Add Controlplane changes for NodeNetworkPolicy #5716

Atish-iaf · 2023-11-16T12:52:00Z

pkg/controller/grouping/controller.go

tnqn · 2023-11-22T06:24:39Z

pkg/controller/grouping/group_entity_index.go

@@ -82,6 +84,12 @@ type Interface interface {
 	// DeleteExternalEntity deletes an ExternalEntity from the index. If any existing groups are affected, eventHandlers
 	// will be called with the affected groups.
 	DeleteExternalEntity(ee *v1alpha2.ExternalEntity)
+	// AddNode adds or updates a Node to the index. If any existing groups are affected, eventHandlers will be called with
+	// the affected groups.
+	AddNode(node *v1.Node)


When NodeSelector is used in AddressGroup, the current code just calculate the selected Nodes via c.nodeLister.List(selector), see

antrea/pkg/controller/networkpolicy/networkpolicy_controller.go

Lines 1137 to 1140 in 22d70be

if g.Selector.NodeSelector != nil {

return n.getNodeMemberSet(g.Selector.NodeSelector)

}

return n.getMemberSetForGroupType(addressGroupType, g.Name)

This is based on the assumption that the scale of Node is smaller than Pod, and Node events that we care about are much less frequent.
I think this PR should do the same to be consistent and to avoid making the grouping interface more complicated until it's necessary.

tnqn · 2023-11-22T06:30:35Z

pkg/controller/networkpolicy/networkpolicy_controller.go

@@ -1180,6 +1180,9 @@ func (n *NetworkPolicyController) getMemberSetForGroupType(groupType grouping.Gr
 	for _, ee := range externalEntities {
 		groupMemberSet.Insert(externalEntityToGroupMember(ee, true))
 	}
+	for _, node := range nodes {
+		groupMemberSet.Insert(nodeToGroupMember(node))


Like a Pod member in an AppliedToGroup, we don't need NodeIP in Node member when it's in an AppliedToGroup, otherwise the code needs to keep a Node group up-to-date when a Node IP changes but actually it's never used.

tnqn · 2023-11-22T06:32:45Z

pkg/controller/networkpolicy/networkpolicy_controller.go

@@ -1342,6 +1345,9 @@ func (n *NetworkPolicyController) syncAppliedToGroup(key string) error {
 				memberSetByNode[entityNodeKey] = entitySet
 				appGroupNodeNames.Insert(entityNodeKey)
 			}
+			for _, node := range nodes {
+				appGroupNodeNames.Insert(node.Name)


Like Pod case, we should fill memberSetByNode to only send the Node itself to a Node. Otherwise it will have to resend the whole members everytime a Node joins or leaves the group.
Please have an unit test to validate it.

pkg/controller/networkpolicy/networkpolicy_controller_test.go

tnqn

I think you should update build/charts/antrea/crds/clusternetworkpolicy.yaml to allow appliedTo to be set to nodeSelector, otherwise such policy can't be created

rajnkamr · 2023-11-24T03:58:32Z

pkg/controller/grouping/controller.go

+func NodeIPsIndexFunc(obj interface{}) ([]string, error) {
+	node, ok := obj.(*v1.Node)
+	if !ok {
+		return nil, fmt.Errorf("obj is not node: %+v", obj)


Since you're checking if obj is of type *v1.Node. However, when the type assertion fails, consider providing more context in the error message. For example: "Expected *v1.Node, got %T"

tnqn

Overall LGTM

pkg/controller/networkpolicy/networkpolicy_controller.go

pkg/controller/networkpolicy/networkpolicy_controller_test.go

tnqn

LGTM
@hongliangl do you have other comments? Does it work with your PR?

pkg/apis/crd/v1beta1/types.go

pkg/apiserver/openapi/zz_generated.openapi.go

hongliangl · 2023-12-21T08:00:27Z

LGTM @hongliangl do you have other comments? Does it work with your PR?

