@@ -603,11 +603,7 @@ func svcMatchPods(svcs []*corev1.Service, pod *corev1.Pod, protocol string) ([]s
603603 matchSvcs := []string {}
604604 // find svc ip by pod's info
605605 for _ , svc := range svcs {
606- isMatch , err := isSvcMatchPod (svc , pod )
607- if err != nil {
608- return nil , err
609- }
610- if isMatch {
606+ if isSvcMatchPod (svc , pod ) {
611607 clusterIPs := util .ServiceClusterIPs (* svc )
612608 protocolClusterIPs := getProtocolSvcIP (clusterIPs , protocol )
613609 if len (protocolClusterIPs ) != 0 {
@@ -628,19 +624,8 @@ func getProtocolSvcIP(clusterIPs []string, protocol string) []string {
628624 return protocolClusterIPs
629625}
630626
631- func isSvcMatchPod (svc * corev1.Service , pod * corev1.Pod ) (bool , error ) {
632- ss := metav1 .SetAsLabelSelector (svc .Spec .Selector )
633- sel , err := metav1 .LabelSelectorAsSelector (ss )
634- if err != nil {
635- return false , fmt .Errorf ("error fetch label selector, %w" , err )
636- }
637- if pod .Labels == nil {
638- return false , nil
639- }
640- if sel .Matches (labels .Set (pod .Labels )) {
641- return true , nil
642- }
643- return false , nil
627+ func isSvcMatchPod (svc * corev1.Service , pod * corev1.Pod ) bool {
628+ return labels .Set (svc .Spec .Selector ).AsSelector ().Matches (labels .Set (pod .Labels ))
644629}
645630
646631func (c * Controller ) podMatchNetworkPolicies (pod * corev1.Pod ) []string {
@@ -660,7 +645,7 @@ func (c *Controller) podMatchNetworkPolicies(pod *corev1.Pod) []string {
660645
661646 match := []string {}
662647 for _ , np := range nps {
663- if isPodMatchNetworkPolicy (pod , * podNs , np , np .Namespace ) {
648+ if isPodMatchNetworkPolicy (pod , podNs , np , np .Namespace ) {
664649 match = append (match , cache .MetaObjectToName (np ).String ())
665650 }
666651 }
@@ -688,7 +673,7 @@ func (c *Controller) svcMatchNetworkPolicies(svc *corev1.Service) ([]string, err
688673 if match .Has (key ) {
689674 continue
690675 }
691- if isPodMatchNetworkPolicy (pod , * ns , np , np .Namespace ) {
676+ if isPodMatchNetworkPolicy (pod , ns , np , np .Namespace ) {
692677 match .Insert (key )
693678 klog .V (3 ).Infof ("svc %s/%s match np %s" , svc .Namespace , svc .Name , key )
694679 }
@@ -697,11 +682,8 @@ func (c *Controller) svcMatchNetworkPolicies(svc *corev1.Service) ([]string, err
697682 return match .UnsortedList (), nil
698683}
699684
700- func isPodMatchNetworkPolicy (pod * corev1.Pod , podNs corev1.Namespace , policy * netv1.NetworkPolicy , policyNs string ) bool {
685+ func isPodMatchNetworkPolicy (pod * corev1.Pod , podNs * corev1.Namespace , policy * netv1.NetworkPolicy , policyNs string ) bool {
701686 sel , _ := metav1 .LabelSelectorAsSelector (& policy .Spec .PodSelector )
702- if pod .Labels == nil {
703- pod .Labels = map [string ]string {}
704- }
705687 if podNs .Name == policyNs && sel .Matches (labels .Set (pod .Labels )) {
706688 return true
707689 }
@@ -722,33 +704,19 @@ func isPodMatchNetworkPolicy(pod *corev1.Pod, podNs corev1.Namespace, policy *ne
722704 return false
723705}
724706
725- func isPodMatchPolicyPeer (pod * corev1.Pod , podNs corev1.Namespace , policyPeer netv1.NetworkPolicyPeer , policyNs string ) bool {
707+ func isPodMatchPolicyPeer (pod * corev1.Pod , podNs * corev1.Namespace , policyPeer netv1.NetworkPolicyPeer , policyNs string ) bool {
726708 if policyPeer .IPBlock != nil {
727709 return false
728710 }
729711 if policyPeer .NamespaceSelector == nil {
730712 if policyNs != podNs .Name {
731713 return false
732714 }
733- } else {
734- nsSel , _ := metav1 .LabelSelectorAsSelector (policyPeer .NamespaceSelector )
735- if podNs .Labels == nil {
736- podNs .Labels = map [string ]string {}
737- }
738- if ! nsSel .Matches (labels .Set (podNs .Labels )) {
739- return false
740- }
741- }
742-
743- if policyPeer .PodSelector == nil {
744- return true
715+ } else if ! util .ObjectMatchesLabelSelector (podNs , policyPeer .NamespaceSelector ) {
716+ return false
745717 }
746718
747- sel , _ := metav1 .LabelSelectorAsSelector (policyPeer .PodSelector )
748- if pod .Labels == nil {
749- pod .Labels = map [string ]string {}
750- }
751- return sel .Matches (labels .Set (pod .Labels ))
719+ return policyPeer .PodSelector == nil || util .ObjectMatchesLabelSelector (pod , policyPeer .PodSelector )
752720}
753721
754722func (c * Controller ) namespaceMatchNetworkPolicies (ns * corev1.Namespace ) []string {
0 commit comments