Repository: istio/istio
File: pilot/pkg/model/authorization.go (Go)

Code before:
	rootNamespace := policy.RootNamespace
	namespace := selectionOpts.Namespace
	workloadLabels := selectionOpts.WorkloadLabels
	var lookupInNamespaces []string

	if namespace != rootNamespace {
		// Only check the root namespace if the (workload) namespace is not already the root namespace
		// to avoid double inclusion.
		lookupInNamespaces = []string{rootNamespace, namespace}
	} else {
		lookupInNamespaces = []string{namespace}
	}

	for _, ns := range lookupInNamespaces {
		for _, config := range policy.NamespaceToPolicies[ns] {
			spec := config.Spec
			var selector labels.Instance // NOTE: nil/empty selector matches all workloads
			switch getPolicyMatcher(gvk.AuthorizationPolicy, config.Name, selectionOpts, spec) {
			case policyMatchSelector:
				selector = spec.GetSelector().GetMatchLabels()
				if selector.SubsetOf(workloadLabels) {
					configs = updateAuthorizationPoliciesResult(configs, config)
				}
			case policyMatchDirect:
				configs = updateAuthorizationPoliciesResult(configs, config)
				continue
			case policyMatchIgnore:
				continue
			}
		}
	}

	return configs
}

func updateAuthorizationPoliciesResult(configs AuthorizationPoliciesResult, config AuthorizationPolicy) AuthorizationPoliciesResult {
	log.Infof("applying authorization policy %s.%s",
		config.Namespace, config.Name)
	switch config.Spec.GetAction() {
	case authpb.AuthorizationPolicy_ALLOW:
		configs.Allow = append(configs.Allow, config)
	case authpb.AuthorizationPolicy_DENY:
		configs.Deny = append(configs.Deny, config)
	case authpb.AuthorizationPolicy_AUDIT:
		configs.Audit = append(configs.Audit, config)
	case authpb.AuthorizationPolicy_CUSTOM:
		configs.Custom = append(configs.Custom, config)
	default:
		log.Errorf("ignored authorization policy %s.%s with unsupported action: %s",
			config.Namespace, config.Name, config.Spec.GetAction())
	}

Review comment (suggestion):
```suggestion
				continue
```
this does nothing (?)

Same with L101

Code after:
	rootNamespace := policy.RootNamespace
	namespace := selectionOpts.Namespace
	workloadLabels := selectionOpts.WorkloadLabels
	var lookupInNamespaces []string

	if namespace != rootNamespace {
		// Only check the root namespace if the (workload) namespace is not already the root namespace
		// to avoid double inclusion.
		lookupInNamespaces = []string{rootNamespace, namespace}
	} else {
		lookupInNamespaces = []string{namespace}
	}

	for _, ns := range lookupInNamespaces {
		for _, config := range policy.NamespaceToPolicies[ns] {
			spec := config.Spec
			switch getPolicyMatcher(gvk.AuthorizationPolicy, config.Name, selectionOpts, spec) {
			case policyMatchSelector:
				selector := labels.Instance(spec.GetSelector().GetMatchLabels())
				if selector.SubsetOf(workloadLabels) {
					configs = updateAuthorizationPoliciesResult(configs, config)
				}
			case policyMatchDirect:
				configs = updateAuthorizationPoliciesResult(configs, config)
			}
		}
	}

	return configs
}

func updateAuthorizationPoliciesResult(configs AuthorizationPoliciesResult, config AuthorizationPolicy) AuthorizationPoliciesResult {
	log.Infof("applying authorization policy %s.%s",
		config.Namespace, config.Name)
	switch config.Spec.GetAction() {
	case authpb.AuthorizationPolicy_ALLOW:
		configs.Allow = append(configs.Allow, config)
	case authpb.AuthorizationPolicy_DENY:
		configs.Deny = append(configs.Deny, config)
	case authpb.AuthorizationPolicy_AUDIT:
		configs.Audit = append(configs.Audit, config)
	case authpb.AuthorizationPolicy_CUSTOM:
		configs.Custom = append(configs.Custom, config)
	default:
		log.Errorf("ignored authorization policy %s.%s with unsupported action: %s",
			config.Namespace, config.Name, config.Spec.GetAction())
	}
	return configs
}