Enhance ACNP applied to NodePort Service

Signed-off-by: graysonwu <[email protected]>
antrea-io · Sep 30, 2022 · bdf6c87 · bdf6c87
1 parent e7486d5
commit bdf6c87
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/pkg/agent/openflow/pipeline.go b/pkg/agent/openflow/pipeline.go
@@ -2113,7 +2113,7 @@ func (f *featureNetworkPolicy) ingressClassifierFlows() []binding.Flow {
 			Action().GotoTable(IngressMetricTable.GetID()).
 			Done(),
 	}
-	if f.proxyAll {
+	if f.enableAntreaPolicy && f.proxyAll {
 		// This generates the flow to match the NodePort Service packets and forward them to AntreaPolicyIngressRuleTable.
 		// Policies applied on NodePort Service will be enforced in AntreaPolicyIngressRuleTable.
 		flows = append(flows, IngressSecurityClassifierTable.ofTable.BuildFlow(priorityNormal+1).

diff --git a/test/e2e/antreapolicy_test.go b/test/e2e/antreapolicy_test.go
@@ -3734,7 +3734,7 @@ func testACNPNodePortServiceSupport(t *testing.T, data *TestData) {
 	testcases := []podToAddrTestStep{
 		{
 			Pod(fmt.Sprintf("%s/%s", data.testNamespace, clientName)),
-			nodeIP(1),
+			nodeIP(0),
 			svc1.Spec.Ports[0].NodePort,
 			Rejected,
 		},