SameLabels support for ACNP peer Namespace selection #4537

Dyanngg · 2023-01-06T06:28:48Z

This PR adds the sameLabels field in ACNP peer's namespaces.
The usecase for this field is to allow cluster admins to create ACNPs that
isolate Namespaces based on their label values. For example, if there are
numerous Namespaces in the cluster that has label tier=production and
other Namespaces with label tier=dev, admins can create a single ACNP
that says the production Namespaces can only communicate within
themselves, and same for the dev Namespaces.

codecov · 2023-01-06T06:44:39Z

Codecov Report

Merging #4537 (6f55f15) into main (f32f796) will decrease coverage by 5.06%.
The diff coverage is 6.49%.

❗ Current head 6f55f15 differs from pull request most recent head 3c2b7d5. Consider uploading reports for the commit 3c2b7d5 to get more accurate results

@@            Coverage Diff             @@
##             main    #4537      +/-   ##
==========================================
- Coverage   73.57%   68.51%   -5.06%     
==========================================
  Files         410      403       -7     
  Lines       61105    58816    -2289     
==========================================
- Hits        44956    40297    -4659     
- Misses      13257    15711    +2454     
+ Partials     2892     2808      -84

Flag	Coverage Δ		*Carryforward flag
e2e-tests	`38.36% <6.49%> (-0.36%)`	⬇️
integration-tests	`34.29% <ø> (+1.06%)`	⬆️	Carriedforward from 4e5fba7
kind-e2e-tests	`41.20% <ø> (-7.50%)`	⬇️	Carriedforward from 4e5fba7
unit-tests	`60.02% <ø> (-4.81%)`	⬇️	Carriedforward from 4e5fba7

*This pull request uses carry forward flags. Click here to find out more.

Impacted Files	Coverage Δ
...ntroller/networkpolicy/networkpolicy_controller.go	`83.92% <0.00%> (-1.24%)`	⬇️
pkg/controller/networkpolicy/validate.go	`52.42% <0.00%> (-27.17%)`	⬇️
...g/controller/networkpolicy/clusternetworkpolicy.go	`54.96% <6.99%> (-19.82%)`	⬇️

... and 185 files with indirect coverage changes

Dyanngg · 2023-01-11T06:22:23Z

/test-multicluster-e2e

Dyanngg · 2023-01-12T21:16:56Z

/test-multicluster-e2e

qiyueyao

I believe SameLabels need to monitor Namespace changes, in addNamespace/updateNamespace.

pkg/controller/networkpolicy/clusternetworkpolicy.go

Dyanngg · 2023-01-27T19:59:32Z

I believe SameLabels need to monitor Namespace changes, in addNamespace/updateNamespace.

Thanks for the heads up. Updated the logic in these functions to better filter the ACNPs that need to be reprocessed

Dyanngg · 2023-03-02T00:16:06Z

@tnqn could you help review this? Hope to merge it by 1.11. Thanks

Dyanngg · 2023-03-02T18:45:46Z

/test-all

Dyanngg · 2024-03-02T00:22:49Z

Any plan to add SameLabels into antrea-network-policy.md doc?

Will do in a separate PR

pkg/controller/networkpolicy/clusternetworkpolicy.go

multicluster/test/e2e/antreapolicy_test.go

pkg/controller/networkpolicy/clusternetworkpolicy.go

test/e2e/antreapolicy_test.go

tnqn

LGTM, two minor comments.

tnqn · 2024-03-14T06:30:20Z

test/e2e/antreapolicy_test.go

 	podIPs                                      map[string][]string
 	p80, p81, p8080, p8081, p8082, p8085, p6443 int32
 	nodes                                       map[string]string
+	selfNamespace                               *crdv1beta1.PeerNamespaces


This is a "invariant" variable defined for reuse, right? I think it's more clear to initialize its value here, instead of in a function. So do other cases like "p80, p81, p8080, p8081, p8082, p8085, p6443".

tnqn · 2024-03-14T06:38:20Z

test/e2e/k8s_util.go

+	_, err := k.crdClient.CrdV1alpha3().Groups(namespace).Get(context.TODO(), name, metav1.GetOptions{})
+	if err != nil {


I had a PR to simplify such code: no need to get a resource first as create will fail with a specific AlreadyExists error anyway.

Signed-off-by: Dyanngg <dingyang@vmware.com>

jsalatiel · 2024-03-18T20:59:16Z

In which version is this expected to be released?

tnqn · 2024-03-19T05:50:23Z

In which version is this expected to be released?

