…tables

Add pod-iptables option to store pod iptables

Fix some timing issue and change memory limit

Add namespace check between pod and multi-networkpolicy

Add ginkgo test to the suite with only default values.
Add `renderProtocol` function with fallback logic.

Signed-off-by: Andrea Panattoni <apanatto@redhat.com>

Use TCP as default for Port.Protocol

Fix to work namespacveSelector policy, without labelSelector

* Add test case for namespace selector

The case is about having two namespaces with pods
and net-attach-def and a multi networkpolicy that
goes through namespace borders.

Signed-off-by: Andrea Panattoni <apanatto@redhat.com>

* Add test case with net-attach-def in other ns

Signed-off-by: Andrea Panattoni <apanatto@redhat.com>

* Add object information to update events

This should make it clearer what k8s object the
daemon is working on.

Increase verbosity threshlod for invoke handlers logs.

Signed-off-by: Andrea Panattoni <apanatto@redhat.com>

* Improve error logging

Signed-off-by: Andrea Panattoni <apanatto@redhat.com>

"go getting" github.com/mgechev/revive can lead to unreproducible
builds, as it download the latest "dev" version. Stick to the latest
(v1.2.1) version.

Signed-off-by: Andrea Panattoni <apanatto@redhat.com>

* Log filter rules

Logging iptables rules before applying them
can be useful to debug complex scenarios.
Setting verbosity level to 6 as they can be
quite cumbersome.

Signed-off-by: Andrea Panattoni <apanatto@redhat.com>

* Clean up logging code

Signed-off-by: Andrea Panattoni <apanatto@redhat.com>

This change refines policy rule generation to introduce conntrack
and support multiple policies in a pod. Fix openshift#17 and openshift#18

fix openshift#24

Refine policy generation routine to support multiple policies

Update github action to fit to latest golang

Remove docker from support runtime due to obsolated

…t#31)

Bumps [github.com/containernetworking/cni](https://github.com/containernetworking/cni) from 0.7.1 to 0.8.1.
- [Release notes](https://github.com/containernetworking/cni/releases)
- [Commits](containernetworking/cni@v0.7.1...v0.8.1)

---
updated-dependencies:
- dependency-name: github.com/containernetworking/cni
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps google.golang.org/protobuf from 1.30.0 to 1.33.0.

---
updated-dependencies:
- dependency-name: google.golang.org/protobuf
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

If a policy rule has a `from` (or `to`) selector that matches no pods,
the subject pod has to not be reached by  (or has to not reach) any pods.

The following example helps clarify the reasons behind these:
Given a scenario  with 3 pods (A, B, C) and a rule like:
```
podSelector:
    matchLabels:
      name: A
  ingress:
  - from:
    - podSelector:
        matchLabels:
          name: B
  policyTypes:
  - Ingress
```
Pod A can be reached only by pod B. Pod C can't reach A, and this has to be
ensured even if pod B is deleted.

Add an end-to-end test case to validate this scenario and adjust unit
tests accordingly.

Signed-off-by: Andrea Panattoni <apanatto@redhat.com>

Signed-off-by: Andrea Panattoni <apanatto@redhat.com>

Make sure that policies with no valid peers are enforced