Fix namespace matching for firewallgroups in firewallpolicies

Merge pull request 'feature/add-namespace-to-firewallgroup-and-firewallpolicy-resources' (#29 ) from feature/add-namespace-to-firewallgroup-and-firewallpolicy-resources into main
Reviewed-on: #29
2025-06-28 18:33:54 +02:00 · 2025-06-27 15:48:14 +00:00 · 2025-06-27 17:01:55 +02:00 · 2025-06-27 16:53:44 +02:00 · 2025-06-27 16:51:05 +02:00 · 2025-06-27 16:46:45 +02:00
5 changed files with 30 additions and 33 deletions
--- a/.gitea/workflows/build.yaml
+++ b/.gitea/workflows/build.yaml
@@ -6,7 +6,7 @@ on:
 jobs:
  build:
    runs-on: ubuntu-latest
-    container: golang:1.24
+    container: registry.engen.priv.no/gitea-build:0.1.0
    steps:
       - name: Setup SSH
         run: |
--- a/.gitea/workflows/kobuild.yaml
+++ b/.gitea/workflows/kobuild.yaml
@@ -6,7 +6,12 @@ on:
 jobs:
  build:
    runs-on: ubuntu-latest
-    container: golang:1.24
+    container: registry.engen.priv.no/gitea-build:0.1.0
+    env:
+      GITEA_USER: ${{ secrets.GITEAUSER }}
+      GITEA_TOKEN: ${{ secrets.GITEATOKEN }}
+      GITEA_REGISTRY: gitea.engen.priv.no
+      GITEA_ORG: klauvsteinen
    steps:
      - name: Setup SSH
        run: |
@@ -14,27 +19,23 @@ jobs:
          echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_rsa
          chmod 600 ~/.ssh/id_rsa
          ssh-keyscan gitea-ssh.engen.priv.no >> ~/.ssh/known_hosts
-      - name: Install node and go
-        run: apt update && apt -y install nodejs
      - name: Check out repository code
        uses: actions/checkout@v4
      - name: ssh repo
        run: git config --global url.git@gitea-ssh.engen.priv.no:.insteadOf https://gitea.engen.priv.no/
-      - name: Install ko
-        run: go install github.com/google/ko@latest
      - name: Docker login
        run: echo "${GITEA_TOKEN}" | docker login "${GITEA_REGISTRY}" --username "${GITEA_USER}" --password-stdin
      - name: Build
        run: |
-         export KO_DOCKER_REPO="${GITEA_REGISTRY}/${GITEA_ORG}/unifi-network-operator-controller"
-         ko publish ./cmd \
-         --tags "latest" \
-         --image-label 'org.opencontainers.image.authors=Klauvsteinen <vegard@engen.priv.no>' \
-         --image-label 'org.opencontainers.image.vendor=Klauvsteinen' \
-         --image-label 'org.opencontainers.image.source=https://gitea.engen.priv.no/klauvsteinen/unifi-network-operator' \
-         --image-label 'org.opencontainers.image.url=https://gitea.engen.priv.no/klauvsteinen/unifi-network-operator' \
-         --image-label 'dev.chainguard.package.main=' \
-         --bare
+          export KO_DOCKER_REPO="${GITEA_REGISTRY}/${GITEA_ORG}/unifi-network-operator-controller"
+          ko publish ./cmd \
+          --tags "latest" \
+          --image-label 'org.opencontainers.image.authors=Klauvsteinen <vegard@engen.priv.no>' \
+          --image-label 'org.opencontainers.image.vendor=Klauvsteinen' \
+          --image-label 'org.opencontainers.image.source=https://gitea.engen.priv.no/klauvsteinen/unifi-network-operator' \
+          --image-label 'org.opencontainers.image.url=https://gitea.engen.priv.no/klauvsteinen/unifi-network-operator' \
+          --image-label 'dev.chainguard.package.main=' \
+          --bare
      - name: Build manifest
        run: |
          make IMG="${GITEA_REGISTRY}/${GITEA_ORG}/unifi-network-operator-controller:latest" build-installer
--- a/.gitea/workflows/publish.yaml
+++ b/.gitea/workflows/publish.yaml
@@ -8,15 +8,13 @@ on:
 jobs:
  build:
    runs-on: ubuntu-latest
-    container: golang:1.24-bookworm
+    container: registry.engen.priv.no/gitea-build:0.1.0
    env:
      GITEA_USER: ${{ secrets.GITEAUSER }}
      GITEA_TOKEN: ${{ secrets.GITEATOKEN }}
      GITEA_REGISTRY: gitea.engen.priv.no
      GITEA_ORG: klauvsteinen
    steps:
-      - name: Install dependencies
-        run: apt update && apt -y install nodejs bash docker.io
      - name: Setup SSH
        run: |
          mkdir -p ~/.ssh
@@ -27,8 +25,6 @@ jobs:
        uses: actions/checkout@v4
      - name: ssh repo
        run: git config --global url.git@gitea-ssh.engen.priv.no:.insteadOf https://gitea.engen.priv.no/
-      - name: Install ko
-        run: go install github.com/google/ko@latest
      - name: Extract tag (outside container)
        shell: bash
        run: |
--- a/internal/controller/firewallgroup_controller.go
+++ b/internal/controller/firewallgroup_controller.go
@@ -361,10 +361,10 @@ func (r *FirewallGroupReconciler) Reconcile(ctx context.Context, req reconcile.R
 		log.Error(err, "Could not list network objects")
 		return reconcile.Result{}, err
 	}
-	ipv4_name := "k8s-" + firewallGroup.Spec.Name + "-ipv4"
-	ipv6_name := "k8s-" + firewallGroup.Spec.Name + "-ipv6"
-	tcpports_name := "k8s-" + firewallGroup.Spec.Name + "-tcpports"
-	udpports_name := "k8s-" + firewallGroup.Spec.Name + "-udpports"
+	ipv4_name := "k8s-" + firewallGroup.Namespace + "/" + firewallGroup.Name + "-ipv4"
+	ipv6_name := "k8s-" + firewallGroup.Namespace + "/" + firewallGroup.Name + "-ipv6"
+	tcpports_name := "k8s-" + firewallGroup.Namespace + "/" + firewallGroup.Name + "-tcpports"
+	udpports_name := "k8s-" + firewallGroup.Namespace + "/" + firewallGroup.Name + "-udpports"
 	ipv4_done := false
 	ipv6_done := false
 	tcpports_done := false
--- a/internal/controller/firewallpolicy_controller.go
+++ b/internal/controller/firewallpolicy_controller.go
@@ -340,7 +340,7 @@ func (r *FirewallPolicyReconciler) Reconcile(ctx context.Context, req ctrl.Reque
 				skipService = true
 			}
 		}
-		if val, found := service.Annotations["unifi.engen.priv.no/firewall-policy"]; found && ((strings.Contains(val, "/") && val == firewallPolicy.Namespace+"/"+firewallPolicy.Name) || (val == firewallPolicy.Name && firewallPolicy.Namespace == defaultNs)) && !skipService {
+		if val, found := service.Annotations["unifi.engen.priv.no/firewall-policy"]; found && ((strings.Contains(val, "/") && val == firewallPolicy.Namespace+"/"+firewallPolicy.Name) || (val == firewallPolicy.Name && firewallPolicy.Namespace == service.Namespace)) && !skipService {
 			myServices = append(myServices, service)
 		} else if _, found := destination_services[service.Namespace+"/"+service.Name]; found && !skipService {
