IBM/network-config-analyzer

Extend support of IstioServiceEntry fields

shireenf-ibm opened this issue · 1 comments

shireenf-ibm commented

  • We already have an initial support of Istio ServiceEntry object (supporting its hosts field), which produces the DNSEntry peers type.
    The new peer type is used by Istio Sidecar policies to fulfill the rules and connections between external hosts (DNSEntry) and an internal peers. merged here - 1st PR

  • The basic support of ServiceEntry objects, is working with all queries and there are tests examples. 2nd PR

so far, DNS entries are exported to all namespaces and the TCP connection type to these hosts is All connections.

In this issue we want to expand the support of ServiceEntry as following:

  • add support of exportTo filed - (3rd PR)
    the idea is creating policy elements from the "exported" namespaces to the DNSEntry peers
    and adding relevant tests

  • add support of ports filed - ( 4th PR)
    update the policy elements with the ServiceEntry's ports and add relevant tests (plus updating the TCP type conns which is All Connections in first PRs to the actual ports )

  • add "complicated" tests , with multiple service-entries which has common hosts but different exportTo/ ports (- 5th PR)

zivnevo commented

Moved to NP-Guard repo. See here