7003

Committed 06 Jan 2023 11:10AM UTC coverage: 56.099%. First build

Build # 7003

Build Type

Pull #1061

travis-ci-com

Committed by

web-flow

Commit Message

<a href="https://github.com/noironetworks/aci-containers/commit/<a class=hub.com/noironetworks/aci-containers/commit/a66e96e1d78ef08610673a400d1c02c1de7595a1">a66e96e1d<a href="https://github.com/noironetworks/aci-containers/commit/a66e96e1d78ef08610673a400d1c02c1de7595a1">">Merge </a><a class="double-link" href="https://github.com/noironetworks/aci-containers/commit/<a class="double-link" href="https://github.com/noironetworks/aci-containers/commit/ce33883855e3944cb86961bf7b9d991d5d676dae">ce3388385</a>">ce3388385</a><a href="https://github.com/noironetworks/aci-containers/commit/a66e96e1d78ef08610673a400d1c02c1de7595a1"> into 8cd4c374e">8cd4c374e</a>

Pull Request Pull Request #1061: hpp optimization

Run Details

170 of 170 new or added lines in 5 files covered. (100.0%)

11985 of 21364 relevant lines covered (56.1%)

0.62 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

73.79

/pkg/hostagent/group_assign.go

// Copyright 2018 Cisco Systems, Inc.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

package hostagent

import (
        "encoding/json"

        "github.com/sirupsen/logrus"

        appsv1 "k8s.io/api/apps/v1"
        v1 "k8s.io/api/core/v1"
        v1net "k8s.io/api/networking/v1"
        "k8s.io/client-go/tools/cache"

        "github.com/noironetworks/aci-containers/pkg/index"
        "github.com/noironetworks/aci-containers/pkg/metadata"
        "github.com/noironetworks/aci-containers/pkg/util"
)

func addGroup(gset map[metadata.OpflexGroup]bool, g []metadata.OpflexGroup,
        tenant string, name string) []metadata.OpflexGroup {
        newg := metadata.OpflexGroup{
                PolicySpace: tenant,
                Name:        name,
        }
        if _, ok := gset[newg]; !ok {
                gset[newg] = true
                g = append(g, newg)
        }
        return g
}

func addPolicy(gset map[metadata.OpflexGroup]bool, g metadata.OpflexGroup,
        tenant string, name string) metadata.OpflexGroup {
        newg := metadata.OpflexGroup{
                PolicySpace: tenant,
                Name:        name,
        }
        if _, ok := gset[newg]; !ok {
                gset[newg] = true
                g = newg
        }
        return g
}

func (agent *HostAgent) mergeQosPolicy(podkey string, qpval metadata.OpflexGroup) metadata.OpflexGroup {

        gset := make(map[metadata.OpflexGroup]bool)
        var g metadata.OpflexGroup

        // Add qos policy that directly select this pod
        for _, qpkey := range agent.qosPolPods.GetObjForPod(podkey) {
                g = addPolicy(gset, g, agent.config.DefaultEg.PolicySpace,
                        util.AciNameForKey(agent.config.AciPrefix, "qp", qpkey))
        }

        // When the pod is not selected by any qos policy, return the
        // existing value from the user annotation
        if len(gset) == 0 {
                return qpval
        }
        return g
}

func (agent *HostAgent) mergeNetPolSg(podkey string, pod *v1.Pod,
        namespace *v1.Namespace, sgval []metadata.OpflexGroup) ([]metadata.OpflexGroup, error) {
        gset := make(map[metadata.OpflexGroup]bool)
        var g []metadata.OpflexGroup
        ptypeset := make(map[v1net.PolicyType]bool)