 			myServices = append(myServices, service)
@@ -468,7 +468,7 @@ func (r *FirewallPolicyReconciler) Reconcile(ctx context.Context, req ctrl.Reque

 				if len(firewallGroup.Status.ResolvedIPV4Addresses) > 0 {
 					if len(firewallGroup.Status.ResolvedTCPPorts) > 0 {
-						policyname := "k8s-fw-" + firewallPolicy.Name + "-" + "zone:" + zoneCRDs.Items[zoneIndex].Name + "-" + firewallGroup.Name + "-ipv4-tcp"
+						policyname := "k8s-fw-" + firewallPolicy.Namespace + "/" + firewallPolicy.Name + "-" + "zone:" + zoneCRDs.Items[zoneIndex].Name + "-" + firewallGroup.Name + "-ipv4-tcp"
 						if _, found := unifiFirewallpolicyNames[policyname]; !found {
 							log.Info(fmt.Sprintf("Creating ipv4 tcp firewallpolicy for %s to %s: %s", zoneCRDs.Items[zoneIndex].Name, firewallGroup.Name, policyname))
 							unifiFirewallPolicy := fillDefaultPolicy()
@@ -503,7 +503,7 @@ func (r *FirewallPolicyReconciler) Reconcile(ctx context.Context, req ctrl.Reque
 						}
 					}
 					if len(firewallGroup.Status.ResolvedUDPPorts) > 0 {
-						policyname := "k8s-fw-" + firewallPolicy.Name + "-" + "zone:" + zoneCRDs.Items[zoneIndex].Name + "-" + firewallGroup.Name + "-ipv4-udp"
+						policyname := "k8s-fw-" + firewallPolicy.Namespace + "/" + firewallPolicy.Name + "-" + "zone:" + zoneCRDs.Items[zoneIndex].Name + "-" + firewallGroup.Name + "-ipv4-udp"
 						if _, found := unifiFirewallpolicyNames[policyname]; !found {
 							log.Info(fmt.Sprintf("Creating ipv4 udp firewallpolicy for %s to %s: %s", zoneCRDs.Items[zoneIndex].Name, firewallGroup.Name, policyname))
 							unifiFirewallPolicy := fillDefaultPolicy()
@@ -541,7 +541,7 @@ func (r *FirewallPolicyReconciler) Reconcile(ctx context.Context, req ctrl.Reque
 				}
 				if len(firewallGroup.Status.ResolvedIPV6Addresses) > 0 {
 					if len(firewallGroup.Status.ResolvedTCPPorts) > 0 {
-						policyname := "k8s-fw-" + firewallPolicy.Name + "-" + "zone:" + zoneCRDs.Items[zoneIndex].Name + "-" + firewallGroup.Name + "-ipv6-tcp"
+						policyname := "k8s-fw-" + firewallPolicy.Namespace + "/" + firewallPolicy.Name + "-" + "zone:" + zoneCRDs.Items[zoneIndex].Name + "-" + firewallGroup.Name + "-ipv6-tcp"
 						if _, found := unifiFirewallpolicyNames[policyname]; !found {
 							log.Info(fmt.Sprintf("Creating ipv6 tcp firewallpolicy for %s to %s: %s", zoneCRDs.Items[zoneIndex].Name, firewallGroup.Name, policyname))
 							unifiFirewallPolicy := fillDefaultPolicy()
@@ -577,7 +577,7 @@ func (r *FirewallPolicyReconciler) Reconcile(ctx context.Context, req ctrl.Reque
 						}
 					}
 					if len(firewallGroup.Status.ResolvedUDPPorts) > 0 {
-						policyname := "k8s-fw-" + firewallPolicy.Name + "-" + "zone:" + zoneCRDs.Items[zoneIndex].Name + "-" + firewallGroup.Name + "-ipv6-udp"
+						policyname := "k8s-fw-" + firewallPolicy.Namespace + "/" + firewallPolicy.Name + "-" + "zone:" + zoneCRDs.Items[zoneIndex].Name + "-" + firewallGroup.Name + "-ipv6-udp"
 						if _, found := unifiFirewallpolicyNames[policyname]; !found {
 							log.Info(fmt.Sprintf("Creating ipv6 udp firewallpolicy for %s to %s: %s", zoneCRDs.Items[zoneIndex].Name, firewallGroup.Name, policyname))
