Skip to content

Commit 49771e3

Browse files
huntergregoryhuntergregory
committed
fix: track endport policies instead of namedport
Signed-off-by: Hunter Gregory <[email protected]>
1 parent 22931a8 commit 49771e3

File tree

5 files changed

+79
-57
lines changed

5 files changed

+79
-57
lines changed

‎npm/metrics/ai-utils.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -120,7 +120,7 @@ func SendHeartbeatWithNumPolicies() {
120120
}
121121

122122
cidrNetPols := GetCidrNetPols()
123-
namedPortNetPols := GetNamedPortNetPols()
124-
message := fmt.Sprintf("info: NPM heartbeat. Total policies: %s, CIDR policies: %d, NamedPort policies: %d", numPoliciesString, cidrNetPols, namedPortNetPols)
123+
endPortNetPols := GetEndPortNetPols()
124+
message := fmt.Sprintf("info: NPM heartbeat. Total policies: %s, CIDR policies: %d, EndPort policies: %d", numPoliciesString, cidrNetPols, endPortNetPols)
125125
SendLog(util.NpmID, message, DonotPrint)
126126
}

‎npm/metrics/counts.go‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,8 @@ var nonPrometheusCounts *counts
77
// counts is a struct holding non-Prometheus counts.
88
type counts struct {
99
sync.Mutex
10-
cidrNetPols int
11-
namedPortNetPols int
10+
cidrNetPols int
11+
endPortNetPols int
1212
}
1313

1414
func IncCidrNetPols() {
@@ -38,29 +38,29 @@ func GetCidrNetPols() int {
3838
return nonPrometheusCounts.cidrNetPols
3939
}
4040

41-
func IncNamedPortNetPols() {
41+
func IncEndPortNetPols() {
4242
if nonPrometheusCounts == nil {
4343
return
4444
}
4545
nonPrometheusCounts.Lock()
4646
defer nonPrometheusCounts.Unlock()
47-
nonPrometheusCounts.namedPortNetPols++
47+
nonPrometheusCounts.endPortNetPols++
4848
}
4949

50-
func DecNamedPortNetPols() {
50+
func DecEndPortNetPols() {
5151
if nonPrometheusCounts == nil {
5252
return
5353
}
5454
nonPrometheusCounts.Lock()
5555
defer nonPrometheusCounts.Unlock()
56-
nonPrometheusCounts.namedPortNetPols--
56+
nonPrometheusCounts.endPortNetPols--
5757
}
5858

59-
func GetNamedPortNetPols() int {
59+
func GetEndPortNetPols() int {
6060
if nonPrometheusCounts == nil {
6161
return 0
6262
}
6363
nonPrometheusCounts.Lock()
6464
defer nonPrometheusCounts.Unlock()
65-
return nonPrometheusCounts.namedPortNetPols
65+
return nonPrometheusCounts.endPortNetPols
6666
}

‎npm/pkg/controlplane/controllers/v2/networkPolicyController.go‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -325,8 +325,8 @@ func (c *NetworkPolicyController) syncAddAndUpdateNetPol(netPolObj *networkingv1
325325
metrics.DecCidrNetPols()
326326
}
327327

328-
if translation.HasNamedPort(oldNetPolSpec) {
329-
metrics.DecNamedPortNetPols()
328+
if translation.HasEndPort(oldNetPolSpec) {
329+
metrics.DecEndPortNetPols()
330330
}
331331
} else {
332332
// inc metric for NumPolicies only if it a new network policy
@@ -337,8 +337,8 @@ func (c *NetworkPolicyController) syncAddAndUpdateNetPol(netPolObj *networkingv1
337337
metrics.IncCidrNetPols()
338338
}
339339

340-
if translation.HasNamedPort(&netPolObj.Spec) {
341-
metrics.IncNamedPortNetPols()
340+
if translation.HasEndPort(&netPolObj.Spec) {
341+
metrics.IncEndPortNetPols()
342342
}
343343

