Meta issue to capture all efforts around policy enforcement validation, testing and completion.

Immediate fixes:

• Verification of connection tracking cleanup on policy change:
  • Resolve known issues regarding connection tracking cleanup (@aanm)
    • Connection tracking is cleared when policy is deleted when endpoint ends up in default allow #2569
  • Resolve datapath issues (@joestringer)
    • L4 policies stay in bpf map after policy change #2270
    • CT allows connections when the source port is the same and the security id was changed on the source #2056

Document policy specification

• Design desired policy specification (@tgraf)
• Resolve eventual delta of current implementation to documented policy spec
  • Datapath implementation review: Review cilium 1.0 datapath implementation #3004

Kubernetes:

• Document delta from Cilium spec to Kubernetes spec
• Verify and document conformance of Kubernetes NetworkPolicy resource Support for Kubernetes Named Ports #2942

Documentation:

• Update docs with the new cilium endpoint list output (POLICY ENFORCEMENT EGRESS | INGRESS) #2301

CI:

• Ensure basic Kubernetes examples are included in regression testing #2337
• Ginkgo: Added PolicyGeneration on Nightly tests #2258
• Policy generation unit test benchmark #1953

Egress enforcement:

• Label based egress enforcement (k8s: Add support for Egress PodSelector / label-based egress #1488, @ianvernon)
• Label based service egress Match services by labels in ToServices egress policy rules. #1875

Bugs:

• ICMP requests are denied when L3-L4 policy is loaded #2571
• Shift proxy_port datapath handling from embedded BPF_L4_MAP into native POLICY_MAP #2564
• Issue on policy import #2415
• cilium endpoint config <id> Policy does not update the policy #2199
• Cilium endpoint list is empty and network policies doesn't work #2053

Proposals:

• L4 protocol policy needs to have always port #2292
• K8s: Add way of reporting errors when importing policy #2095
• Add support for "any" port/protocol in ingress rules #1997
• cilium policy trace should prompt user to specify --dport #1940
• Policy enforcement to/from service (Allow policy enforcement to/from service #1582)
• Ability to send RST when L7 policy is injected #2568

L7:

• Policy tracing capability Ability to cilium policy trace l7 policies #2276
• Higher level kafka policy specification (Make the Kafka rules more generic. #1818)