Repository navigation
Tags
Tags
Extend Pod-side NetworkPolicy reverse-match signal to Cilium and Cali… …co (#651) * Extend Pod-side NetworkPolicy reverse-match signal to Cilium and Calico Surfaces which CiliumNetworkPolicy/CiliumClusterwideNetworkPolicy and Calico NetworkPolicy/GlobalNetworkPolicy objects select a Pod, alongside the existing upstream NetworkPolicy signal -- same compact "selected by ... (ingress/egress restricted)" convention, no attempt at full L7/DNS rule evaluation (Cilium) or order/tier/deny-vs-allow resolution (Calico). Calico's spec.selector/namespaceSelector are a small boolean expression language, not Kubernetes LabelSelectors, so pkg/plugin/calicoselector adapts Calico's own parser/AST (from libcalico-go/lib/selector) rather than risk subtly wrong operator semantics from a from-scratch reimplementation; libcalico-go isn't independently module-versioned so it can't be a plain dependency, and the port drops the interning/hash/visitor machinery that only matters for Calico's own long-running dataplane use case. All of these CRDs are optional -- the KubeGet* helpers degrade to a no-op the same way the upstream NetworkPolicy helper already does when listing fails (missing CRD, RBAC denial, etc). Calico's own NetworkPolicy/GlobalNetworkPolicy are served under crd.projectcalico.org/v1 (the Kubernetes-datastore CRDs), not projectcalico.org/v3 (the calicoctl/Calico-API-server view) -- verified against the real CRD manifests. e2e coverage applies the Cilium/Calico CRDs standalone (no CNI install needed, since matching is entirely client-side against Pod labels) via a new install-e2e-deps step. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * Add regression tests for nil/absent-map edge cases flagged in review Gemini Code Assist's review flagged three spots as potential panics/ mismatches: an absent Cilium endpointSelector, a nil Calico spec passed to policyTypesWithDefault, and Labels() on a not-found Namespace. All three are already handled correctly today -- FromUnstructured(nil, ...) degrades to an empty (match-everything) selector, and reading a nil Go map returns the zero value rather than panicking, which is exactly how RenderableObject's other accessors (Metadata/Spec/Status/Labels) are already designed to behave. Verified empirically before touching anything; these tests pin that behavior down instead of adding defensive checks for cases that can't actually occur. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
PreviousNext