Skip to content

Conversation

@greninja517
Copy link

Description

This PR optimizes the NetworkPolicy reconciliation logic with following changes:

  • Conditional NetworkPolicy updates: Use equality.Semantic.DeepEqual() to compare specs and only update when different
  • Reduced logging frequency: Move logs and events outside the reconciliation loop
  • Smart status updates: Only update NetworkPoliciesInstalled when the field value actually changes
  • Better error handling: Continue processing all namespaces even if some fail

No breaking changes - all existing functionality preserved with improved performance

Fixes #372

How Has This Been Tested?

Checklist:

  • The title of the PR states what changed and the related issues number (used for the release note).
  • Does this PR requires documentation updates?
  • I've updated documentation as required by this PR.
  • I have ran go fmt
  • I have updated the helm chart as required by this PR.
  • I have performed a self-review of my own code.
  • I have commented my code, particularly in hard-to-understand areas.
  • I have tested it for all user roles.
  • I have added all the required unit test cases.
  • I have verified the E2E test cases with new code changes.
  • I have added all the required E2E test cases.

Does this PR introduce a breaking change?


…lls and reduce log noise

Signed-off-by: anjal <anjalpoudel517+github@gmail.com>
Signed-off-by: anjal <anjalpoudel517+github@gmail.com>
}
}

if len(errors) > 0 {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

with this change we return an error after we have set the NetworkPoliciesInstalled status to true above even when only a part of the list of namespaces have the policies installed.

I would suggest to keep the current idea of keeping the NetworkPoliciesInstalled status to be false even when there is partial failure. Otherwise this gives the wrong impression to a regular user that all namespaces are network isolated according to the plan.

Copy link
Author

@greninja517 greninja517 Aug 27, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@gourishkb , I was about to implement the same but here https://github.com/kubeslice/worker-operator/blob/master/api/v1beta1/slice_types.go#L131-L133, it is mentioned that slice.Status.NetworkPoliciesInstalled signifies at least one namespace has successfully NetworkPolicies installed. So, I have implemented the above approach.

Should I keep this slice.status.NetworkPoliciesInstalled value false even if there is partial failure ?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Bug: Refactor NetworkPolicy reconciler

2 participants