kubeovn / kube-ovn / 22943278123

27%

Build Type

push

github

Committed by web-flow

Commit Message

fix: scope ipBlock.except to its own CIDR in NetworkPolicy ACL rules (#6419)

When a NetworkPolicy rule has both ipBlock and selector peers, the
ipBlock.except was incorrectly applied to all peers because all
addresses were merged into a single allow/except address set pair.
Per K8s spec, peers within a rule are OR'd, so ipBlock.except should
only exclude addresses within its own CIDR, not affect selector peers.

Split ipBlock and selector peers into separate ACLs: ipBlock peers
use inline OVN match expressions with per-CIDR scoped except, while
selector peers use address sets without except. This follows the same
approach as ovn-kubernetes.

No upgrade migration needed: handleUpdateNp deletes all ACLs before
recreating, and controller restart triggers resync of all policies.

Signed-off-by: Mengxin Liu <liumengxinfly@gmail.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Coverage Stats

94 of 185 new or added lines in 2 files covered. (50.81%)

5 existing lines in 1 file now uncovered.

12726 of 54713 relevant lines covered (23.26%)

0.27 hits per line