diff --git a/Godeps/Godeps.json b/Godeps/Godeps.json index 4b7384dd..4c35d964 100644 --- a/Godeps/Godeps.json +++ b/Godeps/Godeps.json @@ -592,15 +592,15 @@ }, { "ImportPath": "k8s.io/api", - "Rev": "37fc98278a4b" + "Rev": "bfea6b930ba5" }, { "ImportPath": "k8s.io/apimachinery", - "Rev": "d496f1036126" + "Rev": "46fc763c3981" }, { "ImportPath": "k8s.io/cli-runtime", - "Rev": "aa6580445795" + "Rev": "7b87a9605630" }, { "ImportPath": "k8s.io/client-go", @@ -612,7 +612,7 @@ }, { "ImportPath": "k8s.io/component-base", - "Rev": "cca8f4f7ce4d" + "Rev": "93d53c1bdbbd" }, { "ImportPath": "k8s.io/gengo", diff --git a/go.mod b/go.mod index ae42cad6..feff3a9e 100644 --- a/go.mod +++ b/go.mod @@ -36,11 +36,11 @@ require ( golang.org/x/sys v0.0.0-20190826190057-c7b8b68b1456 gopkg.in/yaml.v2 v2.2.4 gotest.tools v2.2.0+incompatible // indirect - k8s.io/api v0.0.0-20191114100032-37fc98278a4b - k8s.io/apimachinery v0.0.0-20191114095527-d496f1036126 - k8s.io/cli-runtime v0.0.0-20191111063502-aa6580445795 + k8s.io/api v0.0.0-20191114100033-bfea6b930ba5 + k8s.io/apimachinery v0.0.0-20191114095528-46fc763c3981 + k8s.io/cli-runtime v0.0.0-20191114105952-7b87a9605630 k8s.io/client-go v0.0.0-20191114100700-74d7a2e0ebca - k8s.io/component-base v0.0.0-20191111061729-cca8f4f7ce4d + k8s.io/component-base v0.0.0-20191114102134-93d53c1bdbbd k8s.io/klog v1.0.0 k8s.io/kube-openapi v0.0.0-20191107075043-30be4d16710a k8s.io/metrics v0.0.0-20191109111301-80b462294217 @@ -53,11 +53,11 @@ require ( replace ( golang.org/x/sys => golang.org/x/sys v0.0.0-20190813064441-fde4db37ae7a golang.org/x/tools => golang.org/x/tools v0.0.0-20190821162956-65e3620a7ae7 - k8s.io/api => k8s.io/api v0.0.0-20191114100032-37fc98278a4b - k8s.io/apimachinery => k8s.io/apimachinery v0.0.0-20191114095527-d496f1036126 - k8s.io/cli-runtime => k8s.io/cli-runtime v0.0.0-20191111063502-aa6580445795 + k8s.io/api => k8s.io/api v0.0.0-20191114100033-bfea6b930ba5 + k8s.io/apimachinery => k8s.io/apimachinery v0.0.0-20191114095528-46fc763c3981 + k8s.io/cli-runtime => k8s.io/cli-runtime v0.0.0-20191114105952-7b87a9605630 k8s.io/client-go => k8s.io/client-go v0.0.0-20191114100700-74d7a2e0ebca k8s.io/code-generator => k8s.io/code-generator v0.0.0-20191109100332-a9a0d9c0b3aa - k8s.io/component-base => k8s.io/component-base v0.0.0-20191111061729-cca8f4f7ce4d + k8s.io/component-base => k8s.io/component-base v0.0.0-20191114102134-93d53c1bdbbd k8s.io/metrics => k8s.io/metrics v0.0.0-20191109111301-80b462294217 ) diff --git a/go.sum b/go.sum index 53204177..7cdcdf73 100644 --- a/go.sum +++ b/go.sum @@ -316,12 +316,12 @@ gotest.tools v2.2.0+incompatible h1:VsBPFP1AI068pPrMxtb/S8Zkgf9xEmTLJjfM+P5UIEo= gotest.tools v2.2.0+incompatible/go.mod h1:DsYFclhRJ6vuDpmuTbkuFWG+y2sxOXAzmJt81HFBacw= honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4= honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4= -k8s.io/api v0.0.0-20191114100032-37fc98278a4b/go.mod h1:8svLRMiLwQReMTycutfjsaQ0ackWIf8HCT4UcixYLjI= -k8s.io/apimachinery v0.0.0-20191114095527-d496f1036126/go.mod h1:+6CX7hP4aLfX2sb91JYDMIp0VqDSog2kZu0BHe+lP+s= -k8s.io/cli-runtime v0.0.0-20191111063502-aa6580445795/go.mod