@jsalatiel It will be in the next release: v2.0

tnqn

LGTM

tnqn · 2024-03-19T05:51:37Z

/test-all

In NodeNetworkPolicy e2e tests, we have test the following cases: - Nodes to Nodes. We deploy two hostNetwork Pods on different Nodes. - Node to remote Pods. We deploy a hostNetwork Pod on a Node and a non-hostNetwork Pod on another Node. For case of Node to local Pods, we don't test it since the UDP probing from a non-hostNetwork Pod to the hostNetwork Pod deployed on the same Node will get a failure. The reason is that the reply packets use the local Antrea gateway IP as source IP, instead of the local Node IP, which is the destination IP of the request packets, resulting in the failure of test Pods initialization. This PR fixes the e2e test failure by reverting the test Pods initialization modified by PR antrea-io#4537. Signed-off-by: Hongliang Liu <lhongliang@vmware.com>

In NodeNetworkPolicy e2e tests, we have the following cases: - Nodes to Nodes. We deploy two hostNetwork Pods on different Nodes. - Node to remote Pods. We deploy a hostNetwork Pod on a Node and a non-hostNetwork Pod on another Node. For the case of Node to local Pods, we don't test it since the UDP probing from a non-hostNetwork Pod to the hostNetwork Pod deployed on the same Node will get a failure. The reason is that the reply packets use the local Antrea gateway IP as source IP, instead of the local Node IP, which is the destination IP of the request packets, resulting in the failure of test Pods initialization. This PR fixes the e2e test failure by reverting the test Pods initialization modified by PR antrea-io#4537. Signed-off-by: Hongliang Liu <lhongliang@vmware.com>

In NodeNetworkPolicy e2e tests, we have the following cases: - Node to Node. We deploy two hostNetwork Pods on different Nodes. - Node to remote Pods. We deploy a hostNetwork Pod on a Node and a non-hostNetwork Pod on another Node. For the case of Node to local Pods, we don't test it since the UDP probing from a non-hostNetwork Pod to the hostNetwork Pod deployed on the same Node will get a failure. The reason is that the reply packets use the local Antrea gateway IP as source IP, instead of the local Node IP, which is the destination IP of the request packets, resulting in the failure of test Pods initialization. This PR fixes the e2e test failure by reverting the test Pods initialization modified by PR antrea-io#4537. Signed-off-by: Hongliang Liu <lhongliang@vmware.com>

In NodeNetworkPolicy e2e tests, we have the following cases: - Node to Nodes. We deploy two hostNetwork Pods on different Nodes. - Node to remote Pods. We deploy a hostNetwork Pod on a Node and a non-hostNetwork Pod on another Node. For the case of Node to local Pods, we don't test it since the UDP probing from a non-hostNetwork Pod to the hostNetwork Pod deployed on the same Node will get a failure. The reason is that the reply packets use the local Antrea gateway IP as source IP, instead of the local Node IP, which is the destination IP of the request packets, resulting in the failure of test Pods initialization. This PR fixes the e2e test failure by reverting the test Pods initialization modified by PR antrea-io#4537. Signed-off-by: Hongliang Liu <lhongliang@vmware.com>

Dyanngg added this to the Antrea v1.11 release milestone Jan 6, 2023

Dyanngg force-pushed the same-labels branch 10 times, most recently from d9adf87 to dbfd891 Compare January 10, 2023 22:06

Dyanngg changed the title ~~[WIP] SameLabels support for ACNP peer Namespace selection~~ SameLabels support for ACNP peer Namespace selection Jan 10, 2023

Dyanngg force-pushed the same-labels branch 2 times, most recently from 9eb0b92 to e18f8c6 Compare January 11, 2023 06:15

Dyanngg requested review from tnqn, GraysonWu and qiyueyao January 11, 2023 06:15

qiyueyao reviewed Jan 17, 2023

View reviewed changes

pkg/controller/networkpolicy/clusternetworkpolicy.go Show resolved Hide resolved

Dyanngg force-pushed the same-labels branch from e18f8c6 to 7eb27f7 Compare January 18, 2023 19:39

Dyanngg force-pushed the same-labels branch from 1f95447 to 42ddf60 Compare January 27, 2023 03:51

Dyanngg requested a review from qiyueyao January 27, 2023 19:59

Dyanngg force-pushed the same-labels branch from 6123008 to 6166014 Compare March 2, 2023 18:44

vicky-liu removed this from the Antrea v1.11 release milestone Mar 8, 2023

Dyanngg force-pushed the same-labels branch from 6166014 to dadcb74 Compare March 16, 2023 22:49

