Skip to content

Commit

Permalink
policy: Remove useless parsing of old CNP/CCNP
Browse files Browse the repository at this point in the history
Whenever we handle an update event for a CNP or a CCNP, we should not
parse again the old version of the policy, since what comes from the CNP
cache has already been parsed and sanitized when handling the previous
upsert event.

Signed-off-by: Fabio Falzoi <[email protected]>
  • Loading branch information
pippolo84 authored and christarazi committed Jan 9, 2025
1 parent c8e48b8 commit 12dd8dc
Showing 1 changed file with 1 addition and 20 deletions.
21 changes: 1 addition & 20 deletions pkg/k8s/watchers/cilium_network_policy.go
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,6 @@ package watchers

import (
"context"
"errors"
"sync/atomic"

"github.com/sirupsen/logrus"
Expand Down Expand Up @@ -362,25 +361,7 @@ func (k *K8sWatcher) deleteCiliumNetworkPolicyV2(cnp *types.SlimCNP, resourceID
func (k *K8sWatcher) updateCiliumNetworkPolicyV2(ciliumNPClient clientset.Interface,
oldRuleCpy, newRuleCpy *types.SlimCNP, initialRecvTime time.Time, resourceID ipcacheTypes.ResourceID) error {

_, err := oldRuleCpy.Parse()
if err != nil {
ns := oldRuleCpy.GetNamespace() // Disambiguates CNP & CCNP

// We want to ignore parsing errors for empty policies, otherwise the
// update to the new policy will be skipped.
switch {
case ns != "" && !errors.Is(err, cilium_v2.ErrEmptyCNP):
log.WithError(err).WithField(logfields.Object, logfields.Repr(oldRuleCpy)).
Warn("Error parsing old CiliumNetworkPolicy rule")
return err
case ns == "" && !errors.Is(err, cilium_v2.ErrEmptyCCNP):
log.WithError(err).WithField(logfields.Object, logfields.Repr(oldRuleCpy)).
Warn("Error parsing old CiliumClusterwideNetworkPolicy rule")
return err
}
}

_, err = newRuleCpy.Parse()
_, err := newRuleCpy.Parse()
if err != nil {
log.WithError(err).WithField(logfields.Object, logfields.Repr(newRuleCpy)).
Warn("Error parsing new CiliumNetworkPolicy rule")
Expand Down

0 comments on commit 12dd8dc

Please sign in to comment.