npc: Provision networkingv1.IPBlock (only for Egress)

npc/analyser.go

@@ -98,10 +98,12 @@ func (ns *ns) analysePolicyLegacy(policy *extnapi.NetworkPolicy) (
 func (ns *ns) analysePolicy(policy *networkingv1.NetworkPolicy) (
 	rules map[string]*ruleSpec,
 	nsSelectors, podSelectors map[string]*selectorSpec,
+	ipBlocks map[string]*ipBlockSpec,
 	err error) {
 
 	nsSelectors = make(map[string]*selectorSpec)
 	podSelectors = make(map[string]*selectorSpec)
+	ipBlocks = make(map[string]*ipBlockSpec)
 	rules = make(map[string]*ruleSpec)
 	policyTypes := make([]policyType, 0)
 
@@ -116,7 +118,7 @@ func (ns *ns) analysePolicy(policy *networkingv1.NetworkPolicy) (
 	// If empty, matches all pods in a namespace
 	targetSelector, err := newSelectorSpec(&policy.Spec.PodSelector, policyTypes, ns.name, ipset.HashIP)
 	if err != nil {
-		return nil, nil, nil, err
+		return nil, nil, nil, nil, err
 	}
 
 	// To prevent targetSelector being overwritten by a subsequent selector with
@@ -152,14 +154,14 @@ func (ns *ns) analysePolicy(policy *networkingv1.NetworkPolicy) (
 					if peer.PodSelector != nil {
 						srcSelector, err = newSelectorSpec(peer.PodSelector, nil, ns.name, ipset.HashIP)
 						if err != nil {
-							return nil, nil, nil, err
+							return nil, nil, nil, nil, err
 						}
 						addIfNotExist(srcSelector, podSelectors)
 
 					} else if peer.NamespaceSelector != nil {
 						srcSelector, err = newSelectorSpec(peer.NamespaceSelector, nil, "", ipset.ListSet)
 						if err != nil {
-							return nil, nil, nil, err
+							return nil, nil, nil, nil, err
 						}
 						nsSelectors[srcSelector.key] = srcSelector
 					}
@@ -205,16 +207,19 @@ func (ns *ns) analysePolicy(policy *networkingv1.NetworkPolicy) (
 					if peer.PodSelector != nil {
 						dstSelector, err = newSelectorSpec(peer.PodSelector, nil, ns.name, ipset.HashIP)
 						if err != nil {
-							return nil, nil, nil, err
+							return nil, nil, nil, nil, err
 						}
 						addIfNotExist(dstSelector, podSelectors)
 
 					} else if peer.NamespaceSelector != nil {
 						dstSelector, err = newSelectorSpec(peer.NamespaceSelector, nil, "", ipset.ListSet)
 						if err != nil {
-							return nil, nil, nil, err
+							return nil, nil, nil, nil, err
 						}
 						nsSelectors[dstSelector.key] = dstSelector
+					} else if peer.IPBlock != nil {
+						ipBlock := newIPBlockSpec(peer.IPBlock)
+						ipBlocks[ipBlock.key] = ipBlock
 					}
 
 					if allPorts {
@@ -231,7 +236,7 @@ func (ns *ns) analysePolicy(policy *networkingv1.NetworkPolicy) (
 		}
 	}
 
-	return rules, nsSelectors, podSelectors, nil
+	return rules, nsSelectors, podSelectors, ipBlocks, nil
 }
 
 func addIfNotExist(s *selectorSpec, ss map[string]*selectorSpec) {

npc/namespace.go

@@ -40,6 +40,7 @@ type ns struct {
 
 	nsSelectors  *selectorSet
 	podSelectors *selectorSet
+	ipBlocks     *ipBlockSet
 	rules        *ruleSet
 
 	legacy bool
@@ -61,6 +62,7 @@ func newNS(name, nodeName string, legacy bool, ipt iptables.Interface, ips ipset
 		uid:         uuid.NewUUID(),
 		allPods:     allPods,
 		nsSelectors: nsSelectors,
+		ipBlocks:    newIPBlockSet(ips),
 		rules:       newRuleSet(ipt),
 		legacy:      legacy}
 
