exposure analysis with focus-workload #349
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Closed
adisos
requested changes
May 12, 2024
adisos
approved these changes
May 12, 2024
shireenf-ibm
merged commit 6525871
into
new_exposure_analysis_first_branch
2 checks passed
shireenf-ibm
added a commit
that referenced
this pull request
Aug 8, 2024
* exposure-analysis flag * initial support of exposure from only namespaceSelectors * lint gofmt * wip - defining an interface for exposure-analysis results (#295) * wip - define an interface for the new returned value (new API) * Update pkg/netpol/connlist/exposed_pods.go Co-authored-by: Adi Sosnovich <[email protected]> * wip- some updates to the interfaces (only) * Update pkg/netpol/connlist/exposed_pods.go Co-authored-by: Adi Sosnovich <[email protected]> * interface doc update * fixes * Update pkg/netpol/connlist/exposed_peer.go Co-authored-by: Adi Sosnovich <[email protected]> --------- Co-authored-by: Adi Sosnovich <[email protected]> * connlist implementing exposure analysis (#296) * connlist implementing exposure analysis * Update pkg/netpol/connlist/connlist.go Co-authored-by: Adi Sosnovich <[email protected]> * fix rep. pod name * Update pkg/netpol/eval/exposure.go Co-authored-by: Adi Sosnovich <[email protected]> * Update pkg/netpol/connlist/exposed_peer.go Co-authored-by: Adi Sosnovich <[email protected]> * Update pkg/netpol/connlist/exposed_peer.go Co-authored-by: Adi Sosnovich <[email protected]> * Update pkg/netpol/connlist/exposure_analysis.go Co-authored-by: Adi Sosnovich <[email protected]> * Update pkg/netpol/connlist/exposure_analysis.go Co-authored-by: Adi Sosnovich <[email protected]> * add func that updates the protected flag of a pod * return error values * avoid fields dups among types * update func doc * getConnectionsBetweenPeers update doc + returns the exposureMap * move connection interface, avoid code dup, and compare conns using ConnectionSet * make the func an exposureMap func * fixing issue of same string in podsOwnerMap * Update pkg/netpol/connlist/exposure_analysis.go Co-authored-by: Adi Sosnovich <[email protected]> * renaming Connection interface + move PortRange * struct embedding * using connectionSet internally + move the refinement to one iter at the end * Update pkg/netpol/connection/connection.go Co-authored-by: Adi Sosnovich <[email protected]> * Update pkg/netpol/connlist/exposure_analysis.go Co-authored-by: Adi Sosnovich <[email protected]> * rename AllConnections * verify conversion * storing the maximum entire cluster connection --------- Co-authored-by: Adi Sosnovich <[email protected]> * Revert api changes (#298) * revert Connection, diff AllowedConnectivity, PortRange , ConnectionSet * revert connlist API changes * revert eval API changes * Update pkg/netpol/connlist/connlist.go Co-authored-by: Adi Sosnovich <[email protected]> * Update pkg/netpol/connlist/connlist.go Co-authored-by: Adi Sosnovich <[email protected]> * Update pkg/netpol/eval/exposure.go Co-authored-by: Adi Sosnovich <[email protected]> * renaming funcs * exposing common.Connection as connlist.AllowedSet * revert exposing common.Connection as connlist.AllowedSet --------- Co-authored-by: Adi Sosnovich <[email protected]> * Exposure analysis unit tests (#299) * unit tests for the functionality of connlist/exposure_analysis.go * Update pkg/netpol/connlist/exposure_analysis_test.go Co-authored-by: Adi Sosnovich <[email protected]> * adding getallTCPconnections --------- Co-authored-by: Adi Sosnovich <[email protected]> * Entire cluster exposure opt (#304) * optimizing entire cluster exposure * optimizing performance - compute entire cluster exposure only once * Update pkg/netpol/eval/internal/k8s/pod.go Co-authored-by: Adi Sosnovich <[email protected]> * multiple fixes * Update pkg/netpol/eval/internal/k8s/pod.go Co-authored-by: Adi Sosnovich <[email protected]> * using empty connswt instead of nil * add pod exposure data struct * exporting podExposureInfo --------- Co-authored-by: Adi Sosnovich <[email protected]> * pre proccessing policy for general conns (#306) * first commit: pre proccessing policy for general conns * func doc * fixing to PortSet; instead of PortSet{}, call MakePortSet(false) to ensure initializing empty maps for named ports * fixing handling connections with namedPort * fixing lint issued by github - not relevant to PR * tiny fix * fixes * Policy engine with new api func for exposure analysis (#307) * task1 add new api func to policy-engine; so pre-process runs only for exposure-analysis * task2 on exposure analysis benefit from the stored data * eliminate isRuleGeneral; skip general rules in ruleSelectsPeer * missing func doc * Update pkg/netpol/eval/internal/k8s/netpol.go Co-authored-by: Adi Sosnovich <[email protected]> * todo comment * revert initiating conns between two peers * avoid iterating policy if its general conns are all conns * todo comment --------- Co-authored-by: Adi Sosnovich <[email protected]> * adding representativePeer