344344
c.rawNpSpecMap[netpolKey] = &netPolObj.Spec
@@ -362,8 +362,8 @@ func (c *NetworkPolicyController) cleanUpNetworkPolicy(netPolKey string) error {
362362
metrics.DecCidrNetPols()
363363
}
364364

365-
if translation.HasNamedPort(cachedNetPolSpec) {
366-
metrics.DecNamedPortNetPols()
365+
if translation.HasEndPort(cachedNetPolSpec) {
366+
metrics.DecEndPortNetPols()
367367
}
368368

369369
// Success to clean up ipset and iptables operations in kernel and delete the cached network policy from RawNpMap

‎npm/pkg/controlplane/controllers/v2/networkPolicyController_test.go‎

Lines changed: 52 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,13 @@ import (
2424
"k8s.io/client-go/tools/cache"
2525
)
2626

27+
var (
28+
eightyFive int32 = 85
29+
eightyFivePointer = &eightyFive
30+
eightySix int32 = 86
31+
eightySixPointer = &eightySix
32+
)
33+
2734
type netPolFixture struct {
2835
t *testing.T
2936

@@ -633,12 +640,12 @@ func TestCountsAddAndDeleteNetPol(t *testing.T) {
633640
tests := []struct {
634641
name string
635642
// network policy to add
636-
netPolSpec *networkingv1.NetworkPolicySpec
637-
cidrCount int
638-
namedPortCount int
643+
netPolSpec *networkingv1.NetworkPolicySpec
644+
cidrCount int
645+
endPortCount int
639646
}{
640647
{
641-
name: "no-cidr-namedPort",
648+
name: "no-cidr-endPort",
642649
netPolSpec: &networkingv1.NetworkPolicySpec{
643650
PolicyTypes: []networkingv1.PolicyType{
644651
networkingv1.PolicyTypeIngress,
@@ -719,7 +726,7 @@ func TestCountsAddAndDeleteNetPol(t *testing.T) {
719726
cidrCount: 1,
720727
},
721728
{
722-
name: "namedPort-ingress",
729+
name: "endPort-ingress",
723730
netPolSpec: &networkingv1.NetworkPolicySpec{
724731
PolicyTypes: []networkingv1.PolicyType{
725732
networkingv1.PolicyTypeIngress,
@@ -728,16 +735,17 @@ func TestCountsAddAndDeleteNetPol(t *testing.T) {
728735
{
729736
Ports: []networkingv1.NetworkPolicyPort{
730737
{
731-
Port: &intstr.IntOrString{StrVal: "abc"},
738+
Port: &intstr.IntOrString{IntVal: 80},
739+
EndPort: eightyFivePointer,
732740
},
733741
},
734742
},
735743
},
736744
},
737-
namedPortCount: 1,
745+
endPortCount: 1,
738746
},
739747
{
740-
name: "namedPort-egress",
748+
name: "endPort-egress",
741749
netPolSpec: &networkingv1.NetworkPolicySpec{
742750
PolicyTypes: []networkingv1.PolicyType{
743751
networkingv1.PolicyTypeEgress,
@@ -746,16 +754,17 @@ func TestCountsAddAndDeleteNetPol(t *testing.T) {
746754
{
747755
Ports: []networkingv1.NetworkPolicyPort{
748756
{
749-
Port: &intstr.IntOrString{StrVal: "abc"},
757+
Port: &intstr.IntOrString{IntVal: 80},
758+
EndPort: eightyFivePointer,
750759
},
751760
},
752761
},
753762
},
754763
},
755-
namedPortCount: 1,
764+
endPortCount: 1,
756765
},
757766
{
758-
name: "cidr-and-namedPort",
767+
name: "cidr-and-endPort",
759768
netPolSpec: &networkingv1.NetworkPolicySpec{
760769
PolicyTypes: []networkingv1.PolicyType{
761770
networkingv1.PolicyTypeIngress,
@@ -771,14 +780,15 @@ func TestCountsAddAndDeleteNetPol(t *testing.T) {
771780
},
772781
Ports: []networkingv1.NetworkPolicyPort{
773782
{
774-
Port: &intstr.IntOrString{StrVal: "abc"},
783+
Port: &intstr.IntOrString{IntVal: 80},
784+
EndPort: eightyFivePointer,
775785
},
776786
},
777787
},
778788
},
779789
},
780-
cidrCount: 1,
781-
namedPortCount: 1,
790+
cidrCount: 1,
791+
endPortCount: 1,
782792
},
783793
}
784794