LGTM overall. Just the json tag NodeSelector should be nodeSelector. If fixing this, it can work with my PR.

pkg/controller/networkpolicy/clusternetworkpolicy_test.go

Signed-off-by: Kumar Atish <[email protected]>

hongliangl

LGTM

tnqn

LGTM

tnqn · 2023-12-28T06:26:25Z

/skip-all

Atish-iaf force-pushed the HNP-controller-changes branch from 3dd82f0 to 1d9a71a Compare November 16, 2023 13:10

Atish-iaf requested a review from hongliangl November 16, 2023 13:46

tnqn reviewed Nov 22, 2023

View reviewed changes

rajnkamr reviewed Nov 24, 2023

View reviewed changes

Atish-iaf force-pushed the HNP-controller-changes branch from 1d9a71a to 80b24a5 Compare December 4, 2023 04:45

luolanzone added this to the Antrea v1.15 release milestone Dec 6, 2023

Atish-iaf force-pushed the HNP-controller-changes branch 2 times, most recently from 6d988a2 to c888923 Compare December 12, 2023 12:02

Atish-iaf marked this pull request as ready for review December 12, 2023 12:14

Atish-iaf requested a review from tnqn December 12, 2023 12:14

tnqn reviewed Dec 12, 2023

View reviewed changes

Atish-iaf force-pushed the HNP-controller-changes branch from c888923 to acda271 Compare December 12, 2023 15:05

Atish-iaf requested a review from tnqn December 12, 2023 15:22

tnqn previously approved these changes Dec 21, 2023

View reviewed changes

hongliangl reviewed Dec 21, 2023

View reviewed changes

pkg/apis/crd/v1beta1/types.go Outdated Show resolved Hide resolved

pkg/apiserver/openapi/zz_generated.openapi.go Outdated Show resolved Hide resolved

Atish-iaf dismissed tnqn’s stale review via 0e5fc9d December 21, 2023 09:50

Atish-iaf force-pushed the HNP-controller-changes branch from acda271 to 0e5fc9d Compare December 21, 2023 09:50

hongliangl reviewed Dec 21, 2023

View reviewed changes

pkg/controller/networkpolicy/clusternetworkpolicy_test.go Outdated Show resolved Hide resolved

Add Controlplane changes for NodeNetworkPolicy

a7e57e0

Signed-off-by: Kumar Atish <[email protected]>

Atish-iaf force-pushed the HNP-controller-changes branch from 0e5fc9d to a7e57e0 Compare December 21, 2023 10:40

Atish-iaf requested review from hongliangl and tnqn December 21, 2023 10:54

hongliangl approved these changes Dec 22, 2023

View reviewed changes

tnqn approved these changes Dec 28, 2023

View reviewed changes

tnqn added action/release-note Indicates a PR that should be included in release notes. area/network-policy Issues or PRs related to network policies. labels Dec 28, 2023

tnqn merged commit 9e9b073 into antrea-io:main Dec 28, 2023
51 of 55 checks passed

ColonelBundy mentioned this pull request Feb 23, 2024

Control node traffic through network policies #4213

Closed

tnqn mentioned this pull request Feb 23, 2024

Support applying ClusterNetworkPolicy to Nodes in Antrea #5671

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add Controlplane changes for NodeNetworkPolicy #5716

Add Controlplane changes for NodeNetworkPolicy #5716

Atish-iaf commented Nov 16, 2023

tnqn Nov 22, 2023

tnqn Nov 22, 2023

tnqn Nov 22, 2023

tnqn left a comment

rajnkamr Nov 24, 2023

tnqn left a comment

tnqn left a comment

hongliangl commented Dec 21, 2023 •

edited

Loading

hongliangl left a comment

tnqn left a comment

tnqn commented Dec 28, 2023

	if g.Selector.NodeSelector != nil {
	return n.getNodeMemberSet(g.Selector.NodeSelector)
	}
	return n.getMemberSetForGroupType(addressGroupType, g.Name)

Add Controlplane changes for NodeNetworkPolicy #5716

Add Controlplane changes for NodeNetworkPolicy #5716

Conversation

Atish-iaf commented Nov 16, 2023

tnqn Nov 22, 2023

Choose a reason for hiding this comment

tnqn Nov 22, 2023

Choose a reason for hiding this comment

tnqn Nov 22, 2023

Choose a reason for hiding this comment

tnqn left a comment

Choose a reason for hiding this comment

rajnkamr Nov 24, 2023

Choose a reason for hiding this comment

tnqn left a comment

Choose a reason for hiding this comment

tnqn left a comment

Choose a reason for hiding this comment

hongliangl commented Dec 21, 2023 • edited Loading

hongliangl left a comment

Choose a reason for hiding this comment

tnqn left a comment

Choose a reason for hiding this comment

tnqn commented Dec 28, 2023

hongliangl commented Dec 21, 2023 •

edited

Loading