noironetworks / aci-containers / 11538

63%

master: 63%

Build Type

Pull #1658

travis-pro

Committed by jeffinkottaram

Commit Message

Add named port support for NetworkPolicy service augmentation

The controller previously did not handle named target ports when
applying NetworkPolicy egress rules with service augmentation. This
caused egress policies to fail for services using named ports, as
the controller could not match named ports specified in NetworkPolicy
rules against actual service endpoints.

This commit adds tracking and resolution of named target ports and
enforces stricter all-or-nothing port coverage semantics for service
augmentation.

Key changes:
- Add namedPortServiceIndex for empty egress 'To' rules (no peer
  selectors) to track and resolve services with named target ports
- For rules with peer selectors, resolve named ports directly from
  EndpointSlices during NetworkPolicy port processing
- Change targetPort.ports from []int to map[int]bool to efficiently
  verify all endpoint IPs are covered by allowed ports
- Enforce exclusion of services with incomplete endpoint coverage
  (previously not properly enforced)
- Fix ruleCounter to generate unique HPP rule names when multiple
  named ports exist in same rule (prevents duplicate identifiers)
- Support port range specifications that involve named ports

Service augmentation now correctly handles named ports and ensures
services are only augmented when all endpoint ports are covered.

Pull Request Pull Request #1658: Add named port support for NetworkPolicy service augmentation

Run Details

134 of 277 new or added lines in 2 files covered. (48.38%)

18 existing lines in 2 files now uncovered.

13406 of 21372 relevant lines covered (62.73%)

0.72 hits per line