Support both podSelector and namespaceSelector in NetworkPolicy

[brb]

Upcoming Kubernetes release will allow us to select pods in selected namespaces (kubernetes/kubernetes#60452). We should support it in weave-npc.

[murali-reddy]

@brb I gave it a shot to fix this #3428

It appears to me that current design to keep per namespace selector collection does not easily fit in to the combination of podSelector and namespaceSelector.

So the association namespace <- network policy <- selectors works nicely when pods are with in the namespace or all the pods in different namespace selected by namespace selector.

I extended a bit selector to be a different namespaces as well. But does not quite work yet. From what i see add/delete/update pods need to check with all the network policies across namespaces.

Before i go down the path can you check #3428 and see if there is any simple way to solve this?

[brb]

My idea was to get rid of the nsSelectors, to extend podSelectors in a way that it includes a namespace selector, and to share the podSelectors instance among all namespaces.

[n1koo]

Hi friends, is this still targeted for 2.5.1 or needs more research on the approach?

[murali-reddy]

@n1koo IMO it does not look like this can be targeted for 2.5.x I started working on fix (in #3428) but it turned out network policies design changes are needed to accommodate the combination of pod selector and namespace selector.So likely targeted for 2.6

[n1koo]

@murali-reddy thanks for the super quick update. I'm sure things are still in flux for 2.6 but is there any rough estimate?

This would be hugely beneficial for us and i'm sure most of the other folks as separating apps to their own namespaces is pretty much a defacto setup but you still don't want everything in a namespace to be able to connect to everything in the other namespace :)

I'd be happy to help test it out when the work ramps up.

[ernoaapa]

Sorry, not clear to me, does this mean that I cannot use both podSelector and namespaceSelector same time? I.e. allow from any pod in any namespace (but not "anywhere")

[murali-reddy]

Yes, at the moment podSelector and namespaceSelector can not be used together. I am updating #3428, should be part of 2.6.

allow from any pod in any namespace (but not "anywhere")

its more like selected pods from selected namespaces

[murali-reddy]

PR #3647 is in progress implementing this feature. I have done testing with ingress and egress network policies with pod selectors, namespace selectors and combination of namespace and pod selectors. However more testing would be helpful. If any one wish to help test this functionality please replace weaveworks/weave-npc image with muralireddy/weave-npc:podnsselector in the manifest.