        // Add network policies that directly select this pod
        for _, npkey := range agent.netPolPods.GetObjForPod(podkey) {
                obj, exists, err := agent.netPolInformer.GetIndexer().GetByKey(npkey)
                if err != nil {
                        agent.log.Error("Could not lookup network policy ", npkey)
                        return g, err
                }
                if exists && obj != nil {
                        var labelKey string
                        if agent.config.HppOptimization {
                                np := obj.(*v1net.NetworkPolicy)
                                hash, err := util.CreateHashFromNetPol(np)
                                if err != nil {
                                        agent.log.Error("Failed to create hash for network policy ", npkey)
                                        return g, err
                                }
                                labelKey = util.AciNameForKey(agent.config.AciPrefix, "np", hash)
                        } else {
                                labelKey = util.AciNameForKey(agent.config.AciPrefix, "np", npkey)
                        }
                        g = addGroup(gset, g, agent.config.DefaultEg.PolicySpace, labelKey)
                        for _, t := range util.GetNetPolPolicyTypes(agent.netPolInformer.GetIndexer(), npkey) {
                                ptypeset[t] = true
                        }
                }
        }

        // When the pod is not selected by any network policy, don't apply
        // any extra security groups and return the existing value from
        // the user annotation
        if len(gset) == 0 {
                return sgval, nil
        }

        // Add security groups from the user annotation
        for _, og := range sgval {
                gset[og] = true
                g = append(g, og)
        }

        // Add network policy for accessing the pod's local node
        if pod.Spec.NodeName != "" {
                g = addGroup(gset, g, agent.config.DefaultEg.PolicySpace,
                        util.AciNameForKey(agent.config.AciPrefix, "node", pod.Spec.NodeName))
        }

        // Add static-discovery network policy to allow ICMP/ARP
        g = addGroup(gset, g, agent.config.DefaultEg.PolicySpace,
                util.AciNameForKey(agent.config.AciPrefix, "np", "static-discovery"))

        if !ptypeset[v1net.PolicyTypeIngress] {
                // Add static-ingress since no policy applies to ingress
                g = addGroup(gset, g, agent.config.DefaultEg.PolicySpace,
                        util.AciNameForKey(agent.config.AciPrefix, "np", "static-ingress"))
        }
        if !ptypeset[v1net.PolicyTypeEgress] {
                // Add static-egress since no policy applies to egress
                g = addGroup(gset, g, agent.config.DefaultEg.PolicySpace,
                        util.AciNameForKey(agent.config.AciPrefix, "np", "static-egress"))
        }

        if len(g) == 0 {
                return sgval, nil
        }
        return g, nil
}

func decodeAnnotation(annStr string, into interface{}, logger *logrus.Entry, comment string) {
        if annStr != "" {
                logger.Debugf("decodeAnnotation: %s -- [%s]", annStr, comment)
                err := json.Unmarshal([]byte(annStr), &into)
                if err != nil {
                        logger.WithFields(logrus.Fields{
                                "Annotation": annStr,
                        }).Errorf("%s - could not decode annotation: %v", comment, err)
                }
        }
}

// Gets eg, sg and qos policy annotations on associated deployment or rc
func (agent *HostAgent) getParentAnn(podKey string) (string, string, string, bool) {
        set := []struct {
                indexer  *index.PodSelectorIndex
                informer cache.SharedIndexInformer
        }{
                {agent.depPods, agent.depInformer},
                {agent.rcPods, agent.rcInformer},
        }
        for _, parent := range set {
                for _, pkey := range parent.indexer.GetObjForPod(podKey) {
                        agent.log.Debugf("deployment/rc found for pod: %s", pkey)
                        obj, exists, err :=
                                parent.informer.GetIndexer().GetByKey(pkey)
                        if err != nil {
                                agent.log.Error("Could not lookup parent " +
                                        pkey + ": " + err.Error())
                                continue
                        }
                        if exists && obj != nil {
                                deployment, ok := obj.(*appsv1.Deployment)
                                if ok {
                                        return deployment.ObjectMeta.Annotations[metadata.EgAnnotation],
                                                deployment.ObjectMeta.Annotations[metadata.SgAnnotation],
                                                deployment.ObjectMeta.Annotations[metadata.QpAnnotation], true
                                }

