-
Notifications
You must be signed in to change notification settings - Fork 364
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add methods in pkg/agent/route for NodeNetworkPolicy #5692
Add methods in pkg/agent/route for NodeNetworkPolicy #5692
Conversation
eeeb30f
to
1d39a4e
Compare
a84569a
to
f89cec0
Compare
Add the following methods for NodeNetworkPolicy to sync iptables and ipsets: - AddOrUpdateNodeNetworkPolicyIPSet - DeleteNodeNetworkPolicyIPSet - AddOrUpdateNodeNetworkPolicyIPTables - DeleteNodeNetworkPolicyIPTables Signed-off-by: Hongliang Liu <[email protected]>
f89cec0
to
55cad45
Compare
@@ -90,4 +92,16 @@ type Interface interface { | |||
|
|||
// ClearConntrackEntryForService deletes a conntrack entry for a Service connection. | |||
ClearConntrackEntryForService(svcIP net.IP, svcPort uint16, endpointIP net.IP, protocol binding.Protocol) error | |||
|
|||
// AddOrUpdateNodeNetworkPolicyIPSet adds or updates ipset created for NodeNetworkPolicy. | |||
AddOrUpdateNodeNetworkPolicyIPSet(ipsetName string, prevIPSetEntries, curIPSetEntries sets.Set[string], isIPv6 bool) error |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Do we need "NodeNetworkPolicy" in the methods' name? I feel it's better to name it as a general one if the function has not to be bound with NodeNetworkPolicy.
if tt.isIPv6 { | ||
_, exists = c.nodeNetworkPolicyIPSetsIPv6.Load(tt.ipsetName) | ||
} else { | ||
_, exists = c.nodeNetworkPolicyIPSetsIPv4.Load(tt.ipsetName) | ||
} |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Maybe add an internal function to reduce the code duplication.
if tt.isIPv6 { | ||
_, exists = c.nodeNetworkPolicyIPTablesIPv6.Load(chain) | ||
} else { | ||
_, exists = c.nodeNetworkPolicyIPTablesIPv4.Load(chain) | ||
} |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
ditto
Add the following methods for NodeNetworkPolicy to sync iptables and ipsets:
Signed-off-by: Hongliang Liu [email protected]