diff --git a/pkg/controller/gc.go b/pkg/controller/gc.go index 9476f3549b7..3e167b43f7f 100644 --- a/pkg/controller/gc.go +++ b/pkg/controller/gc.go @@ -4,6 +4,7 @@ import ( "context" "fmt" "strings" + "unicode" "github.com/ovn-org/libovsdb/ovsdb" "github.com/scylladb/go-set/strset" @@ -602,7 +603,13 @@ func (c *Controller) gcPortGroup() error { } for _, np := range nps { - npNames.Add(fmt.Sprintf("%s/%s", np.Namespace, np.Name)) + npName := np.Name + nameArray := []rune(np.Name) + if !unicode.IsLetter(nameArray[0]) { + npName = "np" + np.Name + } + + npNames.Add(fmt.Sprintf("%s/%s", np.Namespace, npName)) } // append node port group to npNames to avoid gc node port group diff --git a/pkg/controller/network_policy.go b/pkg/controller/network_policy.go index 80b7d61a1b1..a2a9f311138 100644 --- a/pkg/controller/network_policy.go +++ b/pkg/controller/network_policy.go @@ -168,13 +168,13 @@ func (c *Controller) handleUpdateNp(key string) error { // TODO: ovn acl doesn't support address_set name with '-', now we replace '-' by '.'. // This may cause conflict if two np with name test-np and test.np. Maybe hash is a better solution, // but we do not want to lost the readability now. - pgName := strings.ReplaceAll(fmt.Sprintf("%s.%s", np.Name, np.Namespace), "-", ".") - ingressAllowAsNamePrefix := strings.ReplaceAll(fmt.Sprintf("%s.%s.ingress.allow", np.Name, np.Namespace), "-", ".") - ingressExceptAsNamePrefix := strings.ReplaceAll(fmt.Sprintf("%s.%s.ingress.except", np.Name, np.Namespace), "-", ".") - egressAllowAsNamePrefix := strings.ReplaceAll(fmt.Sprintf("%s.%s.egress.allow", np.Name, np.Namespace), "-", ".") - egressExceptAsNamePrefix := strings.ReplaceAll(fmt.Sprintf("%s.%s.egress.except", np.Name, np.Namespace), "-", ".") + pgName := strings.ReplaceAll(fmt.Sprintf("%s.%s", npName, np.Namespace), "-", ".") + ingressAllowAsNamePrefix := strings.ReplaceAll(fmt.Sprintf("%s.%s.ingress.allow", npName, np.Namespace), "-", ".") + ingressExceptAsNamePrefix := strings.ReplaceAll(fmt.Sprintf("%s.%s.ingress.except", npName, np.Namespace), "-", ".") + egressAllowAsNamePrefix := strings.ReplaceAll(fmt.Sprintf("%s.%s.egress.allow", npName, np.Namespace), "-", ".") + egressExceptAsNamePrefix := strings.ReplaceAll(fmt.Sprintf("%s.%s.egress.except", npName, np.Namespace), "-", ".") - if err = c.OVNNbClient.CreatePortGroup(pgName, map[string]string{networkPolicyKey: np.Namespace + "/" + np.Name}); err != nil { + if err = c.OVNNbClient.CreatePortGroup(pgName, map[string]string{networkPolicyKey: np.Namespace + "/" + npName}); err != nil { klog.Errorf("create port group for np %s: %v", key, err) return err } @@ -220,7 +220,7 @@ func (c *Controller) handleUpdateNp(key string) error { } if err = c.OVNNbClient.CreateAddressSet(svcAsName, map[string]string{ - networkPolicyKey: fmt.Sprintf("%s/%s/%s", np.Namespace, np.Name, "service"), + networkPolicyKey: fmt.Sprintf("%s/%s/%s", np.Namespace, npName, "service"), }); err != nil { klog.Errorf("create address set %s for np %s: %v", svcAsName, key, err) return err @@ -272,10 +272,10 @@ func (c *Controller) handleUpdateNp(key string) error { excepts = append(excepts, except...) } } - klog.Infof("UpdateNp Ingress, allows is %v, excepts is %v, log %v", allows, excepts, logEnable) + klog.Infof("UpdateNp Ingress, allows is %v, excepts is %v, log %v, protocol %v", allows, excepts, logEnable, protocol) if err = c.OVNNbClient.CreateAddressSet(ingressAllowAsName, map[string]string{ - networkPolicyKey: fmt.Sprintf("%s/%s/%s", np.Namespace, np.Name, "ingress"), + networkPolicyKey: fmt.Sprintf("%s/%s/%s", np.Namespace, npName, "ingress"), }); err != nil { klog.Errorf("create address set %s for np %s: %v", ingressAllowAsName, key, err) return err @@ -287,7 +287,7 @@ func (c *Controller) handleUpdateNp(key string) error { } if err = c.OVNNbClient.CreateAddressSet(ingressExceptAsName, map[string]string{ - networkPolicyKey: fmt.Sprintf("%s/%s/%s", np.Namespace, np.Name, "ingress"), + networkPolicyKey: fmt.Sprintf("%s/%s/%s", np.Namespace, npName, "ingress"), }); err != nil { klog.Errorf("create address set %s for np %s: %v", ingressExceptAsName, key, err) return err @@ -316,14 +316,14 @@ func (c *Controller) handleUpdateNp(key string) error { ingressExceptAsName := fmt.Sprintf("%s.