                                rc, ok := obj.(*v1.ReplicationController)
                                if ok {
                                        return rc.ObjectMeta.Annotations[metadata.EgAnnotation],
                                                rc.ObjectMeta.Annotations[metadata.SgAnnotation],
                                                rc.ObjectMeta.Annotations[metadata.QpAnnotation], true
                                }

                        }
                }
        }
        return "", "", "", false
}

// assignGroups assigns epg, security groups and qos policy based on annotations on the
// namespace, deployment and pod.
func (agent *HostAgent) assignGroups(pod *v1.Pod) (metadata.OpflexGroup, []metadata.OpflexGroup, metadata.OpflexGroup, error) {
        var egval metadata.OpflexGroup
        var sgval []metadata.OpflexGroup
        var qpval metadata.OpflexGroup

        logger := podLogger(agent.log, pod)

        podkey, err := cache.MetaNamespaceKeyFunc(pod)
        if err != nil {
                logger.Error("Could not create pod key: ", err)
                return egval, sgval, qpval, err
        }

        namespaceobj, exists, err :=
                agent.nsInformer.GetIndexer().GetByKey(pod.ObjectMeta.Namespace)
        if err != nil {
                agent.log.Error("Could not lookup namespace " +
                        pod.ObjectMeta.Namespace + ": " + err.Error())
                return egval, sgval, qpval, err
        }

        // top-level default annotation
        egval = agent.config.DefaultEg
        sgval = agent.config.DefaultSg
        qpval = agent.config.DefaultQp

        // configured namespace override has next-highest priority
        if nseg, ok := agent.config.NamespaceDefaultEg[pod.Namespace]; ok {
                egval = nseg
        }

        if nssgs, ok := agent.config.NamespaceDefaultSg[pod.Namespace]; ok {
                sgval = nssgs
        }

        if nsqp, ok := agent.config.NamespaceDefaultQp[pod.Namespace]; ok {
                qpval = nsqp
        }

        // namespace annotation has next-highest priority
        var namespace *v1.Namespace
        if exists && namespaceobj != nil {
                namespace = namespaceobj.(*v1.Namespace)
                var temp metadata.OpflexGroup
                decodeAnnotation(namespace.ObjectMeta.Annotations[metadata.EgAnnotation], &temp, logger, "namespace[EpgAnnotation]")

                // For OpenShift installations <= 3.11, we want to offset
                // the namespace annotation applied in this PR:
                // openshift/openshift-ansible@0ad7479. The pods
                // belonging to the four namespaces (i.e.
                // kube-service-catalog,kube-service-catalog,
                // openshift-console, openshift-monitoring and
                // openshift-web-console) need to go into the system
                // EPG, which we do in acc-provision:
                // noironetworks/acc-provision@f93a132
                if agent.config.AciVmmDomainType == "OpenShift" && temp.Name == "kubernetes|kube-system" &&
                        (namespace.ObjectMeta.Name == "kube-service-catalog" || namespace.ObjectMeta.Name == "openshift-console" ||
                                namespace.ObjectMeta.Name == "openshift-monitoring" || namespace.ObjectMeta.Name == "openshift-web-console") {
                        agent.log.Debug("Ignoring annotation set on ", namespace.ObjectMeta.Name)
                } else {
                        decodeAnnotation(namespace.ObjectMeta.Annotations[metadata.EgAnnotation], &egval, logger, "namespace[EpgAnnotation]")
                }
                decodeAnnotation(namespace.ObjectMeta.Annotations[metadata.SgAnnotation], &sgval, logger, "namespace[SgAnnotation]")
                decodeAnnotation(namespace.ObjectMeta.Annotations[metadata.QpAnnotation], &qpval, logger, "namespace[QpAnnotation]")
        }

