reweave/weave
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'gobomb/fix-nil-ns-pointer'

Browse Source 
Needed a few modifications to resolve conflicts due to changed
datatype of UID.
This commit is contained in:
Bryan Boreham committed 2020-08-03 12:32:31 +00:00
2 parents c3504788a0 2ec3e1ef1a
commit f9e27f76d6
3 files changed
+35 -24
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

npc/controller.go
+5 -5
View File
@@ -61,9 +61,9 @@ func New(nodeName string, ipt iptables.Interface, ips ipset.Interface, clientset
func (npc *controller) onNewNsSelector(selector *selector) error {
for _, ns := range npc.nss {
if ns.namespace != nil {
if selector.matchesNamespaceSelector(ns.namespace.ObjectMeta.Labels) {
if err := selector.addEntry(nsuid(ns.namespace), string(ns.allPods.ipsetName), namespaceComment(ns)); err != nil {
if ns.namespaceUID != "" {
if selector.matchesNamespaceSelector(ns.namespaceLabels) {
if err := selector.addEntry(ns.namespaceUID, string(ns.allPods.ipsetName), namespaceComment(ns)); err != nil {
return err
}
}
@@ -74,10 +74,10 @@ func (npc *controller) onNewNsSelector(selector *selector) error {
func (npc *controller) onNewNamespacePodsSelector(selector *selector) error {
for _, ns := range npc.nss {
if ns.namespace != nil && len(ns.pods) > 0 {
if ns.namespaceUID != "" && len(ns.pods) > 0 {
for _, pod := range ns.pods {
if hasIP(pod) {
if selector.matchesNamespacedPodSelector(pod.ObjectMeta.Labels, ns.namespace.ObjectMeta.Labels) {
if selector.matchesNamespacedPodSelector(pod.ObjectMeta.Labels, ns.namespaceLabels) {
if err := selector.addEntry(uid(pod), pod.Status.PodIP, podComment(pod)); err != nil {
return err
}
npc/controller_test.go
+8
View File
@@ -160,6 +160,7 @@ func TestRegressionPolicyNamespaceOrdering3059(t *testing.T) {
sourceNamespace := &coreapi.Namespace{
ObjectMeta: metav1.ObjectMeta{
Name: "source",
UID: "source",
Labels: map[string]string{
"app": "source",
},
@@ -169,6 +170,7 @@ func TestRegressionPolicyNamespaceOrdering3059(t *testing.T) {
destinationNamespace := &coreapi.Namespace{
ObjectMeta: metav1.ObjectMeta{
Name: "destination",
UID: "destination",
},
}
@@ -249,6 +251,7 @@ func TestDefaultAllow(t *testing.T) {
defaultNamespace := &coreapi.Namespace{
ObjectMeta: metav1.ObjectMeta{
Name: "default",
UID: "default",
},
}
controller.AddNamespace(defaultNamespace)
@@ -378,6 +381,7 @@ func TestOutOfOrderPodEvents(t *testing.T) {
defaultNamespace := &coreapi.Namespace{
ObjectMeta: metav1.ObjectMeta{
Name: "default",
UID: "default",
},
}
client.CoreV1().Namespaces().Create(defaultNamespace)
@@ -462,6 +466,7 @@ func TestNewTargetSelector(t *testing.T) {
defaultNamespace := &coreapi.Namespace{
ObjectMeta: metav1.ObjectMeta{
Name: "default",
UID: "default",
},
}
client.CoreV1().Namespaces().Create(defaultNamespace)
@@ -540,11 +545,13 @@ func TestEgressPolicyWithIPBlock(t *testing.T) {
defaultNamespace := &coreapi.Namespace{
ObjectMeta: metav1.ObjectMeta{
Name: "default",
UID: "default",
},
}
nonDefaultNamespace := &coreapi.Namespace{
ObjectMeta: metav1.ObjectMeta{
