Skip to content

policy: Add generic precedence support

Placeholder Jarno Rajahalme requested to merge github/fork/jrajahalme/pr/jrajahalme/policy-precedence into main

Generalize datapath precedence handling for deny and proxy redirect verdicts to use a generic precedence field. This allows building support k8s ClusterNetworkPolicies without further changes needed into the bpf datapath code.

Build support for ordered rule processing into policy package. Unit tests are added but API definition is left for further work.

Cilium policy engine now supports enforcing ordered policy rules.

Merge request reports