cilium / cilium / 11152 / 1
39%
master: 39%

DEFAULT BRANCH: master
Ran
Files 442
Run time 34s
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 45.483% (-0.03%) from 45.516%
11152.1

push

travis-ci-com

ianvernon 
policy: remove checking of CIDR-based fields from `IsLabelBased` checks

CIDR-based policy is converted to a label-based representation, so CIDR-policy
is in a sense label-based. Update the `IsLabelBased` functions for ingress and
egress rules, as well as add unit tests accordingly. The removal of checking of
CIDR-based fields in the `IsLabelBased` checks means that we now do wildcarding
at L7 for CIDR-based rules as well in addition to `EndpointSelector` based
rules. Policies like the following will now result in wildcarding at L7:

```
apiVersion: "cilium.io/v2"
kind: CiliumNetworkPolicy
description: "L3-L4-L7 CIDR policy"
metadata:
  name: "l7-cidr-cnp"
spec:
  egress:
  - toCIDR:
    - 1.2.3.4/32
    toPorts:
    - ports:
      - port: "80"
        protocol: TCP
      rules:
        http:
        - headers:
          - 'X-My-Header: true'
          method: GET
          path: /
  endpointSelector:
    matchLabels:
      id: app1
```

```
apiVersion: "cilium.io/v2"
kind: CiliumNetworkPolicy
description: "L3 CIDR policy"
metadata:
  name: "l3-cidr-cnp"
spec:
  egress:
  - toCIDR:
    - 1.2.3.4/32
  endpointSelector:
    matchLabels:
      id: app1
```

In other words, even though there is one rule (l7-cidr-cnp) which only allows
egress access to `GET /` with `X-My-Header:true` to `1.2.3.4/32` on port 80/TCP,
the second rule (l3-cidr-cnp) pokes a wider hole in the firewall to allow all
egress traffic to 1.2.3.4. However, we still will redirect to the proxy, but
we will allow all traffic to preserve existing behavior for visibility purposes.

Note that rules with `ToServices` and `ToFQDNs` are not considered label based
as of this commit.

Signed-off by: Ian Vernon <ian@cilium.io>

25792 of 56707 relevant lines covered (45.48%)

1202.0 hits per line

Source Files on job 11152.1