%s.all", ingressExceptAsNamePrefix, protocol) if err = c.OVNNbClient.CreateAddressSet(ingressAllowAsName, map[string]string{ - networkPolicyKey: fmt.Sprintf("%s/%s/%s", np.Namespace, np.Name, "ingress"), + networkPolicyKey: fmt.Sprintf("%s/%s/%s", np.Namespace, npName, "ingress"), }); err != nil { klog.Errorf("create address set %s for np %s: %v", ingressAllowAsName, key, err) return err } if err = c.OVNNbClient.CreateAddressSet(ingressExceptAsName, map[string]string{ - networkPolicyKey: fmt.Sprintf("%s/%s/%s", np.Namespace, np.Name, "ingress"), + networkPolicyKey: fmt.Sprintf("%s/%s/%s", np.Namespace, npName, "ingress"), }); err != nil { klog.Errorf("create address set %s for np %s: %v", ingressExceptAsName, key, err) return err @@ -350,7 +350,7 @@ func (c *Controller) handleUpdateNp(key string) error { } ass, err := c.OVNNbClient.ListAddressSets(map[string]string{ - networkPolicyKey: fmt.Sprintf("%s/%s/%s", np.Namespace, np.Name, "ingress"), + networkPolicyKey: fmt.Sprintf("%s/%s/%s", np.Namespace, npName, "ingress"), }) if err != nil { klog.Errorf("list np %s address sets: %v", key, err) @@ -382,7 +382,7 @@ func (c *Controller) handleUpdateNp(key string) error { } if err := c.OVNNbClient.DeleteAddressSets(map[string]string{ - networkPolicyKey: fmt.Sprintf("%s/%s/%s", np.Namespace, np.Name, "ingress"), + networkPolicyKey: fmt.Sprintf("%s/%s/%s", np.Namespace, npName, "ingress"), }); err != nil { klog.Errorf("delete np %s ingress address set: %v", key, err) return err @@ -431,7 +431,7 @@ func (c *Controller) handleUpdateNp(key string) error { klog.Infof("UpdateNp Egress, allows is %v, excepts is %v, log %v", allows, excepts, logEnable) if err = c.OVNNbClient.CreateAddressSet(egressAllowAsName, map[string]string{ - networkPolicyKey: fmt.Sprintf("%s/%s/%s", np.Namespace, np.Name, "egress"), + networkPolicyKey: fmt.Sprintf("%s/%s/%s", np.Namespace, npName, "egress"), }); err != nil { klog.Errorf("create address set %s for np %s: %v", egressAllowAsName, key, err) return err @@ -443,7 +443,7 @@ func (c *Controller) handleUpdateNp(key string) error { } if err = c.OVNNbClient.CreateAddressSet(egressExceptAsName, map[string]string{ - networkPolicyKey: fmt.Sprintf("%s/%s/%s", np.Namespace, np.Name, "egress"), + networkPolicyKey: fmt.Sprintf("%s/%s/%s", np.Namespace, npName, "egress"), }); err != nil { klog.Errorf("create address set %s for np %s: %v", egressExceptAsName, key, err) return err @@ -469,14 +469,14 @@ func (c *Controller) handleUpdateNp(key string) error { egressExceptAsName := fmt.Sprintf("%s.%s.all", egressExceptAsNamePrefix, protocol) if err = c.OVNNbClient.CreateAddressSet(egressAllowAsName, map[string]string{ - networkPolicyKey: fmt.Sprintf("%s/%s/%s", np.Namespace, np.Name, "egress"), + networkPolicyKey: fmt.Sprintf("%s/%s/%s", np.Namespace, npName, "egress"), }); err != nil { klog.Errorf("create address set %s for np %s: %v", egressAllowAsName, key, err) return err } if err = c.OVNNbClient.CreateAddressSet(egressExceptAsName, map[string]string{ - networkPolicyKey: fmt.Sprintf("%s/%s/%s", np.Namespace, np.Name, "egress"), + networkPolicyKey: fmt.Sprintf("%s/%s/%s", np.Namespace, npName, "egress"), }); err != nil { klog.Errorf("create address set %s for np %s: %v", egressExceptAsName, key, err) return err @@ -503,7 +503,7 @@ func (c *Controller) handleUpdateNp(key string) error { } ass, err := c.OVNNbClient.ListAddressSets(map[string]string{ - networkPolicyKey: fmt.Sprintf("%s/%s/%s", np.Namespace, np.Name, "egress"), + networkPolicyKey: fmt.Sprintf("%s/%s/%s", np.Namespace, npName, "egress"), }) if err != nil { klog.Errorf("list np %s address sets: %v", key, err) @@ -536,7 +536,7 @@ func (c *Controller) handleUpdateNp(key string) error { } if err := c.OVNNbClient.DeleteAddressSets(map[string]string{ - networkPolicyKey: fmt.Sprintf("%s/%s/%s", np.Namespace, np.Name, "egress"), + networkPolicyKey: fmt.Sprintf("%s/%s/%s", np.Namespace, npName, "egress"), }); err != nil { klog.Errorf("delete np %s egress address set: %v", key, err) return err @@ -569,7 +569,7 @@ func (c *Controller) handleDeleteNp(key string) error { npName = "np" + name } - pgName := strings.ReplaceAll(fmt.Sprintf("%s.%s", name, namespace), "-", ".") + pgName := strings.ReplaceAll(fmt.Sprintf("%s.%s", npName, namespace), "-", ".") if err = c.OVNNbClient.DeletePortGroup(pgName); err != nil { klog.Errorf("delete np %s port group: %v", key, err) }