@@ -807,28 +817,28 @@ func TestCountsAddAndDeleteNetPol(t *testing.T) {
807817
}
808818
checkNetPolTestResult("TestCountsCreateNetPol", f, testCases)
809819
require.Equal(t, tt.cidrCount, metrics.GetCidrNetPols())
810-
require.Equal(t, tt.namedPortCount, metrics.GetNamedPortNetPols())
820+
require.Equal(t, tt.endPortCount, metrics.GetEndPortNetPols())
811821

812822
deleteNetPol(t, f, netPolObj, DeletedFinalStateknownObject)
813823
testCases = []expectedNetPolValues{
814824
{0, 0, netPolPromVals{0, 1, 0, 1}},
815825
}
816826
checkNetPolTestResult("TestCountsDelNetPol", f, testCases)
817827
require.Equal(t, 0, metrics.GetCidrNetPols())
818-
require.Equal(t, 0, metrics.GetNamedPortNetPols())
828+
require.Equal(t, 0, metrics.GetEndPortNetPols())
819829
})
820830
}
821831
}
822832

823833
func TestCountsUpdateNetPol(t *testing.T) {
824834
tests := []struct {
825-
name string
826-
netPolSpec *networkingv1.NetworkPolicySpec
827-
updatedNetPolSpec *networkingv1.NetworkPolicySpec
828-
cidrCount int
829-
namedPortCount int
830-
updatedCidrCount int
831-
updatedNamedPortCount int
835+
name string
836+
netPolSpec *networkingv1.NetworkPolicySpec
837+
updatedNetPolSpec *networkingv1.NetworkPolicySpec
838+
cidrCount int
839+
endPortCount int
840+
updatedCidrCount int
841+
updatedEndPortCount int
832842
}{
833843
{
834844
name: "cidr-to-no-cidr",
@@ -942,7 +952,7 @@ func TestCountsUpdateNetPol(t *testing.T) {
942952
updatedCidrCount: 1,
943953
},
944954
{
945-
name: "namedPort-to-no-namedPort",
955+
name: "endPort-to-no-endPort",
946956
netPolSpec: &networkingv1.NetworkPolicySpec{
947957
PolicyTypes: []networkingv1.PolicyType{
948958
networkingv1.PolicyTypeIngress,
@@ -951,7 +961,8 @@ func TestCountsUpdateNetPol(t *testing.T) {
951961
{
952962
Ports: []networkingv1.NetworkPolicyPort{
953963
{
954-
Port: &intstr.IntOrString{StrVal: "abc"},
964+
Port: &intstr.IntOrString{IntVal: 80},
965+
EndPort: eightyFivePointer,
955966
},
956967
},
957968
},
@@ -971,11 +982,11 @@ func TestCountsUpdateNetPol(t *testing.T) {
971982
},
972983
},
973984
},
974-
namedPortCount: 1,
975-
updatedNamedPortCount: 0,
985+
endPortCount: 1,
986+
updatedEndPortCount: 0,
976987
},
977988
{
978-
name: "no-namedPort-to-namedPort",
989+
name: "no-endPort-to-endPort",
979990
netPolSpec: &networkingv1.NetworkPolicySpec{
980991
PolicyTypes: []networkingv1.PolicyType{
981992
networkingv1.PolicyTypeIngress,
@@ -998,17 +1009,18 @@ func TestCountsUpdateNetPol(t *testing.T) {
9981009
{
9991010
Ports: []networkingv1.NetworkPolicyPort{
10001011
{
1001-
Port: &intstr.IntOrString{StrVal: "abc"},
1012+
Port: &intstr.IntOrString{IntVal: 80},
1013+
EndPort: eightyFivePointer,
10021014
},
10031015
},
10041016
},
10051017
},
10061018
},
1007-
namedPortCount: 0,
1008-
updatedNamedPortCount: 1,
1019+
endPortCount: 0,
1020+
updatedEndPortCount: 1,
10091021
},
10101022
{
1011-
name: "namedPort-to-namedPort",
1023+
name: "endPort-to-endPort",
10121024
netPolSpec: &networkingv1.NetworkPolicySpec{
10131025
PolicyTypes: []networkingv1.PolicyType{
10141026
networkingv1.PolicyTypeIngress,
@@ -1017,7 +1029,8 @@ func TestCountsUpdateNetPol(t *testing.T) {
10171029
{
10181030
Ports: []networkingv1.NetworkPolicyPort{
10191031
{
1020-
Port: &intstr.IntOrString{StrVal: "abc"},
1032+
Port: &intstr.IntOrString{IntVal: 80},
1033+
EndPort: eightyFivePointer,
10211034
},
10221035
},
10231036
},
@@ -1031,14 +1044,15 @@ func TestCountsUpdateNetPol(t *testing.T) {
10311044
{
10321045
Ports: []networkingv1.NetworkPolicyPort{
10331046
{
1034-
Port: &intstr.IntOrString{StrVal: "xyz"},
1047+
Port: &intstr.IntOrString{IntVal: 80},
1048+
EndPort: eightySixPointer,
10351049
},
10361050
},
10371051
},
10381052
},
10391053
},
1040-
namedPortCount: 1,
1041-
updatedNamedPortCount: 1,
1054+
endPortCount: 1,
1055+
updatedEndPortCount: 1,
10421056
},
10431057
}
10441058