 							unifiFirewallPolicy := fillDefaultPolicy()
@@ -640,7 +640,7 @@ func (r *FirewallPolicyReconciler) Reconcile(ctx context.Context, req ctrl.Reque
 				}
 				if len(firewallGroup.Status.ResolvedIPV4Addresses) > 0 {
 					if len(firewallGroup.Status.ResolvedTCPPorts) > 0 {
-						policyname := "k8s-fw-" + firewallPolicy.Name + "-" + "network:" + networkCRDs.Items[networkIndex].Name + "-" + firewallGroup.Name + "-ipv4-tcp"
+						policyname := "k8s-fw-" + firewallPolicy.Namespace + "/" + firewallPolicy.Name + "-" + "network:" + networkCRDs.Items[networkIndex].Name + "-" + firewallGroup.Name + "-ipv4-tcp"
 						if _, found := unifiFirewallpolicyNames[policyname]; !found {
 							log.Info(fmt.Sprintf("Creating ipv4 tcp firewallpolicy for %s to %s: %s", networkCRDs.Items[networkIndex].Name, firewallGroup.Name, policyname))
 							unifiFirewallPolicy := fillDefaultPolicy()
@@ -677,7 +677,7 @@ func (r *FirewallPolicyReconciler) Reconcile(ctx context.Context, req ctrl.Reque
 						}
 					}
 					if len(firewallGroup.Status.ResolvedUDPPorts) > 0 {
-						policyname := "k8s-fw-" + firewallPolicy.Name + "-" + "network:" + networkCRDs.Items[networkIndex].Name + "-" + firewallGroup.Name + "-ipv4-udp"
+						policyname := "k8s-fw-" + firewallPolicy.Namespace + "/" + firewallPolicy.Name + "-" + "network:" + networkCRDs.Items[networkIndex].Name + "-" + firewallGroup.Name + "-ipv4-udp"
 						if _, found := unifiFirewallpolicyNames[policyname]; !found {
 							log.Info(fmt.Sprintf("Creating ipv4 udp firewallpolicy for %s to %s: %s", networkCRDs.Items[networkIndex].Name, firewallGroup.Name, policyname))
 							unifiFirewallPolicy := fillDefaultPolicy()
@@ -716,7 +716,7 @@ func (r *FirewallPolicyReconciler) Reconcile(ctx context.Context, req ctrl.Reque
 				}
 				if len(firewallGroup.Status.ResolvedIPV6Addresses) > 0 {
 					if len(firewallGroup.Status.ResolvedTCPPorts) > 0 {
-						policyname := "k8s-fw-" + firewallPolicy.Name + "-" + "network:" + networkCRDs.Items[networkIndex].Name + "-" + firewallGroup.Name + "-ipv6-tcp"
+						policyname := "k8s-fw-" + firewallPolicy.Namespace + "/" + firewallPolicy.Name + "-" + "network:" + networkCRDs.Items[networkIndex].Name + "-" + firewallGroup.Name + "-ipv6-tcp"
 						if _, found := unifiFirewallpolicyNames[policyname]; !found {
 							log.Info(fmt.Sprintf("Creating ipv6 tcp firewallpolicy for %s to %s: %s", networkCRDs.Items[networkIndex].Name, firewallGroup.Name, policyname))
 							unifiFirewallPolicy := fillDefaultPolicy()
@@ -753,7 +753,7 @@ func (r *FirewallPolicyReconciler) Reconcile(ctx context.Context, req ctrl.Reque
 						}
 					}
 					if len(firewallGroup.Status.ResolvedUDPPorts) > 0 {
-						policyname := "k8s-fw-" + firewallPolicy.Name + "-" + "network:" + networkCRDs.Items[networkIndex].Name + "-" + firewallGroup.Name + "-ipv6-udp"
+						policyname := "k8s-fw-" + firewallPolicy.Namespace + "/" + firewallPolicy.Name + "-" + "network:" + networkCRDs.Items[networkIndex].Name + "-" + firewallGroup.Name + "-ipv6-udp"
 						if _, found := unifiFirewallpolicyNames[policyname]; !found {
