Add AdminNetworkPolicy

Makefile

@@ -95,10 +95,12 @@ image:
 # using a local kind cluster.
 ###############################################################################
 E2E_FOCUS ?= "sig-network.*Conformance"
+ADMINPOLICY_UNSUPPORTED_FEATURES ?= "BaselineAdminNetworkPolicy"
 e2e-test:
 	$(MAKE) -C e2e build
 	$(MAKE) -C node kind-k8st-setup
-	KUBECONFIG=$(KIND_KUBECONFIG) ./e2e/bin/e2e.test -ginkgo.focus=$(E2E_FOCUS)
+	KUBECONFIG=$(KIND_KUBECONFIG) ./e2e/bin/k8s/e2e.test -ginkgo.focus=$(E2E_FOCUS)
+	KUBECONFIG=$(KIND_KUBECONFIG) ./e2e/bin/adminpolicy/e2e.test -exempt-features=$(ADMINPOLICY_UNSUPPORTED_FEATURES)
 
 ###############################################################################
 # Release logic below

api/pkg/apis/projectcalico/v3/tier.go

@@ -37,7 +37,8 @@ type Tier struct {
 }
 
 const (
-	DefaultTierOrder = float64(1_000_000) // 1 Million
+	DefaultTierOrder            = float64(1_000_000) // 1Million
+	AdminNetworkPolicyTierOrder = float64(1_000)     // 1K
 )
 
 // TierSpec contains the specification for a security policy tier resource.

apiserver/pkg/storage/calico/policy_storage.go

@@ -14,9 +14,9 @@ import (
 
 	v3 "github.com/projectcalico/api/pkg/apis/projectcalico/v3"
 
-	"github.com/projectcalico/calico/libcalico-go/lib/backend/k8s/conversion"
 	"github.com/projectcalico/calico/libcalico-go/lib/clientv3"
 	cerrors "github.com/projectcalico/calico/libcalico-go/lib/errors"
+	"github.com/projectcalico/calico/libcalico-go/lib/names"
 	"github.com/projectcalico/calico/libcalico-go/lib/options"
 	"github.com/projectcalico/calico/libcalico-go/lib/watch"
 )
@@ -27,7 +27,7 @@ func NewNetworkPolicyStorage(opts Options) (registry.DryRunnableStorage, factory
 	createFn := func(ctx context.Context, c clientv3.Interface, obj resourceObject, opts clientOpts) (resourceObject, error) {
 		oso := opts.(options.SetOptions)
 		res := obj.(*v3.NetworkPolicy)
-		if strings.HasPrefix(res.Name, conversion.K8sNetworkPolicyNamePrefix) {
+		if strings.HasPrefix(res.Name, names.K8sNetworkPolicyNamePrefix) {
 			return nil, cerrors.ErrorOperationNotSupported{
 				Operation:  "create or apply",
 				Identifier: obj,
@@ -39,7 +39,7 @@ func NewNetworkPolicyStorage(opts Options) (registry.DryRunnableStorage, factory
 	updateFn := func(ctx context.Context, c clientv3.Interface, obj resourceObject, opts clientOpts) (resourceObject, error) {
 		oso := opts.(options.SetOptions)
 		res := obj.(*v3.NetworkPolicy)
-		if strings.HasPrefix(res.Name, conversion.K8sNetworkPolicyNamePrefix) {
+		if strings.HasPrefix(res.Name, names.K8sNetworkPolicyNamePrefix) {
 			return nil, cerrors.ErrorOperationNotSupported{
 				Operation:  "update or apply",
 				Identifier: obj,
@@ -54,7 +54,7 @@ func NewNetworkPolicyStorage(opts Options) (registry.DryRunnableStorage, factory
 	}
 	deleteFn := func(ctx context.Context, c clientv3.Interface, ns string, name string, opts clientOpts) (resourceObject, error) {
 		odo := opts.(options.DeleteOptions)
-		if strings.HasPrefix(name, conversion.K8sNetworkPolicyNamePrefix) {
+		if strings.HasPrefix(name, names.K8sNetworkPolicyNamePrefix) {
 			return nil, cerrors.ErrorOperationNotSupported{
 				Operation:  "delete",
 				Identifier: name,

