[Windows NPM Lite] Removing IPSets Reference from DataPath for Cidr Blocks

**What happened:**
Azure NPM Lite for Windows converts CIDR-based network policies into Windows HNS
(Host Networking Service) ACL rules. Intermediate ipset data structures are created to hold
CIDR blocks before translating them to HNS rules

Kubernetes NetworkPolicy → NPM Translation → Ipsets → HNS ACL Rules

Detailed Flow of Current NPM Lite Implementation for Windows

1. CIDR Policy Translation Layer
When a Kubernetes NetworkPolicy with CIDR blocks is applied, NPM processes it through
the translation layer:
`func ipBlockRule(policyName, ns string, direction policies.Direction, matchType
policies.MatchType,
ipBlockSetIndex, ipBlockPeerIndex int, ipBlockRule *networkingv1.IPBlock,
) (*ipsets.TranslatedIPSet, policies.SetInfo, error) {
// Creates ipset for CIDR block with except rules
ipBlockIPSet, err := ipBlockIPSet(policyName, ns, direction,
ipBlockSetIndex, ipBlockPeerIndex, ipBlockRule)
// Creates SetInfo bridge object
setInfo := policies.NewSetInfo(ipBlockIPSet.Metadata.Name,
ipsets.CIDRBlocks, included, matchType)
return ipBlockIPSet, setInfo, err
} `
Key Result: Creates an ipset with CIDR members:
ipBlockIPSet.Members = ["192.168.0.0/16", "192.168.1.0/24 nomatch",
"192.168.2.0/24 nomatch"]

3. ACL Policy Construction
`func (aclPolicy *ACLPolicy) AddSetInfo(peerList []SetInfo) {
for _, peer := range peerList {
if peer.MatchType == DstDstMatch {
aclPolicy.DstList = append(aclPolicy.DstList, peer)
continue
}
// CRITICAL: CIDR SetInfo gets added to SrcList or DstList based on
traffic direction
if aclPolicy.Direction == Ingress {
aclPolicy.SrcList = append(aclPolicy.SrcList, peer)
SetInfo added here
// CIDR
} else if aclPolicy.Direction == Egress {
aclPolicy.DstList = append(aclPolicy.DstList, peer) // CIDR
SetInfo added here
}
}
} `
Key Result: SetInfo objects containing ipset references are attached to ACL policies based on
traffic direction.
5. HNS ACL Settings Generation
`func (acl *ACLPolicy) convertToAclSettings(aclID string) (*NPMACLPolSettings,
error) {
policySettings := &NPMACLPolSettings{}
// Extract ipset names from SetInfo objects
srcListStr := getAddrListFromSetInfo(acl.SrcList) // "azure-npm
a1b2c3d4"
dstListStr := getAddrListFromSetInfo(acl.DstList)
dstPortStr := getPortStrFromPorts(acl.DstPorts)
// Map to HNS address fields
policySettings.LocalAddresses = srcListStr
policySettings.RemoteAddresses = dstListStr
policySettings.LocalPorts = dstPortStr
return policySettings, nil
}
// CIDR ipset reference
func getAddrListFromSetInfo(setInfoList []SetInfo) string {
setInfoStr := ""
for i, setInfo := range setInfoList {
if i < setInfoLen-1 {
setInfoStr += setInfo.IPSet.GetHashedName() + ","
a1b2c3d4"
} else {
setInfoStr += setInfo.IPSet.GetHashedName()
}
}
return setInfoStr
} `
7. HNS Policy Application
`// Policy application pipeline
// "azure-npm
rulesToAdd, err := pMgr.getSettingsFromACL(policy) //
Creates []*NPMACLPolSettings
epPolicyRequest, err := getEPPolicyReqFromACLSettings(rulesToAdd)
Converts to HNS format
err = pMgr.applyPoliciesToEndpointID(epID, epPolicyRequest)
Applies to HNS
// HNS application function
//
//
func (pMgr *PolicyManager) applyPoliciesToEndpointID(epID string, policies
hcn.PolicyEndpointRequest) error {
epObj, err := pMgr.ioShim.Hns.GetEndpointByID(epID) // Get
HNS endpoint
err = pMgr.ioShim.Hns.ApplyEndpointPolicy(epObj, hcn.RequestTypeAdd,
policies) // Apply to HNS
return err
} `

Complete Example: CIDR Policy Enforcement
Input: Kubernetes NetworkPolicy
`apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-cidr
namespace: production
spec:
podSelector:
matchLabels:
app: web
policyTypes: - Ingress
ingress: - from: - ipBlock:
cidr: 192.168.0.0/16
ports: - protocol: TCP
port: 80 `

1. Ip Set Creation
2. SetInfo
3. ACL Policy
4. HNS ACL Setting

Step 5: HNS Enforcement
The HNS ACL rule is applied to container endpoints, where:
• LocalAddresses: "azure-npm-a1b2c3d4" references the ipset containing CIDR blocks
• HNS resolves the ipset name to actual IP ranges: 192.168.0.0/16
• Traffic from these IP ranges to port 80 is allowed on the container endpoint

Flow Summary
1. Kubernetes NetworkPolicy Applied
↓
2. ipBlockRule() creates CIDR ipset (exceptions not included in windows)
↓
3. SetInfo bridges ipset to ACL policy
↓
4. AddSetInfo() associates SetInfo with ACL based on direction
↓
5. convertToAclSettings() extracts ipset names for HNS
↓
6. getEPPolicyReqFromACLSettings() formats for HNS
↓
7. applyPoliciesToEndpointID() applies to container endpoints
↓
8. HNS enforces ACL rules on Windows containers

**What you expected to happen:** **How to reproduce it:**
Change that we need to make:

- Azure NPM Lite for Windows converts CIDR-based network policies into Windows:
HNS (Host Networking Service) ACL rules. NPM Lite needs to bypass ipsets entirely
and applies direct CIDR-based rules which get converted to acl's that HNS applied to the endpoints.
through HNS APIs

Difference in two flows
Current NPM Lite Flow with reference to IP Sets:

o No reference on IP sets

[NPM Lite Current vs New Design Doc Without IPSets.docx](https://github.com/user-attachments/files/21801837/NPM.Lite.Current.vs.New.Design.Doc.Without.IPSets.docx)

**Kubernetes Version:**

**Kernel (e.g. `uname -a`):**

**Anything else we need to know?:**
[Miscellaneous information that will assist in solving the issue.]