noironetworks / aci-containers / 11564

63%

master: 63%

Build Type

Pull #1663

travis-pro

Committed by jeffinkottaram

Commit Message

Add named port support for NetworkPolicy service augmentation

The controller previously did not handle named target ports when
applying NetworkPolicy egress rules with service augmentation. This
caused egress policies to fail for services using named ports, as
the controller could not match named ports specified in NetworkPolicy
rules against actual service endpoints.

This commit adds tracking and resolution of named target ports and
enforces stricter all-or-nothing port coverage semantics for service
augmentation.

Key changes:
- Add namedPortServiceIndex for empty egress 'To' rules (no peer
  selectors) to track and resolve services with named target ports
- For rules with peer selectors, resolve named ports directly from
  EndpointSlices during NetworkPolicy port processing
- Change targetPort.ports from []int to map[int]bool to efficiently
  verify all endpoint IPs are covered by allowed ports
- Enforce exclusion of services with incomplete endpoint coverage
  (previously not properly enforced)
- Fix ruleCounter to generate unique HPP rule names when multiple
  named ports exist in same rule (prevents duplicate identifiers)
- Support port range specifications that involve named ports

Service augmentation now correctly handles named ports and ensures
services are only augmented when all endpoint ports are covered.

(cherry picked from commit e143c7d28)

Pull Request Pull Request #1663: [mmr-6.1.1] Add named port support for NetworkPolicy service augmentation

Run Details

125 of 265 new or added lines in 3 files covered. (47.17%)

5 existing lines in 3 files now uncovered.

13420 of 21363 relevant lines covered (62.82%)

0.72 hits per line