NetworkPolicy: Fix e2e test failures

Handle namespaceSelector in NetworkPolicyPeer Fixes #112
cloudnativelabs · Aug 16, 2017 · 4ddfc8b · 4ddfc8b
1 parent 8bf6281
commit 4ddfc8b
Show file tree

Hide file tree

Showing 2 changed files with 32 additions and 1 deletion.
diff --git a/app/controllers/network_policy_controller.go b/app/controllers/network_policy_controller.go
@@ -20,6 +20,7 @@ import (
 	"github.com/golang/glog"
 	"github.com/janeczku/go-ipset/ipset"
 	"k8s.io/client-go/kubernetes"
+	api "k8s.io/client-go/pkg/api/v1"
 	apiv1 "k8s.io/client-go/pkg/api/v1"
 	apiextensions "k8s.io/client-go/pkg/apis/extensions/v1beta1"
 	networking "k8s.io/client-go/pkg/apis/networking/v1"
@@ -693,8 +694,26 @@ func buildNetworkPoliciesInfo() (*[]networkPolicyInfo, error) {
 				ingressRule.matchAllSource = true
 			} else {
 				ingressRule.matchAllSource = false
+				var matchingPods []*api.Pod
+				var err error
 				for _, peer := range specIngressRule.From {
-					matchingPods, err := watchers.PodWatcher.ListByNamespaceAndLabels(policy.Namespace, peer.PodSelector.MatchLabels)
+					// spec must have either of PodSelector or NamespaceSelector
+					if peer.PodSelector != nil {
+						matchingPods, err = watchers.PodWatcher.ListByNamespaceAndLabels(policy.Namespace,
+							peer.PodSelector.MatchLabels)
+					} else if peer.NamespaceSelector != nil {
+						namespaces, err := watchers.NamespaceWatcher.ListByLabels(peer.NamespaceSelector.MatchLabels)
+						if err != nil {
+							return nil, errors.New("Failed to build network policies info due to " + err.Error())
+						}
+						for _, namespace := range namespaces {
+							namespacePods, err := watchers.PodWatcher.ListByNamespaceAndLabels(namespace.Name, nil)
+							if err != nil {
+								return nil, errors.New("Failed to build network policies info due to " + err.Error())
+							}
+							matchingPods = append(matchingPods, namespacePods...)
+						}
+					}
 					if err == nil {
 						for _, matchingPod := range matchingPods {
 							ingressRule.srcPods = append(ingressRule.srcPods,

diff --git a/app/watchers/namespace_watcher.go b/app/watchers/namespace_watcher.go
@@ -10,6 +10,8 @@ import (
 	"k8s.io/client-go/kubernetes"
 	api "k8s.io/client-go/pkg/api/v1"
 	cache "k8s.io/client-go/tools/cache"
+	listers "k8s.io/client-go/listers/core/v1"
+	"k8s.io/apimachinery/pkg/labels"
 )
 
 type NamespaceUpdate struct {
@@ -68,6 +70,16 @@ func (nsw *namespaceWatcher) List() []*api.Namespace {
 	return namespace_instances
 }
 
+func (nsw *namespaceWatcher) ListByLabels(set labels.Set) ([]*api.Namespace, error) {
+	namespaceLister := listers.NewNamespaceLister(nsw.namespaceLister)
+	matchedNamespaces, err := namespaceLister.List(set.AsSelector())
+	if err != nil {
+		return nil, err
+	} else {
+		return matchedNamespaces, nil
+	}
+}
+
 func (nsw *namespaceWatcher) RegisterHandler(handler NamespaceUpdatesHandler) {
 	nsw.broadcaster.Add(utils.ListenerFunc(func(instance interface{}) {
 		handler.OnNamespaceUpdate(instance.(*NamespaceUpdate))