@@ -1066,7 +1080,7 @@ func TestCountsUpdateNetPol(t *testing.T) {
10661080
}
10671081
checkNetPolTestResult("TestCountsAddNetPol", f, testCases)
10681082
require.Equal(t, tt.cidrCount, metrics.GetCidrNetPols())
1069-
require.Equal(t, tt.namedPortCount, metrics.GetNamedPortNetPols())
1083+
require.Equal(t, tt.endPortCount, metrics.GetEndPortNetPols())
10701084

10711085
newNetPolObj := createNetPol()
10721086
newNetPolObj.Spec = *tt.updatedNetPolSpec
@@ -1078,7 +1092,7 @@ func TestCountsUpdateNetPol(t *testing.T) {
10781092
}
10791093
checkNetPolTestResult("TestCountsUpdateNetPol", f, testCases)
10801094
require.Equal(t, tt.updatedCidrCount, metrics.GetCidrNetPols())
1081-
require.Equal(t, tt.updatedNamedPortCount, metrics.GetNamedPortNetPols())
1095+
require.Equal(t, tt.updatedEndPortCount, metrics.GetEndPortNetPols())
10821096
})
10831097
}
10841098
}

‎npm/pkg/controlplane/translation/translatePolicy.go‎

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -705,18 +705,26 @@ func HasCIDRBlock(netPolSpec *networkingv1.NetworkPolicySpec) bool {
705705
return false
706706
}
707707

708-
func HasNamedPort(netPolObj *networkingv1.NetworkPolicySpec) bool {
708+
func HasEndPort(netPolObj *networkingv1.NetworkPolicySpec) bool {
709709
for _, ingress := range netPolObj.Ingress {
710710
for _, port := range ingress.Ports {
711-
if t, err := portType(port); err == nil && t == namedPortType {
711+
if port.EndPort == nil {
712+
continue
713+
}
714+
715+
if t, err := portType(port); err == nil && t == numericPortType {
712716
return true
713717
}
714718
}
715719
}
716720

717721
for _, egress := range netPolObj.Egress {
718722
for _, port := range egress.Ports {
719-
if t, err := portType(port); err == nil && t == namedPortType {
723+
if port.EndPort == nil {
724+
continue
725+
}
726+
727+
if t, err := portType(port); err == nil && t == numericPortType {
720728
return true
721729
}
722730
}

0 commit comments

Comments
 (0)