Policy matching subset dimensions

[jakubdyszkiewicz]

What happened?

			PEntry("n dimensions rules and n-1 dimensions subsets", testCase{
				rules: core_rules.Rules{
					{
						Subset: []core_rules.Tag{
							{Key: "key1", Value: "val1"},
							{Key: "key2", Value: "val1", Not: true},
						},
						Conf: meshtrafficpermission_api.Conf{
							Action: "Allow",
						},
					},
				},
				subset: []core_rules.Tag{
					{Key: "key1", Value: "val1"},
				},
				confYAML: []byte(`action: Allow`),
			}),

This test fails for Compute. I expected this to pass.

@lobkovilya for details how to fix this. We talked offline and the current idea is to

• Introduce function like IsSubset, such as it ignores not tags
• Change Compute to use this new function

[github-actions]

This issue was inactive for 90 days. It will be reviewed in the next triage meeting and might be closed.
If you think this issue is still relevant, please comment on it or attend the next triage meeting.

[github-actions]

This issue was inactive for 90 days. It will be reviewed in the next triage meeting and might be closed.
If you think this issue is still relevant, please comment on it or attend the next triage meeting.

[github-actions]

This issue was inactive for 90 days. It will be reviewed in the next triage meeting and might be closed.
If you think this issue is still relevant, please comment on it or attend the next triage meeting.

[github-actions]

This issue was inactive for 90 days. It will be reviewed in the next triage meeting and might be closed.
If you think this issue is still relevant, please comment on it or attend the next triage meeting.

[lahabana]

Duplicate of #12273

[Icarus9913]

More detail case:

I have one MTP:

apiVersion: kuma.io/v1alpha1
kind: MeshTrafficPermission
metadata:
  name: mtp-allow-kuma-one
  namespace: kuma-system
  labels:
    kuma.io/mesh: default
spec:
  targetRef:
    kind: Mesh
  from:
  - targetRef:
      kind: MeshSubset
      tags:
        k8s.kuma.io/namespace: kuma-one
    default:
      action: Allow
  - targetRef:
      kind: MeshSubset
      tags:
        app: demo
        k8s.kuma.io/namespace: kuma-one
    default:
      action: Deny

And the detail rules:

rule: rules.Rule{Subset:rules.Subset{rules.Tag{Key:"app", Not:false, Value:"demo"}, 
                                      rules.Tag{Key:"k8s.kuma.io/namespace", Not:false, Value:"kuma-one"}}, 
                                      Conf:v1alpha1.Conf{Action:"Deny"}} 

rule: rules.Rule{Subset:rules.Subset{rules.Tag{Key:"app", Not:true, Value:"demo"}, 
                                      rules.Tag{Key:"k8s.kuma.io/namespace", Not:false, Value:"kuma-one"}}, 
                                      Conf:v1alpha1.Conf{Action:"Allow"}}

Then, my DataplaneTags:

 k8s.kuma.io/namespace: kuma-one

So, this should get Allow action.