Name: "non-default",
UID: "non-default",
},
}
client.CoreV1().Namespaces().Create(defaultNamespace)
@@ -635,6 +642,7 @@ func TestIngressPolicyWithIPBlockAndPortSpecified(t *testing.T) {
defaultNamespace := &coreapi.Namespace{
ObjectMeta: metav1.ObjectMeta{
Name: "default",
UID: "default",
},
}
npc/namespace.go
+22 -19
View File
@@ -22,11 +22,12 @@ type ns struct {
ipt iptables.Interface // interface to iptables
ips ipset.Interface // interface to ipset
name string // k8s Namespace name
nodeName string // my node name
namespace *coreapi.Namespace // k8s Namespace object
pods map[ipset.UID]*coreapi.Pod // k8s Pod objects by UID
policies map[ipset.UID]interface{} // k8s NetworkPolicy objects by UID
name string // k8s Namespace name
nodeName string // my node name
namespaceUID ipset.UID // k8s Namespace UID
namespaceLabels map[string]string // k8s Namespace labels
pods map[ipset.UID]*coreapi.Pod // k8s Pod objects by UID
policies map[ipset.UID]interface{} // k8s NetworkPolicy objects by UID
uid ipset.UID // surrogate UID to own allPods selector
allPods *selectorSpec // hash:ip ipset of all pod IPs in this namespace
@@ -54,7 +55,8 @@ func newNS(name, nodeName string, ipt iptables.Interface, ips ipset.Interface, n
ipt: ipt,
ips: ips,
name: name,
namespace: namespaceObj,
namespaceUID: nsuid(namespaceObj),
namespaceLabels: namespaceObj.ObjectMeta.Labels,
nodeName: nodeName,
pods: make(map[ipset.UID]*coreapi.Pod),
policies: make(map[ipset.UID]interface{}),
@@ -88,7 +90,7 @@ func newNS(name, nodeName string, ipt iptables.Interface, ips ipset.Interface, n
}
func (ns *ns) empty() bool {
return len(ns.pods) == 0 && len(ns.policies) == 0 && ns.namespace == nil
return len(ns.pods) == 0 && len(ns.policies) == 0 && ns.namespaceUID == ""
}
func (ns *ns) destroy() error {
@@ -181,7 +183,7 @@ func (ns *ns) addPod(obj *coreapi.Pod) error {
}
}
err = ns.namespacedPodsSelectors.addToMatchingNamespacedPodSelector(uid(obj), obj.ObjectMeta.Labels, ns.namespace.ObjectMeta.Labels, obj.Status.PodIP, podComment(obj))
err = ns.namespacedPodsSelectors.addToMatchingNamespacedPodSelector(uid(obj), obj.ObjectMeta.Labels, ns.namespaceLabels, obj.Status.PodIP, podComment(obj))
if err != nil {
return err
}
@@ -204,7 +206,7 @@ func (ns *ns) updatePod(oldObj, newObj *coreapi.Pod) error {
if err := ns.ips.DelEntry(uid(oldObj), ns.egressDefaultAllowIPSet, oldObj.Status.PodIP); err != nil {
return err
}
if err := ns.namespacedPodsSelectors.delFromMatchingNamespacedPodSelector(uid(oldObj), oldObj.ObjectMeta.Labels, ns.namespace.ObjectMeta.Labels, oldObj.Status.PodIP); err != nil {
if err := ns.namespacedPodsSelectors.delFromMatchingNamespacedPodSelector(uid(oldObj), oldObj.ObjectMeta.Labels, ns.namespaceLabels, oldObj.Status.PodIP); err != nil {
return err
}
@@ -227,7 +229,7 @@ func (ns *ns) updatePod(oldObj, newObj *coreapi.Pod) error {
return err
}
}
err = ns.namespacedPodsSelectors.addToMatchingNamespacedPodSelector(uid(newObj), newObj.ObjectMeta.Labels, ns.namespace.ObjectMeta.Labels, newObj.Status.PodIP, podComment(newObj))
err = ns.namespacedPodsSelectors.addToMatchingNamespacedPodSelector(uid(newObj), newObj.ObjectMeta.Labels, ns.namespaceLabels, newObj.Status.PodIP, podComment(newObj))
if err != nil {
return err
}
@@ -272,8 +274,8 @@ func (ns *ns) updatePod(oldObj, newObj *coreapi.Pod) error {
}
}
for _, ps := range ns.namespacedPodsSelectors.entries {
oldMatch := ps.matchesNamespacedPodSelector(oldObj.ObjectMeta.Labels, ns.namespace.ObjectMeta.Labels)
newMatch := ps.matchesNamespacedPodSelector(newObj.ObjectMeta.Labels, ns.namespace.ObjectMeta.Labels)
oldMatch := ps.matchesNamespacedPodSelector(oldObj.ObjectMeta.Labels, ns.namespaceLabels)
newMatch := ps.matchesNamespacedPodSelector(newObj.ObjectMeta.Labels, ns.namespaceLabels)
if oldMatch == newMatch && oldObj.Status.PodIP == newObj.Status.PodIP {
continue
}
@@ -326,7 +328,7 @@ func (ns *ns) deletePod(obj *coreapi.Pod) error {
if err := ns.podSelectors.delFromMatchingPodSelector(uid(obj), obj.ObjectMeta.Labels, obj.Status.PodIP); err != nil {
return err
}
if err := ns.namespacedPodsSelectors.delFromMatchingNamespacedPodSelector(uid(obj), obj.ObjectMeta.Labels, ns.namespace.ObjectMeta.Labels, obj.Status.PodIP); err != nil {
if err := ns.namespacedPodsSelectors.delFromMatchingNamespacedPodSelector(uid(obj), obj.ObjectMeta.Labels, ns.namespaceLabels, obj.Status.PodIP); err != nil {
return err
}
return nil
@@ -488,7 +490,8 @@ func (ns *ns) deleteBypassRules() error {
}
func (ns *ns) addNamespace(obj *coreapi.Namespace) error {
ns.namespace = obj
ns.namespaceUID = ipset.UID(obj.ObjectMeta.UID)
ns.namespaceLabels = obj.ObjectMeta.Labels
// Insert a rule to bypass policies
if err := ns.ensureBypassRules(); err != nil {
@@ -501,10 +504,10 @@ func (ns *ns) addNamespace(obj *coreapi.Namespace) error {
}
func (ns *ns) updateNamespace(oldObj, newObj *coreapi.Namespace) error {
ns.namespace = newObj
// Re-evaluate namespace selector membership if labels have changed
if !equals(oldObj.ObjectMeta.Labels, newObj.ObjectMeta.Labels) {
ns.namespaceLabels = newObj.ObjectMeta.Labels
for _, selector := range ns.nsSelectors.entries {
oldMatch := selector.matchesNamespaceSelector(oldObj.ObjectMeta.Labels)
newMatch := selector.matchesNamespaceSelector(newObj.ObjectMeta.Labels)
@@ -512,12 +515,12 @@ func (ns *ns) updateNamespace(oldObj, newObj *coreapi.Namespace) error {
continue
}
if oldMatch {
if err := selector.delEntry(nsuid(ns.namespace), string(ns.allPods.ipsetName)); err != nil {
if err := selector.delEntry(ns.namespaceUID, string(ns.allPods.ipsetName)); err != nil {
return err
}
}
if newMatch {
if err := selector.addEntry(nsuid(ns.namespace), string(ns.allPods.ipsetName), namespaceComment(ns)); err != nil {
if err := selector.addEntry(ns.namespaceUID, string(ns.allPods.ipsetName), namespaceComment(ns)); err != nil {
return err
}
}
@@ -528,7 +531,7 @@ func (ns *ns) updateNamespace(oldObj, newObj *coreapi.Namespace) error {
}
func (ns *ns) deleteNamespace(obj *coreapi.Namespace) error {
ns.namespace = nil
ns.namespaceUID = ""
// Remove bypass rule
if err := ns.deleteBypassRules(); err != nil {