From cbac9c791177c0f810a783ddcf828fb3fbd63ef8 Mon Sep 17 00:00:00 2001 From: Siva Subramanian Date: Mon, 10 Aug 2026 10:34:53 +0200 Subject: [PATCH] fix: replace projectcalico.org/name with kubernetes.io/metadata.name in NetworkPolicies Replace all uses of the projectcalico.org/name label with the built-in kubernetes.io/metadata.name label in operator-managed NetworkPolicy namespace selectors (both Calico v3 and Kubernetes NetworkPolicies). On platforms where the Calico namespace controller is not enabled (e.g., EKS with AmazonVPC CNI), the projectcalico.org/name label is never applied to namespaces, causing NetworkPolicy rules that reference it to never match. This breaks DNS resolution for operator components like Whisker and Goldmane. The kubernetes.io/metadata.name label is automatically applied by Kubernetes to all namespaces since v1.21 and requires no controller. Fixes #4624 --- .../policyrecommendation_controller.go | 4 ++-- .../policyrecommendation_controller_test.go | 4 ++-- .../common/networkpolicy/networkpolicy.go | 12 +++++------ pkg/render/common/selector/label.go | 2 +- pkg/render/intrusion_detection.go | 2 +- pkg/render/intrusion_detection_test.go | 4 ++-- pkg/render/logcollector/fluentbit_test.go | 2 +- pkg/render/logcollector/networkpolicy.go | 6 +++--- pkg/render/logstorage.go | 4 ++-- pkg/render/logstorage/esgateway/esgateway.go | 2 +- pkg/render/logstorage/linseed/linseed.go | 2 +- .../expected_policies/alertmanager-mesh.json | 2 +- .../alertmanager-mesh_ocp.json | 4 ++-- .../expected_policies/alertmanager.json | 2 +- .../expected_policies/alertmanager_ocp.json | 4 ++-- .../expected_policies/apiserver.json | 8 ++++---- .../expected_policies/apiserver_ocp.json | 10 +++++----- .../expected_policies/dashboards.json | 4 ++-- .../expected_policies/dashboards_ocp.json | 6 +++--- .../testutils/expected_policies/dex.json | 10 +++++----- .../testutils/expected_policies/dex_ocp.json | 12 +++++------ .../expected_policies/elastic-operator.json | 4 ++-- .../elastic-operator_ocp.json | 6 +++--- .../elasticsearch-internal.json | 2 +- .../expected_policies/elasticsearch.json | 16 +++++++-------- .../expected_policies/elasticsearch_ocp.json | 18 ++++++++--------- .../expected_policies/es-gateway.json | 18 ++++++++--------- .../expected_policies/es-gateway_ocp.json | 20 +++++++++---------- .../expected_policies/es-kubecontrollers.json | 6 +++--- .../es-kubecontrollers_ocp.json | 8 ++++---- .../expected_policies/es-metrics.json | 4 ++-- .../expected_policies/es-metrics_ocp.json | 6 +++--- .../expected_policies/fluentbit_managed.json | 2 +- .../fluentbit_unmanaged.json | 6 +++--- .../fluentbit_unmanaged_ocp.json | 8 ++++---- .../testutils/expected_policies/guardian.json | 10 +++++----- .../expected_policies/guardian_ocp.json | 12 +++++------ ...ntrusion-detection-controller_managed.json | 4 ++-- ...sion-detection-controller_managed_ocp.json | 6 +++--- ...usion-detection-controller_management.json | 6 +++--- ...n-detection-controller_management_ocp.json | 8 ++++---- ...usion-detection-controller_standalone.json | 4 ++-- ...n-detection-controller_standalone_ocp.json | 6 +++--- .../intrusion-detection-elastic.json | 4 ++-- .../intrusion-detection-elastic_ocp.json | 6 +++--- .../testutils/expected_policies/kibana.json | 12 +++++------ .../expected_policies/kibana_ocp.json | 14 ++++++------- .../expected_policies/kubecontrollers.json | 4 ++-- .../kubecontrollers_managed.json | 4 ++-- .../kubecontrollers_managed_ocp.json | 6 +++--- .../kubecontrollers_ocp.json | 6 +++--- .../testutils/expected_policies/linseed.json | 18 ++++++++--------- .../linseed_dpi_enabled.json | 18 ++++++++--------- .../expected_policies/linseed_ocp.json | 20 +++++++++---------- .../linseed_ocp_dpi_enabled.json | 20 +++++++++---------- .../testutils/expected_policies/manager.json | 14 ++++++------- .../expected_policies/manager_ocp.json | 16 +++++++-------- .../expected_policies/packetcapture.json | 6 +++--- .../packetcapture_managed.json | 4 ++-- .../packetcapture_managed_ocp.json | 6 +++--- .../expected_policies/packetcapture_ocp.json | 8 ++++---- .../policyrecommendation.json | 6 +++--- .../policyrecommendation_ocp.json | 8 ++++---- .../expected_policies/prometheus-api.json | 4 ++-- .../expected_policies/prometheus-api_ocp.json | 6 +++--- .../prometheus-operator.json | 2 +- .../prometheus-operator_ocp.json | 4 ++-- .../expected_policies/prometheus.json | 4 ++-- .../expected_policies/prometheus_ocp.json | 6 +++--- 69 files changed, 256 insertions(+), 256 deletions(-) diff --git a/pkg/controller/policyrecommendation/policyrecommendation_controller.go b/pkg/controller/policyrecommendation/policyrecommendation_controller.go index 3fdd36a259..71aeaff041 100644 --- a/pkg/controller/policyrecommendation/policyrecommendation_controller.go +++ b/pkg/controller/policyrecommendation/policyrecommendation_controller.go @@ -540,10 +540,10 @@ func (r *ReconcilePolicyRecommendation) createDefaultPolicyRecommendationScope(c prs.Name = "default" prs.Spec.NamespaceSpec = &v3.PolicyRecommendationScopeNamespaceSpec{ RecStatus: "Disabled", - Selector: "!(projectcalico.org/name starts with 'tigera-') && !(projectcalico.org/name starts with 'calico-') && !(projectcalico.org/name starts with 'kube-')", + Selector: "!(kubernetes.io/metadata.name starts with 'tigera-') && !(kubernetes.io/metadata.name starts with 'calico-') && !(kubernetes.io/metadata.name starts with 'kube-')", } if r.opts.DetectedProvider.IsOpenShift() { - prs.Spec.NamespaceSpec.Selector += " && !(projectcalico.org/name starts with 'openshift-')" + prs.Spec.NamespaceSpec.Selector += " && !(kubernetes.io/metadata.name starts with 'openshift-')" } if err := r.client.Create(ctx, prs); err != nil { diff --git a/pkg/controller/policyrecommendation/policyrecommendation_controller_test.go b/pkg/controller/policyrecommendation/policyrecommendation_controller_test.go index a35ed687f0..b6d52e86d3 100644 --- a/pkg/controller/policyrecommendation/policyrecommendation_controller_test.go +++ b/pkg/controller/policyrecommendation/policyrecommendation_controller_test.go @@ -545,7 +545,7 @@ var _ = Describe("PolicyRecommendation controller tests", func() { // Verify the values of the created PolicyRecommendationScope object. Expect(prs.Spec.NamespaceSpec.RecStatus).To(Equal(v3.PolicyRecommendationDisabled)) - Expect(prs.Spec.NamespaceSpec.Selector).To(Equal("!(projectcalico.org/name starts with 'tigera-') && !(projectcalico.org/name starts with 'calico-') && !(projectcalico.org/name starts with 'kube-')")) + Expect(prs.Spec.NamespaceSpec.Selector).To(Equal("!(kubernetes.io/metadata.name starts with 'tigera-') && !(kubernetes.io/metadata.name starts with 'calico-') && !(kubernetes.io/metadata.name starts with 'kube-')")) }) It("should create default PolicyRecommendationScope for openshift", func() { @@ -584,7 +584,7 @@ var _ = Describe("PolicyRecommendation controller tests", func() { // Verify the values of the created PolicyRecommendationScope object. Expect(prs.Spec.NamespaceSpec.RecStatus).To(Equal(v3.PolicyRecommendationDisabled)) - Expect(prs.Spec.NamespaceSpec.Selector).To(Equal("!(projectcalico.org/name starts with 'tigera-') && !(projectcalico.org/name starts with 'calico-') && !(projectcalico.org/name starts with 'kube-') && !(projectcalico.org/name starts with 'openshift-')")) + Expect(prs.Spec.NamespaceSpec.Selector).To(Equal("!(kubernetes.io/metadata.name starts with 'tigera-') && !(kubernetes.io/metadata.name starts with 'calico-') && !(kubernetes.io/metadata.name starts with 'kube-') && !(kubernetes.io/metadata.name starts with 'openshift-')")) }) }) }) diff --git a/pkg/render/common/networkpolicy/networkpolicy.go b/pkg/render/common/networkpolicy/networkpolicy.go index 733b1b5b2b..d065e60fb7 100644 --- a/pkg/render/common/networkpolicy/networkpolicy.go +++ b/pkg/render/common/networkpolicy/networkpolicy.go @@ -49,7 +49,7 @@ func AppendDNSEgressRules(egressRules []v3.Rule, openShift bool) []v3.Rule { Action: v3.Allow, Protocol: &UDPProtocol, Destination: v3.EntityRule{ - NamespaceSelector: "projectcalico.org/name == 'openshift-dns'", + NamespaceSelector: "kubernetes.io/metadata.name == 'openshift-dns'", Selector: "dns.operator.openshift.io/daemonset-dns == 'default'", Ports: Ports(5353), }, @@ -58,7 +58,7 @@ func AppendDNSEgressRules(egressRules []v3.Rule, openShift bool) []v3.Rule { Action: v3.Allow, Protocol: &TCPProtocol, Destination: v3.EntityRule{ - NamespaceSelector: "projectcalico.org/name == 'openshift-dns'", + NamespaceSelector: "kubernetes.io/metadata.name == 'openshift-dns'", Selector: "dns.operator.openshift.io/daemonset-dns == 'default'", Ports: Ports(5353), }, @@ -69,7 +69,7 @@ func AppendDNSEgressRules(egressRules []v3.Rule, openShift bool) []v3.Rule { Action: v3.Allow, Protocol: &UDPProtocol, Destination: v3.EntityRule{ - NamespaceSelector: "projectcalico.org/name == 'kube-system'", + NamespaceSelector: "kubernetes.io/metadata.name == 'kube-system'", // In most Kubernetes distros the label is for kube-dns, but in Canonical it is for coredns. Selector: "k8s-app in { 'kube-dns', 'coredns' }", Ports: Ports(53), @@ -83,7 +83,7 @@ func AppendDNSEgressRules(egressRules []v3.Rule, openShift bool) []v3.Rule { // CreateEntityRule creates an entity rule that matches traffic using label selectors based on namespace, deployment name, and port. func CreateEntityRule(namespace string, deploymentName string, ports ...uint16) v3.EntityRule { return v3.EntityRule{ - NamespaceSelector: fmt.Sprintf("projectcalico.org/name == '%s'", namespace), + NamespaceSelector: fmt.Sprintf("kubernetes.io/metadata.name == '%s'", namespace), Selector: fmt.Sprintf("k8s-app == '%s'", deploymentName), Ports: Ports(ports...), } @@ -93,7 +93,7 @@ func CreateEntityRule(namespace string, deploymentName string, ports ...uint16) func CreateSourceEntityRule(namespace string, deploymentName string) v3.EntityRule { return v3.EntityRule{ Selector: fmt.Sprintf("k8s-app == '%s'", deploymentName), - NamespaceSelector: fmt.Sprintf("projectcalico.org/name == '%s'", namespace), + NamespaceSelector: fmt.Sprintf("kubernetes.io/metadata.name == '%s'", namespace), } } @@ -320,7 +320,7 @@ func DeprecatedAllowTigeraNetworkPolicyObject(name, namespace string) client.Obj const PrometheusSelector = "k8s-app == 'tigera-prometheus'" var PrometheusEntityRule = v3.EntityRule{ - NamespaceSelector: "projectcalico.org/name == 'tigera-prometheus'", + NamespaceSelector: "kubernetes.io/metadata.name == 'tigera-prometheus'", Selector: PrometheusSelector, Ports: Ports(9095), } diff --git a/pkg/render/common/selector/label.go b/pkg/render/common/selector/label.go index def0b3569f..962e3a7888 100644 --- a/pkg/render/common/selector/label.go +++ b/pkg/render/common/selector/label.go @@ -19,7 +19,7 @@ import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" const ( OpenShiftDNSDaemonsetLabel = "dns.operator.openshift.io/daemonset-dns" K8sNameLabel = "app.kubernetes.io/name" - CalicoNameLabel = "projectcalico.org/name" + CalicoNameLabel = "kubernetes.io/metadata.name" ) func PodLabelSelector(name string) *metav1.LabelSelector { diff --git a/pkg/render/intrusion_detection.go b/pkg/render/intrusion_detection.go index bf6bdaaabd..dd530d1fd8 100644 --- a/pkg/render/intrusion_detection.go +++ b/pkg/render/intrusion_detection.go @@ -73,7 +73,7 @@ const ( // Register secret/certs that need Server and Client Key usage var ( - intrusionDetectionNamespaceSelector = fmt.Sprintf("projectcalico.org/name == '%s'", IntrusionDetectionNamespace) + intrusionDetectionNamespaceSelector = fmt.Sprintf("kubernetes.io/metadata.name == '%s'", IntrusionDetectionNamespace) IntrusionDetectionSourceEntityRule = v3.EntityRule{ NamespaceSelector: intrusionDetectionNamespaceSelector, Selector: fmt.Sprintf("k8s-app == '%s'", IntrusionDetectionControllerName), diff --git a/pkg/render/intrusion_detection_test.go b/pkg/render/intrusion_detection_test.go index 117d5a9eae..9be10b1f81 100644 --- a/pkg/render/intrusion_detection_test.go +++ b/pkg/render/intrusion_detection_test.go @@ -745,7 +745,7 @@ var _ = Describe("Intrusion Detection rendering tests", func() { Action: v3.Allow, Protocol: &networkpolicy.UDPProtocol, Destination: v3.EntityRule{ - NamespaceSelector: "projectcalico.org/name == 'kube-system'", + NamespaceSelector: "kubernetes.io/metadata.name == 'kube-system'", Selector: "k8s-app in { 'kube-dns', 'coredns' }", Ports: networkpolicy.Ports(53), }, @@ -759,7 +759,7 @@ var _ = Describe("Intrusion Detection rendering tests", func() { Action: v3.Allow, Protocol: &networkpolicy.TCPProtocol, Destination: v3.EntityRule{ - NamespaceSelector: fmt.Sprintf("projectcalico.org/name == '%s'", tenantANamespace), + NamespaceSelector: fmt.Sprintf("kubernetes.io/metadata.name == '%s'", tenantANamespace), Selector: "k8s-app == 'calico-manager'", Ports: networkpolicy.Ports(9443), }, diff --git a/pkg/render/logcollector/fluentbit_test.go b/pkg/render/logcollector/fluentbit_test.go index c3d2f775f1..f8b28609e9 100644 --- a/pkg/render/logcollector/fluentbit_test.go +++ b/pkg/render/logcollector/fluentbit_test.go @@ -1387,7 +1387,7 @@ var _ = Describe("Tigera Secure Fluent Bit rendering tests", func() { Protocol: &networkpolicy.TCPProtocol, Source: v3.EntityRule{ Selector: fmt.Sprintf("k8s-app == '%s'", render.ManagerDeploymentName), - NamespaceSelector: fmt.Sprintf("projectcalico.org/name == '%s'", render.ManagerNamespace), + NamespaceSelector: fmt.Sprintf("kubernetes.io/metadata.name == '%s'", render.ManagerNamespace), }, Destination: v3.EntityRule{ Ports: networkpolicy.Ports(logcollector.FluentBitInputPort), diff --git a/pkg/render/logcollector/networkpolicy.go b/pkg/render/logcollector/networkpolicy.go index a4ea51b83a..48db98f2c7 100644 --- a/pkg/render/logcollector/networkpolicy.go +++ b/pkg/render/logcollector/networkpolicy.go @@ -150,7 +150,7 @@ func (c *fluentBitComponent) calicoSystemPolicy() *v3.NetworkPolicy { Protocol: &networkpolicy.TCPProtocol, Source: v3.EntityRule{}, Destination: v3.EntityRule{ - NamespaceSelector: fmt.Sprintf("projectcalico.org/name == '%s'", render.GuardianNamespace), + NamespaceSelector: fmt.Sprintf("kubernetes.io/metadata.name == '%s'", render.GuardianNamespace), Selector: networkpolicy.KubernetesAppSelector(render.GuardianServiceName), NotPorts: networkpolicy.Ports(8080), }, @@ -161,7 +161,7 @@ func (c *fluentBitComponent) calicoSystemPolicy() *v3.NetworkPolicy { Protocol: &networkpolicy.TCPProtocol, Source: v3.EntityRule{}, Destination: v3.EntityRule{ - NamespaceSelector: fmt.Sprintf("projectcalico.org/name == '%s'", render.ElasticsearchNamespace), + NamespaceSelector: fmt.Sprintf("kubernetes.io/metadata.name == '%s'", render.ElasticsearchNamespace), Selector: networkpolicy.KubernetesAppSelector("tigera-secure-es-gateway"), NotPorts: networkpolicy.Ports(5554), }, @@ -171,7 +171,7 @@ func (c *fluentBitComponent) calicoSystemPolicy() *v3.NetworkPolicy { Protocol: &networkpolicy.TCPProtocol, Source: v3.EntityRule{}, Destination: v3.EntityRule{ - NamespaceSelector: fmt.Sprintf("projectcalico.org/name == '%s'", render.ElasticsearchNamespace), + NamespaceSelector: fmt.Sprintf("kubernetes.io/metadata.name == '%s'", render.ElasticsearchNamespace), Selector: networkpolicy.KubernetesAppSelector("tigera-linseed"), NotPorts: networkpolicy.Ports(8444), }, diff --git a/pkg/render/logstorage.go b/pkg/render/logstorage.go index 055b5f8770..7cbc9bf9a8 100644 --- a/pkg/render/logstorage.go +++ b/pkg/render/logstorage.go @@ -128,14 +128,14 @@ const ( var ( ElasticsearchSelector = fmt.Sprintf("elasticsearch.k8s.elastic.co/cluster-name == '%s'", ElasticsearchName) ElasticsearchEntityRule = v3.EntityRule{ - NamespaceSelector: fmt.Sprintf("projectcalico.org/name == '%s'", ElasticsearchNamespace), + NamespaceSelector: fmt.Sprintf("kubernetes.io/metadata.name == '%s'", ElasticsearchNamespace), Selector: ElasticsearchSelector, Ports: []numorstring.Port{{MinPort: ElasticsearchDefaultPort, MaxPort: ElasticsearchDefaultPort}}, } ) var InternalElasticsearchEntityRule = v3.EntityRule{ - NamespaceSelector: fmt.Sprintf("projectcalico.org/name == '%s'", ElasticsearchNamespace), + NamespaceSelector: fmt.Sprintf("kubernetes.io/metadata.name == '%s'", ElasticsearchNamespace), Selector: ElasticsearchSelector, Ports: []numorstring.Port{{MinPort: ElasticsearchInternalPort, MaxPort: ElasticsearchInternalPort}}, } diff --git a/pkg/render/logstorage/esgateway/esgateway.go b/pkg/render/logstorage/esgateway/esgateway.go index f386b8d8d7..05a4e3728f 100644 --- a/pkg/render/logstorage/esgateway/esgateway.go +++ b/pkg/render/logstorage/esgateway/esgateway.go @@ -555,7 +555,7 @@ func (e *esGateway) cloudAccessNetworkPolicy() *v3.NetworkPolicy { Action: v3.Allow, Protocol: &networkpolicy.TCPProtocol, Source: v3.EntityRule{ - NamespaceSelector: "projectcalico.org/name == 'monitoring'", + NamespaceSelector: "kubernetes.io/metadata.name == 'monitoring'", Selector: "app == 'prometheus'", }, // Allow prometheus to scrape the metrics endpoint, which is enabled only on diff --git a/pkg/render/logstorage/linseed/linseed.go b/pkg/render/logstorage/linseed/linseed.go index 66ea6522a9..7c187421c8 100644 --- a/pkg/render/logstorage/linseed/linseed.go +++ b/pkg/render/logstorage/linseed/linseed.go @@ -749,7 +749,7 @@ func (l *linseed) cloudAccessNetworkPolicy() *v3.NetworkPolicy { Action: v3.Allow, Protocol: &networkpolicy.TCPProtocol, Source: v3.EntityRule{ - NamespaceSelector: "projectcalico.org/name == 'monitoring'", + NamespaceSelector: "kubernetes.io/metadata.name == 'monitoring'", Selector: "app == 'prometheus'", }, Destination: v3.EntityRule{ diff --git a/pkg/render/testutils/expected_policies/alertmanager-mesh.json b/pkg/render/testutils/expected_policies/alertmanager-mesh.json index cad878a686..eed4c7fa43 100644 --- a/pkg/render/testutils/expected_policies/alertmanager-mesh.json +++ b/pkg/render/testutils/expected_policies/alertmanager-mesh.json @@ -60,7 +60,7 @@ "action": "Allow", "protocol": "UDP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'kube-system'", + "namespaceSelector": "kubernetes.io/metadata.name == 'kube-system'", "selector": "k8s-app in { 'kube-dns', 'coredns' }", "ports": [ 53 diff --git a/pkg/render/testutils/expected_policies/alertmanager-mesh_ocp.json b/pkg/render/testutils/expected_policies/alertmanager-mesh_ocp.json index 6995985358..7d90e08866 100644 --- a/pkg/render/testutils/expected_policies/alertmanager-mesh_ocp.json +++ b/pkg/render/testutils/expected_policies/alertmanager-mesh_ocp.json @@ -60,7 +60,7 @@ "action": "Allow", "protocol": "UDP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'openshift-dns'", + "namespaceSelector": "kubernetes.io/metadata.name == 'openshift-dns'", "selector": "dns.operator.openshift.io/daemonset-dns == 'default'", "ports": [ 5353 @@ -71,7 +71,7 @@ "action": "Allow", "protocol": "TCP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'openshift-dns'", + "namespaceSelector": "kubernetes.io/metadata.name == 'openshift-dns'", "selector": "dns.operator.openshift.io/daemonset-dns == 'default'", "ports": [ 5353 diff --git a/pkg/render/testutils/expected_policies/alertmanager.json b/pkg/render/testutils/expected_policies/alertmanager.json index f7ca78dcb4..cc7ab42030 100644 --- a/pkg/render/testutils/expected_policies/alertmanager.json +++ b/pkg/render/testutils/expected_policies/alertmanager.json @@ -29,7 +29,7 @@ "action": "Allow", "protocol": "UDP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'kube-system'", + "namespaceSelector": "kubernetes.io/metadata.name == 'kube-system'", "selector": "k8s-app in { 'kube-dns', 'coredns' }", "ports": [ 53 diff --git a/pkg/render/testutils/expected_policies/alertmanager_ocp.json b/pkg/render/testutils/expected_policies/alertmanager_ocp.json index 2793f10ed0..ac0115ebf1 100644 --- a/pkg/render/testutils/expected_policies/alertmanager_ocp.json +++ b/pkg/render/testutils/expected_policies/alertmanager_ocp.json @@ -29,7 +29,7 @@ "action": "Allow", "protocol": "UDP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'openshift-dns'", + "namespaceSelector": "kubernetes.io/metadata.name == 'openshift-dns'", "selector": "dns.operator.openshift.io/daemonset-dns == 'default'", "ports": [ 5353 @@ -40,7 +40,7 @@ "action": "Allow", "protocol": "TCP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'openshift-dns'", + "namespaceSelector": "kubernetes.io/metadata.name == 'openshift-dns'", "selector": "dns.operator.openshift.io/daemonset-dns == 'default'", "ports": [ 5353 diff --git a/pkg/render/testutils/expected_policies/apiserver.json b/pkg/render/testutils/expected_policies/apiserver.json index 50a456c541..4cd13592f8 100644 --- a/pkg/render/testutils/expected_policies/apiserver.json +++ b/pkg/render/testutils/expected_policies/apiserver.json @@ -54,7 +54,7 @@ "action": "Allow", "protocol": "UDP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'kube-system'", + "namespaceSelector": "kubernetes.io/metadata.name == 'kube-system'", "selector": "k8s-app in { 'kube-dns', 'coredns' }", "ports": [ 53 @@ -75,7 +75,7 @@ "action": "Allow", "protocol": "TCP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'tigera-prometheus'", + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-prometheus'", "selector": "k8s-app == 'tigera-prometheus'", "ports": [ 9095 @@ -87,7 +87,7 @@ "protocol": "TCP", "destination": { "selector": "k8s-app == 'tigera-dex'", - "namespaceSelector": "projectcalico.org/name == 'tigera-dex'", + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-dex'", "ports" : [ 5556 ] @@ -97,7 +97,7 @@ "action": "Allow", "protocol": "TCP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'tigera-elasticsearch'", + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-elasticsearch'", "selector": "k8s-app == 'tigera-linseed'", "ports": [ 8444 diff --git a/pkg/render/testutils/expected_policies/apiserver_ocp.json b/pkg/render/testutils/expected_policies/apiserver_ocp.json index 39ee1208f8..60b81c099a 100644 --- a/pkg/render/testutils/expected_policies/apiserver_ocp.json +++ b/pkg/render/testutils/expected_policies/apiserver_ocp.json @@ -54,7 +54,7 @@ "action": "Allow", "protocol": "UDP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'openshift-dns'", + "namespaceSelector": "kubernetes.io/metadata.name == 'openshift-dns'", "selector": "dns.operator.openshift.io/daemonset-dns == 'default'", "ports": [ 5353 @@ -65,7 +65,7 @@ "action": "Allow", "protocol": "TCP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'openshift-dns'", + "namespaceSelector": "kubernetes.io/metadata.name == 'openshift-dns'", "selector": "dns.operator.openshift.io/daemonset-dns == 'default'", "ports": [ 5353 @@ -86,7 +86,7 @@ "action": "Allow", "protocol": "TCP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'tigera-prometheus'", + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-prometheus'", "selector": "k8s-app == 'tigera-prometheus'", "ports": [ 9095 @@ -98,7 +98,7 @@ "protocol": "TCP", "destination": { "selector": "k8s-app == 'tigera-dex'", - "namespaceSelector": "projectcalico.org/name == 'tigera-dex'", + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-dex'", "ports" : [ 5556 ] @@ -108,7 +108,7 @@ "action": "Allow", "protocol": "TCP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'tigera-elasticsearch'", + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-elasticsearch'", "selector": "k8s-app == 'tigera-linseed'", "ports": [ 8444 diff --git a/pkg/render/testutils/expected_policies/dashboards.json b/pkg/render/testutils/expected_policies/dashboards.json index 4fad45a29d..f001be7f6a 100644 --- a/pkg/render/testutils/expected_policies/dashboards.json +++ b/pkg/render/testutils/expected_policies/dashboards.json @@ -17,7 +17,7 @@ "action": "Allow", "protocol": "UDP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'kube-system'", + "namespaceSelector": "kubernetes.io/metadata.name == 'kube-system'", "selector": "k8s-app in { 'kube-dns', 'coredns' }", "ports": [ 53 @@ -28,7 +28,7 @@ "action": "Allow", "protocol": "TCP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'tigera-kibana'", + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-kibana'", "selector": "k8s-app == 'tigera-secure'", "ports": [ 5601 diff --git a/pkg/render/testutils/expected_policies/dashboards_ocp.json b/pkg/render/testutils/expected_policies/dashboards_ocp.json index ff6b2ca887..31a64f30b3 100644 --- a/pkg/render/testutils/expected_policies/dashboards_ocp.json +++ b/pkg/render/testutils/expected_policies/dashboards_ocp.json @@ -17,7 +17,7 @@ "action": "Allow", "protocol": "UDP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'openshift-dns'", + "namespaceSelector": "kubernetes.io/metadata.name == 'openshift-dns'", "selector": "dns.operator.openshift.io/daemonset-dns == 'default'", "ports": [ 5353 @@ -28,7 +28,7 @@ "action": "Allow", "protocol": "TCP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'openshift-dns'", + "namespaceSelector": "kubernetes.io/metadata.name == 'openshift-dns'", "selector": "dns.operator.openshift.io/daemonset-dns == 'default'", "ports": [ 5353 @@ -39,7 +39,7 @@ "action": "Allow", "protocol": "TCP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'tigera-kibana'", + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-kibana'", "selector": "k8s-app == 'tigera-secure'", "ports": [ 5601 diff --git a/pkg/render/testutils/expected_policies/dex.json b/pkg/render/testutils/expected_policies/dex.json index a80963af3b..6e435b82ce 100644 --- a/pkg/render/testutils/expected_policies/dex.json +++ b/pkg/render/testutils/expected_policies/dex.json @@ -19,7 +19,7 @@ "protocol": "TCP", "source": { "selector": "k8s-app == 'calico-manager'", - "namespaceSelector": "projectcalico.org/name == 'calico-system'" + "namespaceSelector": "kubernetes.io/metadata.name == 'calico-system'" }, "destination": { "ports": [ @@ -32,7 +32,7 @@ "protocol": "TCP", "source": { "selector": "k8s-app == 'tigera-secure-es-gateway'", - "namespaceSelector": "projectcalico.org/name == 'tigera-elasticsearch'" + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-elasticsearch'" }, "destination": { "ports": [ @@ -50,7 +50,7 @@ "protocol": "TCP", "source": { "selector": "k8s-app == 'tigera-packetcapture'", - "namespaceSelector": "projectcalico.org/name == 'tigera-packetcapture'" + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-packetcapture'" } }, { @@ -76,7 +76,7 @@ "protocol": "TCP", "source": { "selector": "k8s-app == 'calico-apiserver'", - "namespaceSelector": "projectcalico.org/name == 'calico-system'" + "namespaceSelector": "kubernetes.io/metadata.name == 'calico-system'" } } ], @@ -85,7 +85,7 @@ "action": "Allow", "protocol": "UDP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'kube-system'", + "namespaceSelector": "kubernetes.io/metadata.name == 'kube-system'", "selector": "k8s-app in { 'kube-dns', 'coredns' }", "ports": [ 53 diff --git a/pkg/render/testutils/expected_policies/dex_ocp.json b/pkg/render/testutils/expected_policies/dex_ocp.json index 40a039fe67..03051d1405 100644 --- a/pkg/render/testutils/expected_policies/dex_ocp.json +++ b/pkg/render/testutils/expected_policies/dex_ocp.json @@ -19,7 +19,7 @@ "protocol": "TCP", "source": { "selector": "k8s-app == 'calico-manager'", - "namespaceSelector": "projectcalico.org/name == 'calico-system'" + "namespaceSelector": "kubernetes.io/metadata.name == 'calico-system'" }, "destination": { "ports": [ @@ -32,7 +32,7 @@ "protocol": "TCP", "source": { "selector": "k8s-app == 'tigera-secure-es-gateway'", - "namespaceSelector": "projectcalico.org/name == 'tigera-elasticsearch'" + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-elasticsearch'" }, "destination": { "ports": [ @@ -50,7 +50,7 @@ "protocol": "TCP", "source": { "selector": "k8s-app == 'tigera-packetcapture'", - "namespaceSelector": "projectcalico.org/name == 'tigera-packetcapture'" + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-packetcapture'" } }, { @@ -76,7 +76,7 @@ "protocol": "TCP", "source": { "selector": "k8s-app == 'calico-apiserver'", - "namespaceSelector": "projectcalico.org/name == 'calico-system'" + "namespaceSelector": "kubernetes.io/metadata.name == 'calico-system'" } } ], @@ -85,7 +85,7 @@ "action": "Allow", "protocol": "UDP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'openshift-dns'", + "namespaceSelector": "kubernetes.io/metadata.name == 'openshift-dns'", "selector": "dns.operator.openshift.io/daemonset-dns == 'default'", "ports": [ 5353 @@ -96,7 +96,7 @@ "action": "Allow", "protocol": "TCP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'openshift-dns'", + "namespaceSelector": "kubernetes.io/metadata.name == 'openshift-dns'", "selector": "dns.operator.openshift.io/daemonset-dns == 'default'", "ports": [ 5353 diff --git a/pkg/render/testutils/expected_policies/elastic-operator.json b/pkg/render/testutils/expected_policies/elastic-operator.json index f7973c4bf8..e320e08829 100644 --- a/pkg/render/testutils/expected_policies/elastic-operator.json +++ b/pkg/render/testutils/expected_policies/elastic-operator.json @@ -17,7 +17,7 @@ "action": "Allow", "protocol": "UDP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'kube-system'", + "namespaceSelector": "kubernetes.io/metadata.name == 'kube-system'", "selector": "k8s-app in { 'kube-dns', 'coredns' }", "ports": [ 53 @@ -39,7 +39,7 @@ "protocol": "TCP", "destination": { "selector": "elasticsearch.k8s.elastic.co/cluster-name == 'tigera-secure'", - "namespaceSelector": "projectcalico.org/name == 'tigera-elasticsearch'", + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-elasticsearch'", "ports": [ 9200 ] diff --git a/pkg/render/testutils/expected_policies/elastic-operator_ocp.json b/pkg/render/testutils/expected_policies/elastic-operator_ocp.json index 510134d44b..04bae3b9d6 100644 --- a/pkg/render/testutils/expected_policies/elastic-operator_ocp.json +++ b/pkg/render/testutils/expected_policies/elastic-operator_ocp.json @@ -17,7 +17,7 @@ "action": "Allow", "protocol": "UDP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'openshift-dns'", + "namespaceSelector": "kubernetes.io/metadata.name == 'openshift-dns'", "selector": "dns.operator.openshift.io/daemonset-dns == 'default'", "ports": [ 5353 @@ -28,7 +28,7 @@ "action": "Allow", "protocol": "TCP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'openshift-dns'", + "namespaceSelector": "kubernetes.io/metadata.name == 'openshift-dns'", "selector": "dns.operator.openshift.io/daemonset-dns == 'default'", "ports": [ 5353 @@ -50,7 +50,7 @@ "protocol": "TCP", "destination": { "selector": "elasticsearch.k8s.elastic.co/cluster-name == 'tigera-secure'", - "namespaceSelector": "projectcalico.org/name == 'tigera-elasticsearch'", + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-elasticsearch'", "ports": [ 9200 ] diff --git a/pkg/render/testutils/expected_policies/elasticsearch-internal.json b/pkg/render/testutils/expected_policies/elasticsearch-internal.json index d82184d74c..4640b4fc85 100644 --- a/pkg/render/testutils/expected_policies/elasticsearch-internal.json +++ b/pkg/render/testutils/expected_policies/elasticsearch-internal.json @@ -32,7 +32,7 @@ "action": "Allow", "protocol": "TCP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'tigera-elasticsearch'", + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-elasticsearch'", "selector": "elasticsearch.k8s.elastic.co/cluster-name == 'tigera-secure'", "ports": [ 9300 diff --git a/pkg/render/testutils/expected_policies/elasticsearch.json b/pkg/render/testutils/expected_policies/elasticsearch.json index 6273caa254..90b8b1f7ea 100644 --- a/pkg/render/testutils/expected_policies/elasticsearch.json +++ b/pkg/render/testutils/expected_policies/elasticsearch.json @@ -19,7 +19,7 @@ "protocol": "TCP", "source": { "selector": "k8s-app == 'tigera-secure'", - "namespaceSelector": "projectcalico.org/name == 'tigera-kibana'" + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-kibana'" }, "destination": { "ports": [ @@ -32,7 +32,7 @@ "protocol": "TCP", "source": { "selector": "k8s-app == 'tigera-secure-es-gateway'", - "namespaceSelector": "projectcalico.org/name == 'tigera-elasticsearch'" + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-elasticsearch'" }, "destination": { "ports": [ @@ -45,7 +45,7 @@ "protocol": "TCP", "source": { "selector": "k8s-app == 'tigera-linseed'", - "namespaceSelector": "projectcalico.org/name == 'tigera-elasticsearch'" + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-elasticsearch'" }, "destination": { "ports": [ @@ -64,7 +64,7 @@ "protocol": "TCP", "source": { "selector": "k8s-app == 'elastic-operator'", - "namespaceSelector": "projectcalico.org/name == 'tigera-eck-operator'" + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-eck-operator'" } }, { @@ -82,7 +82,7 @@ "action": "Allow", "protocol": "UDP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'kube-system'", + "namespaceSelector": "kubernetes.io/metadata.name == 'kube-system'", "selector": "k8s-app in { 'kube-dns', 'coredns' }", "ports": [ 53 @@ -93,7 +93,7 @@ "action": "Allow", "protocol": "TCP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'tigera-dex'", + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-dex'", "selector": "k8s-app == 'tigera-dex'", "ports": [ 5556 @@ -104,7 +104,7 @@ "action": "Allow", "protocol": "TCP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'tigera-elasticsearch'", + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-elasticsearch'", "selector": "k8s-app == 'tigera-secure-es-gateway'", "ports": [ 5554 @@ -115,7 +115,7 @@ "action": "Allow", "protocol": "TCP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'tigera-elasticsearch'", + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-elasticsearch'", "selector": "k8s-app == 'tigera-linseed'", "ports": [ 8444 diff --git a/pkg/render/testutils/expected_policies/elasticsearch_ocp.json b/pkg/render/testutils/expected_policies/elasticsearch_ocp.json index d8fb98107c..8a8fab90af 100644 --- a/pkg/render/testutils/expected_policies/elasticsearch_ocp.json +++ b/pkg/render/testutils/expected_policies/elasticsearch_ocp.json @@ -19,7 +19,7 @@ "protocol": "TCP", "source": { "selector": "k8s-app == 'tigera-secure'", - "namespaceSelector": "projectcalico.org/name == 'tigera-kibana'" + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-kibana'" }, "destination": { "ports": [ @@ -32,7 +32,7 @@ "protocol": "TCP", "source": { "selector": "k8s-app == 'tigera-secure-es-gateway'", - "namespaceSelector": "projectcalico.org/name == 'tigera-elasticsearch'" + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-elasticsearch'" }, "destination": { "ports": [ @@ -45,7 +45,7 @@ "protocol": "TCP", "source": { "selector": "k8s-app == 'tigera-linseed'", - "namespaceSelector": "projectcalico.org/name == 'tigera-elasticsearch'" + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-elasticsearch'" }, "destination": { "ports": [ @@ -63,7 +63,7 @@ "protocol": "TCP", "source": { "selector": "k8s-app == 'elastic-operator'", - "namespaceSelector": "projectcalico.org/name == 'tigera-eck-operator'" + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-eck-operator'" } }, { @@ -81,7 +81,7 @@ "action": "Allow", "protocol": "UDP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'openshift-dns'", + "namespaceSelector": "kubernetes.io/metadata.name == 'openshift-dns'", "selector": "dns.operator.openshift.io/daemonset-dns == 'default'", "ports": [ 5353 @@ -92,7 +92,7 @@ "action": "Allow", "protocol": "TCP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'openshift-dns'", + "namespaceSelector": "kubernetes.io/metadata.name == 'openshift-dns'", "selector": "dns.operator.openshift.io/daemonset-dns == 'default'", "ports": [ 5353 @@ -103,7 +103,7 @@ "action": "Allow", "protocol": "TCP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'tigera-dex'", + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-dex'", "selector": "k8s-app == 'tigera-dex'", "ports": [ 5556 @@ -114,7 +114,7 @@ "action": "Allow", "protocol": "TCP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'tigera-elasticsearch'", + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-elasticsearch'", "selector": "k8s-app == 'tigera-secure-es-gateway'", "ports": [ 5554 @@ -125,7 +125,7 @@ "action": "Allow", "protocol": "TCP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'tigera-elasticsearch'", + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-elasticsearch'", "selector": "k8s-app == 'tigera-linseed'", "ports": [ 8444 diff --git a/pkg/render/testutils/expected_policies/es-gateway.json b/pkg/render/testutils/expected_policies/es-gateway.json index cb31999844..905eab0c31 100644 --- a/pkg/render/testutils/expected_policies/es-gateway.json +++ b/pkg/render/testutils/expected_policies/es-gateway.json @@ -19,7 +19,7 @@ "protocol": "TCP", "source": { "selector": "job-name == 'intrusion-detection-es-job-installer'", - "namespaceSelector": "projectcalico.org/name == 'tigera-intrusion-detection'" + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-intrusion-detection'" }, "destination": { "ports": [ @@ -32,7 +32,7 @@ "protocol": "TCP", "source": { "selector": "k8s-app == 'calico-manager'", - "namespaceSelector": "projectcalico.org/name == 'calico-system'" + "namespaceSelector": "kubernetes.io/metadata.name == 'calico-system'" }, "destination": { "ports": [ @@ -50,7 +50,7 @@ "protocol": "TCP", "source": { "selector": "k8s-app == 'intrusion-detection-controller'", - "namespaceSelector": "projectcalico.org/name == 'tigera-intrusion-detection'" + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-intrusion-detection'" } }, { @@ -63,7 +63,7 @@ "protocol": "TCP", "source": { "selector": "k8s-app == 'elastic-operator'", - "namespaceSelector": "projectcalico.org/name == 'tigera-eck-operator'" + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-eck-operator'" } }, { @@ -76,7 +76,7 @@ "protocol": "TCP", "source": { "selector": "k8s-app == 'tigera-elasticsearch-metrics'", - "namespaceSelector": "projectcalico.org/name == 'tigera-elasticsearch'" + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-elasticsearch'" } }, { @@ -94,7 +94,7 @@ "action": "Allow", "protocol": "UDP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'kube-system'", + "namespaceSelector": "kubernetes.io/metadata.name == 'kube-system'", "selector": "k8s-app in { 'kube-dns', 'coredns' }", "ports": [ 53 @@ -105,7 +105,7 @@ "action": "Allow", "protocol": "TCP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'tigera-dex'", + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-dex'", "selector": "k8s-app == 'tigera-dex'", "ports": [ 5556 @@ -126,7 +126,7 @@ "action": "Allow", "protocol": "TCP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'tigera-elasticsearch'", + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-elasticsearch'", "selector": "elasticsearch.k8s.elastic.co/cluster-name == 'tigera-secure'", "ports": [ 9200 @@ -137,7 +137,7 @@ "action": "Allow", "protocol": "TCP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'tigera-kibana'", + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-kibana'", "selector": "k8s-app == 'tigera-secure'", "ports": [ 5601 diff --git a/pkg/render/testutils/expected_policies/es-gateway_ocp.json b/pkg/render/testutils/expected_policies/es-gateway_ocp.json index 7a2d0009a3..28f77747c6 100644 --- a/pkg/render/testutils/expected_policies/es-gateway_ocp.json +++ b/pkg/render/testutils/expected_policies/es-gateway_ocp.json @@ -19,7 +19,7 @@ "protocol": "TCP", "source": { "selector": "job-name == 'intrusion-detection-es-job-installer'", - "namespaceSelector": "projectcalico.org/name == 'tigera-intrusion-detection'" + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-intrusion-detection'" }, "destination": { "ports": [ @@ -32,7 +32,7 @@ "protocol": "TCP", "source": { "selector": "k8s-app == 'calico-manager'", - "namespaceSelector": "projectcalico.org/name == 'calico-system'" + "namespaceSelector": "kubernetes.io/metadata.name == 'calico-system'" }, "destination": { "ports": [ @@ -50,7 +50,7 @@ "protocol": "TCP", "source": { "selector": "k8s-app == 'intrusion-detection-controller'", - "namespaceSelector": "projectcalico.org/name == 'tigera-intrusion-detection'" + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-intrusion-detection'" } }, { @@ -63,7 +63,7 @@ "protocol": "TCP", "source": { "selector": "k8s-app == 'elastic-operator'", - "namespaceSelector": "projectcalico.org/name == 'tigera-eck-operator'" + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-eck-operator'" } }, { @@ -76,7 +76,7 @@ "protocol": "TCP", "source": { "selector": "k8s-app == 'tigera-elasticsearch-metrics'", - "namespaceSelector": "projectcalico.org/name == 'tigera-elasticsearch'" + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-elasticsearch'" } }, { @@ -94,7 +94,7 @@ "action": "Allow", "protocol": "UDP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'openshift-dns'", + "namespaceSelector": "kubernetes.io/metadata.name == 'openshift-dns'", "selector": "dns.operator.openshift.io/daemonset-dns == 'default'", "ports": [ 5353 @@ -105,7 +105,7 @@ "action": "Allow", "protocol": "TCP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'openshift-dns'", + "namespaceSelector": "kubernetes.io/metadata.name == 'openshift-dns'", "selector": "dns.operator.openshift.io/daemonset-dns == 'default'", "ports": [ 5353 @@ -116,7 +116,7 @@ "action": "Allow", "protocol": "TCP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'tigera-dex'", + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-dex'", "selector": "k8s-app == 'tigera-dex'", "ports": [ 5556 @@ -137,7 +137,7 @@ "action": "Allow", "protocol": "TCP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'tigera-elasticsearch'", + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-elasticsearch'", "selector": "elasticsearch.k8s.elastic.co/cluster-name == 'tigera-secure'", "ports": [ 9200 @@ -148,7 +148,7 @@ "action": "Allow", "protocol": "TCP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'tigera-kibana'", + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-kibana'", "selector": "k8s-app == 'tigera-secure'", "ports": [ 5601 diff --git a/pkg/render/testutils/expected_policies/es-kubecontrollers.json b/pkg/render/testutils/expected_policies/es-kubecontrollers.json index a5f1a48962..1b28372d54 100644 --- a/pkg/render/testutils/expected_policies/es-kubecontrollers.json +++ b/pkg/render/testutils/expected_policies/es-kubecontrollers.json @@ -17,7 +17,7 @@ "action": "Allow", "protocol": "UDP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'kube-system'", + "namespaceSelector": "kubernetes.io/metadata.name == 'kube-system'", "selector": "k8s-app in { 'kube-dns', 'coredns' }", "ports": [ 53 @@ -40,7 +40,7 @@ "protocol": "TCP", "destination": { "selector": "k8s-app == 'tigera-secure-es-gateway'", - "namespaceSelector": "projectcalico.org/name == 'tigera-elasticsearch'", + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-elasticsearch'", "ports": [ 5554 ] @@ -51,7 +51,7 @@ "protocol": "TCP", "destination": { "selector": "k8s-app == 'calico-manager'", - "namespaceSelector": "projectcalico.org/name == 'calico-system'", + "namespaceSelector": "kubernetes.io/metadata.name == 'calico-system'", "ports": [ 9443 ] diff --git a/pkg/render/testutils/expected_policies/es-kubecontrollers_ocp.json b/pkg/render/testutils/expected_policies/es-kubecontrollers_ocp.json index b46e6b3faf..fb5cd25ce3 100644 --- a/pkg/render/testutils/expected_policies/es-kubecontrollers_ocp.json +++ b/pkg/render/testutils/expected_policies/es-kubecontrollers_ocp.json @@ -17,7 +17,7 @@ "action": "Allow", "protocol": "UDP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'openshift-dns'", + "namespaceSelector": "kubernetes.io/metadata.name == 'openshift-dns'", "selector": "dns.operator.openshift.io/daemonset-dns == 'default'", "ports": [ 5353 @@ -28,7 +28,7 @@ "action": "Allow", "protocol": "TCP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'openshift-dns'", + "namespaceSelector": "kubernetes.io/metadata.name == 'openshift-dns'", "selector": "dns.operator.openshift.io/daemonset-dns == 'default'", "ports": [ 5353 @@ -51,7 +51,7 @@ "protocol": "TCP", "destination": { "selector": "k8s-app == 'tigera-secure-es-gateway'", - "namespaceSelector": "projectcalico.org/name == 'tigera-elasticsearch'", + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-elasticsearch'", "ports": [ 5554 ] @@ -62,7 +62,7 @@ "protocol": "TCP", "destination": { "selector": "k8s-app == 'calico-manager'", - "namespaceSelector": "projectcalico.org/name == 'calico-system'", + "namespaceSelector": "kubernetes.io/metadata.name == 'calico-system'", "ports": [ 9443 ] diff --git a/pkg/render/testutils/expected_policies/es-metrics.json b/pkg/render/testutils/expected_policies/es-metrics.json index 0a9ee014c3..ed5f03aaa6 100644 --- a/pkg/render/testutils/expected_policies/es-metrics.json +++ b/pkg/render/testutils/expected_policies/es-metrics.json @@ -37,7 +37,7 @@ }, "destination": { "selector": "k8s-app == 'tigera-secure-es-gateway'", - "namespaceSelector": "projectcalico.org/name == 'tigera-elasticsearch'", + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-elasticsearch'", "ports": [ "5554" ] @@ -47,7 +47,7 @@ "action": "Allow", "protocol": "UDP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'kube-system'", + "namespaceSelector": "kubernetes.io/metadata.name == 'kube-system'", "selector": "k8s-app in { 'kube-dns', 'coredns' }", "ports": [ 53 diff --git a/pkg/render/testutils/expected_policies/es-metrics_ocp.json b/pkg/render/testutils/expected_policies/es-metrics_ocp.json index f88a8aae2b..5c7da13f52 100644 --- a/pkg/render/testutils/expected_policies/es-metrics_ocp.json +++ b/pkg/render/testutils/expected_policies/es-metrics_ocp.json @@ -37,7 +37,7 @@ }, "destination": { "selector": "k8s-app == 'tigera-secure-es-gateway'", - "namespaceSelector": "projectcalico.org/name == 'tigera-elasticsearch'", + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-elasticsearch'", "ports": [ "5554" ] @@ -47,7 +47,7 @@ "action": "Allow", "protocol": "UDP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'openshift-dns'", + "namespaceSelector": "kubernetes.io/metadata.name == 'openshift-dns'", "selector": "dns.operator.openshift.io/daemonset-dns == 'default'", "ports": [ 5353 @@ -58,7 +58,7 @@ "action": "Allow", "protocol": "TCP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'openshift-dns'", + "namespaceSelector": "kubernetes.io/metadata.name == 'openshift-dns'", "selector": "dns.operator.openshift.io/daemonset-dns == 'default'", "ports": [ 5353 diff --git a/pkg/render/testutils/expected_policies/fluentbit_managed.json b/pkg/render/testutils/expected_policies/fluentbit_managed.json index aae1dac0e5..411f2f5639 100644 --- a/pkg/render/testutils/expected_policies/fluentbit_managed.json +++ b/pkg/render/testutils/expected_policies/fluentbit_managed.json @@ -36,7 +36,7 @@ }, "destination": { "selector": "k8s-app == 'guardian'", - "namespaceSelector": "projectcalico.org/name == 'calico-system'", + "namespaceSelector": "kubernetes.io/metadata.name == 'calico-system'", "notPorts": [ 8080 ] diff --git a/pkg/render/testutils/expected_policies/fluentbit_unmanaged.json b/pkg/render/testutils/expected_policies/fluentbit_unmanaged.json index 290d673e1b..d5c0adb92c 100644 --- a/pkg/render/testutils/expected_policies/fluentbit_unmanaged.json +++ b/pkg/render/testutils/expected_policies/fluentbit_unmanaged.json @@ -37,7 +37,7 @@ }, "destination": { "selector": "k8s-app == 'tigera-secure-es-gateway'", - "namespaceSelector": "projectcalico.org/name == 'tigera-elasticsearch'", + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-elasticsearch'", "notPorts": [ 5554 ] @@ -50,7 +50,7 @@ }, "destination": { "selector": "k8s-app == 'tigera-linseed'", - "namespaceSelector": "projectcalico.org/name == 'tigera-elasticsearch'", + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-elasticsearch'", "notPorts": [ 8444 ] @@ -60,7 +60,7 @@ "action": "Allow", "protocol": "UDP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'kube-system'", + "namespaceSelector": "kubernetes.io/metadata.name == 'kube-system'", "selector": "k8s-app in { 'kube-dns', 'coredns' }", "ports": [ 53 diff --git a/pkg/render/testutils/expected_policies/fluentbit_unmanaged_ocp.json b/pkg/render/testutils/expected_policies/fluentbit_unmanaged_ocp.json index bf6d782cd2..4a613b8b6a 100644 --- a/pkg/render/testutils/expected_policies/fluentbit_unmanaged_ocp.json +++ b/pkg/render/testutils/expected_policies/fluentbit_unmanaged_ocp.json @@ -37,7 +37,7 @@ }, "destination": { "selector": "k8s-app == 'tigera-secure-es-gateway'", - "namespaceSelector": "projectcalico.org/name == 'tigera-elasticsearch'", + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-elasticsearch'", "notPorts": [ 5554 ] @@ -50,7 +50,7 @@ }, "destination": { "selector": "k8s-app == 'tigera-linseed'", - "namespaceSelector": "projectcalico.org/name == 'tigera-elasticsearch'", + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-elasticsearch'", "notPorts": [ 8444 ] @@ -60,7 +60,7 @@ "action": "Allow", "protocol": "UDP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'openshift-dns'", + "namespaceSelector": "kubernetes.io/metadata.name == 'openshift-dns'", "selector": "dns.operator.openshift.io/daemonset-dns == 'default'", "ports": [ 5353 @@ -71,7 +71,7 @@ "action": "Allow", "protocol": "TCP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'openshift-dns'", + "namespaceSelector": "kubernetes.io/metadata.name == 'openshift-dns'", "selector": "dns.operator.openshift.io/daemonset-dns == 'default'", "ports": [ 5353 diff --git a/pkg/render/testutils/expected_policies/guardian.json b/pkg/render/testutils/expected_policies/guardian.json index b07aa6b462..7c61116b18 100644 --- a/pkg/render/testutils/expected_policies/guardian.json +++ b/pkg/render/testutils/expected_policies/guardian.json @@ -36,7 +36,7 @@ }, "protocol": "TCP", "source": { - "namespaceSelector": "projectcalico.org/name == 'tigera-intrusion-detection'", + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-intrusion-detection'", "selector": "k8s-app == 'intrusion-detection-controller'" } }, @@ -49,7 +49,7 @@ }, "protocol": "TCP", "source": { - "namespaceSelector": "projectcalico.org/name == 'tigera-intrusion-detection'", + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-intrusion-detection'", "selector": "job-name == 'intrusion-detection-es-job-installer'" } }, @@ -68,7 +68,7 @@ "action": "Allow", "protocol": "TCP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'tigera-packetcapture'", + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-packetcapture'", "selector": "k8s-app == 'tigera-packetcapture'", "ports": [ 8444 @@ -79,7 +79,7 @@ "action": "Allow", "protocol": "UDP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'kube-system'", + "namespaceSelector": "kubernetes.io/metadata.name == 'kube-system'", "selector": "k8s-app in { 'kube-dns', 'coredns' }", "ports": [ 53 @@ -101,7 +101,7 @@ "protocol": "TCP", "destination": { "selector": "k8s-app == 'tigera-prometheus'", - "namespaceSelector": "projectcalico.org/name == 'tigera-prometheus'", + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-prometheus'", "ports": [ 9095 ] diff --git a/pkg/render/testutils/expected_policies/guardian_ocp.json b/pkg/render/testutils/expected_policies/guardian_ocp.json index 0fe853c540..d6ae4c8b93 100644 --- a/pkg/render/testutils/expected_policies/guardian_ocp.json +++ b/pkg/render/testutils/expected_policies/guardian_ocp.json @@ -36,7 +36,7 @@ }, "protocol": "TCP", "source": { - "namespaceSelector": "projectcalico.org/name == 'tigera-intrusion-detection'", + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-intrusion-detection'", "selector": "k8s-app == 'intrusion-detection-controller'" } }, @@ -49,7 +49,7 @@ }, "protocol": "TCP", "source": { - "namespaceSelector": "projectcalico.org/name == 'tigera-intrusion-detection'", + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-intrusion-detection'", "selector": "job-name == 'intrusion-detection-es-job-installer'" } }, @@ -68,7 +68,7 @@ "action": "Allow", "protocol": "TCP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'tigera-packetcapture'", + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-packetcapture'", "selector": "k8s-app == 'tigera-packetcapture'", "ports": [ 8444 @@ -79,7 +79,7 @@ "action": "Allow", "protocol": "UDP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'openshift-dns'", + "namespaceSelector": "kubernetes.io/metadata.name == 'openshift-dns'", "selector": "dns.operator.openshift.io/daemonset-dns == 'default'", "ports": [ 5353 @@ -90,7 +90,7 @@ "action": "Allow", "protocol": "TCP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'openshift-dns'", + "namespaceSelector": "kubernetes.io/metadata.name == 'openshift-dns'", "selector": "dns.operator.openshift.io/daemonset-dns == 'default'", "ports": [ 5353 @@ -112,7 +112,7 @@ "protocol": "TCP", "destination": { "selector": "k8s-app == 'tigera-prometheus'", - "namespaceSelector": "projectcalico.org/name == 'tigera-prometheus'", + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-prometheus'", "ports": [ 9095 ] diff --git a/pkg/render/testutils/expected_policies/intrusion-detection-controller_managed.json b/pkg/render/testutils/expected_policies/intrusion-detection-controller_managed.json index 526f27ca1d..bb8d51b223 100644 --- a/pkg/render/testutils/expected_policies/intrusion-detection-controller_managed.json +++ b/pkg/render/testutils/expected_policies/intrusion-detection-controller_managed.json @@ -41,7 +41,7 @@ "action": "Allow", "protocol": "UDP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'kube-system'", + "namespaceSelector": "kubernetes.io/metadata.name == 'kube-system'", "selector": "k8s-app in { 'kube-dns', 'coredns' }", "ports": [ 53 @@ -53,7 +53,7 @@ "protocol": "TCP", "destination": { "selector": "k8s-app == 'guardian'", - "namespaceSelector": "projectcalico.org/name == 'calico-system'", + "namespaceSelector": "kubernetes.io/metadata.name == 'calico-system'", "ports": [ 8080 ] diff --git a/pkg/render/testutils/expected_policies/intrusion-detection-controller_managed_ocp.json b/pkg/render/testutils/expected_policies/intrusion-detection-controller_managed_ocp.json index e58ef947f3..5adaf3d0df 100644 --- a/pkg/render/testutils/expected_policies/intrusion-detection-controller_managed_ocp.json +++ b/pkg/render/testutils/expected_policies/intrusion-detection-controller_managed_ocp.json @@ -41,7 +41,7 @@ "action": "Allow", "protocol": "UDP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'openshift-dns'", + "namespaceSelector": "kubernetes.io/metadata.name == 'openshift-dns'", "selector": "dns.operator.openshift.io/daemonset-dns == 'default'", "ports": [ 5353 @@ -52,7 +52,7 @@ "action": "Allow", "protocol": "TCP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'openshift-dns'", + "namespaceSelector": "kubernetes.io/metadata.name == 'openshift-dns'", "selector": "dns.operator.openshift.io/daemonset-dns == 'default'", "ports": [ 5353 @@ -64,7 +64,7 @@ "protocol": "TCP", "destination": { "selector": "k8s-app == 'guardian'", - "namespaceSelector": "projectcalico.org/name == 'calico-system'", + "namespaceSelector": "kubernetes.io/metadata.name == 'calico-system'", "ports": [ 8080 ] diff --git a/pkg/render/testutils/expected_policies/intrusion-detection-controller_management.json b/pkg/render/testutils/expected_policies/intrusion-detection-controller_management.json index fbad321ef3..5b9af52860 100644 --- a/pkg/render/testutils/expected_policies/intrusion-detection-controller_management.json +++ b/pkg/render/testutils/expected_policies/intrusion-detection-controller_management.json @@ -41,7 +41,7 @@ "action": "Allow", "protocol": "UDP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'kube-system'", + "namespaceSelector": "kubernetes.io/metadata.name == 'kube-system'", "selector": "k8s-app in { 'kube-dns', 'coredns' }", "ports": [ 53 @@ -53,7 +53,7 @@ "protocol": "TCP", "destination": { "selector": "k8s-app == 'tigera-linseed'", - "namespaceSelector": "projectcalico.org/name == 'tigera-elasticsearch'", + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-elasticsearch'", "ports": [ 8444 ] @@ -63,7 +63,7 @@ "action": "Allow", "protocol": "TCP", "destination": { - "namespaceSelector": "projectcalico.org/name == ''", + "namespaceSelector": "kubernetes.io/metadata.name == ''", "selector": "k8s-app == ''", "ports": [ 9443 diff --git a/pkg/render/testutils/expected_policies/intrusion-detection-controller_management_ocp.json b/pkg/render/testutils/expected_policies/intrusion-detection-controller_management_ocp.json index 2ecae62cce..250344da6c 100644 --- a/pkg/render/testutils/expected_policies/intrusion-detection-controller_management_ocp.json +++ b/pkg/render/testutils/expected_policies/intrusion-detection-controller_management_ocp.json @@ -41,7 +41,7 @@ "action": "Allow", "protocol": "UDP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'openshift-dns'", + "namespaceSelector": "kubernetes.io/metadata.name == 'openshift-dns'", "selector": "dns.operator.openshift.io/daemonset-dns == 'default'", "ports": [ 5353 @@ -52,7 +52,7 @@ "action": "Allow", "protocol": "TCP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'openshift-dns'", + "namespaceSelector": "kubernetes.io/metadata.name == 'openshift-dns'", "selector": "dns.operator.openshift.io/daemonset-dns == 'default'", "ports": [ 5353 @@ -64,7 +64,7 @@ "protocol": "TCP", "destination": { "selector": "k8s-app == 'tigera-linseed'", - "namespaceSelector": "projectcalico.org/name == 'tigera-elasticsearch'", + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-elasticsearch'", "ports": [ 8444 ] @@ -74,7 +74,7 @@ "action": "Allow", "protocol": "TCP", "destination": { - "namespaceSelector": "projectcalico.org/name == ''", + "namespaceSelector": "kubernetes.io/metadata.name == ''", "selector": "k8s-app == ''", "ports": [ 9443 diff --git a/pkg/render/testutils/expected_policies/intrusion-detection-controller_standalone.json b/pkg/render/testutils/expected_policies/intrusion-detection-controller_standalone.json index 1588f155f9..8565ca0eb9 100644 --- a/pkg/render/testutils/expected_policies/intrusion-detection-controller_standalone.json +++ b/pkg/render/testutils/expected_policies/intrusion-detection-controller_standalone.json @@ -41,7 +41,7 @@ "action": "Allow", "protocol": "UDP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'kube-system'", + "namespaceSelector": "kubernetes.io/metadata.name == 'kube-system'", "selector": "k8s-app in { 'kube-dns', 'coredns' }", "ports": [ 53 @@ -53,7 +53,7 @@ "protocol": "TCP", "destination": { "selector": "k8s-app == 'tigera-linseed'", - "namespaceSelector": "projectcalico.org/name == 'tigera-elasticsearch'", + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-elasticsearch'", "ports": [ 8444 ] diff --git a/pkg/render/testutils/expected_policies/intrusion-detection-controller_standalone_ocp.json b/pkg/render/testutils/expected_policies/intrusion-detection-controller_standalone_ocp.json index e7fc9311c3..6bc83291c7 100644 --- a/pkg/render/testutils/expected_policies/intrusion-detection-controller_standalone_ocp.json +++ b/pkg/render/testutils/expected_policies/intrusion-detection-controller_standalone_ocp.json @@ -41,7 +41,7 @@ "action": "Allow", "protocol": "UDP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'openshift-dns'", + "namespaceSelector": "kubernetes.io/metadata.name == 'openshift-dns'", "selector": "dns.operator.openshift.io/daemonset-dns == 'default'", "ports": [ 5353 @@ -52,7 +52,7 @@ "action": "Allow", "protocol": "TCP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'openshift-dns'", + "namespaceSelector": "kubernetes.io/metadata.name == 'openshift-dns'", "selector": "dns.operator.openshift.io/daemonset-dns == 'default'", "ports": [ 5353 @@ -64,7 +64,7 @@ "protocol": "TCP", "destination": { "selector": "k8s-app == 'tigera-linseed'", - "namespaceSelector": "projectcalico.org/name == 'tigera-elasticsearch'", + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-elasticsearch'", "ports": [ 8444 ] diff --git a/pkg/render/testutils/expected_policies/intrusion-detection-elastic.json b/pkg/render/testutils/expected_policies/intrusion-detection-elastic.json index 75b9c9996a..4a42657db0 100644 --- a/pkg/render/testutils/expected_policies/intrusion-detection-elastic.json +++ b/pkg/render/testutils/expected_policies/intrusion-detection-elastic.json @@ -17,7 +17,7 @@ "action": "Allow", "protocol": "UDP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'kube-system'", + "namespaceSelector": "kubernetes.io/metadata.name == 'kube-system'", "selector": "k8s-app in { 'kube-dns', 'coredns' }", "ports": [ 53 @@ -29,7 +29,7 @@ "protocol": "TCP", "destination": { "selector": "k8s-app == 'tigera-secure-es-gateway'", - "namespaceSelector": "projectcalico.org/name == 'tigera-elasticsearch'", + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-elasticsearch'", "ports": [ 5554 ] diff --git a/pkg/render/testutils/expected_policies/intrusion-detection-elastic_ocp.json b/pkg/render/testutils/expected_policies/intrusion-detection-elastic_ocp.json index 4ae95a3f3e..091c54d32e 100644 --- a/pkg/render/testutils/expected_policies/intrusion-detection-elastic_ocp.json +++ b/pkg/render/testutils/expected_policies/intrusion-detection-elastic_ocp.json @@ -17,7 +17,7 @@ "action": "Allow", "protocol": "UDP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'openshift-dns'", + "namespaceSelector": "kubernetes.io/metadata.name == 'openshift-dns'", "selector": "dns.operator.openshift.io/daemonset-dns == 'default'", "ports": [ 5353 @@ -28,7 +28,7 @@ "action": "Allow", "protocol": "TCP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'openshift-dns'", + "namespaceSelector": "kubernetes.io/metadata.name == 'openshift-dns'", "selector": "dns.operator.openshift.io/daemonset-dns == 'default'", "ports": [ 5353 @@ -40,7 +40,7 @@ "protocol": "TCP", "destination": { "selector": "k8s-app == 'tigera-secure-es-gateway'", - "namespaceSelector": "projectcalico.org/name == 'tigera-elasticsearch'", + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-elasticsearch'", "ports": [ 5554 ] diff --git a/pkg/render/testutils/expected_policies/kibana.json b/pkg/render/testutils/expected_policies/kibana.json index c8d9bee417..55fbdd1db6 100644 --- a/pkg/render/testutils/expected_policies/kibana.json +++ b/pkg/render/testutils/expected_policies/kibana.json @@ -47,7 +47,7 @@ "protocol": "TCP", "source": { "selector": "k8s-app == 'tigera-secure-es-gateway'", - "namespaceSelector": "projectcalico.org/name == 'tigera-elasticsearch'" + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-elasticsearch'" }, "destination": { "ports": [ @@ -60,7 +60,7 @@ "protocol": "TCP", "source": { "selector": "k8s-app == 'dashboards-installer'", - "namespaceSelector": "projectcalico.org/name == 'tigera-elasticsearch'" + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-elasticsearch'" }, "destination": { "ports": [ @@ -78,7 +78,7 @@ "protocol": "TCP", "source": { "selector": "k8s-app == 'elastic-operator'", - "namespaceSelector": "projectcalico.org/name == 'tigera-eck-operator'" + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-eck-operator'" } } ], @@ -90,7 +90,7 @@ }, "destination": { "selector": "elasticsearch.k8s.elastic.co/cluster-name == 'tigera-secure'", - "namespaceSelector": "projectcalico.org/name == 'tigera-elasticsearch'", + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-elasticsearch'", "ports": [ 9200 ] @@ -100,7 +100,7 @@ "action": "Allow", "protocol": "UDP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'kube-system'", + "namespaceSelector": "kubernetes.io/metadata.name == 'kube-system'", "selector": "k8s-app in { 'kube-dns', 'coredns' }", "ports": [ 53 @@ -124,7 +124,7 @@ 5554 ], "selector": "k8s-app == 'tigera-secure-es-gateway'", - "namespaceSelector": "projectcalico.org/name == 'tigera-elasticsearch'" + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-elasticsearch'" }, "protocol": "TCP" } diff --git a/pkg/render/testutils/expected_policies/kibana_ocp.json b/pkg/render/testutils/expected_policies/kibana_ocp.json index d0ee4c9f31..2a81f5d401 100644 --- a/pkg/render/testutils/expected_policies/kibana_ocp.json +++ b/pkg/render/testutils/expected_policies/kibana_ocp.json @@ -47,7 +47,7 @@ "protocol": "TCP", "source": { "selector": "k8s-app == 'tigera-secure-es-gateway'", - "namespaceSelector": "projectcalico.org/name == 'tigera-elasticsearch'" + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-elasticsearch'" }, "destination": { "ports": [ @@ -60,7 +60,7 @@ "protocol": "TCP", "source": { "selector": "k8s-app == 'dashboards-installer'", - "namespaceSelector": "projectcalico.org/name == 'tigera-elasticsearch'" + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-elasticsearch'" }, "destination": { "ports": [ @@ -78,7 +78,7 @@ "protocol": "TCP", "source": { "selector": "k8s-app == 'elastic-operator'", - "namespaceSelector": "projectcalico.org/name == 'tigera-eck-operator'" + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-eck-operator'" } } ], @@ -90,7 +90,7 @@ }, "destination": { "selector": "elasticsearch.k8s.elastic.co/cluster-name == 'tigera-secure'", - "namespaceSelector": "projectcalico.org/name == 'tigera-elasticsearch'", + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-elasticsearch'", "ports": [ 9200 ] @@ -100,7 +100,7 @@ "action": "Allow", "protocol": "UDP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'openshift-dns'", + "namespaceSelector": "kubernetes.io/metadata.name == 'openshift-dns'", "selector": "dns.operator.openshift.io/daemonset-dns == 'default'", "ports": [ 5353 @@ -111,7 +111,7 @@ "action": "Allow", "protocol": "TCP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'openshift-dns'", + "namespaceSelector": "kubernetes.io/metadata.name == 'openshift-dns'", "selector": "dns.operator.openshift.io/daemonset-dns == 'default'", "ports": [ 5353 @@ -135,7 +135,7 @@ 5554 ], "selector": "k8s-app == 'tigera-secure-es-gateway'", - "namespaceSelector": "projectcalico.org/name == 'tigera-elasticsearch'" + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-elasticsearch'" }, "protocol": "TCP" } diff --git a/pkg/render/testutils/expected_policies/kubecontrollers.json b/pkg/render/testutils/expected_policies/kubecontrollers.json index 5cb789a606..c1770d569f 100644 --- a/pkg/render/testutils/expected_policies/kubecontrollers.json +++ b/pkg/render/testutils/expected_policies/kubecontrollers.json @@ -17,7 +17,7 @@ "action": "Allow", "protocol": "UDP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'kube-system'", + "namespaceSelector": "kubernetes.io/metadata.name == 'kube-system'", "selector": "k8s-app in { 'kube-dns', 'coredns' }", "ports": [ 53 @@ -40,7 +40,7 @@ "protocol": "TCP", "destination": { "selector": "k8s-app == 'calico-manager'", - "namespaceSelector": "projectcalico.org/name == 'calico-system'", + "namespaceSelector": "kubernetes.io/metadata.name == 'calico-system'", "ports": [ 9443 ] diff --git a/pkg/render/testutils/expected_policies/kubecontrollers_managed.json b/pkg/render/testutils/expected_policies/kubecontrollers_managed.json index 1fa07de749..5a41bd4b0c 100644 --- a/pkg/render/testutils/expected_policies/kubecontrollers_managed.json +++ b/pkg/render/testutils/expected_policies/kubecontrollers_managed.json @@ -17,7 +17,7 @@ "action": "Allow", "protocol": "UDP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'kube-system'", + "namespaceSelector": "kubernetes.io/metadata.name == 'kube-system'", "selector": "k8s-app in { 'kube-dns', 'coredns' }", "ports": [ 53 @@ -40,7 +40,7 @@ "protocol": "TCP", "destination": { "selector": "k8s-app == 'guardian'", - "namespaceSelector": "projectcalico.org/name == 'calico-system'", + "namespaceSelector": "kubernetes.io/metadata.name == 'calico-system'", "ports": [ 8080 ] diff --git a/pkg/render/testutils/expected_policies/kubecontrollers_managed_ocp.json b/pkg/render/testutils/expected_policies/kubecontrollers_managed_ocp.json index 2dd0aa750e..12ddf594c9 100644 --- a/pkg/render/testutils/expected_policies/kubecontrollers_managed_ocp.json +++ b/pkg/render/testutils/expected_policies/kubecontrollers_managed_ocp.json @@ -17,7 +17,7 @@ "action": "Allow", "protocol": "UDP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'openshift-dns'", + "namespaceSelector": "kubernetes.io/metadata.name == 'openshift-dns'", "selector": "dns.operator.openshift.io/daemonset-dns == 'default'", "ports": [ 5353 @@ -28,7 +28,7 @@ "action": "Allow", "protocol": "TCP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'openshift-dns'", + "namespaceSelector": "kubernetes.io/metadata.name == 'openshift-dns'", "selector": "dns.operator.openshift.io/daemonset-dns == 'default'", "ports": [ 5353 @@ -51,7 +51,7 @@ "protocol": "TCP", "destination": { "selector": "k8s-app == 'guardian'", - "namespaceSelector": "projectcalico.org/name == 'calico-system'", + "namespaceSelector": "kubernetes.io/metadata.name == 'calico-system'", "ports": [ 8080 ] diff --git a/pkg/render/testutils/expected_policies/kubecontrollers_ocp.json b/pkg/render/testutils/expected_policies/kubecontrollers_ocp.json index a714d61dda..82464e93b4 100644 --- a/pkg/render/testutils/expected_policies/kubecontrollers_ocp.json +++ b/pkg/render/testutils/expected_policies/kubecontrollers_ocp.json @@ -17,7 +17,7 @@ "action": "Allow", "protocol": "UDP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'openshift-dns'", + "namespaceSelector": "kubernetes.io/metadata.name == 'openshift-dns'", "selector": "dns.operator.openshift.io/daemonset-dns == 'default'", "ports": [ 5353 @@ -28,7 +28,7 @@ "action": "Allow", "protocol": "TCP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'openshift-dns'", + "namespaceSelector": "kubernetes.io/metadata.name == 'openshift-dns'", "selector": "dns.operator.openshift.io/daemonset-dns == 'default'", "ports": [ 5353 @@ -51,7 +51,7 @@ "protocol": "TCP", "destination": { "selector": "k8s-app == 'calico-manager'", - "namespaceSelector": "projectcalico.org/name == 'calico-system'", + "namespaceSelector": "kubernetes.io/metadata.name == 'calico-system'", "ports": [ 9443 ] diff --git a/pkg/render/testutils/expected_policies/linseed.json b/pkg/render/testutils/expected_policies/linseed.json index 256a702d4f..3da5f071e3 100644 --- a/pkg/render/testutils/expected_policies/linseed.json +++ b/pkg/render/testutils/expected_policies/linseed.json @@ -32,7 +32,7 @@ "protocol": "TCP", "source": { "selector": "k8s-app == 'eks-log-forwarder'", - "namespaceSelector": "projectcalico.org/name == 'calico-system'" + "namespaceSelector": "kubernetes.io/metadata.name == 'calico-system'" }, "destination": { "ports": [ @@ -45,7 +45,7 @@ "protocol": "TCP", "source": { "selector": "k8s-app == 'calico-manager'", - "namespaceSelector": "projectcalico.org/name == 'calico-system'" + "namespaceSelector": "kubernetes.io/metadata.name == 'calico-system'" }, "destination": { "ports": [ @@ -63,7 +63,7 @@ "protocol": "TCP", "source": { "selector": "k8s-app == 'intrusion-detection-controller'", - "namespaceSelector": "projectcalico.org/name == 'tigera-intrusion-detection'" + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-intrusion-detection'" } }, { @@ -76,7 +76,7 @@ "protocol": "TCP", "source": { "selector": "k8s-app == 'elastic-operator'", - "namespaceSelector": "projectcalico.org/name == 'tigera-eck-operator'" + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-eck-operator'" } }, { @@ -89,7 +89,7 @@ "protocol": "TCP", "source": { "selector": "k8s-app == 'tigera-elasticsearch-metrics'", - "namespaceSelector": "projectcalico.org/name == 'tigera-elasticsearch'" + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-elasticsearch'" } }, { @@ -102,7 +102,7 @@ "protocol": "TCP", "source": { "selector": "k8s-app == 'tigera-policy-recommendation'", - "namespaceSelector": "projectcalico.org/name == 'calico-system'" + "namespaceSelector": "kubernetes.io/metadata.name == 'calico-system'" } }, { @@ -110,7 +110,7 @@ "protocol": "TCP", "source": { "selector": "k8s-app == 'calico-apiserver'", - "namespaceSelector": "projectcalico.org/name == 'calico-system'" + "namespaceSelector": "kubernetes.io/metadata.name == 'calico-system'" }, "destination": { "ports": [ @@ -124,7 +124,7 @@ "action": "Allow", "protocol": "UDP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'kube-system'", + "namespaceSelector": "kubernetes.io/metadata.name == 'kube-system'", "selector": "k8s-app in { 'kube-dns', 'coredns' }", "ports": [ 53 @@ -145,7 +145,7 @@ "action": "Allow", "protocol": "TCP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'tigera-elasticsearch'", + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-elasticsearch'", "selector": "elasticsearch.k8s.elastic.co/cluster-name == 'tigera-secure'", "ports": [ 9200 diff --git a/pkg/render/testutils/expected_policies/linseed_dpi_enabled.json b/pkg/render/testutils/expected_policies/linseed_dpi_enabled.json index 2bfca29e1a..fa8e3f9128 100644 --- a/pkg/render/testutils/expected_policies/linseed_dpi_enabled.json +++ b/pkg/render/testutils/expected_policies/linseed_dpi_enabled.json @@ -32,7 +32,7 @@ "protocol": "TCP", "source": { "selector": "k8s-app == 'eks-log-forwarder'", - "namespaceSelector": "projectcalico.org/name == 'calico-system'" + "namespaceSelector": "kubernetes.io/metadata.name == 'calico-system'" }, "destination": { "ports": [ @@ -45,7 +45,7 @@ "protocol": "TCP", "source": { "selector": "k8s-app == 'calico-manager'", - "namespaceSelector": "projectcalico.org/name == 'calico-system'" + "namespaceSelector": "kubernetes.io/metadata.name == 'calico-system'" }, "destination": { "ports": [ @@ -63,7 +63,7 @@ "protocol": "TCP", "source": { "selector": "k8s-app == 'intrusion-detection-controller'", - "namespaceSelector": "projectcalico.org/name == 'tigera-intrusion-detection'" + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-intrusion-detection'" } }, { @@ -76,7 +76,7 @@ "protocol": "TCP", "source": { "selector": "k8s-app == 'elastic-operator'", - "namespaceSelector": "projectcalico.org/name == 'tigera-eck-operator'" + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-eck-operator'" } }, { @@ -89,7 +89,7 @@ "protocol": "TCP", "source": { "selector": "k8s-app == 'tigera-elasticsearch-metrics'", - "namespaceSelector": "projectcalico.org/name == 'tigera-elasticsearch'" + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-elasticsearch'" } }, { @@ -102,7 +102,7 @@ "protocol": "TCP", "source": { "selector": "k8s-app == 'tigera-policy-recommendation'", - "namespaceSelector": "projectcalico.org/name == 'calico-system'" + "namespaceSelector": "kubernetes.io/metadata.name == 'calico-system'" } }, { @@ -110,7 +110,7 @@ "protocol": "TCP", "source": { "selector": "k8s-app == 'calico-apiserver'", - "namespaceSelector": "projectcalico.org/name == 'calico-system'" + "namespaceSelector": "kubernetes.io/metadata.name == 'calico-system'" }, "destination": { "ports": [ @@ -133,7 +133,7 @@ "action": "Allow", "protocol": "UDP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'kube-system'", + "namespaceSelector": "kubernetes.io/metadata.name == 'kube-system'", "selector": "k8s-app in { 'kube-dns', 'coredns' }", "ports": [ 53 @@ -154,7 +154,7 @@ "action": "Allow", "protocol": "TCP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'tigera-elasticsearch'", + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-elasticsearch'", "selector": "elasticsearch.k8s.elastic.co/cluster-name == 'tigera-secure'", "ports": [ 9200 diff --git a/pkg/render/testutils/expected_policies/linseed_ocp.json b/pkg/render/testutils/expected_policies/linseed_ocp.json index ddbb88b912..bea7f80fad 100644 --- a/pkg/render/testutils/expected_policies/linseed_ocp.json +++ b/pkg/render/testutils/expected_policies/linseed_ocp.json @@ -32,7 +32,7 @@ "protocol": "TCP", "source": { "selector": "k8s-app == 'eks-log-forwarder'", - "namespaceSelector": "projectcalico.org/name == 'calico-system'" + "namespaceSelector": "kubernetes.io/metadata.name == 'calico-system'" }, "destination": { "ports": [ @@ -45,7 +45,7 @@ "protocol": "TCP", "source": { "selector": "k8s-app == 'calico-manager'", - "namespaceSelector": "projectcalico.org/name == 'calico-system'" + "namespaceSelector": "kubernetes.io/metadata.name == 'calico-system'" }, "destination": { "ports": [ @@ -63,7 +63,7 @@ "protocol": "TCP", "source": { "selector": "k8s-app == 'intrusion-detection-controller'", - "namespaceSelector": "projectcalico.org/name == 'tigera-intrusion-detection'" + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-intrusion-detection'" } }, { @@ -76,7 +76,7 @@ "protocol": "TCP", "source": { "selector": "k8s-app == 'elastic-operator'", - "namespaceSelector": "projectcalico.org/name == 'tigera-eck-operator'" + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-eck-operator'" } }, { @@ -89,7 +89,7 @@ "protocol": "TCP", "source": { "selector": "k8s-app == 'tigera-elasticsearch-metrics'", - "namespaceSelector": "projectcalico.org/name == 'tigera-elasticsearch'" + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-elasticsearch'" } }, { @@ -102,7 +102,7 @@ "protocol": "TCP", "source": { "selector": "k8s-app == 'tigera-policy-recommendation'", - "namespaceSelector": "projectcalico.org/name == 'calico-system'" + "namespaceSelector": "kubernetes.io/metadata.name == 'calico-system'" } }, { @@ -110,7 +110,7 @@ "protocol": "TCP", "source": { "selector": "k8s-app == 'calico-apiserver'", - "namespaceSelector": "projectcalico.org/name == 'calico-system'" + "namespaceSelector": "kubernetes.io/metadata.name == 'calico-system'" }, "destination": { "ports": [ @@ -124,7 +124,7 @@ "action": "Allow", "protocol": "UDP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'openshift-dns'", + "namespaceSelector": "kubernetes.io/metadata.name == 'openshift-dns'", "selector": "dns.operator.openshift.io/daemonset-dns == 'default'", "ports": [ 5353 @@ -135,7 +135,7 @@ "action": "Allow", "protocol": "TCP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'openshift-dns'", + "namespaceSelector": "kubernetes.io/metadata.name == 'openshift-dns'", "selector": "dns.operator.openshift.io/daemonset-dns == 'default'", "ports": [ 5353 @@ -156,7 +156,7 @@ "action": "Allow", "protocol": "TCP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'tigera-elasticsearch'", + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-elasticsearch'", "selector": "elasticsearch.k8s.elastic.co/cluster-name == 'tigera-secure'", "ports": [ 9200 diff --git a/pkg/render/testutils/expected_policies/linseed_ocp_dpi_enabled.json b/pkg/render/testutils/expected_policies/linseed_ocp_dpi_enabled.json index b5c1f21170..a9a1b0d103 100644 --- a/pkg/render/testutils/expected_policies/linseed_ocp_dpi_enabled.json +++ b/pkg/render/testutils/expected_policies/linseed_ocp_dpi_enabled.json @@ -32,7 +32,7 @@ "protocol": "TCP", "source": { "selector": "k8s-app == 'eks-log-forwarder'", - "namespaceSelector": "projectcalico.org/name == 'calico-system'" + "namespaceSelector": "kubernetes.io/metadata.name == 'calico-system'" }, "destination": { "ports": [ @@ -45,7 +45,7 @@ "protocol": "TCP", "source": { "selector": "k8s-app == 'calico-manager'", - "namespaceSelector": "projectcalico.org/name == 'calico-system'" + "namespaceSelector": "kubernetes.io/metadata.name == 'calico-system'" }, "destination": { "ports": [ @@ -63,7 +63,7 @@ "protocol": "TCP", "source": { "selector": "k8s-app == 'intrusion-detection-controller'", - "namespaceSelector": "projectcalico.org/name == 'tigera-intrusion-detection'" + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-intrusion-detection'" } }, { @@ -76,7 +76,7 @@ "protocol": "TCP", "source": { "selector": "k8s-app == 'elastic-operator'", - "namespaceSelector": "projectcalico.org/name == 'tigera-eck-operator'" + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-eck-operator'" } }, { @@ -89,7 +89,7 @@ "protocol": "TCP", "source": { "selector": "k8s-app == 'tigera-elasticsearch-metrics'", - "namespaceSelector": "projectcalico.org/name == 'tigera-elasticsearch'" + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-elasticsearch'" } }, { @@ -102,7 +102,7 @@ "protocol": "TCP", "source": { "selector": "k8s-app == 'tigera-policy-recommendation'", - "namespaceSelector": "projectcalico.org/name == 'calico-system'" + "namespaceSelector": "kubernetes.io/metadata.name == 'calico-system'" } }, { @@ -110,7 +110,7 @@ "protocol": "TCP", "source": { "selector": "k8s-app == 'calico-apiserver'", - "namespaceSelector": "projectcalico.org/name == 'calico-system'" + "namespaceSelector": "kubernetes.io/metadata.name == 'calico-system'" }, "destination": { "ports": [ @@ -133,7 +133,7 @@ "action": "Allow", "protocol": "UDP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'openshift-dns'", + "namespaceSelector": "kubernetes.io/metadata.name == 'openshift-dns'", "selector": "dns.operator.openshift.io/daemonset-dns == 'default'", "ports": [ 5353 @@ -144,7 +144,7 @@ "action": "Allow", "protocol": "TCP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'openshift-dns'", + "namespaceSelector": "kubernetes.io/metadata.name == 'openshift-dns'", "selector": "dns.operator.openshift.io/daemonset-dns == 'default'", "ports": [ 5353 @@ -165,7 +165,7 @@ "action": "Allow", "protocol": "TCP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'tigera-elasticsearch'", + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-elasticsearch'", "selector": "elasticsearch.k8s.elastic.co/cluster-name == 'tigera-secure'", "ports": [ 9200 diff --git a/pkg/render/testutils/expected_policies/manager.json b/pkg/render/testutils/expected_policies/manager.json index 30630bafd5..264cd3ffa2 100644 --- a/pkg/render/testutils/expected_policies/manager.json +++ b/pkg/render/testutils/expected_policies/manager.json @@ -60,7 +60,7 @@ "source": {}, "destination": { "selector": "k8s-app == 'calico-manager'", - "namespaceSelector": "projectcalico.org/name == 'calico-system'", + "namespaceSelector": "kubernetes.io/metadata.name == 'calico-system'", "ports": [ 9443 ] @@ -82,7 +82,7 @@ "source": {}, "destination": { "selector": "k8s-app == 'tigera-secure-es-gateway'", - "namespaceSelector": "projectcalico.org/name == 'tigera-elasticsearch'", + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-elasticsearch'", "ports": [ 5554 ] @@ -94,7 +94,7 @@ "source": {}, "destination": { "selector": "k8s-app == 'tigera-linseed'", - "namespaceSelector": "projectcalico.org/name == 'tigera-elasticsearch'", + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-elasticsearch'", "ports": [ 8444 ] @@ -104,7 +104,7 @@ "action": "Allow", "protocol": "TCP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'tigera-dex'", + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-dex'", "selector": "k8s-app == 'tigera-dex'", "ports": [ 5556 @@ -115,7 +115,7 @@ "action": "Allow", "protocol": "TCP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'tigera-packetcapture'", + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-packetcapture'", "selector": "k8s-app == 'tigera-packetcapture'", "ports": [ 8444 @@ -136,7 +136,7 @@ "action": "Allow", "protocol": "UDP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'kube-system'", + "namespaceSelector": "kubernetes.io/metadata.name == 'kube-system'", "selector": "k8s-app in { 'kube-dns', 'coredns' }", "ports": [ 53 @@ -148,7 +148,7 @@ "protocol": "TCP", "destination": { "selector": "k8s-app == 'tigera-prometheus'", - "namespaceSelector": "projectcalico.org/name == 'tigera-prometheus'", + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-prometheus'", "ports": [ 9095 ] diff --git a/pkg/render/testutils/expected_policies/manager_ocp.json b/pkg/render/testutils/expected_policies/manager_ocp.json index b62152c32a..cdc132e352 100644 --- a/pkg/render/testutils/expected_policies/manager_ocp.json +++ b/pkg/render/testutils/expected_policies/manager_ocp.json @@ -60,7 +60,7 @@ "source": {}, "destination": { "selector": "k8s-app == 'calico-manager'", - "namespaceSelector": "projectcalico.org/name == 'calico-system'", + "namespaceSelector": "kubernetes.io/metadata.name == 'calico-system'", "ports": [ 9443 ] @@ -82,7 +82,7 @@ "source": {}, "destination": { "selector": "k8s-app == 'tigera-secure-es-gateway'", - "namespaceSelector": "projectcalico.org/name == 'tigera-elasticsearch'", + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-elasticsearch'", "ports": [ 5554 ] @@ -94,7 +94,7 @@ "source": {}, "destination": { "selector": "k8s-app == 'tigera-linseed'", - "namespaceSelector": "projectcalico.org/name == 'tigera-elasticsearch'", + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-elasticsearch'", "ports": [ 8444 ] @@ -104,7 +104,7 @@ "action": "Allow", "protocol": "TCP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'tigera-dex'", + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-dex'", "selector": "k8s-app == 'tigera-dex'", "ports": [ 5556 @@ -115,7 +115,7 @@ "action": "Allow", "protocol": "TCP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'tigera-packetcapture'", + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-packetcapture'", "selector": "k8s-app == 'tigera-packetcapture'", "ports": [ 8444 @@ -136,7 +136,7 @@ "action": "Allow", "protocol": "UDP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'openshift-dns'", + "namespaceSelector": "kubernetes.io/metadata.name == 'openshift-dns'", "selector": "dns.operator.openshift.io/daemonset-dns == 'default'", "ports": [ 5353 @@ -147,7 +147,7 @@ "action": "Allow", "protocol": "TCP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'openshift-dns'", + "namespaceSelector": "kubernetes.io/metadata.name == 'openshift-dns'", "selector": "dns.operator.openshift.io/daemonset-dns == 'default'", "ports": [ 5353 @@ -159,7 +159,7 @@ "protocol": "TCP", "destination": { "selector": "k8s-app == 'tigera-prometheus'", - "namespaceSelector": "projectcalico.org/name == 'tigera-prometheus'", + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-prometheus'", "ports": [ 