policy: Do not share same policy for multiple cached selectors

[jrajahalme]

Do not share the same PerSelectorPolicy object between multiple cached selectors. This makes sure that when rules are merged only the rules for the intended selectors are affected by the merging process.

Fixes: #9486

Fixed bug where L7 rules would be incorrectly merged between rules for the same (remote) endpoint. This bug could have caused L7 rules to be bypassed via a wildcard header rule being improperly appended to the set of HTTP rules when both a policy with HTTP header rules applying to multiple endpoints and an allow-all rule for only one of those endpoints are specified.

[jrajahalme]

/test

[jrajahalme]

/test-1.16-4.19

[pchaigno]

Fixed entanglement of complex L7 rules in policy ingestion.

Is there any user impact or is it more about simplifying the code? Label says it's the former, while the release note seems to say it's the latter.

[jrajahalme]

ci-eks is known to be broken (#24774), so please disregard that :-)

[jrajahalme]

Fixed entanglement of complex L7 rules in policy ingestion.

Is there any user impact or is it more about simplifying the code? Label says it's the former, while the release note seems to say it's the latter.

Yes, there is user impact when using policies of specific form as demonstrated by the added unit test.

[jrajahalme]

@pchaigno Made the release note more explicit.

[jrajahalme]

@liyihuang Marked this as a release blocker.

[pchaigno]

Fixed entanglement of complex L7 rules in policy ingestion.

Is there any user impact or is it more about simplifying the code? Label says it's the former, while the release note seems to say it's the latter.

Yes, there is user impact when using policies of specific form as demonstrated by the added unit test.

Thanks! It's now clear it's a bugfix but it's still hard to understand what is the impact for users. Does this lead to a policy bypass, to packet drops, to unnecessary proxy redirections, to a failure to apply the policy, etc.?

[pchaigno]

Release note needs to be fixed.

[gandro]

@jrajahalme This does not apply cleanly to any stable branches. I was able to fix it on v1.13, but the difference to 1.12 and 1.11 are larger. You will have to do the backport for 1.12 and 1.11 manually.