        // annotation on parent deployment or rc is next-highest priority
        egAnn, sgAnn, qpAnn, found := agent.getParentAnn(podkey)
        if found {
                decodeAnnotation(egAnn, &egval, logger, "deployment/rc[EpgAnnotation]")
                decodeAnnotation(sgAnn, &sgval, logger, "deployment/rc[SgAnnotation]")
                decodeAnnotation(qpAnn, &qpval, logger, "deployment/rc[QpAnnotation]")
        }

        // direct pod annotation is highest priority
        decodeAnnotation(pod.ObjectMeta.Annotations[metadata.EgAnnotation], &egval, logger, "pod[EpgAnnotation]")
        decodeAnnotation(pod.ObjectMeta.Annotations[metadata.QpAnnotation], &qpval, logger, "pod[QpAnnotation]")
        decodeAnnotation(pod.ObjectMeta.Annotations[metadata.SgAnnotation], &sgval, logger, "pod[SgAnnotation]")

        sgval, err = agent.mergeNetPolSg(podkey, pod, namespace, sgval)
        if err != nil {
                logger.Error("Could not generate network policy ",
                        "security groups:", err)
        }

        qpval = agent.mergeQosPolicy(podkey, qpval)

        return egval, sgval, qpval, nil
}

1	// Copyright 2018 Cisco Systems, Inc.
2	//
3	// Licensed under the Apache License, Version 2.0 (the "License");
4	// you may not use this file except in compliance with the License.
5	// You may obtain a copy of the License at
6	//
7	// http://www.apache.org/licenses/LICENSE-2.0
8	//
9	// Unless required by applicable law or agreed to in writing, software
10	// distributed under the License is distributed on an "AS IS" BASIS,
11	// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12	// See the License for the specific language governing permissions and
13	// limitations under the License.
14
15	package hostagent
16
17	import (
18	"encoding/json"
19
20	"github.com/sirupsen/logrus"
21
22	appsv1 "k8s.io/api/apps/v1"
23	v1 "k8s.io/api/core/v1"
24	v1net "k8s.io/api/networking/v1"
25	"k8s.io/client-go/tools/cache"
26
27	"github.com/noironetworks/aci-containers/pkg/index"
28	"github.com/noironetworks/aci-containers/pkg/metadata"
29	"github.com/noironetworks/aci-containers/pkg/util"
30	)
31
32	func addGroup(gset map[metadata.OpflexGroup]bool, g []metadata.OpflexGroup,
33	tenant string, name string) []metadata.OpflexGroup {	1✔
34	newg := metadata.OpflexGroup{	1✔
35	PolicySpace: tenant,	1✔
36	Name: name,	1✔
37	}	1✔
38	if _, ok := gset[newg]; !ok {	2✔
39	gset[newg] = true	1✔
40	g = append(g, newg)	1✔
41	}	1✔
42	return g	1✔
43	}
44
45	func addPolicy(gset map[metadata.OpflexGroup]bool, g metadata.OpflexGroup,
46	tenant string, name string) metadata.OpflexGroup {	×
47	newg := metadata.OpflexGroup{	×
48	PolicySpace: tenant,	×
49	Name: name,	×
50	}	×
51	if _, ok := gset[newg]; !ok {	×
52	gset[newg] = true	×
53	g = newg	×
54	}	×
55	return g	×
56	}
57
58	func (agent *HostAgent) mergeQosPolicy(podkey string, qpval metadata.OpflexGroup) metadata.OpflexGroup {	1✔
59		1✔
60	gset := make(map[metadata.OpflexGroup]bool)	1✔
61	var g metadata.OpflexGroup	1✔
62		1✔
63	// Add qos policy that directly select this pod	1✔