Dyanngg force-pushed the same-labels branch 2 times, most recently from a2da5ad to 70eccc8 Compare March 2, 2024 00:22

tnqn reviewed Mar 5, 2024

View reviewed changes

Dyanngg force-pushed the same-labels branch from dcd9e63 to 0613884 Compare March 8, 2024 00:35

tnqn previously approved these changes Mar 14, 2024

View reviewed changes

tnqn added the action/release-note Indicates a PR that should be included in release notes. label Mar 14, 2024

Dyanngg added 6 commits March 18, 2024 11:45

Support SameLabels as peer Namespace selection in ACNP

ed01dd7

Signed-off-by: Dyanngg <dingyang@vmware.com>

Refactor policy e2e framework for same labels tests

cd8768d

Signed-off-by: Dyanngg <dingyang@vmware.com>

Add same-labels e2e testcase

5d6985f

Signed-off-by: Dyanngg <dingyang@vmware.com>

Add E2E testcase for Namespace label update

d92ab6a

Signed-off-by: Dyanngg <dingyang@vmware.com>

Improve namespace label filtering

de625a8

Signed-off-by: Dyanngg <dingyang@vmware.com>

Address comments

83e9865

Signed-off-by: Dyanngg <dingyang@vmware.com>

Dyanngg dismissed tnqn’s stale review via 40e2b20 March 18, 2024 20:44

Dyanngg force-pushed the same-labels branch from 0613884 to 40e2b20 Compare March 18, 2024 20:44

Address more comments

b8a8ace

Signed-off-by: Dyanngg <dingyang@vmware.com>

Dyanngg force-pushed the same-labels branch from 40e2b20 to b8a8ace Compare March 18, 2024 20:56

tnqn added this to the Antrea v2.0 release milestone Mar 19, 2024

tnqn approved these changes Mar 19, 2024

View reviewed changes

tnqn merged commit 59f642a into antrea-io:main Mar 19, 2024
52 of 56 checks passed

Dyanngg deleted the same-labels branch March 19, 2024 17:57

tnqn mentioned this pull request Mar 21, 2024

TestL7NetworkPolicy e2e tests failing consistently #6129

Closed

hongliangl mentioned this pull request Apr 2, 2024

Fix NodeNetworkPolicy e2e test failure #6172

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

SameLabels support for ACNP peer Namespace selection #4537

SameLabels support for ACNP peer Namespace selection #4537

Dyanngg commented Jan 6, 2023 •

edited

Loading

codecov bot commented Jan 6, 2023 •

edited

Loading

Dyanngg commented Jan 11, 2023

Dyanngg commented Jan 12, 2023

qiyueyao left a comment

Dyanngg commented Jan 27, 2023

Dyanngg commented Mar 2, 2023

Dyanngg commented Mar 2, 2023

Dyanngg commented Mar 2, 2024

tnqn left a comment

tnqn Mar 14, 2024

tnqn Mar 14, 2024

jsalatiel commented Mar 18, 2024

tnqn commented Mar 19, 2024

tnqn left a comment

tnqn commented Mar 19, 2024

		_, err := k.crdClient.CrdV1alpha3().Groups(namespace).Get(context.TODO(), name, metav1.GetOptions{})
		if err != nil {

SameLabels support for ACNP peer Namespace selection #4537

SameLabels support for ACNP peer Namespace selection #4537

Conversation

Dyanngg commented Jan 6, 2023 • edited Loading

codecov bot commented Jan 6, 2023 • edited Loading

Codecov Report

Dyanngg commented Jan 11, 2023

Dyanngg commented Jan 12, 2023

qiyueyao left a comment

Choose a reason for hiding this comment

Dyanngg commented Jan 27, 2023

Dyanngg commented Mar 2, 2023

Dyanngg commented Mar 2, 2023

Dyanngg commented Mar 2, 2024

tnqn left a comment

Choose a reason for hiding this comment

tnqn Mar 14, 2024

Choose a reason for hiding this comment

tnqn Mar 14, 2024

Choose a reason for hiding this comment

jsalatiel commented Mar 18, 2024

tnqn commented Mar 19, 2024

tnqn left a comment

Choose a reason for hiding this comment

tnqn commented Mar 19, 2024

Dyanngg commented Jan 6, 2023 •

edited

Loading

codecov bot commented Jan 6, 2023 •

edited

Loading