struct (#309) * adding representativePeer struct * Update pkg/netpol/eval/internal/k8s/peer.go Co-authored-by: Adi Sosnovich <[email protected]> * Update pkg/netpol/eval/resources.go Co-authored-by: Adi Sosnovich <[email protected]> * Update pkg/netpol/eval/resources.go Co-authored-by: Adi Sosnovich <[email protected]> * gofmt * connlist if-else fix * fixes to exposure_map.go * fixing connlist includePairOfWorkloads * fix GetPeerList() - separate GetRepresentativePeersList * comment how Pod of representative peer is originated --------- Co-authored-by: Adi Sosnovich <[email protected]> * Optimize representative peers generation (#314) * add representative peers for all non-empty rules while policies upsert * refine pods that has a match in the resources - first commit * handling returned err from convertPeerToPodPeer * handle case of namespaceSelector containing name key * generate unizue rep peers and refine while upsering objects * Update pkg/netpol/eval/resources.go Co-authored-by: Adi Sosnovich <[email protected]> * fixes --------- Co-authored-by: Adi Sosnovich <[email protected]> * go fmt * lint fix * exposure analysis test (#316) * exposure analysis test * exposure data comparison and new test * using ca calls to compute exposed peers * Update pkg/netpol/connlist/exposure_analysis_test.go Co-authored-by: Adi Sosnovich <[email protected]> * Update pkg/netpol/connlist/exposure_analysis_test.go Co-authored-by: Adi Sosnovich <[email protected]> * Update pkg/netpol/connlist/exposure_analysis_test.go Co-authored-by: Adi Sosnovich <[email protected]> * Update pkg/netpol/connlist/exposure_analysis_test.go Co-authored-by: Adi Sosnovich <[email protected]> * Update pkg/netpol/connlist/exposure_analysis_test.go Co-authored-by: Adi Sosnovich <[email protected]> * lint fix * flattening tests dir * exposure map fixes * 3 values of protected data * splitting exposure map into two maps * fixes * required changes * code fixes * typo fix * a new test for increasing coverage * new test * comment update --------- Co-authored-by: Adi Sosnovich <[email protected]> * delete unused file * textual output with exposure analysis (#331) * textual output with exposure analysis * tiny code enhancement * readme update * output change + code modify * fixes * dot output with exposure results (#333) * dot output with exposure results * tiny fix * new tests * fixing golangci-lint 1.58.0 errors * exposure analysis with pod selectors (#343) * code changes + new tests with pod selectors * fixes and new test * running onlineboutique_workloads with exposure * running k8s_ingress_test_new with exposure * linter fix - headers * exposure analysis with focus-workload (#349) * exposure analysis with focus-workload * focus-workload fixes * textual output enhancement (adding [] to strings with multiple words) * fix * enhancing dot view (#353) * don't remove representative peers in any-namespace (#352) * always keep representative peers which match all-namespaces * update test output after merge * examples with rules exposing pod to an existing ns * Update pkg/netpol/eval/exposure.go Co-authored-by: Adi Sosnovich <[email protected]> * don't refine rep. peers matching any pod in a namespace + changing some tests to keep initial purpose+updating results of existing tests * adding same test with nil podSelector instead of empty one * adding test with inaccurate output * fixing comment syntax * Update pkg/netpol/connlist/connlist_test.go Co-authored-by: Adi Sosnovich <[email protected]> * gofmt * updating comments in yaml * tiny fix --------- Co-authored-by: Adi Sosnovich <[email protected]> * supporting csv, md and json formats (#360) * supporting csv, md and json formats * fixing after merge with base branch * consider real exposure flag * csv, md, json are consistent with txt - two sections * dot graphs with exposure edges dashed and with different colors * merging with master branch * empty_commit * handling selectors with matchexpressions (fixed) (#377) * support match expression operators for generating and selecting representative peers + first examples * more tests * more tests * updating code with label selectors * merge fixes * duplicated tests with matching pods * fixing code + tests with multiple policies * update comments in exposure.go * renaming function and updating comments and doc of representative_selectors.go * move `RepresentativeNsLabelSelector` field from namespace.go to pod.go * 1. reverting changes to AddPodByNameAndNamespace and resolveSingleMissingNamespace (to original version from main branch) 2. creating a new func for adding representative pods to the policy-engine, without representative namespaces. a representative pod which should not be in a real namespace, will have no namespace * avoid duplicating code of generating the default namespace name map; and some updates to netpol.go * eliminate representativePeer.PotentialNamespaceLabelSelector as it duplicates Pod.RepresentativeNsLabelSelector * renaming the func in