h1:/1ZIjq+uwB/MFz4qI/QNVt2W3Q7BIuzc8WThDKrVeng= +k8s.io/api v0.0.0-20191114100033-bfea6b930ba5/go.mod h1:J3f3O6tWqxQZx55pJVnBWTkeC85oPosnzvvsKzJ0fwg= +k8s.io/apimachinery v0.0.0-20191114095528-46fc763c3981/go.mod h1:+6CX7hP4aLfX2sb91JYDMIp0VqDSog2kZu0BHe+lP+s= +k8s.io/cli-runtime v0.0.0-20191114105952-7b87a9605630/go.mod h1:reOVNGV6gGhkgMHuJnmeiEqRL3z49lQEGo8E5CGlAic= k8s.io/client-go v0.0.0-20191114100700-74d7a2e0ebca/go.mod h1:NWDcvX+oAkmke5fjHiErMvbgGGoaHcZcxGNYutZ3MtQ= k8s.io/code-generator v0.0.0-20191109100332-a9a0d9c0b3aa/go.mod h1:fRFrKVixH946mn5PeglV2fvxbE86JesGi16bsWZ1xz4= -k8s.io/component-base v0.0.0-20191111061729-cca8f4f7ce4d/go.mod h1:hCGnNyhGnZljl2XmSocXO/ySLrgK5bpKAMqSFAFES/E= +k8s.io/component-base v0.0.0-20191114102134-93d53c1bdbbd/go.mod h1:43XKPi9nLRHCdn6m6mNiHi2rU/0S5loyOlZI2DuZ6iY= k8s.io/gengo v0.0.0-20190128074634-0689ccc1d7d6/go.mod h1:ezvh/TsK7cY6rbqRK0oQQ8IAqLxYwwyPxAX1Pzy0ii0= k8s.io/gengo v0.0.0-20190822140433-26a664648505/go.mod h1:ezvh/TsK7cY6rbqRK0oQQ8IAqLxYwwyPxAX1Pzy0ii0= k8s.io/klog v0.0.0-20181102134211-b9b56d5dfc92/go.mod h1:Gq+BEi5rUBO/HRz0bTSXDUcqjScdoY3a9IHpCEIOOfk= diff --git a/pkg/describe/versioned/describe.go b/pkg/describe/versioned/describe.go index f9fae1df..315ac742 100644 --- a/pkg/describe/versioned/describe.go +++ b/pkg/describe/versioned/describe.go @@ -3745,13 +3745,38 @@ func describeNetworkPolicySpec(nps networkingv1.NetworkPolicySpec, w PrefixWrite } else { w.Write(LEVEL_2, "%s\n", metav1.FormatLabelSelector(&nps.PodSelector)) } - w.Write(LEVEL_1, "Allowing ingress traffic:\n") - printNetworkPolicySpecIngressFrom(nps.Ingress, " ", w) - w.Write(LEVEL_1, "Allowing egress traffic:\n") - printNetworkPolicySpecEgressTo(nps.Egress, " ", w) + + ingressEnabled, egressEnabled := getPolicyType(nps) + if ingressEnabled { + w.Write(LEVEL_1, "Allowing ingress traffic:\n") + printNetworkPolicySpecIngressFrom(nps.Ingress, " ", w) + } else { + w.Write(LEVEL_1, "Not affecting ingress traffic\n") + } + if egressEnabled { + w.Write(LEVEL_1, "Allowing egress traffic:\n") + printNetworkPolicySpecEgressTo(nps.Egress, " ", w) + } else { + w.Write(LEVEL_1, "Not affecting egress traffic\n") + + } w.Write(LEVEL_1, "Policy Types: %v\n", policyTypesToString(nps.PolicyTypes)) } +func getPolicyType(nps networkingv1.NetworkPolicySpec) (bool, bool) { + var ingress, egress bool + for _, pt := range nps.PolicyTypes { + switch pt { + case networkingv1.PolicyTypeIngress: + ingress = true + case networkingv1.PolicyTypeEgress: + egress = true + } + } + + return ingress, egress +} + func printNetworkPolicySpecIngressFrom(npirs []networkingv1.NetworkPolicyIngressRule, initialIndent string, w PrefixWriter) { if len(npirs) == 0 { w.Write(LEVEL_0, "%s%s\n", initialIndent, " (Selected pods are isolated for ingress connectivity)") diff --git a/pkg/describe/versioned/describe_test.go b/pkg/describe/versioned/describe_test.go index f14a7519..5236f4f2 100644 --- a/pkg/describe/versioned/describe_test.go +++ b/pkg/describe/versioned/describe_test.go @@ -3142,6 +3142,261 @@ Spec: } } +func TestDescribeIngressNetworkPolicies(t *testing.T) { + expectedTime, err := time.Parse("2006-01-02 15:04:05 Z0700 MST", "2017-06-04 21:45:56 -0700 PDT") + if