 							log.Info(fmt.Sprintf("Creating ipv6 udp firewallpolicy for %s to %s: %s", networkCRDs.Items[networkIndex].Name, firewallGroup.Name, policyname))
 							unifiFirewallPolicy := fillDefaultPolicy()
Author	SHA1	Message	Date
Vegard Engen	938d53fa8f	Fix namespace matching for firewallgroups in firewallpolicies All checks were successful Build project / build (push) Successful in 1m55s Details Publish / build (push) Successful in 2m5s Details	2025-06-28 18:33:54 +02:00
Vegard Engen	768c61020e	Merge pull request 'feature/add-namespace-to-firewallgroup-and-firewallpolicy-resources' (#29 ) from feature/add-namespace-to-firewallgroup-and-firewallpolicy-resources into main All checks were successful Publish / build (push) Successful in 1m58s Details Reviewed-on: #29	2025-06-27 15:48:14 +00:00
Vegard Engen	8d70a78a50	fix All checks were successful Build project / build (push) Successful in 1m47s Details Publish / build (push) Successful in 1m59s Details	2025-06-27 17:01:55 +02:00
Vegard Engen	5885daac55	Fix Some checks failed Build project / build (push) Failing after 1m9s Details Publish / build (push) Failing after 1m19s Details	2025-06-27 16:53:44 +02:00
Vegard Engen	440dc04e5b	Add namespace to some names Some checks failed Build project / build (push) Failing after 1m10s Details Publish / build (push) Failing after 1m21s Details	2025-06-27 16:51:05 +02:00
Vegard Engen	22c8df6833	Add namespace to name of firewallgroups	2025-06-27 16:46:45 +02:00
Vegard Engen	35d95d107c	Merge pull request 'Use pre-built image' (#28 ) from feature/use-prebuilt-image into main Some checks failed Publish / build (push) Has been cancelled Details Reviewed-on: #28	2025-06-26 23:49:34 +00:00
Vegard Engen	4bb45b0128	Use pre-built image Some checks failed Build project / build (push) Has been cancelled Details Publish / build (push) Successful in 1m54s Details	2025-06-27 01:47:15 +02:00
Vegard Engen	9eefd08823	Merge pull request 'Add variables' (#27 ) from feature/fix-indentation into main Some checks failed Build project / build (push) Has been cancelled Details Publish / build (push) Has been cancelled Details Reviewed-on: #27	2025-06-26 23:36:27 +00:00
Vegard Engen	d53810b714	Add variables Some checks failed Build project / build (push) Has been cancelled Details	2025-06-27 01:36:01 +02:00
Vegard Engen	33f1fd5eac	Merge pull request 'Need docker on main build' (#26 ) from feature/fix-indentation into main Some checks failed Publish / build (push) Failing after 2m21s Details Reviewed-on: #26	2025-06-26 23:28:36 +00:00
Vegard Engen	9ae7d91365	Need docker on main build Some checks failed Build project / build (push) Has been cancelled Details	2025-06-27 01:28:01 +02:00
Vegard Engen	6fe5fdf859	Merge pull request 'Fix indentation' (#25 ) from feature/fix-indentation into main Some checks failed Publish / build (push) Failing after 1m9s Details Reviewed-on: #25	2025-06-26 23:24:16 +00:00
Vegard Engen	37b5eb830a	Fix indentation Some checks failed Build project / build (push) Has been cancelled Details	2025-06-27 01:23:49 +02:00
Vegard Engen	1834527d43	feature/create-correct-manifests (#23 ) Reviewed-on: #23	2025-06-26 23:19:55 +00:00