64	for _, qpkey := range agent.qosPolPods.GetObjForPod(podkey) {	1✔
65	g = addPolicy(gset, g, agent.config.DefaultEg.PolicySpace,	×
66	util.AciNameForKey(agent.config.AciPrefix, "qp", qpkey))	×
67	}	×
68
69	// When the pod is not selected by any qos policy, return the
70	// existing value from the user annotation
71	if len(gset) == 0 {	2✔
72	return qpval	1✔
73	}	1✔
74	return g	×
75	}
76
77	func (agent HostAgent) mergeNetPolSg(podkey string, pod v1.Pod,
78	namespace *v1.Namespace, sgval []metadata.OpflexGroup) ([]metadata.OpflexGroup, error) {	1✔
79	gset := make(map[metadata.OpflexGroup]bool)	1✔
80	var g []metadata.OpflexGroup	1✔
81	ptypeset := make(map[v1net.PolicyType]bool)	1✔
82		1✔
83	// Add network policies that directly select this pod	1✔
84	for _, npkey := range agent.netPolPods.GetObjForPod(podkey) {	2✔
85	obj, exists, err := agent.netPolInformer.GetIndexer().GetByKey(npkey)	1✔
86	if err != nil {	1✔
87	agent.log.Error("Could not lookup network policy ", npkey)	×
88	return g, err	×
89	}	×
90	if exists && obj != nil {	2✔
91	var labelKey string	1✔
92	if agent.config.HppOptimization {	2✔
93	np := obj.(*v1net.NetworkPolicy)	1✔
94	hash, err := util.CreateHashFromNetPol(np)	1✔
95	if err != nil {	1✔
96	agent.log.Error("Failed to create hash for network policy ", npkey)	×
97	return g, err	×
98	}	×
99	labelKey = util.AciNameForKey(agent.config.AciPrefix, "np", hash)	1✔
100	} else {	×
101	labelKey = util.AciNameForKey(agent.config.AciPrefix, "np", npkey)	×
102	}	×
103	g = addGroup(gset, g, agent.config.DefaultEg.PolicySpace, labelKey)	1✔
104	for _, t := range util.GetNetPolPolicyTypes(agent.netPolInformer.GetIndexer(), npkey) {	2✔
105	ptypeset[t] = true	1✔
106	}	1✔
107	}
108	}
109
110	// When the pod is not selected by any network policy, don't apply
111	// any extra security groups and return the existing value from
112	// the user annotation
113	if len(gset) == 0 {	2✔
114	return sgval, nil	1✔
115	}	1✔
116
117	// Add security groups from the user annotation
118	for _, og := range sgval {	1✔
119	gset[og] = true	×
120	g = append(g, og)	×
121	}	×
122
123	// Add network policy for accessing the pod's local node
124	if pod.Spec.NodeName != "" {	2✔
125	g = addGroup(gset, g, agent.config.DefaultEg.PolicySpace,	1✔
126	util.AciNameForKey(agent.config.AciPrefix, "node", pod.Spec.NodeName))	1✔
127	}	1✔
128
129	// Add static-discovery network policy to allow ICMP/ARP
130	g = addGroup(gset, g, agent.config.DefaultEg.PolicySpace,	1✔
131	util.AciNameForKey(agent.config.AciPrefix, "np", "static-discovery"))	1✔
132		1✔
133	if !ptypeset[v1net.PolicyTypeIngress] {	1✔
134	// Add static-ingress since no policy applies to ingress	×
135	g = addGroup(gset, g, agent.config.DefaultEg.PolicySpace,	×
136	util.AciNameForKey(agent.config.AciPrefix, "np", "static-ingress"))	×
137	}	×
138	if !ptypeset[v1net.PolicyTypeEgress] {	2✔
139	// Add static-egress since no policy applies to egress	1✔
140	g = addGroup(gset, g, agent.config.DefaultEg.PolicySpace,	1✔
141	util.AciNameForKey(agent.config.AciPrefix, "np", "static-egress"))	1✔
142	}	1✔
143
144	if len(g) == 0 {	1✔
145	return sgval, nil	×
