Skip to content

Commit

Permalink
Skip processing unrelated namespace peers for Network Policy
Browse files Browse the repository at this point in the history
When network policy object contains peers from namespace which is not on
subject's user defined network, then it doesn't make sense to add that
peer namespace into OVN's network policy ACL, because those namespaces
are isolated already. Hence this commit avoids processing such peers in
network policy namespace peer handler.

Signed-off-by: Periyasamy Palanisamy <pepalani@redhat.com>
  • Loading branch information
pperiyasamy committed Oct 14, 2024
1 parent 689e95a commit b918dc5
Showing 1 changed file with 16 additions and 0 deletions.
16 changes: 16 additions & 0 deletions go-controller/pkg/ovn/base_network_controller_policy.go
Original file line number Diff line number Diff line change
Expand Up @@ -1400,6 +1400,14 @@ func (bnc *BaseNetworkController) handlePeerNamespaceSelectorAdd(np *networkPoli
var errors []error
for _, obj := range objs {
namespace := obj.(*kapi.Namespace)
netinfo, err := bnc.getActiveNetworkForNamespace(namespace.Name)
if err != nil {
return fmt.Errorf("could not get active network for namespace %s: %v", namespace.Name, err)
}
if bnc.GetNetworkName() != netinfo.GetNetworkName() {
np.RUnlock()
return nil
}
// addNamespaceAddressSet is safe for concurrent use, doesn't require additional synchronization
nsUpdated, err := gp.addNamespaceAddressSet(namespace.Name, bnc.addressSetFactory)
if err != nil {
Expand Down Expand Up @@ -1436,6 +1444,14 @@ func (bnc *BaseNetworkController) handlePeerNamespaceSelectorDel(np *networkPoli
updated := false
for _, obj := range objs {
namespace := obj.(*kapi.Namespace)
netinfo, err := bnc.getActiveNetworkForNamespace(namespace.Name)
if err != nil {
return fmt.Errorf("could not get active network for namespace %s: %v", namespace.Name, err)
}
if bnc.GetNetworkName() != netinfo.GetNetworkName() {
np.RUnlock()
return nil
}
// delNamespaceAddressSet is safe for concurrent use, doesn't require additional synchronization
if gp.delNamespaceAddressSet(namespace.Name) {
updated = true
Expand Down

0 comments on commit b918dc5

Please sign in to comment.