@@ -342,7 +344,7 @@ func (ns *ns) deletePod(obj *coreapi.Pod) error {
 func (ns *ns) addNetworkPolicy(obj interface{}) error {
 	// Analyse policy, determine which rules and ipsets are required
 
-	uid, rules, nsSelectors, podSelectors, err := ns.analyse(obj)
+	uid, rules, nsSelectors, podSelectors, ipBlocks, err := ns.analyse(obj)
 	if err != nil {
 		return err
 	}
@@ -354,16 +356,19 @@ func (ns *ns) addNetworkPolicy(obj interface{}) error {
 	if err := ns.podSelectors.provision(uid, nil, podSelectors); err != nil {
 		return err
 	}
+	if err := ns.ipBlocks.provision(uid, nil, ipBlocks); err != nil {
+		return err
+	}
 	return ns.rules.provision(uid, nil, rules)
 }
 
 func (ns *ns) updateNetworkPolicy(oldObj, newObj interface{}) error {
 	// Analyse the old and the new policy so we can determine differences
-	oldUID, oldRules, oldNsSelectors, oldPodSelectors, err := ns.analyse(oldObj)
+	oldUID, oldRules, oldNsSelectors, oldPodSelectors, oldIPBlocks, err := ns.analyse(oldObj)
 	if err != nil {
 		return err
 	}
-	newUID, newRules, newNsSelectors, newPodSelectors, err := ns.analyse(newObj)
+	newUID, newRules, newNsSelectors, newPodSelectors, newIPBlocks, err := ns.analyse(newObj)
 	if err != nil {
 		return err
 	}
@@ -381,18 +386,24 @@ func (ns *ns) updateNetworkPolicy(oldObj, newObj interface{}) error {
 	if err := ns.podSelectors.deprovision(oldUID, oldPodSelectors, newPodSelectors); err != nil {
 		return err
 	}
+	if err := ns.ipBlocks.deprovision(oldUID, oldIPBlocks, newIPBlocks); err != nil {
+		return err
+	}
 	if err := ns.nsSelectors.provision(oldUID, oldNsSelectors, newNsSelectors); err != nil {
 		return err
 	}
 	if err := ns.podSelectors.provision(oldUID, oldPodSelectors, newPodSelectors); err != nil {
 		return err
 	}
+	if err := ns.ipBlocks.provision(oldUID, oldIPBlocks, newIPBlocks); err != nil {
+		return err
+	}
 	return ns.rules.provision(oldUID, oldRules, newRules)
 }
 
 func (ns *ns) deleteNetworkPolicy(obj interface{}) error {
 	// Analyse network policy to free resources
-	uid, rules, nsSelectors, podSelectors, err := ns.analyse(obj)
+	uid, rules, nsSelectors, podSelectors, ipBlocks, err := ns.analyse(obj)
 	if err != nil {
 		return err
 	}
@@ -406,7 +417,14 @@ func (ns *ns) deleteNetworkPolicy(obj interface{}) error {
 	if err := ns.nsSelectors.deprovision(uid, nsSelectors, nil); err != nil {
 		return err
 	}
-	return ns.podSelectors.deprovision(uid, podSelectors, nil)
+	if err := ns.podSelectors.deprovision(uid, podSelectors, nil); err != nil {
+		return err
+	}
+	if err := ns.ipBlocks.deprovision(uid, ipBlocks, nil); err != nil {
+		return err
+	}
+
+	return nil
 }
 
 func (ns *ns) updateDefaultAllowIPSetEntry(oldObj, newObj *coreapi.Pod, ipsetName ipset.Name) error {
@@ -602,6 +620,7 @@ func (ns *ns) analyse(obj interface{}) (
 	uid types.UID,
 	rules map[string]*ruleSpec,
 	nsSelectors, podSelectors map[string]*selectorSpec,
+	ipBlocks map[string]*ipBlockSpec,
 	err error) {
 
 	switch p := obj.(type) {
@@ -622,7 +641,7 @@ func (ns *ns) analyse(obj interface{}) (
 			return
 		}
 	} else {
-		rules, nsSelectors, podSelectors, err = ns.analysePolicy(obj.(*networkingv1.NetworkPolicy))
+		rules, nsSelectors, podSelectors, ipBlocks, err = ns.analysePolicy(obj.(*networkingv1.NetworkPolicy))
 		if err != nil {
 			return
 		}