fix(meshtrafficpermission): nil pointer for autoreachableservice when…

… no top targetRef (backport of #12152) (#12161) fix(meshtrafficpermission): nil pointer for autoreachableservice when no top targetRef (#12152) Signed-off-by: Lukasz Dziedziak <[email protected]> Co-authored-by: Lukasz Dziedziak <[email protected]>
kumahq · Dec 3, 2024 · a5e212d · a5e212d
1 parent 3cb0830
commit a5e212d
Show file tree

Hide file tree

Showing 4 changed files with 18 additions and 2 deletions.
diff --git a/pkg/plugins/policies/meshtrafficpermission/graph/backends/reachable_backend_refs_graph.go b/pkg/plugins/policies/meshtrafficpermission/graph/backends/reachable_backend_refs_graph.go
@@ -41,7 +41,7 @@ func BuildRules(meshServices []*ms_api.MeshServiceResource, mtps []*mtp_api.Mesh
 func trimNotSupportedTags(mtps []*mtp_api.MeshTrafficPermissionResource, supportedTags map[string]string) []*mtp_api.MeshTrafficPermissionResource {
 	newMtps := make([]*mtp_api.MeshTrafficPermissionResource, len(mtps))
 	for i, mtp := range mtps {
-		if len(mtp.Spec.TargetRef.Tags) > 0 {
+		if mtp.Spec != nil && mtp.Spec.TargetRef != nil && len(mtp.Spec.TargetRef.Tags) > 0 {
 			filteredTags := map[string]string{}
 			for tag, val := range mtp.Spec.TargetRef.Tags {
 				if _, ok := supportedTags[tag]; ok {

diff --git a/pkg/plugins/policies/meshtrafficpermission/graph/reachable_backend_refs_graph_test.go b/pkg/plugins/policies/meshtrafficpermission/graph/reachable_backend_refs_graph_test.go
@@ -72,6 +72,14 @@ var _ = Describe("Reachable Backends Graph", func() {
 			},
 			expectedFromAll: fromAllServices,
 		}),
+		Entry("allow all no top targetRef", testCase{
+			mtps: []*v1alpha1.MeshTrafficPermissionResource{
+				builders.MeshTrafficPermission().
+					AddFrom(builders.TargetRefMesh(), v1alpha1.Allow).
+					Build(),
+			},
+			expectedFromAll: fromAllServices,
+		}),
 		Entry("deny all", testCase{
 			mtps: []*v1alpha1.MeshTrafficPermissionResource{
 				builders.MeshTrafficPermission().

diff --git a/pkg/plugins/policies/meshtrafficpermission/graph/reachable_services_graph_test.go b/pkg/plugins/policies/meshtrafficpermission/graph/reachable_services_graph_test.go
@@ -61,6 +61,14 @@ var _ = Describe("Reachable Services Graph", func() {
 			},
 			expectedFromAll: fromAllServices,
 		}),
+		Entry("allow all no top targetRef", testCase{
+			mtps: []*v1alpha1.MeshTrafficPermissionResource{
+				builders.MeshTrafficPermission().
+					AddFrom(builders.TargetRefMesh(), v1alpha1.Allow).
+					Build(),
+			},
+			expectedFromAll: fromAllServices,
+		}),
 		Entry("deny all", testCase{
 			mtps: []*v1alpha1.MeshTrafficPermissionResource{
 				builders.MeshTrafficPermission().

diff --git a/pkg/plugins/policies/meshtrafficpermission/graph/services/reachable_services_graph.go b/pkg/plugins/policies/meshtrafficpermission/graph/services/reachable_services_graph.go
@@ -92,7 +92,7 @@ func BuildRules(services map[string]mesh_proto.SingleValueTagSet, mtps []*mtp_ap
 func trimNotSupportedTags(mtps []*mtp_api.MeshTrafficPermissionResource) []*mtp_api.MeshTrafficPermissionResource {
 	newMtps := make([]*mtp_api.MeshTrafficPermissionResource, len(mtps))
 	for i, mtp := range mtps {
-		if len(mtp.Spec.TargetRef.Tags) > 0 {
+		if mtp.Spec != nil && mtp.Spec.TargetRef != nil && len(mtp.Spec.TargetRef.Tags) > 0 {
 			filteredTags := map[string]string{}
 			for tag, val := range mtp.Spec.TargetRef.Tags {
 				if _, ok := SupportedTags[tag]; ok {