apiserver/pkg/storage/calico/tier_storage_test.go

@@ -29,6 +29,7 @@ import (
 
 	"github.com/projectcalico/calico/libcalico-go/lib/apiconfig"
 	"github.com/projectcalico/calico/libcalico-go/lib/clientv3"
+	"github.com/projectcalico/calico/libcalico-go/lib/names"
 	"github.com/projectcalico/calico/libcalico-go/lib/options"
 
 	v3 "github.com/projectcalico/api/pkg/apis/projectcalico/v3"
@@ -522,13 +523,19 @@ func TestTierList(t *testing.T) {
 		}
 	}
 
-	defaultTier := makeTier("", "", v3.DefaultTierOrder)
 	opts := storage.GetOptions{IgnoreNotFound: false}
+	defaultTier := makeTier(names.DefaultTierName, "", v3.DefaultTierOrder)
 	err := store.Get(ctx, "projectcalico.org/tiers/default", opts, defaultTier)
 	if err != nil {
 		t.Fatalf("Get failed: %v", err)
 	}
 
+	anpTier := makeTier(names.AdminNetworkPolicyTierName, "", v3.AdminNetworkPolicyTierOrder)
+	err = store.Get(ctx, "projectcalico.org/tiers/adminnetworkpolicy", opts, anpTier)
+	if err != nil {
+		t.Fatalf("Get failed: %v", err)
+	}
+
 	tests := []struct {
 		prefix      string
 		pred        storage.SelectionPredicate
@@ -547,7 +554,7 @@ func TestTierList(t *testing.T) {
 				return nil, fields.Set{"metadata.name": tier.Name}, nil
 			},
 		},
-		expectedOut: []*v3.Tier{preset[1].storedObj, defaultTier},
+		expectedOut: []*v3.Tier{anpTier, preset[1].storedObj, defaultTier},
 	}}
 
 	for i, tt := range tests {

calicoctl/calicoctl/commands/convert.go

@@ -32,6 +32,7 @@ import (
 	"github.com/projectcalico/calico/calicoctl/calicoctl/commands/resourceloader"
 	"github.com/projectcalico/calico/calicoctl/calicoctl/util"
 	"github.com/projectcalico/calico/libcalico-go/lib/apis/v1/unversioned"
+	"github.com/projectcalico/calico/libcalico-go/lib/names"
 
 	cconversion "github.com/projectcalico/calico/libcalico-go/lib/backend/k8s/conversion"
 	"github.com/projectcalico/calico/libcalico-go/lib/upgrade/converters"
@@ -217,10 +218,8 @@ func convertK8sResource(convResource unversioned.Resource) (converters.Resource,
 
 		// Trim K8sNetworkPolicyNamePrefix from the policy name (the K8sNetworkPolicyToCalico
 		// function adds it for when it is used for coexisting calico/k8s policies).
-		k8snp.Name = strings.TrimPrefix(k8snp.Name, cconversion.K8sNetworkPolicyNamePrefix)
-
+		k8snp.Name = strings.TrimPrefix(k8snp.Name, names.K8sNetworkPolicyNamePrefix)
 		res = k8snp
-
 	default:
 		return nil, fmt.Errorf("conversion for the k8s resource type '%s' is not supported", k8sResKind)
 	}

calicoctl/calicoctl/commands/datastore/migrate/export.go

@@ -1,4 +1,4 @@
-// Copyright (c) 2020-2021 Tigera, Inc. All rights reserved.
+// Copyright (c) 2020-2024 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -36,7 +36,7 @@ import (
 	"github.com/projectcalico/calico/calicoctl/calicoctl/util"
 	"github.com/projectcalico/calico/libcalico-go/lib/apiconfig"
 	libapiv3 "github.com/projectcalico/calico/libcalico-go/lib/apis/v3"
-	"github.com/projectcalico/calico/libcalico-go/lib/backend/k8s/conversion"
+	"github.com/projectcalico/calico/libcalico-go/lib/names"
 )
 
 var title = cases.Title(language.English)
@@ -221,7 +221,7 @@ Description:
 					if !ok {
 						return fmt.Errorf("Unable to convert Calico network policy for inspection")
 					}
-					if !strings.HasPrefix(metaObj.GetObjectMeta().GetName(), conversion.K8sNetworkPolicyNamePrefix) {
+					if !strings.HasPrefix(metaObj.GetObjectMeta().GetName(), names.K8sNetworkPolicyNamePrefix) {
 						filtered = append(filtered, obj)
 					}
 				}
@@ -233,6 +233,31 @@ Description:
 				results.Resources[i] = resource
 			}
 
+			// Skip exporting Kubernetes admin network policies.
+			if r == "globalnetworkpolicies" {
+				objs, err := meta.ExtractList(resource)
+				if err != nil {
+					return fmt.Errorf("Error extracting global network policies for inspection before exporting: %s", err)
+				}
+
+				filtered := []runtime.Object{}
+				for _, obj := range objs {
+					metaObj, ok := obj.(v1.ObjectMetaAccessor)
+					if !ok {
+						return fmt.Errorf("Unable to convert Calico gloabal network policy for inspection")
+					}
+					if !strings.HasPrefix(metaObj.GetObjectMeta().GetName(), names.K8sAdminNetworkPolicyNamePrefix) {
+						filtered = append(filtered, obj)
+					}
+				}
+
+				err = meta.SetList(resource, filtered)
+				if err != nil {
+					return fmt.Errorf("Unable to remove Kubernetes admin network policies for export: %s", err)
+				}
+				results.Resources[i] = resource
+			}
+
 			// Nodes need to also be modified to move the Orchestrator reference to the name field.
 			if r == "nodes" {
 				err := meta.EachListItem(resource, func(obj runtime.Object) error {

calicoctl/calicoctl/commands/datastore/migrate/import.go

@@ -1,4 +1,4 @@
-// Copyright (c) 2020-2021 Tigera, Inc. All rights reserved.
+// Copyright (c) 2020-2024 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -40,10 +40,10 @@ import (
 	"github.com/projectcalico/calico/libcalico-go/lib/apiconfig"
 	libapiv3 "github.com/projectcalico/calico/libcalico-go/lib/apis/v3"
 	"github.com/projectcalico/calico/libcalico-go/lib/backend/k8s"
-	"github.com/projectcalico/calico/libcalico-go/lib/backend/k8s/conversion"
 	"github.com/projectcalico/calico/libcalico-go/lib/backend/model"
 	client "github.com/projectcalico/calico/libcalico-go/lib/clientv3"
 	calicoErrors "github.com/projectcalico/calico/libcalico-go/lib/errors"
+	"github.com/projectcalico/calico/libcalico-go/lib/names"
 	"github.com/projectcalico/calico/libcalico-go/lib/options"
 )
 
@@ -246,7 +246,25 @@ func checkCalicoResourcesNotExist(args map[string]interface{}, c client.Interfac
 						}
 
 						// Make sure that the network policy is a K8s network policy
-						if !strings.HasPrefix(metaObj.GetObjectMeta().GetName(), conversion.K8sNetworkPolicyNamePrefix) {
+						if !strings.HasPrefix(metaObj.GetObjectMeta().GetName(), names.K8sNetworkPolicyNamePrefix) {
+							return fmt.Errorf("Found existing Calico %s resource", results.SingleKind)
+						}
+					}
+				} else if r == "globalnetworkpolicies" {
+					// For globalnetworkpolicies, having K8s admin network policies should not throw an error
+					objs, err := meta.ExtractList(resource)
+					if err != nil {
+						return fmt.Errorf("Error extracting global network policies for inspection: %s", err)
+					}
+
+					for _, obj := range objs {
+						metaObj, ok := obj.(v1.ObjectMetaAccessor)
+						if !ok {
+							return fmt.Errorf("Unable to convert Calico global network policy for inspection")
+						}
+
+						// Make sure that the global network policy is a K8s admin network policy
+						if !strings.HasPrefix(metaObj.GetObjectMeta().GetName(), names.K8sAdminNetworkPolicyNamePrefix) {
 							return fmt.Errorf("Found existing Calico %s resource", results.SingleKind)
 						}
 					}

