W.I.P Support admin netpolicy #380
Conversation
…rt_admin_netpolicy
|
hi @adisos. this is the beginning of supporting the ANP this PR contains tests with ANPs with multiple rules (tests respecting rules ordering - connlist and diff tests) tasks & PRs which are/will be extensions for current PR:
|
…ll but: udp 5353 instead of SCTP 1-65535,TCP 1-65535,UDP 1-5352,5354-65535)
This comment was marked as outdated.
This comment was marked as outdated.
…t) for connectionSet
Signed-off-by: adisos <[email protected]>
Signed-off-by: adisos <[email protected]>
Signed-off-by: adisos <[email protected]>
Signed-off-by: adisos <[email protected]>
pkg/netpol/connlist/connlist_test.go
Outdated
| outputFormats: []string{output.TextFormat}, | ||
| }, | ||
| { | ||
| testDirName: "anp_test2_allow_traffic_at_cluster_level", |
There was a problem hiding this comment.
for test tests/anp_test2_allow_traffic_at_cluster_level, the result connectivity will be the same even if the policy is deleted, so the effect of the policy is not well demonstrated.
better change the test so that the effect of the tested policy is actual.
please also check this for all other tests.
There was a problem hiding this comment.
okay, I remember those 3 were the first tests I've added ; were taken from here.
will add NetworkPolicy that blocks some of the traffic and see that it is allowed because of the ANP.
will check for other tests
There was a problem hiding this comment.
not sure I understand anp_test_3 - the output with and without the anp is the same
There was a problem hiding this comment.
true, I jsut wanted to show that if the anp passes a connection but this connection is not allowed by networkpolicy then it is not allowed (implicit deny).
I could add A BANP that denies TCP 8080 ; but we have such example
#30