146	}	×
147	return g, nil	1✔
148	}
149
150	func decodeAnnotation(annStr string, into interface{}, logger *logrus.Entry, comment string) {	1✔
151	if annStr != "" {	2✔
152	logger.Debugf("decodeAnnotation: %s -- [%s]", annStr, comment)	1✔
153	err := json.Unmarshal([]byte(annStr), &into)	1✔
154	if err != nil {	1✔
155	logger.WithFields(logrus.Fields{	×
156	"Annotation": annStr,	×
157	}).Errorf("%s - could not decode annotation: %v", comment, err)	×
158	}	×
159	}
160	}
161
162	// Gets eg, sg and qos policy annotations on associated deployment or rc
163	func (agent *HostAgent) getParentAnn(podKey string) (string, string, string, bool) {	1✔
164	set := []struct {	1✔
165	indexer *index.PodSelectorIndex	1✔
166	informer cache.SharedIndexInformer	1✔
167	}{	1✔
168	{agent.depPods, agent.depInformer},	1✔
169	{agent.rcPods, agent.rcInformer},	1✔
170	}	1✔
171	for _, parent := range set {	2✔
172	for _, pkey := range parent.indexer.GetObjForPod(podKey) {	2✔
173	agent.log.Debugf("deployment/rc found for pod: %s", pkey)	1✔
174	obj, exists, err :=	1✔
175	parent.informer.GetIndexer().GetByKey(pkey)	1✔
176	if err != nil {	1✔
177	agent.log.Error("Could not lookup parent " +	×
178	pkey + ": " + err.Error())	×
179	continue	×
180	}
181	if exists && obj != nil {	2✔
182	deployment, ok := obj.(*appsv1.Deployment)	1✔
183	if ok {	2✔
184	return deployment.ObjectMeta.Annotations[metadata.EgAnnotation],	1✔
185	deployment.ObjectMeta.Annotations[metadata.SgAnnotation],	1✔
186	deployment.ObjectMeta.Annotations[metadata.QpAnnotation], true	1✔
187	}	1✔
188
189	rc, ok := obj.(*v1.ReplicationController)	1✔
190	if ok {	2✔
191	return rc.ObjectMeta.Annotations[metadata.EgAnnotation],	1✔
192	rc.ObjectMeta.Annotations[metadata.SgAnnotation],	1✔
193	rc.ObjectMeta.Annotations[metadata.QpAnnotation], true	1✔
194	}	1✔
195
196	}
197	}
198	}
199	return "", "", "", false	1✔
200	}
201
202	// assignGroups assigns epg, security groups and qos policy based on annotations on the
203	// namespace, deployment and pod.
204	func (agent HostAgent) assignGroups(pod v1.Pod) (metadata.OpflexGroup, []metadata.OpflexGroup, metadata.OpflexGroup, error) {	1✔
205	var egval metadata.OpflexGroup	1✔
206	var sgval []metadata.OpflexGroup	1✔
207	var qpval metadata.OpflexGroup	1✔
208		1✔
209	logger := podLogger(agent.log, pod)	1✔
210		1✔
211	podkey, err := cache.MetaNamespaceKeyFunc(pod)	1✔
212	if err != nil {	1✔
213	logger.Error("Could not create pod key: ", err)	×
214	return egval, sgval, qpval, err	×
215	}	×
216
217	namespaceobj, exists, err :=	1✔
218	agent.nsInformer.GetIndexer().GetByKey(pod.ObjectMeta.Namespace)	1✔
219	if err != nil {	1✔
220	agent.log.Error("Could not lookup namespace " +	×
221	pod.ObjectMeta.Namespace + ": " + err.Error())	×
222	return egval, sgval, qpval, err	×
223	}	×
224
225	// top-level default annotation
226	egval = agent.config.DefaultEg	1✔
227	sgval = agent.config.DefaultSg	1✔
228	qpval = agent.config.DefaultQp	1✔
229		1✔
230	// configured namespace override has next-highest priority	1✔
231	if nseg, ok := agent.config.NamespaceDefaultEg[pod.Namespace]; ok {	2✔
