exposure analysis with focus-workload

pkg/netpol/connlist/connlist.go

@@ -525,7 +525,7 @@ func (ca *ConnlistAnalyzer) getConnectionsBetweenPeers(pe *eval.PolicyEngine, pe
 				return nil, nil, err
 			}
 			if ca.exposureAnalysis {
-				err = updatePeersGeneralExposureData(pe, srcPeer, dstPeer, ingressSet, egressSet, exposureMaps)
+				err = ca.updatePeersGeneralExposureData(pe, srcPeer, dstPeer, ingressSet, egressSet, exposureMaps)
 				if err != nil {
 					return nil, nil, err
 				}
@@ -635,7 +635,8 @@ func createConnectionObject(allowedConnections common.Connection, src, dst Peer)
 }
 
 // updatePeersGeneralExposureData updates src and dst connections to entire world/cluster on the exposures map
-func updatePeersGeneralExposureData(pe *eval.PolicyEngine, src, dst Peer, ingressSet, egressSet map[Peer]bool, exMaps *exposureMaps) error {
+func (ca *ConnlistAnalyzer) updatePeersGeneralExposureData(pe *eval.PolicyEngine, src, dst Peer, ingressSet, egressSet map[Peer]bool,
+	exMaps *exposureMaps) error {
 	// when computing allowed conns between the peers,(even on first time)
 	// if a workload peer is not protected by netpols this was definitely detected;
 	// also exposure to entire cluster was definitely computed for src or/and dst (if its a workload peer)
@@ -646,17 +647,29 @@ func updatePeersGeneralExposureData(pe *eval.PolicyEngine, src, dst Peer, ingres
 	// (e.g. only one peer with one netpol exposing the peer to entire cluster, no netpols)
 	var err error
 	// 1. only on first time : add general exposure data for the src peer (on egress)
-	if !src.IsPeerIPType() && !pe.IsRepresentativePeer(src) && !egressSet[src] {
+	if ca.shouldAddPeerGeneralExposureData(pe, src, egressSet) {
 		err = exMaps.addPeerGeneralExposure(pe, src, false)
 		if err != nil {
 			return err
 		}
 	}
 	egressSet[src] = true
 	// 2. only on first time : add general exposure data for the dst peer (on ingress)
-	if !dst.IsPeerIPType() && !pe.IsRepresentativePeer(dst) && !ingressSet[dst] {
+	if ca.shouldAddPeerGeneralExposureData(pe, dst, ingressSet) {
 		err = exMaps.addPeerGeneralExposure(pe, dst, true)
 	}
 	ingressSet[dst] = true
 	return err
 }
+
+// shouldAddPeerGeneralExposureData returns whether should add given peer's general
+// exposure data to the exposure results.
+// returns true if :
+// - the peer is not IP type
+// - the peer is not representative peer
+// - focus-workload flag is not used or the peer is the focus-workload
+// - it is first time the peer is visited
+func (ca *ConnlistAnalyzer) shouldAddPeerGeneralExposureData(pe *eval.PolicyEngine, peer Peer, xgressSet map[Peer]bool) bool {
+	return !peer.IsPeerIPType() && !pe.IsRepresentativePeer(peer) && !xgressSet[peer] &&
+		(ca.focusWorkload == "" || ca.isPeerFocusWorkload(peer))
+}

pkg/netpol/connlist/connlist_test.go

@@ -754,6 +754,20 @@ var goodPathTests = []struct {
 		exposureAnalysis: true,
 		outputFormats:    ExposureValidFormats,
 	},
+	{
+		testDirName:      "acs-security-demos",
+		exposureAnalysis: true,
+		// test with focus-workload that appears in exposure-analysis result
+		focusWorkload: "frontend/webapp",
+		outputFormats: ExposureValidFormats,
+	},
+	{
+		testDirName:      "acs-security-demos",
+		exposureAnalysis: true,
+		// test with focus-workload that does not appear in exposure-analysis result
+		focusWorkload: "backend/catalog",
+		outputFormats: ExposureValidFormats,
+	},
 	{
 		testDirName:      "test_allow_all",
 		exposureAnalysis: true,
@@ -779,6 +793,12 @@ var goodPathTests = []struct {
 		exposureAnalysis: true,
 		outputFormats:    ExposureValidFormats,
 	},
+	{
+		testDirName:      "test_matched_and_unmatched_rules",
+		exposureAnalysis: true,
+		focusWorkload:    "hello-world/workload-a",
+		outputFormats:    ExposureValidFormats,
+	},
 	{
 		testDirName:      "test_only_matched_rules",
 		exposureAnalysis: true,
@@ -864,9 +884,27 @@ var goodPathTests = []struct {
 		exposureAnalysis: true,
 		outputFormats:    ExposureValidFormats,
 	},
+	{
+		testDirName:      "onlineboutique_workloads",
+		exposureAnalysis: true,
+		focusWorkload:    "default/loadgenerator",
+		outputFormats:    ExposureValidFormats,
+	},
 	{
 		testDirName:      "k8s_ingress_test_new",
 		exposureAnalysis: true,
 		outputFormats:    ExposureValidFormats,
 	},
+	{
+		testDirName:      "k8s_ingress_test_new",
+		exposureAnalysis: true,
+		focusWorkload:    "details-v1-79f774bdb9",
+		outputFormats:    ExposureValidFormats,
+	},
+	{
+		testDirName:      "k8s_ingress_test",
+		exposureAnalysis: true,
+		focusWorkload:    "ratings-v1-b6994bb9",
+		outputFormats:    ExposureValidFormats,
+	},
 }

test_outputs/connlist/exposure_acs-security-demos_focus_workload_backend_catalog_connlist_output.dot

