[NPM Lite] Support Network Policies Through CNS #3287
Conversation
rejain456
changed the title
tamilmani1989
changed the title
|
can we add comment to the description that this change is only applied on windows |
|
/azp run Azure Container Networking PR |
|
Azure Pipelines successfully started running 1 pipeline(s). |
rejain456
dismissed stale reviews from paulyufan2 and tamilmani1989
via
ab735cc
|
/azp run Azure Container Networking PR |
|
Azure Pipelines successfully started running 1 pipeline(s). |
|
/azp run Azure Container Networking PR |
|
Azure Pipelines successfully started running 1 pipeline(s). |
There was a problem hiding this comment.
Could you also add a test in cni/network/network_windows_test.go > TestPluginWindowsAdd (modify either test) such that the returned cns response includes a different endpoint policy to be returned for each response and then confirm that it propagates to the network and endpoint policies fields in the respective wanted EndpointInfo structs properly?
cni/network/network.go
Outdated
| @@ -616,6 +616,7 @@ func (plugin *NetPlugin) Add(args *cniSkel.CmdArgs) error { | |||
|
|
|||
| natInfo := getNATInfo(nwCfg, options[network.SNATIPKey], enableSnatForDNS) | |||
| networkID, _ := plugin.getNetworkID(args.Netns, &ifInfo, nwCfg) | |||
| policies = append(policies, ipamAddResult.interfaceInfo[key].EndpointPolicies...) | |||
There was a problem hiding this comment.
Since there is only one "policies" variable won't this keep appending policies from each interface info such that the last item in this loop will have a "policies" field equal to all policies from all interfaceinfos?
Like if in the first iteration I loop over the infra nic and have a deny policy, it'll get added to the policies variable. Then in the second iteration if I then loop over a delegated nic, policies will still contain the default deny but now it will be applied to the delegated nic right?
If these policies are specific to this particular interface info maybe they can be placed here? https://github.com/Azure/azure-container-networking/pull/3287/files#diff-a2f1c51b6e94c2d11383e394bdae9391a1cdef8e6b6ff24210e4ff04f7692f5eR836 .
Alternatively we can create a new endpoint policies variable so the original "policies" variable isn't overwritten after each iteration of the loop.
There was a problem hiding this comment.
Thanks a lot for the suggestion, updated the code
rejain456
force-pushed
the
jainriya/npmliteCNIchange
branch
from
b799db1 to
19c40d7
Compare
Reason for Change:
As part of adding default deny so pods can't communicate with one another when network policies are not present, this pr is part 3 which updates the cni code, retrieving the default deny acl from cns and creating HNS endpoints of the ACL's for the pods
Issue Fixed:
Requirements:
Notes: