Add AdminNetworkPolicy

api/pkg/apis/projectcalico/v3/policy_common.go

@@ -1,4 +1,4 @@
-// Copyright (c) 2017-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2017-2018,2020-2021 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -34,12 +34,6 @@ const (
 // criteria within a rule must be satisfied for a packet to match. A single rule can contain
 // the positive and negative version of a match and both must be satisfied for the rule to match.
 type Rule struct {
-	// Name is an identifier for this rule, that may be no more than 100 characters
-	// in length. This field is to improve observability and readability of rules.
-	// +optional
-	// +kubebuilder:validation:MaxLength=100
-	Name string `json:"name,omitempty"`
-	// Rule's action
 	Action Action `json:"action" validate:"action"`
 	// IPVersion is an optional field that restricts the rule to only match a specific IP
 	// version.

calicoctl/tests/st/calicoctl/test_crud.py

@@ -1131,7 +1131,7 @@ def test_tier_list_order(self):
         # adminnetworkpolicy has a value of 1K, and should be second one.
         self.assertEqual(tierList['items'][0]['metadata']['name'], name(tier_name2_rev1))
         self.assertEqual(tierList['items'][1]['metadata']['name'], 'adminnetworkpolicy')
-        self.assertEqual(tierList['items'][2]['metadata']['name'], namVe(tier_name1_rev1))
+        self.assertEqual(tierList['items'][2]['metadata']['name'], name(tier_name1_rev1))
         self.assertEqual(tierList['items'][3]['metadata']['name'], 'default')
 
         # Delete the resources

felix/rules/endpoints.go

@@ -463,6 +463,13 @@ func (r *DefaultRuleRenderer) endpointIptablesChain(
 				Comment: []string{"Start of tier " + tier.Name},
 			})
 
+			// Track if any of the policies are not staged. If all of the policies in a tier are staged
+			// then the default end of tier behavior should be pass rather than drop.
+			endOfTierDrop := true
+			if tier.Name == "adminnetworkpolicy" {
+				endOfTierDrop = false
+			}
+
 			for _, polGroup := range policyGroups {
 				var chainsToJumpTo []string
 				if polGroup.ShouldBeInlined() {
@@ -505,16 +512,19 @@ func (r *DefaultRuleRenderer) endpointIptablesChain(
 			}
 
 			if chainType == chainTypeNormal || chainType == chainTypeForward {
-				// When rendering normal and forward rules, if no policy marked the packet as "pass", drop the
-				// packet.
-				//
-				// For untracked and pre-DNAT rules, we don't do that because there may be
-				// normal rules still to be applied to the packet in the filter table.
-				rules = append(rules, generictables.Rule{
-					Match:   r.NewMatch().MarkClear(r.IptablesMarkPass),
-					Action:  r.IptablesFilterDenyAction(),
-					Comment: []string{fmt.Sprintf("%s if no policies passed packet", r.IptablesFilterDenyAction())},
-				})
+				// TODO: Fix this properly
+				if endOfTierDrop {
+					// When rendering normal and forward rules, if no policy marked the packet as "pass", drop the
+					// packet.
+					//
+					// For untracked and pre-DNAT rules, we don't do that because there may be
+					// normal rules still to be applied to the packet in the filter table.
+					rules = append(rules, generictables.Rule{
+						Match:   r.NewMatch().MarkClear(r.IptablesMarkPass),
+						Action:  r.IptablesFilterDenyAction(),
+						Comment: []string{fmt.Sprintf("%s if no policies passed packet", r.IptablesFilterDenyAction())},
+					})
+				}
 			}
 		}
 	}

libcalico-go/Makefile

@@ -6,8 +6,9 @@ LOCAL_CHECKS = goimports check-gen-files
 
 KIND_CONFIG = $(KIND_DIR)/kind-single.config
 
-K8S_NET_POLICY_REPO = https://github.com/kubernetes-sigs/network-policy-api.git
-K8S_NET_POL_TAG = v0.1.5
+NETPOL_TAG = v0.1.5
+NETPOL_CRD_URL = https://raw.githubusercontent.com/kubernetes-sigs/network-policy-api/refs/tags/$(NETPOL_TAG)/config/crd/standard
+NETPOL_ANP_CRD = policy.networking.k8s.io_adminnetworkpolicies.yaml
 
 ###############################################################################
 # Download and include ../lib.Makefile
@@ -57,10 +58,7 @@ gen-crds:
 	# The first two lines are a newline and a yaml separator - remove them.
 	$(DOCKER_GO_BUILD) sh -c 'find ./config/crd -name "*.yaml" | xargs sed -i -e 1,2d'
 	# Add K8S AdminNetworkPolicy CRD
-	git clone $(K8S_NET_POLICY_REPO)
-	cd ./network-policy-api && git checkout $(K8S_NET_POL_TAG)
-	cp ./network-policy-api/config/crd/standard/policy.networking.k8s.io_adminnetworkpolicies.yaml ./config/crd
-	rm -rf ./network-policy-api
+	curl $(NETPOL_CRD_URL)/$(NETPOL_ANP_CRD) -o ./config/crd/$(NETPOL_ANP_CRD)
 
 ./lib/upgrade/migrator/clients/v1/k8s/custom/zz_generated.deepcopy.go: $(UPGRADE_SRCS)
 	$(DOCKER_GO_BUILD) sh -c 'deepcopy-gen \