Skip to content

Commit 58fc5a6

Browse files
jaydeokarjaydeokar
authored
Merge branch 'main' into helm_charts
2 parents db40716 + 5322072 commit 58fc5a6

File tree

4 files changed

+78
-57
lines changed

4 files changed

+78
-57
lines changed

‎go.mod‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -3,19 +3,19 @@ module github.com/aws/amazon-network-policy-controller-k8s
33
go 1.21
44

55
require (
6-
github.com/go-logr/logr v1.3.0
6+
github.com/go-logr/logr v1.4.1
77
github.com/golang/mock v1.6.0
88
github.com/google/go-cmp v0.6.0
9-
github.com/onsi/ginkgo/v2 v2.13.0
10-
github.com/onsi/gomega v1.30.0
9+
github.com/onsi/ginkgo/v2 v2.15.0
10+
github.com/onsi/gomega v1.31.1
1111
github.com/pkg/errors v0.9.1
1212
github.com/samber/lo v1.39.0
1313
github.com/spf13/pflag v1.0.5
1414
github.com/stretchr/testify v1.8.4
1515
go.uber.org/zap v1.26.0
1616
golang.org/x/exp v0.0.0-20220722155223-a9213eeb770e
17-
k8s.io/api v0.29.0
18-
k8s.io/apimachinery v0.29.0
17+
k8s.io/api v0.29.1
18+
k8s.io/apimachinery v0.29.1
1919
k8s.io/client-go v0.29.0
2020
sigs.k8s.io/controller-runtime v0.16.3
2121
)
@@ -54,13 +54,13 @@ require (
5454
github.com/prometheus/common v0.44.0 // indirect
5555
github.com/prometheus/procfs v0.10.1 // indirect
5656
go.uber.org/multierr v1.11.0 // indirect
57-
golang.org/x/net v0.17.0 // indirect
57+
golang.org/x/net v0.19.0 // indirect
5858
golang.org/x/oauth2 v0.10.0 // indirect
59-
golang.org/x/sys v0.13.0 // indirect
60-
golang.org/x/term v0.13.0 // indirect
61-
golang.org/x/text v0.13.0 // indirect
59+
golang.org/x/sys v0.15.0 // indirect
60+
golang.org/x/term v0.15.0 // indirect
61+
golang.org/x/text v0.14.0 // indirect
6262
golang.org/x/time v0.3.0 // indirect
63-
golang.org/x/tools v0.12.0 // indirect
63+
golang.org/x/tools v0.16.1 // indirect
6464
gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
6565
google.golang.org/appengine v1.6.7 // indirect
6666
google.golang.org/protobuf v1.31.0 // indirect

