Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Extend anp egress peer #447

Merged
merged 139 commits into from
Dec 11, 2024
Merged

Extend anp egress peer #447

merged 139 commits into from
Dec 11, 2024

Conversation

shireenf-ibm
Copy link
Contributor

@shireenf-ibm shireenf-ibm commented Nov 18, 2024

base PR: #380
issue: #442

  • support Networks field in AdminNetworkPolicyEgressPeer
  • add logger to k8s objects and raise some warnings (on IPv6 cidr / nodes field / named ports without match ..)
  • more tests (good paths w/wo warnings)
  • unit tests on logger warnings
  • some "tbd" in the committed code

…ll but: udp 5353 instead of SCTP 1-65535,TCP 1-65535,UDP 1-5352,5354-65535)
@shireenf-ibm shireenf-ibm requested a review from adisos December 8, 2024 11:29
@shireenf-ibm shireenf-ibm changed the title W.I.P Extend anp egress peer Extend anp egress peer Dec 8, 2024
pkg/netpol/eval/resources.go Outdated Show resolved Hide resolved
pkg/netpol/eval/internal/k8s/adminnetpol.go Outdated Show resolved Hide resolved
@adisos
Copy link
Collaborator

adisos commented Dec 10, 2024

warning formats: be consistent with current format, for example:

$ ./bin/k8snetpolicy list --dirpath tests/bad_netpols/subdir5/
2024/12/01 15:12:11 Network policy "default/shippingservice-netpol": port name:  "abc" has no match in the configuration of the destination peer "default/shippingservice-1"; it will be ignored, and will not appear in the connectivity results.
0.0.0.0-255.255.255.255 => default/adservice[Deployment] : All Connections
0.0.0.0-255.255.255.255 => default/cartservice[Deployment] : All Connections
0.0.0.0-255.255.255.255 => default/checkoutservice[Deployment] : All Connections

and example from current implementation:

r$ ./bin/k8snetpolicy list --dirpath tests/anp_and_banp_using_networks_with_ipv6_test/
2024/12/01 15:14:13 admin network policy "network-as-egress-peer": Warning  in rule "allow-all-egress-to-intranet": IPv6 addresses are not supported; it will be ignored, and will not appear in the connectivity results.

can be changed to:

admin network policy "network-as-egress-peer": in rule "allow-all-egress-to-intranet": IPv6 addresses are not supported

also, better explain the impact of the "IPV6 not supported" warning in the README documentation.

Please also shorten the warning as I wrote above.

@shireenf-ibm
Copy link
Contributor Author

Please also shorten the warning as I wrote above.

done

pkg/netpol/eval/internal/k8s/adminnetpol.go Outdated Show resolved Hide resolved
pkg/netpol/eval/internal/k8s/adminnetpol.go Outdated Show resolved Hide resolved
pkg/cli/evaluate.go Outdated Show resolved Hide resolved
pkg/netpol/connlist/connlist.go Show resolved Hide resolved
pkg/netpol/connlist/connlist.go Outdated Show resolved Hide resolved
pkg/netpol/eval/internal/k8s/adminnetpol.go Outdated Show resolved Hide resolved
pkg/netpol/eval/internal/k8s/adminnetpol.go Outdated Show resolved Hide resolved
Copy link
Collaborator

@adisos adisos left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@shireenf-ibm shireenf-ibm merged commit f198af1 into main Dec 11, 2024
4 checks passed
@shireenf-ibm shireenf-ibm deleted the extend_anp_egress_peer branch December 11, 2024 13:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

AdminNetworkPolicy : extend AdminNetworkPolicyEgressPeer fields support
3 participants