From c742ec49938de9fe81acfaa40f1559d4973ad7d1 Mon Sep 17 00:00:00 2001 From: Martynas Pumputis Date: Fri, 3 Aug 2018 13:02:50 +0200 Subject: [PATCH] npc: Enable ipBlock for Ingress policy When using ipBlock in Ingress policy, one should be aware that source IP addr of packet destined to Pod in many cases is mangled, see docs/k8s-src-ip.md for the cases. However, the mangling in some cases can be prevented with setting externalTrafficPolicy to Local. --- npc/analyser.go | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/npc/analyser.go b/npc/analyser.go index a19bb711..d33068ba 100644 --- a/npc/analyser.go +++ b/npc/analyser.go @@ -63,6 +63,7 @@ func (ns *ns) analysePolicy(policy *networkingv1.NetworkPolicy) ( } else { for _, peer := range ingressRule.From { var srcSelector *selectorSpec + var srcRuleHost ruleHost // NetworkPolicyPeer describes a peer to allow traffic from. // Exactly one of its fields must be specified. @@ -72,17 +73,22 @@ func (ns *ns) analysePolicy(policy *networkingv1.NetworkPolicy) ( return nil, nil, nil, nil, err } addIfNotExist(srcSelector, podSelectors) - + srcRuleHost = srcSelector } else if peer.NamespaceSelector != nil { srcSelector, err = newSelectorSpec(peer.NamespaceSelector, nil, "", ipset.ListSet) if err != nil { return nil, nil, nil, nil, err } nsSelectors[srcSelector.key] = srcSelector + srcRuleHost = srcSelector + } else if peer.IPBlock != nil { + ipBlock := newIPBlockSpec(peer.IPBlock, ns.name) + ipBlocks[ipBlock.key] = ipBlock + srcRuleHost = ipBlock } if allPorts { - rule := newRuleSpec(policyTypeIngress, nil, srcSelector, targetSelector, nil) + rule := newRuleSpec(policyTypeIngress, nil, srcRuleHost, targetSelector, nil) rules[rule.key] = rule } else { withNormalisedProtoAndPort(ingressRule.Ports, func(proto, port string) {