‎go.sum‎

Lines changed: 20 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -19,8 +19,9 @@ github.com/evanphx/json-patch/v5 v5.6.0/go.mod h1:G79N1coSVB93tBe7j6PhzjmR3/2Vvl
1919
github.com/fsnotify/fsnotify v1.6.0 h1:n+5WquG0fcWoWp6xPWfHdbskMCQaFnG6PfBrh1Ky4HY=
2020
github.com/fsnotify/fsnotify v1.6.0/go.mod h1:sl3t1tCWJFWoRz9R8WJCbQihKKwmorjAbSClcnxKAGw=
2121
github.com/go-logr/logr v1.2.4/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
22-
github.com/go-logr/logr v1.3.0 h1:2y3SDp0ZXuc6/cjLSZ+Q3ir+QB9T/iG5yYRXqsagWSY=
2322
github.com/go-logr/logr v1.3.0/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
23+
github.com/go-logr/logr v1.4.1 h1:pKouT5E8xu9zeFC39JXRDukb6JFQPXM5p5I91188VAQ=
24+
github.com/go-logr/logr v1.4.1/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
2425
github.com/go-logr/zapr v1.2.4 h1:QHVo+6stLbfJmYGkQ7uGHUCu5hnAFAj6mDe6Ea0SeOo=
2526
github.com/go-logr/zapr v1.2.4/go.mod h1:FyHWQIzQORZ0QVE1BtVHv3cKtNLuXsbNLtpuhNapBOA=
2627
github.com/go-openapi/jsonpointer v0.19.6 h1:eCs3fxoIi3Wh6vtgmLTOjdhSpiqphQ+DaPn38N2ZdrE=
@@ -84,10 +85,10 @@ github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9G
8485
github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
8586
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
8687
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
87-
github.com/onsi/ginkgo/v2 v2.13.0 h1:0jY9lJquiL8fcf3M4LAXN5aMlS/b2BV86HFFPCPMgE4=
88-
github.com/onsi/ginkgo/v2 v2.13.0/go.mod h1:TE309ZR8s5FsKKpuB1YAQYBzCaAfUgatB/xlT/ETL/o=
89-
github.com/onsi/gomega v1.30.0 h1:hvMK7xYz4D3HapigLTeGdId/NcfQx1VHMJc60ew99+8=
90-
github.com/onsi/gomega v1.30.0/go.mod h1:9sxs+SwGrKI0+PWe4Fxa9tFQQBG5xSsSbMXOI8PPpoQ=
88+
github.com/onsi/ginkgo/v2 v2.15.0 h1:79HwNRBAZHOEwrczrgSOPy+eFTTlIGELKy5as+ClttY=
89+
github.com/onsi/ginkgo/v2 v2.15.0/go.mod h1:HlxMHtYF57y6Dpf+mc5529KKmSq9h2FpCF+/ZkwUxKM=
90+
github.com/onsi/gomega v1.31.1 h1:KYppCUK+bUgAZwHOu7EXVBKyQA6ILvOESHkn/tgoqvo=
91+
github.com/onsi/gomega v1.31.1/go.mod h1:y40C95dwAD1Nz36SsEnxvfFe8FFfNxzI5eJ0EYGyAy0=
9192
github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
9293
github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
9394
github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
@@ -140,17 +141,15 @@ golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHl
140141
golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
141142
golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
142143
golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
143-
golang.org/x/mod v0.12.0 h1:rmsUpXtvNzj340zd98LZ4KntptpfRHwpFOHG188oHXc=
144-
golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
145144
golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
146145
golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
147146
golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
148147
golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
149148
golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
150149
golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
151150
golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
152-
golang.org/x/net v0.17.0 h1:pVaXccu2ozPjCXewfr1S7xza/zcXTity9cCdXQYSjIM=
153-
golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
151+
golang.org/x/net v0.19.0 h1:zTwKpTd2XuCqf8huc7Fo2iSy+4RHPd10s4KzeTnVr1c=
152+
golang.org/x/net v0.19.0/go.mod h1:CfAk/cbD4CthTvqiEl8NpboMuiuOYsAr/7NOjZJtv1U=
154153
golang.org/x/oauth2 v0.10.0 h1:zHCpF2Khkwy4mMB4bv0U37YtJdTGW8jI0glAApi0Kh8=
155154
golang.org/x/oauth2 v0.10.0/go.mod h1:kTpgurOux7LqtuxjuyZa4Gj2gdezIt/jQtGnNFfypQI=
156155
golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -166,16 +165,16 @@ golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7w
166165
golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
167166
golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
168167
golang.org/x/sys v0.0.0-20220908164124-27713097b956/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
169-
golang.org/x/sys v0.13.0 h1:Af8nKPmuFypiUBjVoU9V20FiaFXOcuZI21p0ycVYYGE=
170-
golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
168+
golang.org/x/sys v0.15.0 h1:h48lPFYpsTvQJZF4EKyI4aLHaev3CxivZmv7yZig9pc=
169+
golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
171170
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
172-
golang.org/x/term v0.13.0 h1:bb+I9cTfFazGW51MZqBVmZy7+JEJMouUHTUSKVQLBek=
173-
golang.org/x/term v0.13.0/go.mod h1:LTmsnFJwVN6bCy1rVCoS+qHT1HhALEFxKncY3WNNh4U=
171+
golang.org/x/term v0.15.0 h1:y/Oo/a/q3IXu26lQgl04j/gjuBDOBlx7X6Om1j2CPW4=
172+
golang.org/x/term v0.15.0/go.mod h1:BDl952bC7+uMoWR75FIrCDx79TPU9oHkTZ9yRbYOrX0=
174173
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
175174
golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
176175
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
177-
golang.org/x/text v0.13.0 h1:ablQoSUd0tRdKxZewP80B+BaqeKJuVhuRxj/dkrun3k=
178-
golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
176+
golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
177+
golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
179178
golang.org/x/time v0.3.0 h1:rg5rLMjNzMS1RkNLzCG38eapWhnYLFYXDXj2gOlr8j4=
180179
golang.org/x/time v0.3.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
181180
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -185,8 +184,8 @@ golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roY
185184
golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
186185
golang.org/x/tools v0.1.1/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
187186
golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
188-
golang.org/x/tools v0.12.0 h1:YW6HUoUmYBpwSgyaGaZq1fHjrBjX1rlpZ54T6mu2kss=
189-
golang.org/x/tools v0.12.0/go.mod h1:Sc0INKfu04TlqNoRA1hgpFZbhYXHPr4V5DzpSBTPqQM=
187+
golang.org/x/tools v0.16.1 h1:TLyB3WofjdOEepBHAU20JdNC1Zbg87elYofWYAY5oZA=
188+
golang.org/x/tools v0.16.1/go.mod h1:kYVVN6I1mBNoB1OX+noeBjbRk4IUEPa7JJ+TJMEooJ0=
190189
golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
191190
golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
192191
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -211,12 +210,12 @@ gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
211210
gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
212211
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
213212
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
214-
k8s.io/api v0.29.0 h1:NiCdQMY1QOp1H8lfRyeEf8eOwV6+0xA6XEE44ohDX2A=
215-
k8s.io/api v0.29.0/go.mod h1:sdVmXoz2Bo/cb77Pxi71IPTSErEW32xa4aXwKH7gfBA=
213+
k8s.io/api v0.29.1 h1:DAjwWX/9YT7NQD4INu49ROJuZAAAP/Ijki48GUPzxqw=
214+
k8s.io/api v0.29.1/go.mod h1:7Kl10vBRUXhnQQI8YR/R327zXC8eJ7887/+Ybta+RoQ=
216215
k8s.io/apiextensions-apiserver v0.28.3 h1:Od7DEnhXHnHPZG+W9I97/fSQkVpVPQx2diy+2EtmY08=
217216
k8s.io/apiextensions-apiserver v0.28.3/go.mod h1:NE1XJZ4On0hS11aWWJUTNkmVB03j9LM7gJSisbRt8Lc=
218-
k8s.io/apimachinery v0.29.0 h1:+ACVktwyicPz0oc6MTMLwa2Pw3ouLAfAon1wPLtG48o=
219-
k8s.io/apimachinery v0.29.0/go.mod h1:eVBxQ/cwiJxH58eK/jd/vAk4mrxmVlnpBH5J2GbMeis=
217+
k8s.io/apimachinery v0.29.1 h1:KY4/E6km/wLBguvCZv8cKTeOwwOBqFNjwJIdMkMbbRc=
218+
k8s.io/apimachinery v0.29.1/go.mod h1:6HVkd1FwxIagpYrHSwJlQqZI3G9LfYWRPAkUvLnXTKU=
220219
k8s.io/client-go v0.29.0 h1:KmlDtFcrdUzOYrBhXHgKw5ycWzc3ryPX5mQe0SkG3y8=
221220
k8s.io/client-go v0.29.0/go.mod h1:yLkXH4HKMAywcrD82KMSmfYg2DlE8mepPR4JGSo5n38=
222221
k8s.io/component-base v0.28.3 h1:rDy68eHKxq/80RiMb2Ld/tbH8uAE75JdCqJyi6lXMzI=

