Skip to content

Commit c32653b

Browse files
committed
removed logic to only look at /32 pod cidrs and allow all pod cidr
1 parent 3179b1f commit c32653b

File tree

1 file changed

+5
-7
lines changed

1 file changed

+5
-7
lines changed

npm/pkg/controlplane/translation/translatePolicy.go

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,6 @@ package translation
33
import (
44
"errors"
55
"fmt"
6-
"strings"
76

87
"github.com/Azure/azure-container-networking/npm/pkg/dataplane/ipsets"
98
"github.com/Azure/azure-container-networking/npm/pkg/dataplane/policies"
@@ -364,14 +363,13 @@ func peerAndPortRule(npmNetPol *policies.NPMNetworkPolicy, direction policies.Di
364363
}
365364

366365
func directPeerAndPortRule(npmNetPol *policies.NPMNetworkPolicy, direction policies.Direction, ports []networkingv1.NetworkPolicyPort, cidr string, npmLiteToggle bool) error {
367-
ip := strings.TrimSuffix(cidr, "/32")
368366
if len(ports) == 0 {
369367
acl := policies.NewACLPolicy(policies.Allowed, direction)
370368
// bypasses ipset creation for /32 cidrs and directly creates an acl with the cidr
371369
if direction == policies.Ingress {
372-
acl.SrcDirectIPs = []string{ip}
370+
acl.SrcDirectIPs = []string{cidr}
373371
} else {
374-
acl.DstDirectIPs = []string{ip}
372+
acl.DstDirectIPs = []string{cidr}
375373
}
376374
npmNetPol.ACLs = append(npmNetPol.ACLs, acl)
377375
return nil
@@ -392,9 +390,9 @@ func directPeerAndPortRule(npmNetPol *policies.NPMNetworkPolicy, direction polic
392390

393391
// Set direct IP based on direction
394392
if direction == policies.Ingress {
395-
acl.SrcDirectIPs = []string{ip}
393+
acl.SrcDirectIPs = []string{cidr}
396394
} else {
397-
acl.DstDirectIPs = []string{ip}
395+
acl.DstDirectIPs = []string{cidr}
398396
}
399397

400398
// Handle ports
@@ -455,7 +453,7 @@ func translateRule(npmNetPol *policies.NPMNetworkPolicy,
455453
if len(peer.IPBlock.CIDR) > 0 {
456454
// add logic that if the peer is only IPBlock and npm lite is enabled and is a /32 cidr block
457455
// then skip creating IpBlockIPSet
458-
if npmLiteToggle && util.IsCIDR32(peer.IPBlock.CIDR) {
456+
if npmLiteToggle {
459457
err = directPeerAndPortRule(npmNetPol, direction, ports, peer.IPBlock.CIDR, npmLiteToggle)
460458
if err != nil {
461459
return err

0 commit comments

Comments
 (0)