Bug 1613280 - only create netpolicy if one already exists #172
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
update test to reflect new createsandbox rules
jmrodri
force-pushed
the
network-policy
branch
from
ffbba68 to
ee040cc
Compare
shawn-hurley
approved these changes
Oct 8, 2018
Contributor
shawn-hurley
left a comment
shawn-hurley
left a comment
There was a problem hiding this comment.
This looks good to me I don't see any problems
VISACK
If you want a second pair of eyes on testing let me know and I can spin up my dev env for this again
eriknelson
approved these changes
Oct 19, 2018
| apbRole: "edit", | ||
| }, | ||
| { | ||
| name: "Test Create Sandbox with ns in target with net policy", |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
If there are other services in the target namespace talking to each other with no network policy, during APB deployments we automatically create one that blocks the other services. This change looks to see if there are any network policies on the target namespace. If there are none, we forgo creating the network policy, assuming things are open and the transient namespace should be able to talk to the target with no issues. If there are existing network policies, then we will add ours to give the transient namespace access to the target. There is still the chance that our network policy could still affect things depending on the variety of existing network policies in place, too many to verify.