OCPBUGS-45980: Downstream merge 2025-10-29#76
OCPBUGS-45980: Downstream merge 2025-10-29#76openshift-merge-bot[bot] merged 100 commits intoopenshift:mainfrom
Conversation
This change introduces pod-iptables option to store iptables-rules in pod's network namespace. This helps administrator/engineer to troubleshooting.
…tables Add pod-iptables option to store pod iptables
Fix some timing issue and change memory limit
Add namespace check between pod and multi-networkpolicy
Add ginkgo test to the suite with only default values. Add `renderProtocol` function with fallback logic. Signed-off-by: Andrea Panattoni <apanatto@redhat.com>
Use TCP as default for Port.Protocol
Fix to work namespacveSelector policy, without labelSelector
* Add test case for namespace selector The case is about having two namespaces with pods and net-attach-def and a multi networkpolicy that goes through namespace borders. Signed-off-by: Andrea Panattoni <apanatto@redhat.com> * Add test case with net-attach-def in other ns Signed-off-by: Andrea Panattoni <apanatto@redhat.com>
* Add object information to update events This should make it clearer what k8s object the daemon is working on. Increase verbosity threshlod for invoke handlers logs. Signed-off-by: Andrea Panattoni <apanatto@redhat.com> * Improve error logging Signed-off-by: Andrea Panattoni <apanatto@redhat.com>
"go getting" github.com/mgechev/revive can lead to unreproducible builds, as it download the latest "dev" version. Stick to the latest (v1.2.1) version. Signed-off-by: Andrea Panattoni <apanatto@redhat.com>
* Log filter rules Logging iptables rules before applying them can be useful to debug complex scenarios. Setting verbosity level to 6 as they can be quite cumbersome. Signed-off-by: Andrea Panattoni <apanatto@redhat.com> * Clean up logging code Signed-off-by: Andrea Panattoni <apanatto@redhat.com>
This change refines policy rule generation to introduce conntrack and support multiple policies in a pod. Fix openshift#17 and openshift#18
Refine policy generation routine to support multiple policies
Update github action to fit to latest golang
Remove docker from support runtime due to obsolated
…t#31) Bumps [github.com/containernetworking/cni](https://github.com/containernetworking/cni) from 0.7.1 to 0.8.1. - [Release notes](https://github.com/containernetworking/cni/releases) - [Commits](containernetworking/cni@v0.7.1...v0.8.1) --- updated-dependencies: - dependency-name: github.com/containernetworking/cni dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Support `EndPort` field
Add end2end test cases for - k8snetworkplumbingwg/multi-networkpolicy-iptables#75 Signed-off-by: Andrea Panattoni <apanatto@redhat.com>
and split them in multple smaller functions. Signed-off-by: Andrea Panattoni <apanatto@redhat.com>
As per API description [1]: > IPBlock defines policy on a particular IPBlock. If this field is set then neither of the other fields can be." if a policy rule has a from/to rule with an IPBlock field, then the PodSelector and NamespaceSelector fields must be ignored. [1] https://github.com/k8snetworkplumbingwg/multi-networkpolicy/blob/master/scheme.yml#L88 Signed-off-by: Andrea Panattoni <apanatto@redhat.com>
CVE-2024-45338 ``` $ go get -u golang.org/x/net@v0.34.0 go: upgraded golang.org/x/net v0.20.0 => v0.41.0 $ go mod tidy $ go mod vendor ``` Signed-off-by: Andrea Panattoni <apanatto@redhat.com>
deps: bump `golang.org/x/net`
e2e: test for port ranges
Give precendence to IPBlock field over PodSelector
openshift-ci-robot
added
jira/severity-important
|
@zeeke: This pull request references Jira Issue OCPBUGS-45980, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this: Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci
bot
added
the
approved
zeeke
force-pushed
the
ds/sync-20251029
branch
from
e54b6ce to
7224f53
Compare
|
@zeeke: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
/jira refresh |
openshift-ci-robot
added
jira/valid-bug
|
@zeeke: This pull request references Jira Issue OCPBUGS-45980, which is valid. The bug has been moved to the POST state. 3 validation(s) were run on this bug
Requesting review from QA contact: DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: cgoncalves, zeeke The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
@zeeke: Jira Issue OCPBUGS-45980: All pull requests linked via external trackers have merged: Jira Issue OCPBUGS-45980 has been moved to the MODIFIED state. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
Fix included in accepted release 4.21.0-0.nightly-2025-11-05-234508 |
9 participants
pulling downstream:
golang.org/x/netk8snetworkplumbingwg/multi-networkpolicy-iptables#74