‎pkg/resolvers/endpoints.go‎

Lines changed: 26 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -191,15 +191,8 @@ func (r *defaultEndpointsResolver) resolveNetworkPeers(ctx context.Context, poli
191191
namespaces = []string{policy.Namespace}
192192
}
193193

194-
var portsToApply []policyinfo.Port
195-
// populate the policy applied targets' ports
196-
// only populate ports for Ingress and from network policy namespaces as destination ports
197-
if policyType == networking.PolicyTypeIngress {
198-
portsToApply = r.getIngressRulesPorts(ctx, policy.Namespace, &policy.Spec.PodSelector, ports)
199-
}
200-
201194
for _, ns := range namespaces {
202-
networkPeers = append(networkPeers, r.getMatchingPodAddresses(ctx, peer.PodSelector, ns, portsToApply, ports, policyType)...)
195+
networkPeers = append(networkPeers, r.getMatchingPodAddresses(ctx, peer.PodSelector, ns, policy, ports, policyType)...)
203196
}
204197

205198
}
@@ -317,9 +310,22 @@ func (r *defaultEndpointsResolver) resolveNamespaces(ctx context.Context, ls *me
317310
}
318311

319312
func (r *defaultEndpointsResolver) getMatchingPodAddresses(ctx context.Context, ls *metav1.LabelSelector, namespace string,
320-
policyPorts []policyinfo.Port, ports []networking.NetworkPolicyPort, rule networking.PolicyType) []policyinfo.EndpointInfo {
313+
policy *networking.NetworkPolicy, rulePorts []networking.NetworkPolicyPort, policyType networking.PolicyType) []policyinfo.EndpointInfo {
321314
var addresses []policyinfo.EndpointInfo
322315

316+
var portList []policyinfo.Port
317+
// populate the policy applied targets' ports
318+
// only populate ports for Ingress and from network policy namespaces as destination ports
319+
if policyType == networking.PolicyTypeIngress {
320+
portList = r.getIngressRulesPorts(ctx, policy.Namespace, &policy.Spec.PodSelector, rulePorts)
321+
if len(rulePorts) != len(portList) && len(portList) == 0 {
322+
r.logger.Info("Couldn't get matched port list from ingress of policy", "policy", types.NamespacedName{Name: policy.Name, Namespace: policy.Namespace}.String(),
323+
"ingressPorts", rulePorts, "derivedPorts", portList)
324+
return nil
325+
}
326+
}
327+
328+
// populate src pods for ingress and dst pods for egress
323329
podList := &corev1.PodList{}
324330
if err := r.k8sClient.List(ctx, podList, &client.ListOptions{
325331
LabelSelector: r.createPodLabelSelector(ls),
@@ -329,25 +335,25 @@ func (r *defaultEndpointsResolver) getMatchingPodAddresses(ctx context.Context,
329335
return nil
330336
}
331337
r.logger.V(1).Info("Got pods for label selector", "count", len(podList.Items), "selector", ls.String())
338+
332339
for _, pod := range podList.Items {
333340
podIP := k8s.GetPodIP(&pod)
334341
if len(podIP) == 0 {
335342
r.logger.Info("pod IP not assigned yet", "pod", k8s.NamespacedName(&pod))
336343
continue
337344
}
338-
portList := r.getPortList(pod, ports)
339-
if len(ports) != len(portList) && len(portList) == 0 {
340-
r.logger.Info("Couldn't get matched port list from the pod", "pod", k8s.NamespacedName(&pod), "expectedPorts", ports)
341-
continue
345+
346+
if policyType == networking.PolicyTypeEgress {
347+
portList = r.getPortList(pod, rulePorts)
348+
if len(rulePorts) != len(portList) && len(portList) == 0 {
349+
r.logger.Info("Couldn't get matched port list from the pod", "pod", k8s.NamespacedName(&pod), "expectedPorts", rulePorts)
350+
continue
351+
}
342352
}
353+
343354
addresses = append(addresses, policyinfo.EndpointInfo{
344-
CIDR: policyinfo.NetworkAddress(podIP),
345-
Ports: func(policyType networking.PolicyType) []policyinfo.Port {
346-
if policyType == networking.PolicyTypeIngress {
347-
return policyPorts
348-
}
349-
return portList
350-
}(rule),
355+
CIDR: policyinfo.NetworkAddress(podIP),
356+
Ports: portList,
351357
})
352358
}
353359

‎pkg/resolvers/endpoints_test.go‎

Lines changed: 22 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -658,7 +658,7 @@ func TestEndpointsResolver_ResolveNetworkPeers(t *testing.T) {
658658
{
659659
ContainerPort: port80,
660660
Protocol: corev1.ProtocolTCP,
661-
Name: "test-port",
661+
Name: "src-port",
662662
},
663663
},
664664
},
@@ -668,6 +668,7 @@ func TestEndpointsResolver_ResolveNetworkPeers(t *testing.T) {
668668
PodIP: "1.0.0.1",
669669
},
670670
}
671+
671672
dstPodOne := corev1.Pod{
672673
ObjectMeta: metav1.ObjectMeta{
673674
Name: "pod2",
@@ -681,7 +682,7 @@ func TestEndpointsResolver_ResolveNetworkPeers(t *testing.T) {
681682
{
682683
ContainerPort: port8080,
683684
Protocol: corev1.ProtocolTCP,
684-
Name: "test-port",
685+
Name: "dst-port",
685686
},
686687
},
687688
},
@@ -715,6 +716,12 @@ func TestEndpointsResolver_ResolveNetworkPeers(t *testing.T) {
715716
},
716717
}
717718

