Exemplo n.º 1
0
func (d *Daemon) getFilteredLabels(allLabels map[string]string) labels.Labels {
	var ciliumLabels, k8sLabels labels.Labels
	if podName := k8sDockerLbls.GetPodName(allLabels); podName != "" {
		k8sNormalLabels, err := d.fetchK8sLabels(allLabels)
		if err != nil {
			log.Warningf("Error while getting kubernetes labels: %s", err)
		} else if k8sNormalLabels != nil {
			k8sLabels = labels.Map2Labels(k8sNormalLabels, common.K8sLabelSource)
		}
	}

	ciliumLabels = labels.Map2Labels(allLabels, common.CiliumLabelSource)

	ciliumLabels.MergeLabels(k8sLabels)

	d.conf.ValidLabelPrefixesMU.RLock()
	defer d.conf.ValidLabelPrefixesMU.RUnlock()
	return d.conf.ValidLabelPrefixes.FilterLabels(ciliumLabels)
}
Exemplo n.º 2
0
func K8sNP2CP(np *v1beta1.NetworkPolicy) (string, *policy.Node, error) {
	var parentNodeName, policyName string
	if np.Annotations[common.K8sAnnotationParentName] == "" {
		parentNodeName = common.GlobalLabelPrefix
	} else {
		parentNodeName = np.Annotations[common.K8sAnnotationParentName]
	}
	if np.Annotations[common.K8sAnnotationName] == "" {
		policyName = np.Name
	} else {
		policyName = np.Annotations[common.K8sAnnotationName]
	}

	allowRules := []policy.AllowRule{}
	for _, iRule := range np.Spec.Ingress {
		if iRule.From != nil {
			for _, rule := range iRule.From {
				if rule.PodSelector != nil {
					for k, v := range rule.PodSelector.MatchLabels {
						l := labels.NewLabel(k, v, "")
						if l.Source == common.CiliumLabelSource {
							l.Source = common.K8sLabelSource
						}
						ar := policy.AllowRule{
							Action: policy.ALWAYS_ACCEPT,
							Label:  *l,
						}
						allowRules = append(allowRules, ar)
					}
				} else if rule.NamespaceSelector != nil {
					for k := range rule.NamespaceSelector.MatchLabels {
						l := labels.NewLabel(common.K8sPodNamespaceLabel, k, common.K8sLabelSource)
						ar := policy.AllowRule{
							Action: policy.ALWAYS_ACCEPT,
							Label:  *l,
						}
						allowRules = append(allowRules, ar)
					}
				}
			}
		}
	}

	coverageLbls := labels.Map2Labels(np.Spec.PodSelector.MatchLabels, common.K8sLabelSource)
	pn := policy.NewNode(policyName, nil)
	pn.Rules = []policy.PolicyRule{
		&policy.PolicyRuleConsumers{
			Coverage: coverageLbls.ToSlice(),
			Allow:    allowRules,
		},
	}
	return parentNodeName, pn, nil
}