(toRuleEntries, entry)
777783
}
778784
} else {
779785
cidrEntry := &iptm.IptEntry{
@@ -798,7 +804,7 @@ func translateEgress(ns string, targetSelector metav1.LabelSelector, rules []net
798804
"ALLOW-"+toRule.IPBlock.CIDR+
799805
"-FROM-"+targetSelectorComment,
800806
)
801-
entries = append(entries, cidrEntry)
807+
toRuleEntries = append(toRuleEntries, cidrEntry)
802808
addedEgressToEntry = true
803809
}
804810
}
@@ -1051,6 +1057,10 @@ func translateEgress(ns string, targetSelector metav1.LabelSelector, rules []net
10511057
}
10521058
}
10531059

1060+
if len(toRuleEntries) > 0 {
1061+
entries = append(entries, toRuleEntries...)
1062+
}
1063+
10541064
if addedPortEntry && !addedEgressToEntry {
10551065
entry := &iptm.IptEntry{
10561066
Chain: util.IptablesAzureEgressPortChain,

‎npm/translatePolicy_test.go‎

Lines changed: 25 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -2989,33 +2989,18 @@ func TestTranslatePolicy(t *testing.T) {
29892989
expectedIptEntries = []*iptm.IptEntry{}
29902990
nonKubeSystemEntries = []*iptm.IptEntry{
29912991
&iptm.IptEntry{
2992-
Chain: util.IptablesAzureIngressFromChain,
2992+
Chain: util.IptablesAzureIngressPortChain,
29932993
Specs: []string{
2994-
util.IptablesSFlag,
2995-
"172.17.1.0/24",
29962994
util.IptablesModuleFlag,
29972995
util.IptablesSetModuleFlag,
29982996
util.IptablesMatchSetFlag,
29992997
util.GetHashedName("role:db"),
30002998
util.IptablesDstFlag,
3001-
util.IptablesJumpFlag,
3002-
util.IptablesDrop,
3003-
util.IptablesModuleFlag,
3004-
util.IptablesCommentModuleFlag,
3005-
util.IptablesCommentFlag,
3006-
"DROP-172.17.1.0/24-TO-role:db",
3007-
},
3008-
},
3009-
&iptm.IptEntry{
3010-
Chain: util.IptablesAzureIngressPortChain,
3011-
Specs: []string{
30122999
util.IptablesModuleFlag,
30133000
util.IptablesSetModuleFlag,
30143001
util.IptablesMatchSetFlag,
3015-
util.GetHashedName("role:db"),
3016-
util.IptablesDstFlag,
3017-
util.IptablesSFlag,
3018-
"172.17.0.0/16",
3002+
util.GetHashedName("ns-project:myproject"),
3003+
util.IptablesSrcFlag,
30193004
util.IptablesProtFlag,
30203005
"TCP",
30213006
util.IptablesDstPortFlag,
@@ -3025,7 +3010,7 @@ func TestTranslatePolicy(t *testing.T) {
30253010
util.IptablesModuleFlag,
30263011
util.IptablesCommentModuleFlag,
30273012
util.IptablesCommentFlag,
3028-
"ALLOW-172.17.0.0/16-:-TCP-PORT-6379-TO-role:db",
3013+
"ALLOW-ns-project:myproject-AND-TCP-PORT-6379-TO-role:db",
30293014
},
30303015
},
30313016
&iptm.IptEntry{
@@ -3039,7 +3024,7 @@ func TestTranslatePolicy(t *testing.T) {
30393024
util.IptablesModuleFlag,
30403025
util.IptablesSetModuleFlag,
30413026
util.IptablesMatchSetFlag,
3042-
util.GetHashedName("ns-project:myproject"),
3027+
util.GetHashedName("role:frontend"),
30433028
util.IptablesSrcFlag,
30443029
util.IptablesProtFlag,
30453030
"TCP",
@@ -3050,22 +3035,37 @@ func TestTranslatePolicy(t *testing.T) {
30503035
util.IptablesModuleFlag,
30513036
util.IptablesCommentModuleFlag,
30523037
util.IptablesCommentFlag,
3053-
"ALLOW-ns-project:myproject-AND-TCP-PORT-6379-TO-role:db",
3038+
"ALLOW-role:frontend-AND-TCP-PORT-6379-TO-role:db",
30543039
},
30553040
},
30563041
&iptm.IptEntry{
3057-
Chain: util.IptablesAzureIngressPortChain,
3042+
Chain: util.IptablesAzureIngressFromChain,
30583043
Specs: []string{
3044+
util.IptablesSFlag,
3045+
"172.17.1.0/24",
30593046
util.IptablesModuleFlag,
30603047
util.IptablesSetModuleFlag,
30613048
util.IptablesMatchSetFlag,
30623049
util.GetHashedName("role:db"),
30633050
util.IptablesDstFlag,
3051+
util.IptablesJumpFlag,
3052+
util.IptablesDrop,
3053+
util.IptablesModuleFlag,
3054+
util.IptablesCommentModuleFlag,
3055+
util.IptablesCommentFlag,
3056+
"DROP-172.17.1.0/24-TO-role:db",
3057+
},
3058+
},
3059+
&iptm.IptEntry{
3060+
Chain: util.IptablesAzureIngressPortChain,
3061+
Specs: []string{
30643062
util.IptablesModuleFlag,
30653063
util.IptablesSetModuleFlag,
30663064
util.IptablesMatchSetFlag,
3067-
util.GetHashedName("role:frontend"),
3068-
util.IptablesSrcFlag,
3065+
util.GetHashedName("role:db"),
3066+
util.IptablesDstFlag,
3067+
util.IptablesSFlag,
3068+
"172.17.0.0/16",
30693069
util.IptablesProtFlag,
30703070
"TCP",
30713071
util.IptablesDstPortFlag,
@@ -3075,7 +3075,7 @@ func TestTranslatePolicy(t *testing.T) {
30753075
util.IptablesModuleFlag,
30763076
util.IptablesCommentModuleFlag,
30773077
util.IptablesCommentFlag,
3078-
"ALLOW-role:frontend-AND-TCP-PORT-6379-TO-role:db",
3078+
"ALLOW-172.17.0.0/16-:-TCP-PORT-6379-TO-role:db",
30793079
},
30803080
},
30813081
&iptm.IptEntry{

0 commit comments

Comments
 (0)