diff --git a/npc/analyser.go b/npc/analyser.go index bd7203cf..0e98d8d6 100644 --- a/npc/analyser.go +++ b/npc/analyser.go @@ -103,9 +103,17 @@ func (ns *ns) analysePolicy(policy *networkingv1.NetworkPolicy) ( nsSelectors = make(map[string]*selectorSpec) podSelectors = make(map[string]*selectorSpec) rules = make(map[string]*ruleSpec) + policyTypes := make([]policyType, 0) + for _, pt := range policy.Spec.PolicyTypes { + if pt == networkingv1.PolicyTypeIngress { + policyTypes = append(policyTypes, ingressPolicy) + } + if pt == networkingv1.PolicyTypeEgress { + policyTypes = append(policyTypes, egressPolicy) + } + } // If empty, matches all pods in a namespace - policyTypes := []policyType{ingressPolicy} dstSelector, err := newSelectorSpec(&policy.Spec.PodSelector, true, policyTypes, ns.name, ipset.HashIP) if err != nil { return nil, nil, nil, err diff --git a/npc/controller_test.go b/npc/controller_test.go index 0336416a..1f7b9a79 100644 --- a/npc/controller_test.go +++ b/npc/controller_test.go @@ -144,6 +144,7 @@ func TestRegressionPolicyNamespaceOrdering3059(t *testing.T) { Namespace: "destination", }, Spec: networkingv1.NetworkPolicySpec{ + PolicyTypes: []networkingv1.PolicyType{networkingv1.PolicyTypeIngress}, Ingress: []networkingv1.NetworkPolicyIngressRule{ { From: []networkingv1.NetworkPolicyPeer{ @@ -249,6 +250,7 @@ func TestDefaultAllow(t *testing.T) { Namespace: "default", }, Spec: networkingv1.NetworkPolicySpec{ + PolicyTypes: []networkingv1.PolicyType{networkingv1.PolicyTypeIngress}, PodSelector: metav1.LabelSelector{MatchLabels: map[string]string{"run": "foo"}}, Ingress: []networkingv1.NetworkPolicyIngressRule{{ From: []networkingv1.NetworkPolicyPeer{{ @@ -299,7 +301,6 @@ func TestDefaultAllow(t *testing.T) { controller.DeleteNamespace(defaultNamespace) // Should remove default ipset require.NotContains(t, m.sets, ingressDefaultAllowIPSetName) - } func TestOutOfOrderPodEvents(t *testing.T) { @@ -337,6 +338,7 @@ func TestOutOfOrderPodEvents(t *testing.T) { Namespace: "default", }, Spec: networkingv1.NetworkPolicySpec{ + PolicyTypes: []networkingv1.PolicyType{networkingv1.PolicyTypeIngress}, PodSelector: metav1.LabelSelector{MatchLabels: map[string]string{"run": "foo"}}, Ingress: []networkingv1.NetworkPolicyIngressRule{{ From: []networkingv1.NetworkPolicyPeer{{ @@ -418,6 +420,7 @@ func TestNewDstSelector(t *testing.T) { Namespace: "default", }, Spec: networkingv1.NetworkPolicySpec{ + PolicyTypes: []networkingv1.PolicyType{networkingv1.PolicyTypeIngress}, PodSelector: metav1.LabelSelector{}, Ingress: []networkingv1.NetworkPolicyIngressRule{{ From: []networkingv1.NetworkPolicyPeer{{ @@ -438,6 +441,7 @@ func TestNewDstSelector(t *testing.T) { Namespace: "default", }, Spec: networkingv1.NetworkPolicySpec{ + PolicyTypes: []networkingv1.PolicyType{networkingv1.PolicyTypeIngress}, PodSelector: metav1.LabelSelector{}, Ingress: []networkingv1.NetworkPolicyIngressRule{{ From: []networkingv1.NetworkPolicyPeer{{