Skip to content

Commit e7b1630

Browse files
SkalaNetworksSkalaNetworks
committed
fix(netpol): don't add default block twice for dualstacks
Signed-off-by: SkalaNetworks <contact@skala.network>
1 parent e14c95e commit e7b1630

File tree

4 files changed

+118
-86
lines changed

4 files changed

+118
-86
lines changed

‎pkg/controller/network_policy.go‎

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -173,6 +173,9 @@ func (c *Controller) handleUpdateNp(key string) error {
173173
}
174174

175175
if hasIngressRule(np) {
176+
blockACLOps, err := c.OVNNbClient.UpdateDefaultBlockACLOps(npName, pgName, ovnnb.ACLDirectionToLport, logEnable)
177+
ingressACLOps = append(ingressACLOps, blockACLOps...)
178+
176179
for _, protocol := range protocolSet.List() {
177180
for idx, npr := range np.Spec.Ingress {
178181
// A single address set must contain addresses of the same type and the name must be unique within table, so IPv4 and IPv6 address set should be different
@@ -214,7 +217,7 @@ func (c *Controller) handleUpdateNp(key string) error {
214217
npp = npr.Ports
215218
}
216219

217-
ops, err := c.OVNNbClient.UpdateIngressACLOps(key, pgName, ingressAllowAsName, ingressExceptAsName, protocol, aclName, npp, logEnable, logActions, namedPortMap)
220+
ops, err := c.OVNNbClient.UpdateIngressACLOps(pgName, ingressAllowAsName, ingressExceptAsName, protocol, aclName, npp, logEnable, logActions, namedPortMap)
218221
if err != nil {
219222
klog.Errorf("generate operations that add ingress acls to np %s: %v", key, err)
220223
return err
@@ -236,7 +239,7 @@ func (c *Controller) handleUpdateNp(key string) error {
236239
return err
237240
}
238241

239-
ops, err := c.OVNNbClient.UpdateIngressACLOps(key, pgName, ingressAllowAsName, ingressExceptAsName, protocol, aclName, nil, logEnable, logActions, namedPortMap)
242+
ops, err := c.OVNNbClient.UpdateIngressACLOps(pgName, ingressAllowAsName, ingressExceptAsName, protocol, aclName, nil, logEnable, logActions, namedPortMap)
240243
if err != nil {
241244
klog.Errorf("generate operations that add ingress acls to np %s: %v", key, err)
242245
return err
@@ -302,6 +305,9 @@ func (c *Controller) handleUpdateNp(key string) error {
302305
}
303306

304307
if hasEgressRule(np) {
308+
blockACLOps, err := c.OVNNbClient.UpdateDefaultBlockACLOps(npName, pgName, ovnnb.ACLDirectionFromLport, logEnable)
309+
egressACLOps = append(egressACLOps, blockACLOps...)
310+
305311
for _, protocol := range protocolSet.List() {
306312
for idx, npr := range np.Spec.Egress {
307313
// A single address set must contain addresses of the same type and the name must be unique within table, so IPv4 and IPv6 address set should be different
@@ -343,7 +349,7 @@ func (c *Controller) handleUpdateNp(key string) error {
343349
npp = npr.Ports
344350
}
345351

346-
ops, err := c.OVNNbClient.UpdateEgressACLOps(key, pgName, egressAllowAsName, egressExceptAsName, protocol, aclName, npp, logEnable, logActions, namedPortMap)
352+
ops, err := c.OVNNbClient.UpdateEgressACLOps(pgName, egressAllowAsName, egressExceptAsName, protocol, aclName, npp, logEnable, logActions, namedPortMap)
347353
if err != nil {
348354
klog.Errorf("generate operations that add egress acls to np %s: %v", key, err)
349355
return err
@@ -365,7 +371,7 @@ func (c *Controller) handleUpdateNp(key string) error {
365371
return err
366372
}
367373

368-
ops, err := c.OVNNbClient.UpdateEgressACLOps(key, pgName, egressAllowAsName, egressExceptAsName, protocol, aclName, nil, logEnable, logActions, namedPortMap)
374+
ops, err := c.OVNNbClient.UpdateEgressACLOps(pgName, egressAllowAsName, egressExceptAsName, protocol, aclName, nil, logEnable, logActions, namedPortMap)
369375
if err != nil {
370376
klog.Errorf("generate operations that add egress acls to np %s: %v", key, err)
371377
return err

‎pkg/ovs/interface.go‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -157,8 +157,9 @@ type PortGroup interface {
157157
}
158158

159159
type ACL interface {
160-
UpdateIngressACLOps(netpol, pgName, asIngressName, asExceptName, protocol, aclName string, npp []netv1.NetworkPolicyPort, logEnable bool, logACLActions []ovnnb.ACLAction, namedPortMap map[string]*util.NamedPortInfo) ([]ovsdb.Operation, error)
161-
UpdateEgressACLOps(netpol, pgName, asEgressName, asExceptName, protocol, aclName string, npp []netv1.NetworkPolicyPort, logEnable bool, logACLActions []ovnnb.ACLAction, namedPortMap map[string]*util.NamedPortInfo) ([]ovsdb.Operation, error)
160+
UpdateDefaultBlockACLOps(netpol, pgName, direction string, loggingEnabled bool) ([]ovsdb.Operation, error)
161+
UpdateIngressACLOps(pgName, asIngressName, asExceptName, protocol, aclName string, npp []netv1.NetworkPolicyPort, logEnable bool, logACLActions []ovnnb.ACLAction, namedPortMap map[string]*util.NamedPortInfo) ([]ovsdb.Operation, error)
162+
UpdateEgressACLOps(pgName, asEgressName, asExceptName, protocol, aclName string, npp []netv1.NetworkPolicyPort, logEnable bool, logACLActions []ovnnb.ACLAction, namedPortMap map[string]*util.NamedPortInfo) ([]ovsdb.Operation, error)
162163
CreateGatewayACL(lsName, pgName, gateway, u2oInterconnectionIP string) error
163164
CreateNodeACL(pgName, nodeIPStr, joinIPStr string) error
164165
CreateSgDenyAllACL(sgName string) error

‎pkg/ovs/ovn-nb-acl.go‎

Lines changed: 45 additions & 52 deletions
Original file line numberDiff line numberDiff line change
@@ -53,34 +53,56 @@ func setACLName(acl *ovnnb.ACL, name string) {
5353
acl.Name = ptr.To(name)
5454
}
5555

56-
// UpdateIngressACLOps return operation that creates an ingress ACL
57-
func (c *OVNNbClient) UpdateIngressACLOps(netpol, pgName, asIngressName, asExceptName, protocol, aclName string, npp []netv1.NetworkPolicyPort, logEnable bool, logACLActions []ovnnb.ACLAction, namedPortMap map[string]*util.NamedPortInfo) ([]ovsdb.Operation, error) {
58-
acls := make([]*ovnnb.ACL, 0)
56+
// UpdateDefaultBlockACLOps returns operations to update/create the default block ACL
57+
func (c *OVNNbClient) UpdateDefaultBlockACLOps(netpol, pgName, direction string, loggingEnabled bool) ([]ovsdb.Operation, error) {
58+
portDirection := "outport"
59+
priority := util.IngressDefaultDrop
5960

60-
if strings.HasSuffix(asIngressName, ".0") || strings.HasSuffix(asIngressName, ".all") {
61-
// create the default drop rule for only once
62-
// both IPv4 and IPv6 traffic should be forbade in dual-stack situation
63-
allIPMatch := NewAndACLMatch(
64-
NewACLMatch("outport", "==", "@"+pgName, ""),
65-
NewACLMatch("ip", "", "", ""),
66-
)
67-
options := func(acl *ovnnb.ACL) {
68-
setACLName(acl, netpol)
69-
if logEnable {
70-
acl.Log = true
71-
acl.Severity = ptr.To(ovnnb.ACLSeverityWarning)
72-
}
61+
if direction == ovnnb.ACLDirectionFromLport {
62+
portDirection = "inport"
63+
priority = util.EgressDefaultDrop
64+
}
65+
66+
// Block everything IP related (IPv4/IPv6/ICMPv4/ICMPv6/...)
67+
allIPMatch := NewAndACLMatch(
68+
NewACLMatch(portDirection, "==", "@"+pgName, ""),
69+
NewACLMatch("ip", "", "", ""),
70+
)
71+
72+
options := func(acl *ovnnb.ACL) {
73+
setACLName(acl, netpol)
74+
if loggingEnabled {
75+
acl.Log = true
76+
acl.Severity = ptr.To(ovnnb.ACLSeverityWarning)
7377
}
7478

