NetworkPolicy: Provider-scoped policies for multi-network pods by akbarkn · Pull Request #6223 · kubeovn/kube-ovn

akbarkn · 2026-01-28T02:58:00Z

Pull Request

Make sure you have followed Kube-OVN Code Style.

What type of this PR

Examples of user facing changes:

Features
Tests

Describe your changes here

Add ovn.kubernetes.io/policy-for parsing and provider‑scoped NetworkPolicy application.
Filter selected ports/peers by provider and gate Service ClusterIP inclusion to primary‑only policies.
Add unit tests for parsePolicyFor.
Add e2e tests for provider scoping and ClusterIP gating.

Which issue(s) this PR fixes

Fixes #6205

gemini-code-assist · 2026-01-28T02:58:20Z

Summary of Changes

Hello @akbarkn, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request significantly enhances the flexibility of Kubernetes NetworkPolicies in multi-network environments. By introducing a new annotation, ovn.kubernetes.io/policy-for, users can now precisely define which network providers a given NetworkPolicy should apply to. This allows for more granular control over network traffic for pods connected to multiple networks, ensuring that security policies are enforced on the intended network interfaces. Additionally, it refines the handling of Service ClusterIPs, restricting their inclusion to primary-only policies to prevent unintended exposure or misconfiguration in secondary networks.

Highlights

Provider-Scoped NetworkPolicies: Introduced a new annotation ovn.kubernetes.io/policy-for to Kubernetes NetworkPolicies, enabling them to be scoped to specific network providers (primary or secondary networks).
Filtered Policy Application: Implemented logic to filter selected ports and peers based on the specified network providers in the new annotation, ensuring policies apply only to intended network interfaces.
Service ClusterIP Gating: Gated the inclusion of Service ClusterIPs in NetworkPolicies, allowing them only for policies explicitly applied to the primary network to prevent unintended exposure in secondary networks.
Unit Tests for Annotation Parsing: Added comprehensive unit tests for the new parsePolicyFor function to ensure correct parsing of the policy-for annotation under various valid and error conditions.
End-to-End Tests: Included end-to-end tests to validate the functionality of provider-scoped NetworkPolicies and the ClusterIP gating mechanism in a multi-network environment.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request introduces provider-scoped network policies, allowing NetworkPolicy resources to be applied to specific provider networks for multi-homed pods. This is achieved through a new annotation, ovn.kubernetes.io/policy-for. The implementation includes parsing this annotation, filtering selected ports and peers based on the specified providers, and conditionally including Service ClusterIPs. The changes are well-supported by new unit tests for the annotation parsing logic and comprehensive e2e tests that validate both the provider scoping and the ClusterIP gating behavior. Overall, the changes are solid and well-tested. I have one suggestion to improve the efficiency of the annotation parsing logic.

pkg/controller/network_policy.go

coveralls · 2026-01-28T03:23:33Z

Pull Request Test Coverage Report for Build 21872834558

Details

32 of 62 (51.61%) changed or added relevant lines in 1 file are covered.
No unchanged relevant lines lost coverage.
Overall coverage increased (+0.04%) to 22.959%

Changes Missing Coverage	Covered Lines	Changed/Added Lines	%
pkg/controller/network_policy.go	32	62	51.61%

Totals
Change from base Build 21854778227:	0.04%
Covered Lines:	12487
Relevant Lines:	54389

💛 - Coveralls

zhangzujian · 2026-01-28T07:55:49Z

/gemini review

gemini-code-assist

Code Review

This pull request introduces provider-scoped network policies for multi-network pods, a valuable feature. The implementation is clean and follows existing patterns in the controller. The new annotation ovn.kubernetes.io/policy-for is parsed robustly, and the logic to filter ports and addresses based on the specified providers is correctly integrated. The addition of unit tests for the parsing logic and e2e tests for the overall feature is excellent and ensures the correctness and reliability of the changes. The code is of high quality, and I have no specific comments for improvement.

pkg/controller/network_policy.go

SkalaNetworks · 2026-01-28T21:35:19Z

@akbarkn Thanks for the great feature

I made a few comments. Just out of curiosity, if I create a netpol that forbids all traffic for a specific provider, will this also work?

akbarkn · 2026-01-29T16:35:09Z

@akbarkn Thanks for the great feature

I made a few comments. Just out of curiosity, if I create a netpol that forbids all traffic for a specific provider, will this also work?

Yes. A policy with policyTypes: [Ingress,Egress] and no rules + ovn.kubernetes.io/network_policy_for=<ns>/<nad> will default‑deny traffic for that provider only. Other providers remain unaffected. If you omit the annotation, it applies to all providers (current behavior).

akbarkn · 2026-01-31T11:01:27Z

@SkalaNetworks Please review when you have time. Thank you.

SkalaNetworks

apart from a few nits, this all seems good to me :)

pkg/controller/network_policy.go

pkg/controller/network_policy_test.go

SkalaNetworks · 2026-02-06T21:36:42Z

@akbarkn Thanks, this looks good to me.

If you can get some docs published on Kube-OVN userguide, it would be great!

