From cbc3d5b04c2434f577ee74c537642ab9bfde010c Mon Sep 17 00:00:00 2001 From: Mike Bryant Date: Wed, 12 Jul 2017 11:16:42 +0100 Subject: [PATCH] Don't bypass selector provisioning when not default deny If we have namespaces Source and Destination, and Destination contains a NetworkPolicy allowing access from Source, we need to provision the ipsets for Source and add them to relevant selectors, even though Source is DefaultAllow. This also fixes an issue where if the Namespace labels are updated, that would be ignored. Fixes #3059 --- npc/namespace.go | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/npc/namespace.go b/npc/namespace.go index 3749ed36..e0cce644 100644 --- a/npc/namespace.go +++ b/npc/namespace.go @@ -265,7 +265,9 @@ func (ns *ns) addNamespace(obj *coreapi.Namespace) error { // Insert a rule to bypass policies if namespace is DefaultAllow if !isDefaultDeny(obj) { - return ns.ensureBypassRule(ns.allPods.ipsetName) + if err := ns.ensureBypassRule(ns.allPods.ipsetName); err != nil { + return err + } } // Add namespace ipset to matching namespace selectors @@ -282,10 +284,14 @@ func (ns *ns) updateNamespace(oldObj, newObj *coreapi.Namespace) error { if oldDefaultDeny != newDefaultDeny { common.Log.Infof("namespace DefaultDeny changed from %t to %t", oldDefaultDeny, newDefaultDeny) if oldDefaultDeny { - return ns.ensureBypassRule(ns.allPods.ipsetName) + if err := ns.ensureBypassRule(ns.allPods.ipsetName); err != nil { + return err + } } if newDefaultDeny { - return ns.deleteBypassRule(ns.allPods.ipsetName) + if err := ns.deleteBypassRule(ns.allPods.ipsetName); err != nil { + return err + } } } @@ -318,7 +324,9 @@ func (ns *ns) deleteNamespace(obj *coreapi.Namespace) error { // Remove bypass rule if !isDefaultDeny(obj) { - return ns.deleteBypassRule(ns.allPods.ipsetName) + if err := ns.deleteBypassRule(ns.allPods.ipsetName); err != nil { + return err + } } // Remove namespace ipset from any matching namespace selectors