232	egval = nseg	1✔
233	}	1✔
234
235	if nssgs, ok := agent.config.NamespaceDefaultSg[pod.Namespace]; ok {	1✔
236	sgval = nssgs	×
237	}	×
238
239	if nsqp, ok := agent.config.NamespaceDefaultQp[pod.Namespace]; ok {	1✔
240	qpval = nsqp	×
241	}	×
242
243	// namespace annotation has next-highest priority
244	var namespace *v1.Namespace	1✔
245	if exists && namespaceobj != nil {	2✔
246	namespace = namespaceobj.(*v1.Namespace)	1✔
247	var temp metadata.OpflexGroup	1✔
248	decodeAnnotation(namespace.ObjectMeta.Annotations[metadata.EgAnnotation], &temp, logger, "namespace[EpgAnnotation]")	1✔
249		1✔
250	// For OpenShift installations <= 3.11, we want to offset	1✔
251	// the namespace annotation applied in this PR:	1✔
252	// openshift/openshift-ansible@0ad7479. The pods	1✔
253	// belonging to the four namespaces (i.e.	1✔
254	// kube-service-catalog,kube-service-catalog,	1✔
255	// openshift-console, openshift-monitoring and	1✔
256	// openshift-web-console) need to go into the system	1✔
257	// EPG, which we do in acc-provision:	1✔
258	// noironetworks/acc-provision@f93a132	1✔
259	if agent.config.AciVmmDomainType == "OpenShift" && temp.Name == "kubernetes\|kube-system" &&	1✔
260	(namespace.ObjectMeta.Name == "kube-service-catalog" \|\| namespace.ObjectMeta.Name == "openshift-console" \|\|	1✔
261	namespace.ObjectMeta.Name == "openshift-monitoring" \|\| namespace.ObjectMeta.Name == "openshift-web-console") {	1✔
262	agent.log.Debug("Ignoring annotation set on ", namespace.ObjectMeta.Name)	×
263	} else {	1✔
264	decodeAnnotation(namespace.ObjectMeta.Annotations[metadata.EgAnnotation], &egval, logger, "namespace[EpgAnnotation]")	1✔
265	}	1✔
266	decodeAnnotation(namespace.ObjectMeta.Annotations[metadata.SgAnnotation], &sgval, logger, "namespace[SgAnnotation]")	1✔
267	decodeAnnotation(namespace.ObjectMeta.Annotations[metadata.QpAnnotation], &qpval, logger, "namespace[QpAnnotation]")	1✔
268	}
269
270	// annotation on parent deployment or rc is next-highest priority
271	egAnn, sgAnn, qpAnn, found := agent.getParentAnn(podkey)	1✔
272	if found {	2✔
273	decodeAnnotation(egAnn, &egval, logger, "deployment/rc[EpgAnnotation]")	1✔
274	decodeAnnotation(sgAnn, &sgval, logger, "deployment/rc[SgAnnotation]")	1✔
275	decodeAnnotation(qpAnn, &qpval, logger, "deployment/rc[QpAnnotation]")	1✔
276	}	1✔
277
278	// direct pod annotation is highest priority
279	decodeAnnotation(pod.ObjectMeta.Annotations[metadata.EgAnnotation], &egval, logger, "pod[EpgAnnotation]")	1✔
280	decodeAnnotation(pod.ObjectMeta.Annotations[metadata.QpAnnotation], &qpval, logger, "pod[QpAnnotation]")	1✔
281	decodeAnnotation(pod.ObjectMeta.Annotations[metadata.SgAnnotation], &sgval, logger, "pod[SgAnnotation]")	1✔
282		1✔
283	sgval, err = agent.mergeNetPolSg(podkey, pod, namespace, sgval)	1✔
284	if err != nil {	1✔
285	logger.Error("Could not generate network policy ",	×
286	"security groups:", err)	×
287	}	×
288
289	qpval = agent.mergeQosPolicy(podkey, qpval)	1✔
290		1✔
291	return egval, sgval, qpval, nil	1✔
292	}

noironetworks / aci-containers / 7003

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous