Skip to content

Policy pass fixes#43589

Merged
jrajahalme merged 4 commits intocilium:mainfrom
jrajahalme:policy-pass-fixes
Jan 8, 2026
Merged

Policy pass fixes#43589
jrajahalme merged 4 commits intocilium:mainfrom
jrajahalme:policy-pass-fixes

Conversation

@jrajahalme
Copy link
Copy Markdown
Member

Address the remaining comments at #42896 that did not get to the initial merge:

  • policy: Remove panics, XXX & TODO comments
  • policy: Bump tier for egress default allow like for ingress
  • policy: Factor out ruleSlice.computeTierPriorities()
  • policy: Add precedence test with default allow

Fixes: #42896

Remove or replace panics with error logs, replace XXX & TODO comments
with more elaborate normal comments.

Signed-off-by: Jarno Rajahalme <[email protected]>
Bump tier for egress default allow rule like we do for default ingress
allow. Bump is only done if non-zero tier or priority is used in the
policy.

Signed-off-by: Jarno Rajahalme <[email protected]>
Make 'ruleSlice.resolveL4Policy()' easier to read by factoring out
'ruleSlice.computeTierPriorities()' as a separate function.

Suggested-by: Blaz Zupan <[email protected]>
Signed-off-by: Jarno Rajahalme <[email protected]>
Add test case with default allow to make sure default allow mapstate
entry is properly created.

Add "derived from" labels to the default allow rules to separate them
from explicit allow-all rules.

Signed-off-by: Jarno Rajahalme <[email protected]>
@jrajahalme jrajahalme requested review from a team as code owners January 6, 2026 18:20
@jrajahalme jrajahalme requested a review from tklauser January 6, 2026 18:20
@jrajahalme jrajahalme added kind/enhancement This would improve or streamline existing functionality. sig/policy Impacts whether traffic is allowed or denied based on user-defined policies. labels Jan 6, 2026
@maintainer-s-little-helper maintainer-s-little-helper bot added dont-merge/needs-release-note-label The author needs to describe the release impact of these changes. labels Jan 6, 2026
@jrajahalme jrajahalme added the release-note/misc This PR makes changes that have no direct user impact. label Jan 6, 2026
@maintainer-s-little-helper maintainer-s-little-helper bot removed the dont-merge/needs-release-note-label The author needs to describe the release impact of these changes. label Jan 6, 2026
@jrajahalme jrajahalme requested review from TheBeeZee and squeed and removed request for tklauser January 6, 2026 18:21
@jrajahalme
Copy link
Copy Markdown
Member Author

Assigned @squeed and @TheBeeZee as reviewers as this PR addresses their comments at #42896.

@jrajahalme
Copy link
Copy Markdown
Member Author

/test

@jrajahalme jrajahalme enabled auto-merge January 6, 2026 19:44
@jrajahalme jrajahalme added this pull request to the merge queue Jan 8, 2026
Merged via the queue into cilium:main with commit 6e7070c Jan 8, 2026
87 of 88 checks passed
@jrajahalme jrajahalme deleted the policy-pass-fixes branch January 8, 2026 13:49
@cilium-release-bot cilium-release-bot bot moved this to Released in cilium v1.19.0 Feb 3, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

kind/enhancement This would improve or streamline existing functionality. release-note/misc This PR makes changes that have no direct user impact. sig/policy Impacts whether traffic is allowed or denied based on user-defined policies.

Projects

No open projects
Status: Released

Development

Successfully merging this pull request may close these issues.

3 participants