Skip to content

Conversation

shirmoran
Copy link
Collaborator

@shirmoran shirmoran commented Aug 26, 2025

Current issue: when the service.Spec.Selector is empty, the labels.SelectorFromSet function return a label that matches all pods. Than, when listing the pods based on the label we check pods which do not match the service.
This issue seems to be the cause of the following bug: OCPBUGS-59836

This PR adds a check whether the service's selector is empty.
if the selector is empty:

  • if the service is internal, than skip this service when adding EPS.
  • else (extrnal service), we will add all of the ports in the EPS to communication matrix.

if the selector is not empty, we will continue in manner we have checked open ports up until now.
See the chart explaining the entire flow of the communication matrix creation:
image

@openshift-ci openshift-ci bot requested review from oribon and SchSeba August 26, 2025 13:32
Copy link

openshift-ci bot commented Aug 26, 2025

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: shirmoran
Once this PR has been reviewed and has the lgtm label, please assign schseba for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@shirmoran shirmoran force-pushed the handle-svc-empty-selector branch 2 times, most recently from 5551261 to bdb60f5 Compare August 27, 2025 06:34
@weliang1
Copy link

weliang1 commented Sep 2, 2025

/test commatrix-e2e-tests

Copy link

openshift-ci bot commented Sep 2, 2025

@weliang1: The specified target(s) for /test were not found.
The following commands are available to trigger required jobs:

/test commatrix-e2e-tests-1of2
/test commatrix-e2e-tests-2of2
/test lint
/test unit-test

The following commands are available to trigger optional jobs:

/test images
/test security

Use /test all to run all jobs.

In response to this:

/test commatrix-e2e-tests

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@shirmoran
Copy link
Collaborator Author

/test commatrix-e2e-tests-2of2

@shirmoran
Copy link
Collaborator Author

/retest

@shirmoran shirmoran force-pushed the handle-svc-empty-selector branch from bdb60f5 to c63cd91 Compare September 3, 2025 12:05
@shirmoran shirmoran requested a review from SchSeba September 3, 2025 12:06
Copy link

openshift-ci bot commented Sep 3, 2025

@shirmoran: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/commatrix-e2e-tests bdb60f5 link true /test commatrix-e2e-tests

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Current issue: when the service.Spec.Selector is empty, the
labels.SelectorFromSet function return a label that matches all pods.
Than, when listing the pods based on the label we check pods which do
not match the service.
This PR adds a check whether the service's selector is empty.
if the selector is empty:
- if the service is internal, than skip this service when adding EPS.
- else (extrnal service), we will add all of the ports in
the EPS to communication matrix.
if the selector is not empty, we will continue in manner we have checked
open ports up until now. a chart explaining the entire flow of the
communication matrix creation is added to the description of the PR.
@shirmoran shirmoran force-pushed the handle-svc-empty-selector branch from c63cd91 to 73acfce Compare September 3, 2025 13:38
@shirmoran shirmoran changed the title Handle services with empty selectors OCPBUGS-59836: Handle services with empty selectors Sep 4, 2025
@openshift-ci-robot
Copy link

@shirmoran: This pull request references Jira Issue OCPBUGS-59836, which is invalid:

  • expected the bug to target the "4.21.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

Current issue: when the service.Spec.Selector is empty, the labels.SelectorFromSet function return a label that matches all pods. Than, when listing the pods based on the label we check pods which do not match the service.
This issue seems to be the cause of the following bug: OCPBUGS-59836

This PR adds a check whether the service's selector is empty.
if the selector is empty:

  • if the service is internal, than skip this service when adding EPS.
  • else (extrnal service), we will add all of the ports in the EPS to communication matrix.

if the selector is not empty, we will continue in manner we have checked open ports up until now.
See the chart explaining the entire flow of the communication matrix creation:
image

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@shirmoran
Copy link
Collaborator Author

/jira refresh

@openshift-ci-robot
Copy link

@shirmoran: This pull request references Jira Issue OCPBUGS-59836, which is invalid:

  • expected the bug to target the "4.21.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@shirmoran
Copy link
Collaborator Author

/jira refresh

@openshift-ci-robot
Copy link

@shirmoran: This pull request references Jira Issue OCPBUGS-59836, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug
  • bug is open, matching expected state (open)
  • bug target version (4.21.0) matches configured target version for branch (4.21.0)
  • bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)

No GitHub users were found matching the public email listed for the QA contact in Jira ([email protected]), skipping review request.

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants