networkpolicy: provider-scoped policies for multi-network pods

- update messages for logging
- update `parsePolicyFor()` to not return error
- update `network_policy_test.go` for `parsePolicyFor()`

Signed-off-by: akbarkn <akbarkusumanegaralth@gmail.com>

Author: akbarkn

pkg/controller/network_policy.go

@@ -121,10 +121,7 @@ func (c *Controller) handleUpdateNp(key string) error {
 	}
 	logRate := parseACLLogRate(np.Annotations)
 
-	providers, err := parsePolicyFor(np)
-	if err != nil {
-		return err
-	}
+	providers := parsePolicyFor(np)
 
 	npName := np.Name
 	nameArray := []rune(np.Name)
@@ -536,14 +533,14 @@ func (c *Controller) handleDeleteNp(key string) error {
 	return nil
 }
 
-func parsePolicyFor(np *netv1.NetworkPolicy) (set.Set[string], error) {
+func parsePolicyFor(np *netv1.NetworkPolicy) set.Set[string] {
 	raw := strings.TrimSpace(np.Annotations[util.NetworkPolicyForAnnotation])
 	if raw == "" {
-		return nil, nil
+		return nil
 	}
 
 	providers := set.New[string]()
-	invalidMsg := `ignore invalid network_policy_for entry %q, expect "ovn" or "<namespace>/<net-attach-def>"`
+	invalidMsg := `ignore invalid network_policy_for annotation %q for netpol %s/%s, expect "ovn" or "<namespace>/<net-attach-def>"`
 
 	for _, token := range strings.Split(raw, ",") {
 		t := strings.TrimSpace(token)
@@ -558,21 +555,21 @@ func parsePolicyFor(np *netv1.NetworkPolicy) (set.Set[string], error) {
 		if strings.Contains(t, "/") {
 			parts := strings.SplitN(t, "/", 2)
 			if len(parts) != 2 || parts[0] == "" || parts[1] == "" {
-				klog.Warningf(invalidMsg, t)
+				klog.Warningf(invalidMsg, t, np.Namespace, np.Name)
 				continue
 			}
 			provider := fmt.Sprintf("%s.%s.%s", parts[1], parts[0], util.OvnProvider)
 			providers.Insert(provider)
 			continue
 		}
-		klog.Warningf(invalidMsg, t)
+		klog.Warningf(invalidMsg, t, np.Namespace, np.Name)
 	}
 
 	if len(providers) == 0 {
-		klog.Warning("network_policy_for annotation has no valid entries; policy selects no pods")
-		return providers, nil
+		klog.Warningf("network_policy_for annotation has no valid entries; policy %s/%s selects no pods", np.Namespace, np.Name)
+		return providers
 	}
-	return providers, nil
+	return providers
 }
 
 func netpolAppliesToProvider(provider string, providers set.Set[string]) bool {
@@ -609,8 +606,7 @@ func (c *Controller) fetchSelectedPorts(namespace string, selector *metav1.Label
 			if !isOvnSubnet(podNet.Subnet) {
 				continue
 			}
-			provider := podNet.ProviderName
-			if !netpolAppliesToProvider(provider, providers) {
+			if !netpolAppliesToProvider(podNet.ProviderName, providers) {
 				continue
 			}
 			matchedProvider = true

pkg/controller/network_policy_test.go

@@ -20,37 +20,32 @@ func TestParsePolicyFor(t *testing.T) {
 		name          string
 		annotation    *string
 		wantProviders set.Set[string]
-		wantErr       bool
 	}{
 		{
 			name:          "annotation omitted",
 			annotation:    nil,
 			wantProviders: nil,
-			wantErr:       false,
 		},
 		{
 			name:       "ovn only",
 			annotation: ptrString("ovn"),
 			wantProviders: set.New(
 				util.OvnProvider,
 			),
-			wantErr: false,
 		},
 		{
 			name:       "duplicate ovn",
 			annotation: ptrString("ovn, ovn"),
 			wantProviders: set.New(
 				util.OvnProvider,
 			),
-			wantErr: false,
 		},
 		{
 			name:       "secondary only",
 			annotation: ptrString("ns1/net1"),
 			wantProviders: set.New(
 				"net1.ns1." + util.OvnProvider,
 			),
-			wantErr: false,
 		},
 		{
 			name:       "ovn and secondary",
@@ -59,39 +54,33 @@ func TestParsePolicyFor(t *testing.T) {
 				util.OvnProvider,
 				"net1.ns1."+util.OvnProvider,
 			),
-			wantErr: false,
 		},
 		{
 			name:       "ovn and invalid",
 			annotation: ptrString("ovn, foo"),
 			wantProviders: set.New(
 				util.OvnProvider,
 			),
-			wantErr: false,
 		},
 		{
 			name:          "invalid all",
 			annotation:    ptrString("all"),
 			wantProviders: set.New[string](),
-			wantErr:       false,
 		},
 		{
 			name:          "invalid default",
 			annotation:    ptrString("default"),
 			wantProviders: set.New[string](),
-			wantErr:       false,
 		},
 		{
 			name:          "invalid no entries",
 			annotation:    ptrString(","),
 			wantProviders: set.New[string](),
-			wantErr:       false,
 		},
 		{
 			name:          "invalid token",
 			annotation:    ptrString("foo"),
 			wantProviders: set.New[string](),
-			wantErr:       false,
 		},
 	}
 
@@ -109,13 +98,7 @@ func TestParsePolicyFor(t *testing.T) {
 				}
 			}
 
-			providers, err := parsePolicyFor(np)
-			if tt.wantErr {
-				require.Error(t, err)
-				return
-			}
-
-			require.NoError(t, err)
+			providers := parsePolicyFor(np)
 			if tt.wantProviders == nil {
 				require.Nil(t, providers)
 				return