plugin/kubernetes: correctly set NODATA for ns (#1229)

* plugin/kubernetes: Add GetNamespaceByName

A bare or wildcard query for just the namespace should return NODATA,
not NXDOMAIN, otherwise we deny the entirety of the names under the
namespace.

Add test to check for this in pod verified mode.

* Review

More comments and move namespace code to namespace.go

1 files changed, 20 insertions, 0 deletions

diff --git a/plugin/kubernetes/namespace.go b/plugin/kubernetes/namespace.go
new file mode 100644
index 000000000..7dafc7ab3
--- /dev/null
+++ b/plugin/kubernetes/namespace.go
@@ -0,0 +1,20 @@
+package kubernetes
+
+// namespace checks if namespace n exists in this cluster. This returns true
+// even for non exposed namespaces, see namespaceExposed.
+func (k *Kubernetes) namespace(n string) bool {
+	ns, err := k.APIConn.GetNamespaceByName(n)
+	if err != nil {
+		return false
+	}
+	return ns.ObjectMeta.Name == n
+}
+
+// namespaceExposed returns true when the namespace is exposed.
+func (k *Kubernetes) namespaceExposed(namespace string) bool {
+	_, ok := k.Namespaces[namespace]
+	if len(k.Namespaces) > 0 && !ok {
+		return false
+	}
+	return true
+}