Add Except for Antrea-native ipBlock #6658
Conversation
Dyanngg
force-pushed
the
add-ipblock-except-antrea
branch
4 times, most recently
from
c840536 to
cd59fed
Compare
Dyanngg
changed the title
Dyanngg
force-pushed
the
add-ipblock-except-antrea
branch
2 times, most recently
from
cc5df40 to
1153d8c
Compare
Dyanngg
force-pushed
the
add-ipblock-except-antrea
branch
from
1153d8c to
413edae
Compare
antoninbas
added
action/release-note
| if ipb.CIDR == "" { | ||
| return "field 'cidr' is required in an ipBlock", false | ||
| } |
There was a problem hiding this comment.
We can keep this, but I assume this is guaranteed by the OpenAPI spec?
There was a problem hiding this comment.
Yes it should already be guaranteed by openAPI, just trying to keep it on par with https://github.com/kubernetes/kubernetes/blob/master/pkg/apis/networking/validation/validation.go#L219
Signed-off-by: Dyanngg <dingyang@vmware.com>
Signed-off-by: Dyanngg <dingyang@vmware.com>
Dyanngg
force-pushed
the
add-ipblock-except-antrea
branch
from
413edae to
1a0c157
Compare
| if multicast && unicast { | ||
| return "can not set multicast groupAddress together with unicast ip address", false | ||
| } |
There was a problem hiding this comment.
Will multicast NetworkPolicy support the except field?
There was a problem hiding this comment.
This is obviously not supported for IGMP rules since the addresses you would specify in the protocol is not a CIDR to begin with. In terms of "dropping udp egress to a multicast CIDR", I would say yes, since the CIDR subtraction logic will be the same for regular and multicast IP addresses
|
/test-all |
|
/test-conformance |
|
/test-networkpolicy /test-e2e /test-all-features-conformance |
|
/test-conformance |
|
/test-kind-e2e |
|
|
Fixes antrea-io#6428 This PR adds an "except" field for all ipBlocks in Antrea-native policies and groups. Users can exclude certain CIDRs from the ipBlock.cidr in all resources that support ipBlocks, including AntreaClusterNetworkPolicy, AntreaNetworkPolicy, ClusterGroup and Group. Group membership and IP association query logic are also updated to accommodate this change. Documentation will follow in a separate PR. Signed-off-by: Dyanngg <dingyang@vmware.com>
Fixes #6428
This PR adds an "except" field for all ipBlocks in Antrea-native policies and groups. Users can exclude certain CIDRs from the ipBlock.cidr in all resources that support ipBlocks, including AntreaClusterNetworkPolicy, AntreaNetworkPolicy, ClusterGroup and Group. Group membership and IP association query logic are also updated to accommodate this change. Documentation will follow in a separate PR.