[NPM] Add a protocol flag to namedport (#904)

* NPM today does not adhere to the protocol attached to a named port

* fixing a UT

* expanding ports to test

Author: vakalapa

npm/translatePolicy.go

@@ -313,6 +313,13 @@ func translateIngress(ns string, policyName string, targetSelector metav1.LabelS
 						Chain: util.IptablesAzureIngressPortChain,
 						Specs: append([]string(nil), targetSelectorIptEntrySpec...),
 					}
+					if portRule.Protocol != nil {
+						entry.Specs = append(
+							entry.Specs,
+							util.IptablesProtFlag,
+							string(*portRule.Protocol),
+						)
+					}
 					entry.Specs = append(
 						entry.Specs,
 						util.IptablesModuleFlag,
@@ -385,6 +392,13 @@ func translateIngress(ns string, policyName string, targetSelector metav1.LabelS
 									Chain: util.IptablesAzureIngressPortChain,
 									Specs: append([]string(nil), targetSelectorIptEntrySpec...),
 								}
+								if portRule.Protocol != nil {
+									entry.Specs = append(
+										entry.Specs,
+										util.IptablesProtFlag,
+										string(*portRule.Protocol),
+									)
+								}
 								entry.Specs = append(
 									entry.Specs,
 									util.IptablesModuleFlag,
@@ -616,6 +630,13 @@ func translateIngress(ns string, policyName string, targetSelector metav1.LabelS
 								Chain: util.IptablesAzureIngressPortChain,
 								Specs: append([]string(nil), targetSelectorIptEntrySpec...),
 							}
+							if portRule.Protocol != nil {
+								entry.Specs = append(
+									entry.Specs,
+									util.IptablesProtFlag,
+									string(*portRule.Protocol),
+								)
+							}
 							entry.Specs = append(
 								entry.Specs,
 								iptPartialPodSpec...,
@@ -728,6 +749,13 @@ func translateIngress(ns string, policyName string, targetSelector metav1.LabelS
 								Chain: util.IptablesAzureIngressPortChain,
 								Specs: append([]string(nil), iptPartialNsSpec...),
 							}
+							if portRule.Protocol != nil {
+								entry.Specs = append(
+									entry.Specs,
+									util.IptablesProtFlag,
+									string(*portRule.Protocol),
+								)
+							}
 							entry.Specs = append(
 								entry.Specs,
 								iptPartialPodSpec...,
@@ -942,6 +970,13 @@ func translateEgress(ns string, policyName string, targetSelector metav1.LabelSe
 						Chain: util.IptablesAzureEgressPortChain,
 						Specs: append([]string(nil), targetSelectorIptEntrySpec...),
 					}
+					if portRule.Protocol != nil {
+						entry.Specs = append(
+							entry.Specs,
+							util.IptablesProtFlag,
+							string(*portRule.Protocol),
+						)
+					}
 					entry.Specs = append(
 						entry.Specs,
 						util.IptablesModuleFlag,
@@ -1014,6 +1049,13 @@ func translateEgress(ns string, policyName string, targetSelector metav1.LabelSe
 									Chain: util.IptablesAzureEgressPortChain,
 									Specs: append([]string(nil), targetSelectorIptEntrySpec...),
 								}
+								if portRule.Protocol != nil {
+									entry.Specs = append(
+										entry.Specs,
+										util.IptablesProtFlag,
+										string(*portRule.Protocol),
+									)
+								}
 								entry.Specs = append(
 									entry.Specs,
 									util.IptablesModuleFlag,
@@ -1254,6 +1296,13 @@ func translateEgress(ns string, policyName string, targetSelector metav1.LabelSe
 								entry.Specs,
 								targetSelectorIptEntrySpec...,
 							)
+							if portRule.Protocol != nil {
+								entry.Specs = append(
+									entry.Specs,
+									util.IptablesProtFlag,
+									string(*portRule.Protocol),
+								)
+							}
 							entry.Specs = append(
 								entry.Specs,
 								util.IptablesModuleFlag,
@@ -1371,6 +1420,13 @@ func translateEgress(ns string, policyName string, targetSelector metav1.LabelSe
 								entry.Specs,
 								iptPartialPodSpec...,
 							)
+							if portRule.Protocol != nil {
+								entry.Specs = append(
+									entry.Specs,
+									util.IptablesProtFlag,
+									string(*portRule.Protocol),
+								)
+							}
 							entry.Specs = append(
 								entry.Specs,
 								util.IptablesModuleFlag,

npm/translatePolicy_test.go

@@ -3333,6 +3333,8 @@ func TestNamedPorts(t *testing.T) {
 				util.IptablesMatchSetFlag,
 				util.GetHashedName("app:server"),
 				util.IptablesDstFlag,
+				util.IptablesProtFlag,
+				"TCP",
 				util.IptablesModuleFlag,
 				util.IptablesSetModuleFlag,
 				util.IptablesMatchSetFlag,

test/cyclonus/install-cyclonus.yaml

@@ -20,7 +20,6 @@ spec:
             - --pod-creation-timeout-seconds=30
             - --job-timeout-seconds=2
             - --server-protocol=TCP,UDP
-            - --server-port=80
           name: cyclonus
           imagePullPolicy: IfNotPresent
           image: mfenwick100/cyclonus:v0.4.7