Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Adding complement string representation for conns #395

Closed
wants to merge 112 commits into from
Closed
Changes from 1 commit
Commits
Show all changes
112 commits
Select commit Hold shift + click to select a range
7286094
adding ANP to parser.k8sobj
shireenf-ibm Apr 30, 2024
cc14430
fixing gocritic rangeValCopy by indexing
shireenf-ibm Apr 30, 2024
bb14609
Merge github.com:np-guard/netpol-analyzer into support_admin_netpolicy
shireenf-ibm Jun 13, 2024
03af344
Merge branch 'main' of github.com:np-guard/netpol-analyzer into suppo…
shireenf-ibm Jun 23, 2024
47b8718
Merge github.com:np-guard/netpol-analyzer into support_admin_netpolicy
shireenf-ibm Jul 4, 2024
150f698
w.i.p. anp support - first commit
shireenf-ibm Jul 8, 2024
87243c2
more examples (2 ANPs/ ANP+NP)
shireenf-ibm Jul 10, 2024
4adf709
fixing references
shireenf-ibm Jul 11, 2024
d25107d
new_test that ensures rule ordering in ANP is respected
shireenf-ibm Jul 11, 2024
d72b159
update the conn representation as complement in case it is shorter (a…
shireenf-ibm Jul 11, 2024
4dfeb6d
test with swapped rules from another test + diff test
shireenf-ibm Jul 11, 2024
de0ff91
more-tests
shireenf-ibm Jul 14, 2024
3eacc3c
fixing conns computations and a test with multiple ANPs
shireenf-ibm Jul 18, 2024
0a85d43
extending output formats of existing tests
shireenf-ibm Jul 18, 2024
3e9db6e
tiny fix
shireenf-ibm Jul 21, 2024
836ed4f
fixing a tinu bug in ruleConnections func
shireenf-ibm Jul 24, 2024
6641bfd
tiny doc updte
shireenf-ibm Jul 29, 2024
619cb88
tiny doc update
shireenf-ibm Jul 29, 2024
b082158
a @todo tbd while review
shireenf-ibm Jul 29, 2024
484d447
return error if ANPs are without name or not unique names
shireenf-ibm Jul 30, 2024
71031e8
remove redundant lines
shireenf-ibm Aug 5, 2024
f672a0b
reverting the changes adding complement string representation (all bu…
shireenf-ibm Aug 11, 2024
4353943
update the conn representation as complement in case it is shorter (a…
shireenf-ibm Jul 11, 2024
2e0d52c
update tests results
shireenf-ibm Aug 11, 2024
eb7a685
Merge github.com:np-guard/netpol-analyzer into support_admin_netpolicy
shireenf-ibm Aug 12, 2024
634706f
Merge remote-tracking branch 'origin/HEAD' into support_admin_netpolicy
shireenf-ibm Aug 12, 2024
2e2ca27
minor updates to netpol_errors
shireenf-ibm Aug 12, 2024
bc29f3f
currently disabling exposure-analysis when there are admin-network-po…
shireenf-ibm Aug 12, 2024
56e9f5d
some organizations (mainly comments updates)
shireenf-ibm Aug 14, 2024
6391bbe
updating some todo messages
shireenf-ibm Aug 14, 2024
9b93505
updating some todo messages/questions
shireenf-ibm Aug 14, 2024
fb5a582
todo question
shireenf-ibm Aug 14, 2024
e168f41
removing a todo that had an answer for, will add some tests on that case
shireenf-ibm Aug 15, 2024
813bf1b
fixing single anp conns compute when ingress and egress are intersect…
shireenf-ibm Aug 15, 2024
5fdac64
Update pkg/internal/netpolerrors/netpol_errors.go
shireenf-ibm Aug 19, 2024
9d81020
Update pkg/netpol/eval/internal/k8s/adminnetpol.go
shireenf-ibm Aug 19, 2024
4839c64
update todo msg
shireenf-ibm Aug 19, 2024
b8ca744
Merge branch 'support_admin_netpolicy' of github.com:np-guard/netpol-…
shireenf-ibm Aug 19, 2024
dcea12d
some fixes to anp so it matches latest apis
shireenf-ibm Aug 19, 2024
586dc7c
fixing port-set union func
shireenf-ibm Aug 20, 2024
ef0ab4d
Update pkg/netpol/connlist/connlist.go
shireenf-ibm Sep 1, 2024
f171a91
Update pkg/netpol/eval/internal/k8s/adminnetpol.go
shireenf-ibm Sep 1, 2024
62d874e
Update pkg/netpol/internal/common/connectionset.go
shireenf-ibm Sep 1, 2024
82ce0f0
Update pkg/netpol/eval/internal/k8s/adminnetpol.go
shireenf-ibm Sep 1, 2024
e40535e
Update pkg/netpol/eval/internal/k8s/adminnetpol.go
shireenf-ibm Sep 1, 2024
92702c0
go.mod + lint fix
shireenf-ibm Sep 2, 2024
eeaf66a
adding todo comment
shireenf-ibm Sep 2, 2024
bcc4545
fixes in subtract
shireenf-ibm Sep 2, 2024
806cc14
one line func eliminated
shireenf-ibm Sep 2, 2024
e972489
uniqueness names are required for netpols and admin-netpols
shireenf-ibm Sep 3, 2024
d3f70e7
hasNetpols considers ANPs too
shireenf-ibm Sep 3, 2024
0778788
Tests for AdminNetworkPolicy (#388)
tanyaveksler Sep 3, 2024
d591d65
Merge branch 'support_admin_netpolicy' of github.com:np-guard/netpol-…
shireenf-ibm Sep 5, 2024
65eff08
updating some todo comment which were updated in BANP PR
shireenf-ibm Sep 9, 2024
c90ac47
