feat(cel/network): serviceRef/serviceSelector/host neighbor resolution #915
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,156 @@ | ||
| package networkpeer | ||
|
|
||
| import ( | ||
| "strings" | ||
|
|
||
| "github.com/kubescape/storage/pkg/apis/softwarecomposition/v1beta1" | ||
| ) | ||
|
|
||
| // ExpandServiceNeighbors resolves every serviceRef / serviceSelector / entity | ||
| // neighbor in the list against the cluster view and returns equivalent | ||
| // synthesized ipAddresses neighbors (one per source neighbor, carrying the | ||
| // resolved IPs and the source neighbor's own ports). | ||
| // | ||
| // The synthesized neighbors are ordinary selector-free ipAddresses entries | ||
| // (plus, for Service-backed specs, the Service's cluster FQDN as a dnsName so a | ||
| // client dialling it by name is allowlisted too), so the existing | ||
| // port-sensitive address matcher and DNS matcher handle them with no further | ||
| // change — a serviceRef/host neighbor becomes exactly the narrow, resolved | ||
| // entry it stands for. Neighbors that resolve to nothing (unknown | ||
| // Service, selector matching nothing, unknown entity) contribute nothing — | ||
| // never a match-all. Callers append the result to the same direction (egress | ||
| // or ingress) before projecting the profile. | ||
| func ExpandServiceNeighbors(neighbors []v1beta1.NetworkNeighbor, l Lister) []v1beta1.NetworkNeighbor { | ||
| if l == nil { | ||
| return nil | ||
| } | ||
| var out []v1beta1.NetworkNeighbor | ||
| for i := range neighbors { | ||
| n := &neighbors[i] | ||
| spec, ok := specFromNeighbor(n) | ||
| if !ok { | ||
| continue | ||
| } | ||
| ips := ResolveIPs(spec, l) | ||
| dnsNames := ResolveDNSNames(spec, l) | ||
| if len(ips) == 0 && len(dnsNames) == 0 { | ||
| continue | ||
| } | ||
| out = append(out, v1beta1.NetworkNeighbor{ | ||
| Identifier: n.Identifier + "-resolved", | ||
| Type: n.Type, | ||
| IPAddresses: ips, | ||
| DNSNames: dnsNames, | ||
| Ports: n.Ports, | ||
| }) | ||
| } | ||
| return out | ||
| } | ||
|
|
||
| // WithResolvedServiceNeighbors returns cp with every serviceRef/serviceSelector/ | ||
| // entity neighbor expanded into equivalent selector-free ipAddresses neighbors | ||
| // (appended to the same direction), so the projection's existing address | ||
| // surface enforces them. It is a no-op — returning cp unchanged — when the | ||
| // lister is nil or nothing resolves, and it never mutates the input: a copy is | ||
| // made only when there is something to add. Call it immediately before | ||
| // projecting a ContainerProfile. | ||
| func WithResolvedServiceNeighbors(cp *v1beta1.ContainerProfile, l Lister) *v1beta1.ContainerProfile { | ||
| if cp == nil || l == nil { | ||
| return cp | ||
| } | ||
| egExtra := ExpandServiceNeighbors(cp.Spec.Egress, l) | ||
| inExtra := ExpandServiceNeighbors(cp.Spec.Ingress, l) | ||
| if len(egExtra) == 0 && len(inExtra) == 0 { | ||
| return cp | ||
| } | ||
| out := cp.DeepCopy() | ||
| out.Spec.Egress = append(out.Spec.Egress, egExtra...) | ||
| out.Spec.Ingress = append(out.Spec.Ingress, inExtra...) | ||
| return out | ||
| } | ||
|
|
||
| // HasServiceNeighbors reports whether any egress/ingress neighbor declares a | ||
| // serviceRef / serviceSelector / entity — i.e. whether this profile's | ||
| // projection depends on the live cluster view (Service/EndpointSlice/Node) and | ||
| // must be re-projected when that view changes. Keyed on the raw fields, not on | ||
| // whether they currently resolve, so a profile projected before the informers | ||
| // synced is still marked and re-projects once they do. | ||
| func HasServiceNeighbors(cp *v1beta1.ContainerProfile) bool { | ||
| if cp == nil { | ||
| return false | ||
| } | ||
| for i := range cp.Spec.Egress { | ||
| if hasServiceFields(&cp.Spec.Egress[i]) { | ||
| return true | ||
| } | ||
| } | ||
| for i := range cp.Spec.Ingress { | ||
| if hasServiceFields(&cp.Spec.Ingress[i]) { | ||
| return true | ||
| } | ||