75-
defaultDropACL, err := c.newACLWithoutCheck(pgName, ovnnb.ACLDirectionToLport, util.IngressDefaultDrop, allIPMatch.String(), ovnnb.ACLActionDrop, util.NetpolACLTier, options)
76-
if err != nil {
77-
klog.Error(err)
78-
return nil, fmt.Errorf("new default drop ingress acl for port group %s: %w", pgName, err)
79+
if direction == ovnnb.ACLDirectionFromLport {
80+
if acl.Options == nil {
81+
acl.Options = make(map[string]string)
82+
}
83+
acl.Options["apply-after-lb"] = "true"
7984
}
85+
}
8086

81-
acls = append(acls, defaultDropACL)
87+
defaultDropACL, err := c.newACL(pgName, direction, priority, allIPMatch.String(), ovnnb.ACLActionDrop, util.NetpolACLTier, options)
88+
if err != nil {
89+
klog.Error(err)
90+
return nil, fmt.Errorf("failed to create drop acl for port group %s: %w", pgName, err)
8291
}
8392

93+
ops, err := c.CreateAclsOps(pgName, portGroupKey, defaultDropACL)
94+
if err != nil {
95+
klog.Error(err)
96+
return nil, fmt.Errorf("failed to create default drop acl ops for port group %s: %w", pgName, err)
97+
}
98+
99+
return ops, nil
100+
}
101+
102+
// UpdateIngressACLOps return operation that creates an ingress ACL
103+
func (c *OVNNbClient) UpdateIngressACLOps(pgName, asIngressName, asExceptName, protocol, aclName string, npp []netv1.NetworkPolicyPort, logEnable bool, logACLActions []ovnnb.ACLAction, namedPortMap map[string]*util.NamedPortInfo) ([]ovsdb.Operation, error) {
104+
acls := make([]*ovnnb.ACL, 0)
105+
84106
/* allow acl */
85107
matches := newNetworkPolicyACLMatch(pgName, asIngressName, asExceptName, protocol, ovnnb.ACLDirectionToLport, npp, namedPortMap)
86108
for _, m := range matches {
@@ -110,38 +132,9 @@ func (c *OVNNbClient) UpdateIngressACLOps(netpol, pgName, asIngressName, asExcep
110132
}
111133

112134
// UpdateEgressACLOps return operation that creates an egress ACL
113-
func (c *OVNNbClient) UpdateEgressACLOps(netpol, pgName, asEgressName, asExceptName, protocol, aclName string, npp []netv1.NetworkPolicyPort, logEnable bool, logACLActions []ovnnb.ACLAction, namedPortMap map[string]*util.NamedPortInfo) ([]ovsdb.Operation, error) {
135+
func (c *OVNNbClient) UpdateEgressACLOps(pgName, asEgressName, asExceptName, protocol, aclName string, npp []netv1.NetworkPolicyPort, logEnable bool, logACLActions []ovnnb.ACLAction, namedPortMap map[string]*util.NamedPortInfo) ([]ovsdb.Operation, error) {
114136
acls := make([]*ovnnb.ACL, 0)
115137

116-
if strings.HasSuffix(asEgressName, ".0") || strings.HasSuffix(asEgressName, ".all") {
117-
// create the default drop rule for only once
118-
// both IPv4 and IPv6 traffic should be forbade in dual-stack situation
119-
allIPMatch := NewAndACLMatch(
120-
NewACLMatch("inport", "==", "@"+pgName, ""),
121-
NewACLMatch("ip", "", "", ""),
122-
)
123-
options := func(acl *ovnnb.ACL) {
124-
setACLName(acl, netpol)
125-
if logEnable {
126-
acl.Log = true
127-
acl.Severity = ptr.To(ovnnb.ACLSeverityWarning)
128-
}
129-
130-
if acl.Options == nil {
131-
acl.Options = make(map[string]string)
132-
}
133-
acl.Options["apply-after-lb"] = "true"
134-
}
135-
136-
defaultDropACL, err := c.newACLWithoutCheck(pgName, ovnnb.ACLDirectionFromLport, util.EgressDefaultDrop, allIPMatch.String(), ovnnb.ACLActionDrop, util.NetpolACLTier, options)
137-
if err != nil {
138-
klog.Error(err)
139-
return nil, fmt.Errorf("new default drop egress acl for port group %s: %w", pgName, err)
140-
}
141-
142-
acls = append(acls, defaultDropACL)
143-
}
144-
145138
/* allow acl */
146139
matches := newNetworkPolicyACLMatch(pgName, asEgressName, asExceptName, protocol, ovnnb.ACLDirectionFromLport, npp, namedPortMap)
147140
for _, m := range matches {
@@ -356,7 +349,7 @@ func (c *OVNNbClient) CreateSgBaseACL(sgName, direction string) error {
356349
acl, err := c.newACL(pgName, direction, util.SecurityGroupBasePriority, match, ovnnb.ACLActionAllowRelated, util.NetpolACLTier)
357350
if err != nil {
358351
klog.Error(err)
359-
klog.Errorf("new base ingress acl for security group %s: %v", sgName, err)
352+
klog.Errorf("failed to create new base ingress acl for security group %s: %v", sgName, err)
360353
return
361354
}
362355
acls = append(acls, acl)

‎pkg/ovs/ovn-nb-acl_test.go‎

Lines changed: 60 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,54 @@ func newACL(parentName, direction, priority, match, action string, tier int, opt
6565
return acl
6666
}
6767

68+
func (suite *OvnClientTestSuite) testUpdateDefaultBlockACLOps() {
69+
t := suite.T()
70+
t.Parallel()
71+
72+
nbClient := suite.ovnNBClient
73+
74+
expect := func(row ovsdb.Row, action, direction, match, priority string) {
75+
intPriority, err := strconv.Atoi(priority)
76+
require.NoError(t, err)
77+
require.Equal(t, action, row["action"])
78+
require.Equal(t, direction, row["direction"])
79+
require.Equal(t, match, row["match"])
80+
require.Equal(t, intPriority, row["priority"])
81+
}
82+
83+
t.Run("default block ingress", func(t *testing.T) {
84+
t.Parallel()
85+
86+
netpol := "default block ingress"
87+
pgName := "test_create_block_ingress_acl_pg"
88+
89+
err := nbClient.CreatePortGroup(pgName, nil)
90+
require.NoError(t, err)
91+
92+
ops, err := nbClient.UpdateDefaultBlockACLOps(netpol, pgName, ovnnb.ACLDirectionToLport, true)
93+
require.NoError(t, err)
94+
require.Len(t, ops, 1)
95+
96+
expect(ops[0].Row, "drop", ovnnb.ACLDirectionToLport, fmt.Sprintf("outport == @%s && ip", pgName), util.IngressDefaultDrop)
97+
})
98+
99+
t.Run("default block egress", func(t *testing.T) {
100+
t.Parallel()
101+
102+
netpol := "default block egress"
103+
pgName := "test_create_block_egress_acl_pg"
104+
105+
err := nbClient.CreatePortGroup(pgName, nil)
106+
require.NoError(t, err)
107+
108+
ops, err := nbClient.UpdateDefaultBlockACLOps(netpol, pgName, ovnnb.ACLDirectionFromLport, true)
109+
require.NoError(t, err)
110+
require.Len(t, ops, 1)
111+
112+
expect(ops[0].Row, "drop", ovnnb.ACLDirectionFromLport, fmt.Sprintf("inport == @%s && ip", pgName), util.EgressDefaultDrop)
113+
})
114+
}
115+
68116
func (suite *OvnClientTestSuite) testUpdateIngressACLOps() {
69117
t := suite.T()
70118
t.Parallel()
@@ -83,7 +131,6 @@ func (suite *OvnClientTestSuite) testUpdateIngressACLOps() {
83131
t.Run("ipv4 acl", func(t *testing.T) {
84132
t.Parallel()
85133

86-
netpol := "ipv4 ingress"
87134
pgName := "test_create_v4_ingress_acl_pg"
88135
asIngressName := "test.default.ingress.allow.ipv4.all"
89136
asExceptName := "test.default.ingress.except.ipv4.all"
@@ -95,11 +142,9 @@ func (suite *OvnClientTestSuite) testUpdateIngressACLOps() {
95142

96143
npp := mockNetworkPolicyPort()
97144

98-
ops, err := nbClient.UpdateIngressACLOps(netpol, pgName, asIngressName, asExceptName, protocol, aclName, npp, true, nil, nil)
145+
ops, err := nbClient.UpdateIngressACLOps(pgName, asIngressName, asExceptName, protocol, aclName, npp, true, nil, nil)
99146
require.NoError(t, err)
100-
require.Len(t, ops, 4)
101-
102-
expect(ops[0].Row, "drop", ovnnb.ACLDirectionToLport, fmt.Sprintf("outport == @%s && ip", pgName), util.IngressDefaultDrop)
147+
require.Len(t, ops, 3)
103148

104149
matches := newNetworkPolicyACLMatch(pgName, asIngressName, asExceptName, protocol, ovnnb.ACLDirectionToLport, npp, nil)
105150
i := 1
@@ -113,7 +158,6 @@ func (suite *OvnClientTestSuite) testUpdateIngressACLOps() {
113158
t.Run("ipv6 acl", func(t *testing.T) {
114159
t.Parallel()
115160

116-
netpol := "ipv6 ingress"
117161
pgName := "test_create_v6_ingress_acl_pg"
118162
asIngressName := "test.default.ingress.allow.ipv6.all"
119163
asExceptName := "test.default.ingress.except.ipv6.all"
@@ -123,11 +167,9 @@ func (suite *OvnClientTestSuite) testUpdateIngressACLOps() {
123167
err := nbClient.CreatePortGroup(pgName, nil)
124168
require.NoError(t, err)
125169

126-
ops, err := nbClient.UpdateIngressACLOps(netpol, pgName, asIngressName, asExceptName, protocol, aclName, nil, true, nil, nil)
170+
ops, err := nbClient.UpdateIngressACLOps(pgName, asIngressName, asExceptName, protocol, aclName, nil, true, nil, nil)
127171
require.NoError(t, err)
128-
require.Len(t, ops, 3)
129-
130-
expect(ops[0].Row, "drop", ovnnb.ACLDirectionToLport, fmt.Sprintf("outport == @%s && ip", pgName), util.IngressDefaultDrop)
172+
require.Len(t, ops, 2)
131173

132174
matches := newNetworkPolicyACLMatch(pgName, asIngressName, asExceptName, protocol, ovnnb.ACLDirectionToLport, nil, nil)
133175
i := 1
@@ -141,28 +183,26 @@ func (suite *OvnClientTestSuite) testUpdateIngressACLOps() {
141183
t.Run("test empty pgName", func(t *testing.T) {
142184
t.Parallel()
143185

144-
netpol := "ingress with empty pg name"
145186
pgName := ""
146187
asIngressName := "test.default.ingress.allow.ipv4.all"
147188
asExceptName := "test.default.ingress.except.ipv4.all"
148189
protocol := kubeovnv1.ProtocolIPv4
149190
aclName := "test_create_v4_ingress_acl_pg"
150191

151-
_, err := nbClient.UpdateIngressACLOps(netpol, pgName, asIngressName, asExceptName, protocol, aclName, nil, true, nil, nil)
192+
_, err := nbClient.UpdateIngressACLOps(pgName, asIngressName, asExceptName, protocol, aclName, nil, true, nil, nil)
152193
require.ErrorContains(t, err, "the port group name or logical switch name is required")
153194
})
154195

155196
t.Run("test empty pgName without suffix", func(t *testing.T) {
156197
t.Parallel()
157198

158-
netpol := "ingress with empty pg name and no suffix"
159199
pgName := ""
160200
asIngressName := "test.default.ingress.allow.ipv4"
161201
asExceptName := "test.default.ingress.except.ipv4"
162202
protocol := kubeovnv1.ProtocolIPv4
163203
aclName := "test_create_v4_ingress_acl_pg"
164204

165-
_, err := nbClient.UpdateIngressACLOps(netpol, pgName, asIngressName, asExceptName, protocol, aclName, nil, true, nil, nil)
205+
_, err := nbClient.UpdateIngressACLOps(pgName, asIngressName, asExceptName, protocol, aclName, nil, true, nil, nil)
166206
require.ErrorContains(t, err, "the port group name or logical switch name is required")
167207
})
168208
}
@@ -185,7 +225,6 @@ func (suite *OvnClientTestSuite) testUpdateEgressACLOps() {
185225
t.Run("ipv4 acl", func(t *testing.T) {
186226
t.Parallel()
187227

188-
netpol := "ipv4 egress"
189228
pgName := "test_create_v4_egress_acl_pg"
190229
asEgressName := "test.default.egress.allow.ipv4.all"
191230
asExceptName := "test.default.egress.except.ipv4.all"
@@ -197,11 +236,9 @@ func (suite *OvnClientTestSuite) testUpdateEgressACLOps() {
197236