sort anps only once before allowed-conns computes (#402)
shireenf-ibm Sep 9, 2024
8d2e6a3
support_banp (#403)
shireenf-ibm Sep 9, 2024
b8c2bbe
adding banp to policy kinds
shireenf-ibm Sep 9, 2024
be0741d
adding comment on priority range
shireenf-ibm Sep 10, 2024
ac39b9f
Update pkg/internal/netpolerrors/netpol_errors.go
shireenf-ibm Sep 15, 2024
d6f8c2f
Update pkg/netpol/eval/internal/k8s/adminnetpol.go
shireenf-ibm Sep 15, 2024
055bd06
Update pkg/netpol/eval/internal/k8s/adminnetpol.go
shireenf-ibm Sep 15, 2024
caf2071
Update pkg/netpol/eval/resources.go
shireenf-ibm Sep 15, 2024
205d829
Update pkg/netpol/eval/internal/k8s/policy_connections.go
shireenf-ibm Sep 15, 2024
8890555
some fixes + a new test
shireenf-ibm Sep 16, 2024
a34c6bf
tiny doc update
shireenf-ibm Sep 19, 2024
c04ee03
demo test
shireenf-ibm Sep 23, 2024
6a88841
tiny change to getPoliciesSelectingPod func and deleting the "depreca…
shireenf-ibm Sep 24, 2024
060e428
removing redundant if statements
shireenf-ibm Sep 29, 2024
793d3cb
new parsed tests with expected outputs and a fix to the func computin…
shireenf-ibm Oct 8, 2024
9293a34
Merge branch 'main' into support_admin_netpolicy
shireenf-ibm Oct 9, 2024
9ad15c5
fixing implementing approach + some more parsed tests
shireenf-ibm Oct 10, 2024
0e99bea
tiny doc update
shireenf-ibm Oct 13, 2024
7a5fdbd
renaming func
shireenf-ibm Oct 20, 2024
33ee747
comment changed
shireenf-ibm Oct 20, 2024
12b45ce
removing comment
shireenf-ibm Oct 23, 2024
a7f1003
changing const names
shireenf-ibm Oct 23, 2024
40bf40f
fixing if else
shireenf-ibm Oct 23, 2024
94a9f21
Merge branch 'main' into support_admin_netpolicy
shireenf-ibm Oct 23, 2024
c6440da
code optimizations and re-org
shireenf-ibm Oct 30, 2024
fceda09
moving parsed_resources_tests file + some re-orgs
shireenf-ibm Oct 30, 2024
102fece
Merge branch 'main' into support_admin_netpolicy
shireenf-ibm Oct 30, 2024
b538089
optimizing collect from banp + fixing one test output
shireenf-ibm Oct 31, 2024
fde9bc8
optimize + fix + tests confirming results - tested with policy-assis…
shireenf-ibm Oct 31, 2024
7ad4e9e
deny examples parallel to the allow examples added previously
shireenf-ibm Nov 1, 2024
62d7a6e
switch
shireenf-ibm Nov 4, 2024
833d1a4
policy conns
shireenf-ibm Nov 4, 2024
b67cc4f
collect from banp
shireenf-ibm Nov 4, 2024
884b288
Merge branch 'main' into support_admin_netpolicy
shireenf-ibm Nov 4, 2024
13045e5
updating outputs with empty line at eof
shireenf-ibm Nov 4, 2024
2eea053
add anp_banp_blog_demo example
adisos Nov 5, 2024
73575da
update example
adisos Nov 5, 2024
6efc4fc
tiny fix
shireenf-ibm Nov 5, 2024
7762462
update example - add another workload and ns
adisos Nov 5, 2024
7bf8d9a
Merge branch 'main' into support_admin_netpolicy
shireenf-ibm Nov 5, 2024
bebdefc
update example
adisos Nov 7, 2024
9d5eab2
min-max priority consts
shireenf-ibm Nov 12, 2024
42ae13c
moving consts
shireenf-ibm Nov 12, 2024
fd39bb1
Merge branch 'main' into support_admin_netpolicy
shireenf-ibm Nov 13, 2024
8ba28f4
renaming some tests + adding blog_test to the connlist_test
shireenf-ibm Nov 13, 2024
09eabee
test updates
shireenf-ibm Nov 13, 2024
22b6a03
updating test
shireenf-ibm Nov 17, 2024
3756baf
adding references
shireenf-ibm Nov 17, 2024
142cfdd
updating test anp_test_6_swapping_rules
shireenf-ibm Nov 17, 2024
5ad1aed
test update
shireenf-ibm Nov 27, 2024
b8b98c6
Merge branch 'main' into support_admin_netpolicy
shireenf-ibm Nov 27, 2024
8a0144b
test update
shireenf-ibm Nov 27, 2024
7b0c7b8
add test details
adisos Nov 28, 2024
d1bf317
Merge remote-tracking branch 'origin/support_admin_netpolicy' into ad…
shireenf-ibm Nov 28, 2024
343fb05
updating new tests outputs with complement str
shireenf-ibm Nov 28, 2024
d19ccbc
Merge branch 'main' into adding_complement_str_rep_for_conns
shireenf-ibm Nov 28, 2024
dfbf544
Merge branch 'main' into adding_complement_str_rep_for_conns
shireenf-ibm Nov 28, 2024
aae7693
Merge branch 'main' into adding_complement_str_rep_for_conns
shireenf-ibm Dec 1, 2024
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
currently disabling exposure-analysis when there are admin-network-po…
…licies in the input resources
shireenf-ibm committed Aug 12, 2024
commit bc29f3fc3aedc8f433de219145ed665c56f562e4
15 changes: 8 additions & 7 deletions pkg/internal/netpolerrors/netpol_errors.go
Original file line number Diff line number Diff line change
@@ -62,13 +62,14 @@ const (
UnableToDecodeErr = "unable to decode"