@@ -0,0 +1,12 @@
+digraph {
+	subgraph "cluster_backend" {
+		color="black"
+		fontcolor="black"
+		"backend/catalog[Deployment]" [label="catalog[Deployment]" color="blue" fontcolor="blue"]
+		"backend/recommendation[Deployment]" [label="recommendation[Deployment]" color="blue" fontcolor="blue"]
+		"backend/reports[Deployment]" [label="reports[Deployment]" color="blue" fontcolor="blue"]
+		label="backend"
+	}
+	"backend/recommendation[Deployment]" -> "backend/catalog[Deployment]" [label="TCP 8080" color="gold2" fontcolor="darkgreen"]
+	"backend/reports[Deployment]" -> "backend/catalog[Deployment]" [label="TCP 8080" color="gold2" fontcolor="darkgreen"]
+}

test_outputs/connlist/exposure_acs-security-demos_focus_workload_backend_catalog_connlist_output.txt

@@ -0,0 +1,2 @@
+backend/recommendation[Deployment] => backend/catalog[Deployment] : TCP 8080
+backend/reports[Deployment] => backend/catalog[Deployment] : TCP 8080

test_outputs/connlist/exposure_acs-security-demos_focus_workload_frontend_webapp_connlist_output.dot

@@ -0,0 +1,26 @@
+digraph {
+	subgraph "cluster_backend" {
+		color="black"
+		fontcolor="black"
+		"backend/checkout[Deployment]" [label="checkout[Deployment]" color="blue" fontcolor="blue"]
+		"backend/recommendation[Deployment]" [label="recommendation[Deployment]" color="blue" fontcolor="blue"]
+		"backend/reports[Deployment]" [label="reports[Deployment]" color="blue" fontcolor="blue"]
+		"backend/shipping[Deployment]" [label="shipping[Deployment]" color="blue" fontcolor="blue"]
+		label="backend"
+	}
+	subgraph "cluster_frontend" {
+		color="black"
+		fontcolor="black"
+		"frontend/webapp[Deployment]" [label="webapp[Deployment]" color="blue" fontcolor="blue"]
+		label="frontend"
+	}
+	"entire-cluster" [label="entire-cluster" color="red2" fontcolor="red2" shape=diamond]
+	"{ingress-controller}" [label="{ingress-controller}" color="blue" fontcolor="blue"]
+	"entire-cluster" -> "frontend/webapp[Deployment]" [label="TCP 8080" color="gold2" fontcolor="darkgreen"]
+	"frontend/webapp[Deployment]" -> "backend/checkout[Deployment]" [label="TCP 8080" color="gold2" fontcolor="darkgreen"]
+	"frontend/webapp[Deployment]" -> "backend/recommendation[Deployment]" [label="TCP 8080" color="gold2" fontcolor="darkgreen"]
+	"frontend/webapp[Deployment]" -> "backend/reports[Deployment]" [label="TCP 8080" color="gold2" fontcolor="darkgreen"]
+	"frontend/webapp[Deployment]" -> "backend/shipping[Deployment]" [label="TCP 8080" color="gold2" fontcolor="darkgreen"]
+	"frontend/webapp[Deployment]" -> "entire-cluster" [label="UDP 5353" color="gold2" fontcolor="darkgreen"]
+	"{ingress-controller}" -> "frontend/webapp[Deployment]" [label="TCP 8080" color="gold2" fontcolor="darkgreen"]
+}

test_outputs/connlist/exposure_acs-security-demos_focus_workload_frontend_webapp_connlist_output.txt

@@ -0,0 +1,12 @@
+frontend/webapp[Deployment] => backend/checkout[Deployment] : TCP 8080
+frontend/webapp[Deployment] => backend/recommendation[Deployment] : TCP 8080
+frontend/webapp[Deployment] => backend/reports[Deployment] : TCP 8080
+frontend/webapp[Deployment] => backend/shipping[Deployment] : TCP 8080
+{ingress-controller} => frontend/webapp[Deployment] : TCP 8080
+
+Exposure Analysis Result:
+Egress Exposure:
+frontend/webapp[Deployment] 	=> 	entire-cluster : UDP 5353
+
+Ingress Exposure:
+frontend/webapp[Deployment] 	<= 	entire-cluster : TCP 8080