198237
npp := mockNetworkPolicyPort()
199238

200-
ops, err := nbClient.UpdateEgressACLOps(netpol, pgName, asEgressName, asExceptName, protocol, aclName, npp, true, nil, nil)
239+
ops, err := nbClient.UpdateEgressACLOps(pgName, asEgressName, asExceptName, protocol, aclName, npp, true, nil, nil)
201240
require.NoError(t, err)
202-
require.Len(t, ops, 4)
203-
204-
expect(ops[0].Row, "drop", ovnnb.ACLDirectionFromLport, fmt.Sprintf("inport == @%s && ip", pgName), util.EgressDefaultDrop)
241+
require.Len(t, ops, 3)
205242

206243
matches := newNetworkPolicyACLMatch(pgName, asEgressName, asExceptName, protocol, ovnnb.ACLDirectionFromLport, npp, nil)
207244
i := 1
@@ -215,7 +252,6 @@ func (suite *OvnClientTestSuite) testUpdateEgressACLOps() {
215252
t.Run("ipv6 acl", func(t *testing.T) {
216253
t.Parallel()
217254

218-
netpol := "ipv6 egress"
219255
pgName := "test_create_v6_egress_acl_pg"
220256
asEgressName := "test.default.egress.allow.ipv6.all"
221257
asExceptName := "test.default.egress.except.ipv6.all"
@@ -225,11 +261,9 @@ func (suite *OvnClientTestSuite) testUpdateEgressACLOps() {
225261
err := nbClient.CreatePortGroup(pgName, nil)
226262
require.NoError(t, err)
227263

228-
ops, err := nbClient.UpdateEgressACLOps(netpol, pgName, asEgressName, asExceptName, protocol, aclName, nil, true, nil, nil)
264+
ops, err := nbClient.UpdateEgressACLOps(pgName, asEgressName, asExceptName, protocol, aclName, nil, true, nil, nil)
229265
require.NoError(t, err)
230-
require.Len(t, ops, 3)
231-
232-
expect(ops[0].Row, "drop", ovnnb.ACLDirectionFromLport, fmt.Sprintf("inport == @%s && ip", pgName), util.EgressDefaultDrop)
266+
require.Len(t, ops, 2)
233267

234268
matches := newNetworkPolicyACLMatch(pgName, asEgressName, asExceptName, protocol, ovnnb.ACLDirectionFromLport, nil, nil)
235269
i := 1
@@ -243,28 +277,26 @@ func (suite *OvnClientTestSuite) testUpdateEgressACLOps() {
243277
t.Run("test empty pgName", func(t *testing.T) {
244278
t.Parallel()
245279

246-
netpol := "egress with empty pg name"
247280
pgName := ""
248281
asEgressName := "test.default.egress.allow.ipv4.all"
249282
asExceptName := "test.default.egress.except.ipv4.all"
250283
protocol := kubeovnv1.ProtocolIPv4
251284
aclName := "test_create_v4_egress_acl_pg"
252285

253-
_, err := nbClient.UpdateEgressACLOps(netpol, pgName, asEgressName, asExceptName, protocol, aclName, nil, true, nil, nil)
286+
_, err := nbClient.UpdateEgressACLOps(pgName, asEgressName, asExceptName, protocol, aclName, nil, true, nil, nil)
254287
require.ErrorContains(t, err, "the port group name or logical switch name is required")
255288
})
256289

257290
t.Run("test empty pgName without suffix", func(t *testing.T) {
258291
t.Parallel()
259292

260-
netpol := "egress with empty pg name and no suffix"
261293
pgName := ""
262294
asEgressName := "test.default.egress.allow.ipv4"
263295
asExceptName := "test.default.egress.except.ipv4"
264296
protocol := kubeovnv1.ProtocolIPv4
265297
aclName := "test_create_v4_egress_acl_pg"
266298

267-
_, err := nbClient.UpdateEgressACLOps(netpol, pgName, asEgressName, asExceptName, protocol, aclName, nil, true, nil, nil)
299+
_, err := nbClient.UpdateEgressACLOps(pgName, asEgressName, asExceptName, protocol, aclName, nil, true, nil, nil)
268300
require.ErrorContains(t, err, "the port group name or logical switch name is required")
269301
})
270302
}

0 commit comments

Comments
 (0)