err != nil { + t.Errorf("unable to parse time %q error: %s", "2017-06-04 21:45:56 -0700 PDT", err) + } + expectedOut := `Name: network-policy-1 +Namespace: default +Created on: 2017-06-04 21:45:56 -0700 PDT +Labels: +Annotations: +Spec: + PodSelector: foo in (bar1,bar2),foo2 notin (bar1,bar2),id1=app1,id2=app2 + Allowing ingress traffic: + To Port: 80/TCP + To Port: 82/TCP + From: + NamespaceSelector: id=ns1,id2=ns2 + PodSelector: id=pod1,id2=pod2 + From: + PodSelector: id=app2,id2=app3 + From: + NamespaceSelector: id=app2,id2=app3 + From: + NamespaceSelector: foo in (bar1,bar2),id=app2,id2=app3 + From: + IPBlock: + CIDR: 192.168.0.0/16 + Except: 192.168.3.0/24, 192.168.4.0/24 + ---------- + To Port: (traffic allowed to all ports) + From: (traffic not restricted by source) + Not affecting egress traffic + Policy Types: Ingress +` + + port80 := intstr.FromInt(80) + port82 := intstr.FromInt(82) + protoTCP := corev1.ProtocolTCP + + versionedFake := fake.NewSimpleClientset(&networkingv1.NetworkPolicy{ + ObjectMeta: metav1.ObjectMeta{ + Name: "network-policy-1", + Namespace: "default", + CreationTimestamp: metav1.NewTime(expectedTime), + }, + Spec: networkingv1.NetworkPolicySpec{ + PodSelector: metav1.LabelSelector{ + MatchLabels: map[string]string{ + "id1": "app1", + "id2": "app2", + }, + MatchExpressions: []metav1.LabelSelectorRequirement{ + {Key: "foo", Operator: "In", Values: []string{"bar1", "bar2"}}, + {Key: "foo2", Operator: "NotIn", Values: []string{"bar1", "bar2"}}, + }, + }, + Ingress: []networkingv1.NetworkPolicyIngressRule{ + { + Ports: []networkingv1.NetworkPolicyPort{ + {Port: &port80}, + {Port: &port82, Protocol: &protoTCP}, + }, + From: []networkingv1.NetworkPolicyPeer{ + { + PodSelector: &metav1.LabelSelector{ + MatchLabels: map[string]string{ + "id": "pod1", + "id2": "pod2", + }, + }, + NamespaceSelector: &metav1.LabelSelector{ + MatchLabels: map[string]string{ + "id": "ns1", + "id2": "ns2", + }, + }, + }, + { + PodSelector: &metav1.LabelSelector{ + MatchLabels: map[string]string{ + "id": "app2", + "id2": "app3", + }, + }, + }, + { + NamespaceSelector: &metav1.LabelSelector{ + MatchLabels: map[string]string{ + "id": "app2", + "id2": "app3", + }, + }, + }, + { + NamespaceSelector: &metav1.LabelSelector{ + MatchLabels: map[string]string{ + "id": "app2", + "id2": "app3", + }, + MatchExpressions: []metav1.LabelSelectorRequirement{ + {Key: "foo", Operator: "In", Values: []string{"bar1", "bar2"}}, + }, + }, + }, + { + IPBlock: &networkingv1.IPBlock{ + CIDR: "192.168.0.0/16", + Except: []string{"192.168.3.0/24", "192.168.4.0/24"}, + }, + }, + }, + }, + {}, + }, + PolicyTypes: []networkingv1.PolicyType{networkingv1.PolicyTypeIngress}, + }, + }) + d := NetworkPolicyDescriber{versionedFake} + out, err := d.Describe("default", "network-policy-1", describe.DescriberSettings{}) + if err != nil { + t.Errorf("unexpected error: %s", err) + } + if out != expectedOut { + t.Errorf("want:\n%s\ngot:\n%s", expectedOut, out) + } +} + +func TestDescribeIsolatedEgressNetworkPolicies(t *testing.T) { + expectedTime, err := time.Parse("2006-01-02 15:04:05 Z0700 MST", "2017-06-04 21:45:56 -0700 PDT") + if err != nil { + t.Errorf("unable