719+
portsMap := map[string]int32{
720+
"src-port": port80,
721+
"dst-port": port8080,
722+
}
723+
724+
// the policy is applied to dst namespace on dst pod
718725
policy := &networking.NetworkPolicy{
719726
ObjectMeta: metav1.ObjectMeta{
720727
Name: "netpol",
@@ -737,7 +744,7 @@ func TestEndpointsResolver_ResolveNetworkPeers(t *testing.T) {
737744
Ports: []networking.NetworkPolicyPort{
738745
{
739746
Protocol: &protocolTCP,
740-
Port: &intstr.IntOrString{Type: intstr.String, StrVal: "test-port"},
747+
Port: &intstr.IntOrString{Type: intstr.String, StrVal: "dst-port"},
741748
},
742749
},
743750
},
@@ -756,7 +763,7 @@ func TestEndpointsResolver_ResolveNetworkPeers(t *testing.T) {
756763
Ports: []networking.NetworkPolicyPort{
757764
{
758765
Protocol: &protocolTCP,
759-
Port: &intstr.IntOrString{Type: intstr.Int, IntVal: port8080},
766+
Port: &intstr.IntOrString{Type: intstr.String, StrVal: "src-port"},
760767
EndPort: &port9090,
761768
},
762769
},
@@ -798,6 +805,7 @@ func TestEndpointsResolver_ResolveNetworkPeers(t *testing.T) {
798805
// getting ingress endpoint calls listing pods with dst NS first
799806
mockClient.EXPECT().List(gomock.Any(), podList, gomock.Any()).DoAndReturn(
800807
func(ctx context.Context, podList *corev1.PodList, opts ...client.ListOption) error {
808+
podList.Items = []corev1.Pod{dstPodOne, dstPodTwo}
801809
podList.Items = []corev1.Pod{dstPodOne, dstPodTwo}
802810
return nil
803811
},
@@ -820,7 +828,7 @@ func TestEndpointsResolver_ResolveNetworkPeers(t *testing.T) {
820828

821829
dstNS := corev1.Namespace{
822830
ObjectMeta: metav1.ObjectMeta{
823-
Name: "dst",
831+
Name: "src",
824832
},
825833
}
826834

@@ -834,6 +842,7 @@ func TestEndpointsResolver_ResolveNetworkPeers(t *testing.T) {
834842
),
835843
mockClient.EXPECT().List(gomock.Any(), podList, gomock.Any()).DoAndReturn(
836844
func(ctx context.Context, podList *corev1.PodList, opts ...client.ListOption) error {
845+
podList.Items = []corev1.Pod{dstPodOne, dstPodTwo}
837846
podList.Items = []corev1.Pod{dstPodOne, dstPodTwo}
838847
return nil
839848
},
@@ -866,16 +875,23 @@ func TestEndpointsResolver_ResolveNetworkPeers(t *testing.T) {
866875
}
867876
}
868877

878+
// the policy is applied to dst namespace
879+
// the ingress should have cidr from src pod and ports from dst pod
880+
// the egress should have cidr from src pod and ports from src pod
869881
for _, ingPE := range ingressEndpoints {
870882
assert.Equal(t, srcPod.Status.PodIP, string(ingPE.CIDR))
871883
assert.Equal(t, dstPodOne.Spec.Containers[0].Ports[0].ContainerPort, *ingPE.Ports[0].Port)
872884
assert.Equal(t, 1, len(ingPE.Ports))
885+
assert.Equal(t, dstPodOne.Spec.Containers[0].Ports[0].ContainerPort, *ingPE.Ports[0].Port)
886+
assert.Equal(t, 1, len(ingPE.Ports))
873887
}
874888

875889
for _, egPE := range egressEndpoints {
876890
assert.True(t, string(egPE.CIDR) == dstPodOne.Status.PodIP || string(egPE.CIDR) == dstPodTwo.Status.PodIP)
877891
assert.Equal(t, dstPodOne.Spec.Containers[0].Ports[0].ContainerPort, *egPE.Ports[0].Port)
878-
assert.Equal(t, policy.Spec.Egress[0].Ports[0].Port.IntVal, *egPE.Ports[0].Port)
892+
assert.Equal(t, srcPod.Status.PodIP, string(egPE.CIDR))
893+
assert.Equal(t, srcPod.Spec.Containers[0].Ports[0].ContainerPort, *egPE.Ports[0].Port)
894+
assert.Equal(t, portsMap[policy.Spec.Egress[0].Ports[0].Port.StrVal], *egPE.Ports[0].Port)
879895
assert.Equal(t, *policy.Spec.Egress[0].Ports[0].EndPort, *egPE.Ports[0].EndPort)
880896
}
881897
}

0 commit comments

Comments
 (0)