Update to the API changes for ClusterNetworkPolicy

[bowei]

No description provided.

[danwinship]

need to update go.mod

[danwinship]

If DestinationPort is nil, then the policy is invalid. In the future, if/when we add something like flags, this clause will still not be correct. So just remove this.

[bowei]

Missed this comment, let me check that I incorporated.

[danwinship]

I think it makes sense now... if we add flags in the future, there'd be a second

if matchTCPFlags(policyProtocol.TCP.Flags, tcpFlags) {
	return true
}

here, which would also do "if nil { return true }". And then if either property was filled in, it would get checked, and if it wasn't, then it wouldn't.

[danwinship]

/lgtm

[danwinship]

I think it makes sense now... if we add flags in the future, there'd be a second

if matchTCPFlags(policyProtocol.TCP.Flags, tcpFlags) {
	return true
}

here, which would also do "if nil { return true }". And then if either property was filled in, it would get checked, and if it wasn't, then it wouldn't.

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bowei, danwinship

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [danwinship]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[danwinship]

@bowei you need to update the policies in tests/*.bats and ./install-iptracker.yaml

[aojea]

@bowei can you finish so we get the CI green?
I have some updated blocked on ci

[bowei]

investigating the failed e2e

[aojea]

it times out on SCTP

TestConformanceProfiles/CNPBaselineTierEgressSCTP/Should_support_an_'deny-egress'_policy_for_SCTP_protocol;_ensure_rule_ordering_is_respected (3s)

is it possible that is related to the protocol and we forget about SCTP and only aadded UDP and TCP?

[bowei]

We were doing some experiments and it seems like the SCTP tests pass when run in isolation. Trying to pin down why it is failing.

[bowei]

It seems like increasing the timeout fixed the tests.

[bowei]

/test

[bowei]

/test pull-kube-network-policies-iptracker
/test pull-kube-network-policies-nftables-ipv6

[aojea]

It seems like increasing the timeout fixed the tests.

previously it run in ~12 mins and now it runs in ~21 mins https://github.com/kubernetes-sigs/kube-network-policies/actions/workflows/.github/workflows/npa.yml

what have we changed? did we add more tests?

checking new https://github.com/kubernetes-sigs/kube-network-policies/actions/runs/22374201653/job/64760904901?pr=303 vs old https://github.com/kubernetes-sigs/kube-network-policies/actions/runs/21652851118/job/62421538562

gemini analysis

Metric	Run 1	Run 2	Difference
Total Test Duration	381.879s (~6.3 min)	892.664s (~14.8 min)	+133% (Over 2x slower)
Gress Test Group	55.87s	129.71s	+73.84s
Individual Subtests	~3.10s avg	~7.20s avg	Significantly higher latency

2. Command-Line Arguments
   The test command was modified to include a timeout, likely to accommodate the slower execution:

Run 1: Standard go test arguments.

Run 2: Added --timeout 20m.

Note: Without this addition, Run 2 might have reached the default Go test timeout (10m), causing a failure.

3. Log Line References
   The internal file line numbers for the helper.go log messages have shifted, indicating the second run likely used a slightly different version of the testing code or a different build of the network-policy-api repository.

Run 1: StatefulSet rollout logs were at helper.go:123.

Run 2: StatefulSet rollout logs moved to helper.go:137.

4. Setup & Rollout Behavior
   In the setup phase where the "Harry Potter" themed namespaces and pods are created:

Run 1: Only monitored the gryffindor namespace until ready.

Run 2: Included an extra log line for the ravenclaw namespace (1/2 replicas available) before declaring the cluster ready.

Result: Run 2 took slightly longer to reach a "Ready" state for the base manifests.

[npinaeva]

n, Run 2 might have reac

Sorry forgot to mention it in the PR description.
We have added retries to make the tests more reliable kubernetes-sigs/network-policy-api#353
some more details here https://kubernetes.slack.com/archives/C01CWSHQWQJ/p1770983726167229

[npinaeva]

/lgtm

[aojea]

great