Fixed match set on IPv6 iptables rules

Signed-off-by: Roberto Bonafiglia <roberto.bonafiglia@suse.com>
k3s-io · Jan 9, 2024 · 6660072 · 6660072
1 parent 7e4894c
commit 6660072
Showing 1 changed file with 11 additions and 4 deletions.
diff --git a/pkg/controllers/netpol/policy.go b/pkg/controllers/netpol/policy.go
@@ -912,32 +912,39 @@ func networkPolicyChainName(namespace, policyName string, version string, ipFami
 	return kubeNetworkPolicyChainPrefix + encoded[:16]
 }
 
+func getIPSetFamilyPrefix(ipFamily api.IPFamily) string {
+	if ipFamily == api.IPv6Protocol {
+		return "inet6:"
+	}
+	return ""
+}
+
 func policySourcePodIPSetName(namespace, policyName string, ipFamily api.IPFamily) string {
 	hash := sha256.Sum256([]byte(namespace + policyName + string(ipFamily)))
 	encoded := base32.StdEncoding.EncodeToString(hash[:])
-	return kubeSourceIPSetPrefix + encoded[:16]
+	return getIPSetFamilyPrefix(ipFamily) + kubeSourceIPSetPrefix + encoded[:16]
 }
 
 func policyDestinationPodIPSetName(namespace, policyName string, ipFamily api.IPFamily) string {
 	hash := sha256.Sum256([]byte(namespace + policyName + string(ipFamily)))
 	encoded := base32.StdEncoding.EncodeToString(hash[:])
-	return kubeDestinationIPSetPrefix + encoded[:16]
+	return getIPSetFamilyPrefix(ipFamily) + kubeDestinationIPSetPrefix + encoded[:16]
 }
 
 func policyIndexedSourcePodIPSetName(
 	namespace, policyName string, ingressRuleNo int, ipFamily api.IPFamily) string {
 	hash := sha256.Sum256([]byte(namespace + policyName + "ingressrule" + strconv.Itoa(ingressRuleNo) +
 		string(ipFamily) + "pod"))
 	encoded := base32.StdEncoding.EncodeToString(hash[:])
-	return kubeSourceIPSetPrefix + encoded[:16]
+	return getIPSetFamilyPrefix(ipFamily) + kubeSourceIPSetPrefix + encoded[:16]
 }
 
 func policyIndexedDestinationPodIPSetName(
 	namespace, policyName string, egressRuleNo int, ipFamily api.IPFamily) string {
 	hash := sha256.Sum256([]byte(namespace + policyName + "egressrule" + strconv.Itoa(egressRuleNo) +
 		string(ipFamily) + "pod"))
 	encoded := base32.StdEncoding.EncodeToString(hash[:])
-	return kubeDestinationIPSetPrefix + encoded[:16]
+	return getIPSetFamilyPrefix(ipFamily) + kubeDestinationIPSetPrefix + encoded[:16]
 }
 
 func policyIndexedSourceIPBlockIPSetName(