representative_selectors.go again * a new test with handling a special case of equiv rules written in a different way * unit test for representative_selectors.go * removing redundant code * updating documentation of new fields in pod.go * fixes in resources.go * fix in check.go * update few comments Signed-off-by: adisos <[email protected]> * renaming AddObjects + updating its documentation * renaming netpol funcs * renaming connPeers * fixing representative pods naming and updating relevant funcs * renaming "GeneralConns" to "ExposedGeneralConns" * removing PolicyNsFlag * no need to split namespaces with policies at first * Revert "no need to split namespaces with policies at first" This reverts commit 03e384e. * rename extractLabelsAndRefineRepresentativePeers and refineRepresentativePeersMatchingLabels * renaming checkIfP2PConnOrExposureConn * lint fix * func allAllowedConnectionsBetweenPeers: remove ingressSet, egressSet * using new terms for general conns : ClusterWideExposure and ExternalExposure * an example why should split namespaces at the beginning with the policies * eliminate RepresentativePeer struct * fixing some typos and adding some very used words to a cspell file * more typos fixes * updating some comments * updating readme (all formats supported) * getting netpols before pods for live cluster - so it works well for both exposure-analysis on/off * Update pkg/netpol/eval/check.go Co-authored-by: Adi Sosnovich <[email protected]> * Update pkg/netpol/eval/check.go Co-authored-by: Adi Sosnovich <[email protected]> * Update pkg/netpol/eval/exposure.go Co-authored-by: Adi Sosnovich <[email protected]> * Update pkg/netpol/eval/exposure.go Co-authored-by: Adi Sosnovich <[email protected]> * Update pkg/netpol/eval/internal/k8s/netpol.go Co-authored-by: Adi Sosnovich <[email protected]> * Update pkg/netpol/eval/internal/k8s/netpol.go Co-authored-by: Adi Sosnovich <[email protected]> * Update pkg/netpol/eval/internal/k8s/netpol.go Co-authored-by: Adi Sosnovich <[email protected]> * Update pkg/netpol/eval/internal/k8s/netpol.go Co-authored-by: Adi Sosnovich <[email protected]> * Update pkg/netpol/eval/internal/k8s/netpol.go Co-authored-by: Adi Sosnovich <[email protected]> * Update pkg/netpol/eval/exposure.go Co-authored-by: Adi Sosnovich <[email protected]> * Update pkg/netpol/eval/exposure.go Co-authored-by: Adi Sosnovich <[email protected]> * Update pkg/netpol/eval/exposure.go Co-authored-by: Adi Sosnovich <[email protected]> * rename getSelectorsAndUpdateExposedGeneralConns * rename ScanPolicyRulesAndUpdateExposedWideConns * rename updateNetworkPolicyWideExposureConns * Update pkg/netpol/eval/resources.go Co-authored-by: Adi Sosnovich <[email protected]> * Update pkg/netpol/eval/internal/k8s/peer.go Co-authored-by: Adi Sosnovich <[email protected]> * Update pkg/netpol/eval/internal/k8s/peer.go Co-authored-by: Adi Sosnovich <[email protected]> * Update pkg/netpol/eval/internal/k8s/pod.go Co-authored-by: Adi Sosnovich <[email protected]> * Update pkg/netpol/eval/internal/k8s/pod.go Co-authored-by: Adi Sosnovich <[email protected]> * Update pkg/netpol/eval/resources.go Co-authored-by: Adi Sosnovich <[email protected]> * Update pkg/netpol/eval/resources.go Co-authored-by: Adi Sosnovich <[email protected]> * fixing lint * Update pkg/netpol/eval/internal/k8s/representative_selectors.go Co-authored-by: Adi Sosnovich <[email protected]> * lint fix * Update pkg/netpol/eval/internal/k8s/representative_selectors.go Co-authored-by: Adi Sosnovich <[email protected]> * fixing the last commit * fixing the SelectorsFullMatch doc * removing unnecessaryDeepCopy calls * Update pkg/netpol/eval/internal/k8s/netpol.go Co-authored-by: Adi Sosnovich <[email protected]> * Update pkg/netpol/eval/internal/k8s/netpol.go Co-authored-by: Adi Sosnovich <[email protected]> * lint fix * some renamings in representative_selectors + document why returning full match for rep selector in case of empty rule * adding line to comment * split funcs in check.go for readability * rename hasRepresentativePod * updating comment * updating comment of storing the named port * updating String() func of workloadpeer * comment update * updating comment * new func of selectors match in `netpol.go` to avoid duplicates * updating comment in pod.go (what do the combinations of rep selectors imply for) * renaming str vars * eliminating addIfMissingNamespace func * new tests - rep peers when there is real ns but no real pods matching * add comment on String() func * rename handleRequirementWithInOpAndSingleValue * renaming test dirs and expected output of exposure-analysis tests * new fixes --------- Signed-off-by: adisos <[email protected]> Co-authored-by: adisos <[email protected]> Co-authored-by: Adi Sosnovich <[email protected]> --------- Signed-off-by: adisos <[email protected]> Co-authored-by: Adi Sosnovich <[email protected]> Co-authored-by: Tanya <[email protected]> Co-authored-by: adisos <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
issue #236
task: