With NetworkPolicy v1, there is no longer a "DefaultDeny" annotation, and instead, pods are isolated if and only if there is a NetworkPolicy selecting them. This updates for that.

First, when parsing NetworkPolicies, we note which pod IPs they select. Then when updating OVS, we output the "accept" flows for all the policies at priority=150, while also checking if any policy selects the entire Namespace. If there is not a policy that selects the entire Namespace, then that means there are potentially un-isolated pods that are default-accept rather than default-deny, so we also output a priority=100, actions=drop flow for each IP mentioned in any of the "accept" flows, and a priority=50 flow accepting all other traffic in the namespace. (If there is a policy that selects the entire Namespace, then any traffic not accepted by any NetworkPolicy is denied, so we don't need any other rules because the base priority=0, actions=drop rule will do the right thing.)

We may want to revisit this and optimize it further later. In particular, it's inefficient if you have a different NetworkPolicy for each pod in a Namespace (and no match-all policies, and no unmatched pods). We could fix that by having explicit "accept" rules for unmatched pods rather than explicit "deny" rules for matched pods. That would have required more rewriting though, and it only matters in the case where you don't have a "default deny" policy anyway.

(Note to self: needs release note)

@openshift/networking PTAL