// errors constants from adminNetworkPolicy
SubjectErrTitle = "invalid Subject:"
SubjectFieldsErr = "Exactly one field must be set"
UnknownRuleActionErr = "unrecognized action"
ANPPortsError = "exactly one field must be set in an AdminNetworkPolicyPort"
ANPIngressRulePeersErr = "From field must be defined and contain at least one item"
ANPEgressRulePeersErr = "To field must be defined and contain at least one item"
ANPMissingNameErr = "missing name for an AdminNetworkPolicy object"
SubjectErrTitle = "invalid Subject:"
SubjectFieldsErr = "Exactly one field must be set"
UnknownRuleActionErr = "unrecognized action"
ANPPortsError = "exactly one field must be set in an AdminNetworkPolicyPort"
ANPIngressRulePeersErr = "From field must be defined and contain at least one item"
ANPEgressRulePeersErr = "To field must be defined and contain at least one item"
ANPMissingNameErr = "missing name for an AdminNetworkPolicy object"
ExposureAnalysisDisabledWithANPs = "exposure analysis is disabled when there are admin-network-policies in the input resources"

UnknownCommandErr = "unknown command"

4 changes: 4 additions & 0 deletions pkg/netpol/eval/resources.go
Original file line number Diff line number Diff line change
@@ -437,6 +437,10 @@ func (pe *PolicyEngine) insertNetworkPolicy(np *netv1.NetworkPolicy) error {
}

func (pe *PolicyEngine) insertAdminNetworkPolicy(anp *apisv1a.AdminNetworkPolicy) error {
// @TBD : currently disabling exposure-analysis when there are admin-network-policies in the input resources
if pe.exposureAnalysisFlag {
return errors.New(netpolerrors.ExposureAnalysisDisabledWithANPs)
}
if anp.Name == "" {
return errors.New(netpolerrors.ANPMissingNameErr)
}