9095 ] diff --git a/pkg/render/testutils/expected_policies/packetcapture.json b/pkg/render/testutils/expected_policies/packetcapture.json index 99d9e63b94..e94c0c14c5 100644 --- a/pkg/render/testutils/expected_policies/packetcapture.json +++ b/pkg/render/testutils/expected_policies/packetcapture.json @@ -19,7 +19,7 @@ "protocol": "TCP", "source": { "selector": "k8s-app == 'calico-manager'", - "namespaceSelector": "projectcalico.org/name == 'calico-system'" + "namespaceSelector": "kubernetes.io/metadata.name == 'calico-system'" }, "destination": { "ports": [ @@ -43,7 +43,7 @@ "action": "Allow", "protocol": "UDP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'kube-system'", + "namespaceSelector": "kubernetes.io/metadata.name == 'kube-system'", "selector": "k8s-app in { 'kube-dns', 'coredns' }", "ports": [ 53 @@ -54,7 +54,7 @@ "action": "Allow", "protocol": "TCP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'tigera-dex'", + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-dex'", "selector": "k8s-app == 'tigera-dex'", "ports": [ 5556 diff --git a/pkg/render/testutils/expected_policies/packetcapture_managed.json b/pkg/render/testutils/expected_policies/packetcapture_managed.json index bda9822ddd..ba00e605ef 100644 --- a/pkg/render/testutils/expected_policies/packetcapture_managed.json +++ b/pkg/render/testutils/expected_policies/packetcapture_managed.json @@ -19,7 +19,7 @@ "protocol": "TCP", "source": { "selector": "k8s-app == 'guardian'", - "namespaceSelector": "projectcalico.org/name == 'calico-system'" + "namespaceSelector": "kubernetes.io/metadata.name == 'calico-system'" }, "destination": { "ports": [ @@ -43,7 +43,7 @@ "action": "Allow", "protocol": "UDP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'kube-system'", + "namespaceSelector": "kubernetes.io/metadata.name == 'kube-system'", "selector": "k8s-app in { 'kube-dns', 'coredns' }", "ports": [ 53 diff --git a/pkg/render/testutils/expected_policies/packetcapture_managed_ocp.json b/pkg/render/testutils/expected_policies/packetcapture_managed_ocp.json index bec901b1e1..735f9f1789 100644 --- a/pkg/render/testutils/expected_policies/packetcapture_managed_ocp.json +++ b/pkg/render/testutils/expected_policies/packetcapture_managed_ocp.json @@ -19,7 +19,7 @@ "protocol": "TCP", "source": { "selector": "k8s-app == 'guardian'", - "namespaceSelector": "projectcalico.org/name == 'calico-system'" + "namespaceSelector": "kubernetes.io/metadata.name == 'calico-system'" }, "destination": { "ports": [ @@ -43,7 +43,7 @@ "action": "Allow", "protocol": "UDP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'openshift-dns'", + "namespaceSelector": "kubernetes.io/metadata.name == 'openshift-dns'", "selector": "dns.operator.openshift.io/daemonset-dns == 'default'", "ports": [ 5353 @@ -54,7 +54,7 @@ "action": "Allow", "protocol": "TCP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'openshift-dns'", + "namespaceSelector": "kubernetes.io/metadata.name == 'openshift-dns'", "selector": "dns.operator.openshift.io/daemonset-dns == 'default'", "ports": [ 5353 diff --git a/pkg/render/testutils/expected_policies/packetcapture_ocp.json b/pkg/render/testutils/expected_policies/packetcapture_ocp.json index 733612e5c9..c99ed77d5c 100644 --- a/pkg/render/testutils/expected_policies/packetcapture_ocp.json +++ b/pkg/render/testutils/expected_policies/packetcapture_ocp.json @@ -19,7 +19,7 @@ "protocol": "TCP", "source": { "selector": "k8s-app == 'calico-manager'", - "namespaceSelector": "projectcalico.org/name == 'calico-system'" + "namespaceSelector": "kubernetes.io/metadata.name == 'calico-system'" }, "destination": { "ports": [ @@ -43,7 +43,7 @@ "action": "Allow", "protocol": "UDP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'openshift-dns'", + "namespaceSelector": "kubernetes.io/metadata.name == 'openshift-dns'", "selector": "dns.operator.openshift.io/daemonset-dns == 'default'", "ports": [ 5353 @@ -54,7 +54,7 @@ "action": "Allow", "protocol": "TCP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'openshift-dns'", + "namespaceSelector": "kubernetes.io/metadata.name == 'openshift-dns'", "selector": "dns.operator.openshift.io/daemonset-dns == 'default'", "ports": [ 5353 @@ -65,7 +65,7 @@ "action": "Allow", "protocol": "TCP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'tigera-dex'", + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-dex'", "selector": "k8s-app == 'tigera-dex'", "ports": [ 5556 diff --git a/pkg/render/testutils/expected_policies/policyrecommendation.json b/pkg/render/testutils/expected_policies/policyrecommendation.json index 79325f8cac..3806935fb8 100644 --- a/pkg/render/testutils/expected_policies/policyrecommendation.json +++ b/pkg/render/testutils/expected_policies/policyrecommendation.json @@ -28,7 +28,7 @@ "action": "Allow", "protocol": "TCP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'calico-system'", + "namespaceSelector": "kubernetes.io/metadata.name == 'calico-system'", "selector": "k8s-app == 'calico-manager'", "ports": [ 9443 @@ -42,7 +42,7 @@ }, "destination": { "selector": "k8s-app == 'tigera-linseed'", - "namespaceSelector": "projectcalico.org/name == 'tigera-elasticsearch'", + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-elasticsearch'", "ports": [ 8444 ] @@ -52,7 +52,7 @@ "action": "Allow", "protocol": "UDP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'kube-system'", + "namespaceSelector": "kubernetes.io/metadata.name == 'kube-system'", "selector": "k8s-app in { 'kube-dns', 'coredns' }", "ports": [ 53 diff --git a/pkg/render/testutils/expected_policies/policyrecommendation_ocp.json b/pkg/render/testutils/expected_policies/policyrecommendation_ocp.json index 28b686d48c..949ee225e6 100644 --- a/pkg/render/testutils/expected_policies/policyrecommendation_ocp.json +++ b/pkg/render/testutils/expected_policies/policyrecommendation_ocp.json @@ -28,7 +28,7 @@ "action": "Allow", "protocol": "TCP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'calico-system'", + "namespaceSelector": "kubernetes.io/metadata.name == 'calico-system'", "selector": "k8s-app == 'calico-manager'", "ports": [ 9443 @@ -42,7 +42,7 @@ }, "destination": { "selector": "k8s-app == 'tigera-linseed'", - "namespaceSelector": "projectcalico.org/name == 'tigera-elasticsearch'", + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-elasticsearch'", "ports": [ 8444 ] @@ -52,7 +52,7 @@ "action": "Allow", "protocol": "UDP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'openshift-dns'", + "namespaceSelector": "kubernetes.io/metadata.name == 'openshift-dns'", "selector": "dns.operator.openshift.io/daemonset-dns == 'default'", "ports": [ 5353 @@ -63,7 +63,7 @@ "action": "Allow", "protocol": "TCP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'openshift-dns'", + "namespaceSelector": "kubernetes.io/metadata.name == 'openshift-dns'", "selector": "dns.operator.openshift.io/daemonset-dns == 'default'", "ports": [ 5353 diff --git a/pkg/render/testutils/expected_policies/prometheus-api.json b/pkg/render/testutils/expected_policies/prometheus-api.json index 27343ea317..69bebaddc7 100644 --- a/pkg/render/testutils/expected_policies/prometheus-api.json +++ b/pkg/render/testutils/expected_policies/prometheus-api.json @@ -29,7 +29,7 @@ "action": "Allow", "protocol": "UDP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'kube-system'", + "namespaceSelector": "kubernetes.io/metadata.name == 'kube-system'", "selector": "k8s-app in { 'kube-dns', 'coredns' }", "ports": [ 53 @@ -40,7 +40,7 @@ "action": "Allow", "protocol": "TCP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'tigera-prometheus'", + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-prometheus'", "selector": "k8s-app == 'tigera-prometheus'", "ports": [ 9095 diff --git a/pkg/render/testutils/expected_policies/prometheus-api_ocp.json b/pkg/render/testutils/expected_policies/prometheus-api_ocp.json index 68c1679862..7b939ec774 100644 --- a/pkg/render/testutils/expected_policies/prometheus-api_ocp.json +++ b/pkg/render/testutils/expected_policies/prometheus-api_ocp.json @@ -29,7 +29,7 @@ "action": "Allow", "protocol": "UDP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'openshift-dns'", + "namespaceSelector": "kubernetes.io/metadata.name == 'openshift-dns'", "selector": "dns.operator.openshift.io/daemonset-dns == 'default'", "ports": [ 5353 @@ -40,7 +40,7 @@ "action": "Allow", "protocol": "TCP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'openshift-dns'", + "namespaceSelector": "kubernetes.io/metadata.name == 'openshift-dns'", "selector": "dns.operator.openshift.io/daemonset-dns == 'default'", "ports": [ 5353 @@ -51,7 +51,7 @@ "action": "Allow", "protocol": "TCP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'tigera-prometheus'", + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-prometheus'", "selector": "k8s-app == 'tigera-prometheus'", "ports": [ 9095 diff --git a/pkg/render/testutils/expected_policies/prometheus-operator.json b/pkg/render/testutils/expected_policies/prometheus-operator.json index 0506b6d4a0..13a79c9eb9 100644 --- a/pkg/render/testutils/expected_policies/prometheus-operator.json +++ b/pkg/render/testutils/expected_policies/prometheus-operator.json @@ -17,7 +17,7 @@ "action": "Allow", "protocol": "UDP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'kube-system'", + "namespaceSelector": "kubernetes.io/metadata.name == 'kube-system'", "selector": "k8s-app in { 'kube-dns', 'coredns' }", "ports": [ 53 diff --git a/pkg/render/testutils/expected_policies/prometheus-operator_ocp.json b/pkg/render/testutils/expected_policies/prometheus-operator_ocp.json index 5559cc4191..d1ae760e8d 100644 --- a/pkg/render/testutils/expected_policies/prometheus-operator_ocp.json +++ b/pkg/render/testutils/expected_policies/prometheus-operator_ocp.json @@ -17,7 +17,7 @@ "action": "Allow", "protocol": "UDP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'openshift-dns'", + "namespaceSelector": "kubernetes.io/metadata.name == 'openshift-dns'", "selector": "dns.operator.openshift.io/daemonset-dns == 'default'", "ports": [ 5353 @@ -28,7 +28,7 @@ "action": "Allow", "protocol": "TCP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'openshift-dns'", + "namespaceSelector": "kubernetes.io/metadata.name == 'openshift-dns'", "selector": "dns.operator.openshift.io/daemonset-dns == 'default'", "ports": [ 5353 diff --git a/pkg/render/testutils/expected_policies/prometheus.json b/pkg/render/testutils/expected_policies/prometheus.json index 98041b84cf..4dea31b23f 100644 --- a/pkg/render/testutils/expected_policies/prometheus.json +++ b/pkg/render/testutils/expected_policies/prometheus.json @@ -29,7 +29,7 @@ "action": "Allow", "protocol": "UDP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'kube-system'", + "namespaceSelector": "kubernetes.io/metadata.name == 'kube-system'", "selector": "k8s-app in { 'kube-dns', 'coredns' }", "ports": [ 53 @@ -97,7 +97,7 @@ "action": "Allow", "protocol": "TCP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'tigera-dex'", + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-dex'", "selector": "k8s-app == 'tigera-dex'", "ports": [ 5556 diff --git a/pkg/render/testutils/expected_policies/prometheus_ocp.json b/pkg/render/testutils/expected_policies/prometheus_ocp.json index 96188a8b42..b862b126e0 100644 --- a/pkg/render/testutils/expected_policies/prometheus_ocp.json +++ b/pkg/render/testutils/expected_policies/prometheus_ocp.json @@ -29,7 +29,7 @@ "action": "Allow", "protocol": "UDP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'openshift-dns'", + "namespaceSelector": "kubernetes.io/metadata.name == 'openshift-dns'", "selector": "dns.operator.openshift.io/daemonset-dns == 'default'", "ports": [ 5353 @@ -40,7 +40,7 @@ "action": "Allow", "protocol": "TCP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'openshift-dns'", + "namespaceSelector": "kubernetes.io/metadata.name == 'openshift-dns'", "selector": "dns.operator.openshift.io/daemonset-dns == 'default'", "ports": [ 5353 @@ -108,7 +108,7 @@ "action": "Allow", "protocol": "TCP", "destination": { - "namespaceSelector": "projectcalico.org/name == 'tigera-dex'", + "namespaceSelector": "kubernetes.io/metadata.name == 'tigera-dex'", "selector": "k8s-app == 'tigera-dex'", "ports": [ 5556