| } | ||
| return false | ||
| } | ||
|
|
||
| func hasServiceFields(n *v1beta1.NetworkNeighbor) bool { | ||
| return n.ServiceRefNamespace != "" || n.ServiceRefName != "" || n.ServiceSelector != nil || n.Entity != "" | ||
| } | ||
|
|
||
| // specFromNeighbor extracts a PeerSpec from a NetworkNeighbor, reporting false | ||
| // if the neighbor declares none of the service/entity selectors (a plain | ||
| // ipAddresses / dnsNames / podSelector neighbor is left untouched). | ||
| func specFromNeighbor(n *v1beta1.NetworkNeighbor) (PeerSpec, bool) { | ||
| // Cheap-reject a plain ipAddresses/dnsNames neighbor before allocating a | ||
| // []PortProto it would only discard (hot on every projection's non-service | ||
| // neighbors). | ||
| if n.Entity == "" && n.ServiceRefName == "" && n.ServiceSelector == nil { | ||
| return PeerSpec{}, false | ||
| } | ||
| spec := PeerSpec{Ports: portsFromNeighbor(n.Ports)} | ||
| switch { | ||
| case n.Entity != "": | ||
| spec.Entity = n.Entity | ||
| case n.ServiceRefName != "": | ||
| spec.ServiceRef = &ServiceRef{Namespace: n.ServiceRefNamespace, Name: n.ServiceRefName} | ||
| case n.ServiceSelector != nil: | ||
| // Only equality (matchLabels) is honored. A MatchExpressions clause or | ||
| // an empty matchLabels would either be silently ignored (broadening the | ||
| // match) or resolve to every Service — fail closed instead. | ||
| if len(n.ServiceSelector.MatchExpressions) > 0 || len(n.ServiceSelector.MatchLabels) == 0 { | ||
| return PeerSpec{}, false | ||
| } | ||
| spec.ServiceSelector = n.ServiceSelector.MatchLabels | ||
| // A namespaceSelector is honored only as the single equality | ||
| // kubernetes.io/metadata.name=<ns> (the only key the lister scopes on). | ||
| // Any other form — MatchExpressions, extra keys, or a different key — | ||
| // would be silently dropped and broaden the match cluster-wide, so fail | ||
| // closed. A nil namespaceSelector is cluster-wide by design. | ||
| if n.NamespaceSelector != nil { | ||
| nsl := n.NamespaceSelector | ||
| if len(nsl.MatchExpressions) > 0 || len(nsl.MatchLabels) != 1 || | ||
| nsl.MatchLabels["kubernetes.io/metadata.name"] == "" { | ||
| return PeerSpec{}, false | ||
| } | ||
| spec.NamespaceLabels = nsl.MatchLabels | ||
| } | ||
|
Comment on lines
+128
to
+135
There was a problem hiding this comment. 🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
# Inspect the effective storage replacement and trace NamespaceSelector handling.
rg -n -C 3 'github.com/(kubescape|k8sstormcenter)/storage|replace' go.mod
rg -n -C 5 'NamespaceSelector|NamespaceLabels|ServicesByLabels' pkg/networkpeerRepository: kubescape/node-agent Length of output: 9449 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '--- expand.go ---'
cat -n pkg/networkpeer/expand.go | sed -n '1,125p'
printf '%s\n' '--- lister.go ---'
cat -n pkg/networkpeer/lister.go | sed -n '1,140p'
printf '%s\n' '--- relevant tests ---'
cat -n pkg/networkpeer/expand_test.go | sed -n '1,180p'
cat -n pkg/networkpeer/lister_test.go | sed -n '85,130p'
printf '%s\n' '--- all namespace selector references ---'
rg -n -C 3 'NamespaceSelector|NamespaceLabels|ServicesByLabels' --glob '*.go' .Repository: kubescape/node-agent Length of output: 43367 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '--- namespace label construction ---'
cat -n pkg/containerprofilemanager/v1/container_data.go | sed -n '185,260p'
rg -n -C 5 'func getNamespaceMatchLabels|getNamespaceMatchLabels\(' pkg
printf '%s\n' '--- standalone behavior probe for ServicesByLabels namespace handling ---'
python3 - <<'PY'
services = [
{"namespace": "gitops-demo", "labels": {"app": "guestbook"}},
{"namespace": "other", "labels": {"app": "guestbook"}},
]
def services_by_labels(service_selector, namespace_labels):
if not service_selector:
return []
selected = [
s for s in services
if all(s["labels"].get(k) == v for k, v in service_selector.items())
]
want_ns = ""
if namespace_labels is not None:
want_ns = namespace_labels.get("kubernetes.io/metadata.name", "")