/lgtm

@oilbeater this looks fine considering the initial proposal in issue #6205

SkalaNetworks · 2026-02-06T21:36:58Z

/gemini review

gemini-code-assist

Code Review

This pull request introduces a valuable feature for provider-scoped network policies in multi-network environments. The implementation is well-structured, adding a new annotation to control policy scope and updating the controller logic accordingly. The inclusion of both unit and e2e tests is commendable and ensures the new functionality is well-covered. I have a few suggestions to improve code style, compatibility, and test robustness.

test/e2e/kube-ovn/network-policy/multi-network-policy.go

pkg/controller/network_policy.go

test/e2e/kube-ovn/network-policy/multi-network-policy.go

akbarkn · 2026-02-09T09:37:33Z

@akbarkn Thanks, this looks good to me.

If you can get some docs published on Kube-OVN userguide, it would be great!

/lgtm

@oilbeater this looks fine considering the initial proposal in issue #6205

@SkalaNetworks Thanks for reviewing. I will update the docs once this PR merged.

oilbeater · 2026-02-10T07:11:43Z

LGTM, only some lint issues here https://github.com/kubeovn/kube-ovn/actions/runs/21829170600/job/63069753460?pr=6223

SkalaNetworks · 2026-02-10T09:36:33Z

@oilbeater am I authorized to merge PRs when they reach the dedicated state or do you want to add the extra check and handle that yourself?

oilbeater · 2026-02-10T09:40:53Z

@oilbeater am I authorized to merge PRs when they reach the dedicated state or do you want to add the extra check and handle that yourself?

Of course, go ahead!

- add ovn.kubernetes.io/policy-for parsing and provider filtering - gate Service ClusterIP inclusion to default VPC - add unit + e2e tests (skip if NAD CRD missing) Signed-off-by: akbarkn <akbarkusumanegaralth@gmail.com>

SkalaNetworks · 2026-02-10T17:31:30Z

@akbarkn thank you so much for this feature :)

If the tests are a go, I'll merge this!

akbarkn · 2026-02-11T03:54:10Z

@SkalaNetworks @oilbeater Thanks to you too 🚀
I'll update the docs to add this feature

dosubot bot added size:L This PR changes 100-499 lines, ignoring generated files. network policy test automation tests labels Jan 28, 2026

gemini-code-assist bot reviewed Jan 28, 2026

View reviewed changes

pkg/controller/network_policy.go Outdated Show resolved Hide resolved

akbarkn force-pushed the multinetworkpolicy branch from 77f021a to 9bcdb92 Compare January 28, 2026 07:31

gemini-code-assist bot reviewed Jan 28, 2026

View reviewed changes

SkalaNetworks reviewed Jan 28, 2026

View reviewed changes

dosubot bot added size:XL This PR changes 500-999 lines, ignoring generated files. and removed size:L This PR changes 100-499 lines, ignoring generated files. labels Jan 30, 2026

akbarkn requested a review from SkalaNetworks February 2, 2026 02:17

SkalaNetworks requested changes Feb 2, 2026

View reviewed changes

akbarkn requested a review from SkalaNetworks February 6, 2026 16:51

SkalaNetworks added lgtm This PR has been approved by a maintainer feature New network feature labels Feb 6, 2026

gemini-code-assist bot reviewed Feb 6, 2026

View reviewed changes

akbarkn force-pushed the multinetworkpolicy branch from 06ea057 to 70c50d0 Compare February 9, 2026 14:33

networkpolicy: provider-scoped policies for multi-network pods

41ee629

- add ovn.kubernetes.io/policy-for parsing and provider filtering - gate Service ClusterIP inclusion to default VPC - add unit + e2e tests (skip if NAD CRD missing) Signed-off-by: akbarkn <akbarkusumanegaralth@gmail.com>

akbarkn force-pushed the multinetworkpolicy branch from 70c50d0 to 41ee629 Compare February 10, 2026 16:15

SkalaNetworks approved these changes Feb 10, 2026

View reviewed changes

SkalaNetworks self-assigned this Feb 10, 2026

SkalaNetworks merged commit 8978c18 into kubeovn:master Feb 10, 2026
87 checks passed

Conversation

akbarkn commented Jan 28, 2026

Pull Request

What type of this PR

Describe your changes here

Which issue(s) this PR fixes

Uh oh!

gemini-code-assist bot commented Jan 28, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

coveralls commented Jan 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Pull Request Test Coverage Report for Build 21872834558

Details

💛 - Coveralls

Uh oh!

zhangzujian commented Jan 28, 2026

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

SkalaNetworks commented Jan 28, 2026

Uh oh!

akbarkn commented Jan 29, 2026

Uh oh!

akbarkn commented Jan 31, 2026

Uh oh!

SkalaNetworks left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

SkalaNetworks commented Feb 6, 2026

Uh oh!

SkalaNetworks commented Feb 6, 2026

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

akbarkn commented Feb 9, 2026

Uh oh!

oilbeater commented Feb 10, 2026

Uh oh!

SkalaNetworks commented Feb 10, 2026

Uh oh!

oilbeater commented Feb 10, 2026

Uh oh!

SkalaNetworks commented Feb 10, 2026

Uh oh!

Uh oh!

akbarkn commented Feb 11, 2026

coveralls commented Jan 28, 2026 •

edited

Loading