diff --git a/pkg/agent/controller/networkpolicy/fqdn.go b/pkg/agent/controller/networkpolicy/fqdn.go index 882eb2fa1c1..71846ea04e2 100644 --- a/pkg/agent/controller/networkpolicy/fqdn.go +++ b/pkg/agent/controller/networkpolicy/fqdn.go @@ -482,20 +482,18 @@ func (f *fqdnController) onDNSResponseMsg(dnsMsg *dns.Msg, lookupTime time.Time, // wait for another attempt of realization of these rules, before forwarding the response to the // original client. func (f *fqdnController) syncDirtyRules(fqdn string, waitCh chan error, addressUpdate bool) { + dirtyRules := sets.New[string]() + for selectorItem := range f.fqdnToSelectorItem[fqdn] { + utilsets.MergeString(dirtyRules, f.selectorItemToRuleIDs[selectorItem]) + } if waitCh == nil { if addressUpdate { - for selectorItem := range f.fqdnToSelectorItem[fqdn] { - for ruleID := range f.selectorItemToRuleIDs[selectorItem] { - klog.V(4).InfoS("Reconciling dirty rule", "ruleID", ruleID) - f.dirtyRuleHandler(ruleID) - } + for ruleID := range dirtyRules { + klog.V(4).InfoS("Reconciling dirty rule for FQDN address updates", "ruleID", ruleID) + f.dirtyRuleHandler(ruleID) } } } else { - dirtyRules := sets.New[string]() - for selectorItem := range f.fqdnToSelectorItem[fqdn] { - utilsets.MergeString(dirtyRules, f.selectorItemToRuleIDs[selectorItem]) - } if !addressUpdate { // If there is no address update for this FQDN, and rules selecting this FQDN // were all previously realized successfully, then there will be no dirty rules diff --git a/pkg/agent/controller/networkpolicy/fqdn_test.go b/pkg/agent/controller/networkpolicy/fqdn_test.go index 4a2e762f286..60923d2931d 100644 --- a/pkg/agent/controller/networkpolicy/fqdn_test.go +++ b/pkg/agent/controller/networkpolicy/fqdn_test.go @@ -395,6 +395,10 @@ func TestSyncDirtyRules(t *testing.T) { selectorItem2 := fqdnSelectorItem{ matchName: testFQDN2, } + testFQDN3 := "*antrea.io" + selectorItem3 := fqdnSelectorItem{ + matchRegex: testFQDN3, + } tests := []struct { name string fqdnsToSync []string @@ -482,10 +486,13 @@ func TestSyncDirtyRules(t *testing.T) { dirtyRuleSyncCalls = append(dirtyRuleSyncCalls, s) } f.addFQDNSelector("1", []string{testFQDN}) + f.addFQDNSelector("1", []string{testFQDN3}) f.addFQDNSelector("2", []string{testFQDN}) f.addFQDNSelector("2", []string{testFQDN2}) f.setFQDNMatchSelector(testFQDN, selectorItem) f.setFQDNMatchSelector(testFQDN2, selectorItem2) + f.setFQDNMatchSelector(testFQDN, selectorItem3) + f.setFQDNMatchSelector(testFQDN2, selectorItem3) // This simulates failed rule syncs in previous syncDirtyRules() calls if len(tc.prevDirtyRules) > 0 { f.ruleSyncTracker.dirtyRules = tc.prevDirtyRules