mirrors/kube-router
1
0
Fork 0
mirror of https://github.com/cloudnativelabs/kube-router.git synced 2025-10-11 18:01:05 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #86 from cloudnativelabs/85-network-policy-ga

Browse Source 
GA network policy does not reject if there is not a single source pod matching a policy
This commit is contained in:
Murali Reddy 2017-07-29 18:14:50 +05:30 committed by GitHub
commit 909c24d9d3
1 changed files with 40 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
app/controllers/network_policy_controller.go
View File

@ -68,7 +68,9 @@ type podInfo struct {
}
type ingressRule struct {
matchAllPorts bool
ports []protocolAndPort
matchAllSource bool
srcPods []podInfo
}
@ -304,7 +306,7 @@ func (npc *NetworkPolicyController) syncNetworkPolicyChains() (map[string]bool,
// case where only 'ports' details specified but no 'from' details in the ingress rule
// so match on all sources, with specified port and protocol
if len(ingressRule.srcPods) == 0 && len(ingressRule.ports) != 0 {
if ingressRule.matchAllSource && !ingressRule.matchAllPorts {
for _, portProtocol := range ingressRule.ports {
comment := "rule to ACCEPT traffic from source pods to dest pods selected by policy name: " +
policy.name + " namespace " + policy.namespace
@ -322,7 +324,14 @@ func (npc *NetworkPolicyController) syncNetworkPolicyChains() (map[string]bool,
// case where nether ports nor from details are speified in the ingress rule
// so match on all ports, protocol, source IP's
if len(ingressRule.srcPods) == 0 && len(ingressRule.ports) == 0 {
if ingressRule.matchAllSource && ingressRule.matchAllPorts {
// if no ports or source information is present in spec this is specical case
// where network policy does not allow any traffic
if npc.v1NetworkPolicy {
continue
}
comment := "rule to ACCEPT traffic from source pods to dest pods selected by policy name: " +
policy.name + " namespace " + policy.namespace
args := []string{"-m", "comment", "--comment", comment,
@ -655,12 +664,25 @@ func buildNetworkPoliciesInfo() (*[]networkPolicyInfo, error) {
ingressRule := ingressRule{}
ingressRule.ports = make([]protocolAndPort, 0)
// If this field is empty or missing in the spec, this rule matches all ports
if len(specIngressRule.Ports) == 0 {
ingressRule.matchAllPorts = true
} else {
ingressRule.matchAllPorts = false
for _, port := range specIngressRule.Ports {
protocolAndPort := protocolAndPort{protocol: string(*port.Protocol), port: port.Port.String()}
ingressRule.ports = append(ingressRule.ports, protocolAndPort)
}
}
ingressRule.srcPods = make([]podInfo, 0)
// If this field is empty or missing in the spec, this rule matches all sources
if len(specIngressRule.From) == 0 {
ingressRule.matchAllSource = true
} else {
ingressRule.matchAllSource = false
for _, peer := range specIngressRule.From {
matchingPods, err := watchers.PodWatcher.ListByNamespaceAndLabels(policy.Namespace, peer.PodSelector.MatchLabels)
if err == nil {
@ -673,6 +695,8 @@ func buildNetworkPoliciesInfo() (*[]networkPolicyInfo, error) {
}
}
}
}
newPolicy.ingressRules = append(newPolicy.ingressRules, ingressRule)
}
NetworkPolicies = append(NetworkPolicies, newPolicy)