policy: Do not select any identity with empty slices #29608
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
7bc0a93 to
ab776e6
Compare
|
/test |
ab776e6 to
cbe8190
Compare
|
/test |
cbe8190 to
c606bc5
Compare
|
/test |
This comment was marked as outdated.
This comment was marked as outdated.
In case of L4 ingress policies with an explicit (non-nil) empty slice in either: - fromEndpoints - fromCIDR - fromCIDRSet - fromEntities no identities should be selected, thus falling back to default deny for an allow policy. Signed-off-by: Fabio Falzoi <fabio.falzoi@isovalent.com>
In case of L4 egress policies with an explicit (non-nil) empty slice in one of: - toEndpoints - toCIDR - toCIDRSet - toEntities no identities should be selected, thus falling back to default deny for an allow policy. Signed-off-by: Fabio Falzoi <fabio.falzoi@isovalent.com>
Add a unit test to check that a non-nil empty ToEndpoints slice in an egress CiliumNetworkPolicy does not select any identity. Signed-off-by: Fabio Falzoi <fabio.falzoi@isovalent.com>
Following the changes in previous commits, where the semantic of an empty non-nil slice in CNPs has been changed, an upgrade note is added to the upgrade guide. Signed-off-by: Fabio Falzoi <fabio.falzoi@isovalent.com>
aafebcb to
015b71b
Compare
|
/test |
|
ci-runtime failure tracked in #28415 (comment), rerunning |
|
👋 if this is a bug fix, do we need backports? |
3 tasks
christarazi
added a commit
to christarazi/cilium
that referenced
this pull request
Jun 27, 2024
As reported in ciliumGH-33432, do not skip other selectors in the case ToEndpoints is empty. For example, if the user defined a ToCIDR with an empty ToEndpoints, then getDestinationEndpointSelectorsWithRequirements() / GetSourceEndpointSelectorsWithRequirements() returns nil, causing the ToCIDRs section to be skipped. Instead, return the aggregated selectors, which aggregates selectors such as ToCIDRs, prior to the call to the aforementioned functions inside SetAggregatedSelectors(). Fixes: e97df7b ("policy: Do not select any identity with ingress empty slices") Fixes: 6ccd044 ("policy: Do not select any identity with egress empty slices") Fixes: cilium#29608 Signed-off-by: Chris Tarazi <chris@isovalent.com>
christarazi
added a commit
to christarazi/cilium
that referenced
this pull request
Jun 28, 2024
As reported in ciliumGH-33432, do not skip other selectors in the case ToEndpoints is empty. For example, if the user defined a ToCIDR with an empty ToEndpoints, then getDestinationEndpointSelectorsWithRequirements() / GetSourceEndpointSelectorsWithRequirements() returns nil, causing the ToCIDRs section to be skipped. Instead, return the aggregated selectors, which aggregates selectors such as ToCIDRs, prior to the call to the aforementioned functions inside SetAggregatedSelectors(). Fixes: e97df7b ("policy: Do not select any identity with ingress empty slices") Fixes: 6ccd044 ("policy: Do not select any identity with egress empty slices") Fixes: cilium#29608 Signed-off-by: Chris Tarazi <chris@isovalent.com>
christarazi
added a commit
to christarazi/cilium
that referenced
this pull request
Jun 28, 2024
As reported in ciliumGH-33432, do not skip other selectors in the case ToEndpoints is empty. For example, if the user defined a ToCIDR with an empty ToEndpoints, then getDestinationEndpointSelectorsWithRequirements() / GetSourceEndpointSelectorsWithRequirements() returns nil, causing the ToCIDRs section to be skipped. Instead, return the aggregated selectors, which aggregates selectors such as ToCIDRs, prior to the call to the aforementioned functions inside SetAggregatedSelectors(). Fixes: e97df7b ("policy: Do not select any identity with ingress empty slices") Fixes: 6ccd044 ("policy: Do not select any identity with egress empty slices") Fixes: cilium#29608 Signed-off-by: Chris Tarazi <chris@isovalent.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR aims to redefine the semantic of a non-nil empty slice in CNP/CCNP. Specifically, In case of egress/ingress policies with an explicit (non-nil) empty slice in one of:
no identities should be selected, thus falling back to default deny for an allow policy.
An example of the different behavior introduced with this PR can be seen with the following two L4 ingress policies:
The first one, with an explicit empty
fromCIDRslice, does not select any identity (thus resulting in default deny) while the second one keeps the current behavior and allow traffic to port 80 for all identities.This behavior also fixes a bug in policies referencing a CiliumCIDRGroup in the
fromCIDRSet/cidrGroupReffield. If the referenced CIDR Group is empty or non-existent, the policy is equivalent to the first one, and therefore it won't select any identities.