calicoctl/calicoctl/resourcemgr/globalnetworkpolicy.go

@@ -16,12 +16,15 @@ package resourcemgr
 
 import (
 	"context"
+	"strings"
 
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
 	api "github.com/projectcalico/api/pkg/apis/projectcalico/v3"
 
 	client "github.com/projectcalico/calico/libcalico-go/lib/clientv3"
+	cerrors "github.com/projectcalico/calico/libcalico-go/lib/errors"
+	"github.com/projectcalico/calico/libcalico-go/lib/names"
 	"github.com/projectcalico/calico/libcalico-go/lib/options"
 )
 
@@ -41,14 +44,35 @@ func init() {
 		},
 		func(ctx context.Context, client client.Interface, resource ResourceObject) (ResourceObject, error) {
 			r := resource.(*api.GlobalNetworkPolicy)
+			if strings.HasPrefix(r.Name, names.K8sAdminNetworkPolicyNamePrefix) {
+				return nil, cerrors.ErrorOperationNotSupported{
+					Operation:  "create or apply",
+					Identifier: resource,
+					Reason:     "kubernetes admin network policies must be managed through the kubernetes API",
+				}
+			}
 			return client.GlobalNetworkPolicies().Create(ctx, r, options.SetOptions{})
 		},
 		func(ctx context.Context, client client.Interface, resource ResourceObject) (ResourceObject, error) {
 			r := resource.(*api.GlobalNetworkPolicy)
+			if strings.HasPrefix(r.Name, names.K8sAdminNetworkPolicyNamePrefix) {
+				return nil, cerrors.ErrorOperationNotSupported{
+					Operation:  "create or apply",
+					Identifier: resource,
+					Reason:     "kubernetes admin network policies must be managed through the kubernetes API",
+				}
+			}
 			return client.GlobalNetworkPolicies().Update(ctx, r, options.SetOptions{})
 		},
 		func(ctx context.Context, client client.Interface, resource ResourceObject) (ResourceObject, error) {
 			r := resource.(*api.GlobalNetworkPolicy)
+			if strings.HasPrefix(r.Name, names.K8sAdminNetworkPolicyNamePrefix) {
+				return nil, cerrors.ErrorOperationNotSupported{
+					Operation:  "create or apply",
+					Identifier: resource,
+					Reason:     "kubernetes admin network policies must be managed through the kubernetes API",
+				}
+			}
 			return client.GlobalNetworkPolicies().Delete(ctx, r.Name, options.DeleteOptions{ResourceVersion: r.ResourceVersion})
 		},
 		func(ctx context.Context, client client.Interface, resource ResourceObject) (ResourceObject, error) {

calicoctl/calicoctl/resourcemgr/networkpolicy.go

@@ -21,9 +21,9 @@ import (
 	api "github.com/projectcalico/api/pkg/apis/projectcalico/v3"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
-	"github.com/projectcalico/calico/libcalico-go/lib/backend/k8s/conversion"
 	client "github.com/projectcalico/calico/libcalico-go/lib/clientv3"
 	cerrors "github.com/projectcalico/calico/libcalico-go/lib/errors"
+	"github.com/projectcalico/calico/libcalico-go/lib/names"
 	"github.com/projectcalico/calico/libcalico-go/lib/options"
 )
 
