func (d *Daemon) getFilteredLabels(allLabels map[string]string) labels.Labels {
var ciliumLabels, k8sLabels labels.Labels
if podName := k8sDockerLbls.GetPodName(allLabels); podName != "" {
k8sNormalLabels, err := d.fetchK8sLabels(allLabels)
if err != nil {
log.Warningf("Error while getting kubernetes labels: %s", err)
} else if k8sNormalLabels != nil {
k8sLabels = labels.Map2Labels(k8sNormalLabels, common.K8sLabelSource)
}
}
ciliumLabels = labels.Map2Labels(allLabels, common.CiliumLabelSource)
ciliumLabels.MergeLabels(k8sLabels)
d.conf.ValidLabelPrefixesMU.RLock()
defer d.conf.ValidLabelPrefixesMU.RUnlock()
return d.conf.ValidLabelPrefixes.FilterLabels(ciliumLabels)
}
func K8sNP2CP(np *v1beta1.NetworkPolicy) (string, *policy.Node, error) {
var parentNodeName, policyName string
if np.Annotations[common.K8sAnnotationParentName] == "" {
parentNodeName = common.GlobalLabelPrefix
} else {
parentNodeName = np.Annotations[common.K8sAnnotationParentName]
}
if np.Annotations[common.K8sAnnotationName] == "" {
policyName = np.Name
} else {
policyName = np.Annotations[common.K8sAnnotationName]
}
allowRules := []policy.AllowRule{}
for _, iRule := range np.Spec.Ingress {
if iRule.From != nil {
for _, rule := range iRule.From {
if rule.PodSelector != nil {
for k, v := range rule.PodSelector.MatchLabels {
l := labels.NewLabel(k, v, "")
if l.Source == common.CiliumLabelSource {
l.Source = common.K8sLabelSource
}
ar := policy.AllowRule{
Action: policy.ALWAYS_ACCEPT,
Label: *l,
}
allowRules = append(allowRules, ar)
}
} else if rule.NamespaceSelector != nil {
for k := range rule.NamespaceSelector.MatchLabels {
l := labels.NewLabel(common.K8sPodNamespaceLabel, k, common.K8sLabelSource)
ar := policy.AllowRule{
Action: policy.ALWAYS_ACCEPT,
Label: *l,
}
allowRules = append(allowRules, ar)
}
}
}
}
}
coverageLbls := labels.Map2Labels(np.Spec.PodSelector.MatchLabels, common.K8sLabelSource)
pn := policy.NewNode(policyName, nil)
pn.Rules = []policy.PolicyRule{
&policy.PolicyRuleConsumers{
Coverage: coverageLbls.ToSlice(),
Allow: allowRules,
},
}
return parentNodeName, pn, nil
}