to parse time %q error: %s", "2017-06-04 21:45:56 -0700 PDT", err) + } + expectedOut := `Name: network-policy-1 +Namespace: default +Created on: 2017-06-04 21:45:56 -0700 PDT +Labels: +Annotations: +Spec: + PodSelector: foo in (bar1,bar2),foo2 notin (bar1,bar2),id1=app1,id2=app2 + Allowing ingress traffic: + To Port: 80/TCP + To Port: 82/TCP + From: + NamespaceSelector: id=ns1,id2=ns2 + PodSelector: id=pod1,id2=pod2 + From: + PodSelector: id=app2,id2=app3 + From: + NamespaceSelector: id=app2,id2=app3 + From: + NamespaceSelector: foo in (bar1,bar2),id=app2,id2=app3 + From: + IPBlock: + CIDR: 192.168.0.0/16 + Except: 192.168.3.0/24, 192.168.4.0/24 + ---------- + To Port: (traffic allowed to all ports) + From: (traffic not restricted by source) + Allowing egress traffic: + (Selected pods are isolated for egress connectivity) + Policy Types: Ingress, Egress +` + + port80 := intstr.FromInt(80) + port82 := intstr.FromInt(82) + protoTCP := corev1.ProtocolTCP + + versionedFake := fake.NewSimpleClientset(&networkingv1.NetworkPolicy{ + ObjectMeta: metav1.ObjectMeta{ + Name: "network-policy-1", + Namespace: "default", + CreationTimestamp: metav1.NewTime(expectedTime), + }, + Spec: networkingv1.NetworkPolicySpec{ + PodSelector: metav1.LabelSelector{ + MatchLabels: map[string]string{ + "id1": "app1", + "id2": "app2", + }, + MatchExpressions: []metav1.LabelSelectorRequirement{ + {Key: "foo", Operator: "In", Values: []string{"bar1", "bar2"}}, + {Key: "foo2", Operator: "NotIn", Values: []string{"bar1", "bar2"}}, + }, + }, + Ingress: []networkingv1.NetworkPolicyIngressRule{ + { + Ports: []networkingv1.NetworkPolicyPort{ + {Port: &port80}, + {Port: &port82, Protocol: &protoTCP}, + }, + From: []networkingv1.NetworkPolicyPeer{ + { + PodSelector: &metav1.LabelSelector{ + MatchLabels: map[string]string{ + "id": "pod1", + "id2": "pod2", + }, + }, + NamespaceSelector: &metav1.LabelSelector{ + MatchLabels: map[string]string{ + "id": "ns1", + "id2": "ns2", + }, + }, + }, + { + PodSelector: &metav1.LabelSelector{ + MatchLabels: map[string]string{ + "id": "app2", + "id2": "app3", + }, + }, + }, + { + NamespaceSelector: &metav1.LabelSelector{ + MatchLabels: map[string]string{ + "id": "app2", + "id2": "app3", + }, + }, + }, + { + NamespaceSelector: &metav1.LabelSelector{ + MatchLabels: map[string]string{ + "id": "app2", + "id2": "app3", + }, + MatchExpressions: []metav1.LabelSelectorRequirement{ + {Key: "foo", Operator: "In", Values: []string{"bar1", "bar2"}}, + }, + }, + }, + { + IPBlock: &networkingv1.IPBlock{ + CIDR: "192.168.0.0/16", + Except: []string{"192.168.3.0/24", "192.168.4.0/24"}, + }, + }, + }, + }, + {}, + }, + PolicyTypes: []networkingv1.PolicyType{networkingv1.PolicyTypeIngress, networkingv1.PolicyTypeEgress}, + }, + }) + d := NetworkPolicyDescriber{versionedFake} + out, err := d.Describe("default", "network-policy-1", describe.DescriberSettings{}) + if err != nil { + t.Errorf("unexpected error: %s", err) + } + if out != expectedOut { + t.Errorf("want:\n%s\ngot:\n%s", expectedOut, out) + } +} + func TestDescribeServiceAccount(t *testing.T) { fake := fake.NewSimpleClientset(&corev1.ServiceAccount{ ObjectMeta: metav1.ObjectMeta{