Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[exposure analysis] should change peer IsProtected definition? #489

Open
shireenf-ibm opened this issue Jan 27, 2025 · 0 comments
Open

[exposure analysis] should change peer IsProtected definition? #489

shireenf-ibm opened this issue Jan 27, 2025 · 0 comments
Assignees

Comments

@shireenf-ibm
Copy link
Contributor

in following example : tests/exposure_test_with_anp_1/

$ ./bin/k8snetpolicy list --dirpath tests/exposure_test_with_anp_1/ --exposure
0.0.0.0-255.255.255.255 => hello-world/workload-b[Deployment] : All Connections
hello-world/workload-b[Deployment] => 0.0.0.0-255.255.255.255 : All Connections

Exposure Analysis Result:
Egress Exposure:
hello-world/workload-a[Deployment]      =>      [namespace with {conformance-house=slytherin}]/[all pods] : TCP 80
hello-world/workload-b[Deployment]      =>      0.0.0.0-255.255.255.255 : All Connections
hello-world/workload-b[Deployment]      =>      entire-cluster : All Connections

Ingress Exposure:
hello-world/workload-a[Deployment]      <=      [namespace with {conformance-house=slytherin}]/[all pods] : TCP 80
hello-world/workload-b[Deployment]      <=      0.0.0.0-255.255.255.255 : All Connections
hello-world/workload-b[Deployment]      <=      entire-cluster : All Connections

There is an AdminNetworkPolicy with subject a namespace hello-world and a NetworkPolicy selecting hello-world/workload-a
the connections defined in the AdminNetworkPolicy does not affect hello-world/workload-b
but still hello-world/workload-b is defined as protected by the policies, since it belongs to the ANP's subject group.
should we define it as not-protected when policies don't have affect on its exposure?

@shireenf-ibm shireenf-ibm self-assigned this Jan 27, 2025
@adisos adisos changed the title should change peer IsProtected definition? [exposure analysis] should change peer IsProtected definition? Jan 27, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant