Cluster Network Policy

[aojea]

Implementation of the new v1alpha2 api for ClusterNetworkPolicy

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: aojea

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [aojea]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[aojea]

/assign @danwinship @npinaeva @bowei

I just vibe coded this in 30 mins to unblock the progress on the feature and conformance, so I sstill need to review the code too, but with the new architecture is pretty easy also to add unit tests

[aojea]

@npinaeva this does not work as it is because the controller only matches on the pods that matches a network policy, you can force that by setting admin network policy the boolean to true on the controller config

[aojea]

@npinaeva this does not work as it is because the controller only matches on the pods that matches a network policy, you can force that by setting admin network policy the boolean to true on the controller config

fixed in last commit and image. uploaded to aojea/kube-network-policies:cnp

[aojea]

pushed latest and most sure definitive version for the project structure, right now you checkout the PR and build the image with

make image-build-npa-v1alpha2
Building npa-v1alpha2 binary...
go build -o ./bin/kube-network-policies-npa-v1alpha2 ./cmd/npa-v1alpha2
docker buildx build . \
        --build-arg TARGET_BUILD=npa-v1alpha2 \
        --tag="gcr.io/k8s-staging-networking/kube-network-policies:v20250817-v0.4.0-215-g07a3817-npa-v1alpha2" \
        --load

no more flags for the same binary, now we have one binary per feature and as soon as they graduate they belong to the main binary, this is less risky and easier to iterate

[npinaeva]

tested latest version with kubernetes-sigs/network-policy-api#307 locally and it seems to work!

[npinaeva]

this code looks surprisingly good :D

[npinaeva]

shouldn't this file be under cmd/kube-network-policies/npa-v1alpha2?

[npinaeva]

I think domainResolver is only nil for unit tests, but should we log something anyway in this case?

[npinaeva]

tested again, still works!

[aojea]

/hold

wait for merging the conformance tests so we also add the ci jobs for the new apis

[aojea]

/hold cancel

I let nadia decide when she wants to merge and how :)

[npinaeva]

let's get this in, then update the CI when the new conformance is merged
/lgtm