return [s for s in selected if not want_ns or s["namespace"] == want_ns]
cases = [
("exact namespace", {"kubernetes.io/metadata.name": "gitops-demo"}),
("arbitrary namespace label", {"team": "prod"}),
("empty namespace selector", {}),
("expression-only selector represented after MatchLabels conversion", {}),
]
for name, namespace_labels in cases:
result = services_by_labels({"app": "guestbook"}, namespace_labels)
print(name, "=>", [s["namespace"] for s in result])
PY
printf '%s\n' '--- NetworkNeighbor type/schema references in available sources ---'
rg -n -C 4 'type NetworkNeighbor struct|ServiceSelector.*\*metav1.LabelSelector|NamespaceSelector.*\*metav1.LabelSelector' \
. $(go env GOPATH 2>/dev/null)/pkg/mod/github.com/k8sstormcenter/storage* \
$(go env GOPATH 2>/dev/null)/pkg/mod/github.com/kubescape/storage* 2>/dev/null || trueRepository: kubescape/node-agent Length of output: 50376 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '--- namespace helper and resolver contract ---'
cat -n pkg/containerprofilemanager/v1/network_helpers.go | sed -n '125,145p'
cat -n pkg/networkpeer/resolve.go | sed -n '100,130p'
rg -n -C 5 'WithResolvedServiceNeighbors|ExpandServiceNeighbors|ServiceSelector|same namespace|NamespaceSelector' \
pkg README.md docs 2>/dev/null | head -n 300
printf '%s\n' '--- storage API comments for NetworkNeighbor fields ---'
storage_mod="$(find "$(go env GOPATH)/pkg/mod/github.com/k8sstormcenter" -maxdepth 1 -type d -name 'storage@*' | head -n 1)"
if [ -n "$storage_mod" ]; then
cat -n "$storage_mod/pkg/apis/softwarecomposition/v1beta1/network_types.go" | sed -n '20,48p'
fi
printf '%s\n' '--- generated same-namespace selector behavior ---'
python3 - <<'PY'
def get_namespace_match_labels(destination, source):
if destination != source:
return {"kubernetes.io/metadata.name": destination}
return None
def resolve(service_selector, namespace_labels, services):
if not service_selector:
return []
want_ns = ""
if namespace_labels is not None:
want_ns = namespace_labels.get("kubernetes.io/metadata.name", "")
return [
s for s in services
if all(s["labels"].get(k) == v for k, v in service_selector.items())
and (not want_ns or s["namespace"] == want_ns)
]
services = [
{"namespace": "source", "labels": {"app": "guestbook"}},
{"namespace": "other", "labels": {"app": "guestbook"}},
]
for destination, source in [("source", "source"), ("other", "source")]:
ns = get_namespace_match_labels(destination, source)
print(f"destination={destination}, source={source}, NamespaceSelector={ns!r} =>",
[s["namespace"] for s in resolve({"app": "guestbook"}, ns, services)])
PYRepository: kubescape/node-agent Length of output: 25901 Preserve namespace scoping for
Evaluate the complete selector, or reject unsupported selectors and carry an explicit same-namespace constraint. Add tests for arbitrary labels, expressions, empty selectors, and same-namespace selectors. 🤖 Prompt for AI Agents |
||
| default: | ||
| return PeerSpec{}, false | ||
| } | ||
| return spec, true | ||
| } | ||
|
|
||
| func portsFromNeighbor(ports []v1beta1.NetworkPort) []PortProto { | ||
| if len(ports) == 0 { | ||
| return nil | ||
| } | ||
| out := make([]PortProto, 0, len(ports)) | ||
| for i := range ports { | ||
| p := &ports[i] | ||
| var port int32 | ||
| if p.Port != nil { | ||
| port = *p.Port | ||
| } | ||
| out = append(out, PortProto{Port: port, Protocol: strings.ToUpper(string(p.Protocol))}) | ||
| } | ||
| return out | ||
| } | ||
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Blocker:
replace github.com/kubescape/storage => github.com/k8sstormcenter/storage v0.0.240-...pins to a fork commit, not the upstreamkubescape/storagemodule. Per the PR description this is intentional until theNetworkNeighborschema change (ServiceRef/ServiceSelector/Entity) lands upstream — flagging it explicitly so it isn't merged accidentally while still pointing at the fork. This needs to be removed (pointing back at a releasedkubescape/storagetag) before merge.