@@ -45,7 +45,7 @@ func init() {
 		},
 		func(ctx context.Context, client client.Interface, resource ResourceObject) (ResourceObject, error) {
 			r := resource.(*api.NetworkPolicy)
-			if strings.HasPrefix(r.Name, conversion.K8sNetworkPolicyNamePrefix) {
+			if strings.HasPrefix(r.Name, names.K8sNetworkPolicyNamePrefix) {
 				return nil, cerrors.ErrorOperationNotSupported{
 					Operation:  "create or apply",
 					Identifier: resource,
@@ -56,7 +56,7 @@ func init() {
 		},
 		func(ctx context.Context, client client.Interface, resource ResourceObject) (ResourceObject, error) {
 			r := resource.(*api.NetworkPolicy)
-			if strings.HasPrefix(r.Name, conversion.K8sNetworkPolicyNamePrefix) {
+			if strings.HasPrefix(r.Name, names.K8sNetworkPolicyNamePrefix) {
 				return nil, cerrors.ErrorOperationNotSupported{
 					Operation:  "apply or replace",
 					Identifier: resource,
@@ -67,7 +67,7 @@ func init() {
 		},
 		func(ctx context.Context, client client.Interface, resource ResourceObject) (ResourceObject, error) {
 			r := resource.(*api.NetworkPolicy)
-			if strings.HasPrefix(r.Name, conversion.K8sNetworkPolicyNamePrefix) {
+			if strings.HasPrefix(r.Name, names.K8sNetworkPolicyNamePrefix) {
 				return nil, cerrors.ErrorOperationNotSupported{
 					Operation:  "delete",
 					Identifier: resource,

calicoctl/tests/st/calicoctl/test_crud.py

@@ -1127,10 +1127,12 @@ def test_tier_list_order(self):
         rc.assert_no_error()
         tierList = rc.decoded
 
-        # Validate the tiers are ordered correctly. Default should have a value of nil and should be placed last.
+        # Validate the tiers are ordered correctly. Default should have a value of 1M and should be placed last.
+        # adminnetworkpolicy has a value of 1K, and should be second one.
         self.assertEqual(tierList['items'][0]['metadata']['name'], name(tier_name2_rev1))
-        self.assertEqual(tierList['items'][1]['metadata']['name'], name(tier_name1_rev1))
-        self.assertEqual(tierList['items'][2]['metadata']['name'], 'default')
+        self.assertEqual(tierList['items'][1]['metadata']['name'], 'adminnetworkpolicy')
+        self.assertEqual(tierList['items'][2]['metadata']['name'], name(tier_name1_rev1))
+        self.assertEqual(tierList['items'][3]['metadata']['name'], 'default')
 
         # Delete the resources
         rc = calicoctl("delete", data=resources)

calicoctl/tests/st/utils/data.py

@@ -336,7 +336,7 @@
         'name': 'admin',
     },
     'spec': {
-        'Order': 1000,
+        'Order': 10000,
     },
 }
 

charts/calico/templates/calico-node-rbac.yaml

@@ -68,6 +68,13 @@ rules:
     verbs:
       - watch
       - list
+  # Watch for changes to Kubernetes AdminNetworkPolicies.
+  - apiGroups: ["policy.networking.k8s.io"]
+    resources:
+      - adminnetworkpolicies
+    verbs:
+      - watch
+      - list
   # Used by Calico for policy information.
   - apiGroups: [""]
     resources:

e2e/Makefile

@@ -3,10 +3,14 @@ include ../metadata.mk
 PACKAGE_NAME=github.com/projectcalico/calico/e2e
 include ../lib.Makefile
 
-build: bin/e2e.test
-bin/e2e.test: $(SRC_FILES)
+build: bin/k8s/e2e.test bin/adminpolicy/e2e.test
+bin/k8s/e2e.test: $(SRC_FILES)
 	mkdir -p bin
-	$(DOCKER_RUN) $(CALICO_BUILD) go test ./cmd -c -o $@
+	$(DOCKER_RUN) $(CALICO_BUILD) go test ./cmd/k8s -c -o $@
+
+bin/adminpolicy/e2e.test: $(SRC_FILES)
+	mkdir -p bin
+	$(DOCKER_RUN) $(CALICO_BUILD) go test ./cmd/adminpolicy -c -o $@
 
 clean:
 	rm -rf bin/