Skip to content

Commit 10a7267

Browse files
tssuryatssurya
committed
Add support for selecting external destinations
Some FTR things: 1) As a peer a user can selector either namespaces, or pods or nodes or externalNetworks. In a given rule more than 1 type of selection is not allowed. 2) An empty externalNetworks selector means it selects all externalNetworkSets in the cluster. 3) externalNetworks can be set only from to.Peer Signed-off-by: Surya Seetharaman <[email protected]>
1 parent 0873bf8 commit 10a7267

23 files changed

+1206
-0
lines changed

‎apis/v1alpha1/adminnetworkpolicy_types.go

+1
Original file line numberDiff line numberDiff line change
@@ -137,6 +137,7 @@ type AdminNetworkPolicyIngressRule struct {
137137
// +kubebuilder:validation:MinItems=1
138138
// +kubebuilder:validation:MaxItems=100
139139
// +kubebuilder:validation:XValidation:rule="self.all(value, !has(value.nodes))",message="cluster-ingress traffic controls are unsupported"
140+
// +kubebuilder:validation:XValidation:rule="self.all(value, !has(value.externalNetworks))",message="cluster-ingress traffic controls are unsupported"
140141
From []AdminNetworkPolicyPeer `json:"from"`
141142

142143
// Ports allows for matching traffic based on port and protocols.

‎apis/v1alpha1/baselineadminnetworkpolicy_types.go

+1
Original file line numberDiff line numberDiff line change
@@ -120,6 +120,7 @@ type BaselineAdminNetworkPolicyIngressRule struct {
120120
//
121121
// +kubebuilder:validation:MinItems=1
122122
// +kubebuilder:validation:XValidation:rule="self.all(value, !has(value.nodes))",message="cluster-ingress traffic controls are unsupported"
123+
// +kubebuilder:validation:XValidation:rule="self.all(value, !has(value.externalNetworks))",message="cluster-ingress traffic controls are unsupported"
123124
From []AdminNetworkPolicyPeer `json:"from"`
124125

125126
// Ports allows for matching traffic based on port and protocols.

‎apis/v1alpha1/externalnetworkset_types.go

+66
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
/*
2+
Copyright 2023 The Kubernetes Authors.
3+
Licensed under the Apache License, Version 2.0 (the "License");
4+
you may not use this file except in compliance with the License.
5+
You may obtain a copy of the License at
6+
http://www.apache.org/licenses/LICENSE-2.0
7+
Unless required by applicable law or agreed to in writing, software
8+
distributed under the License is distributed on an "AS IS" BASIS,
9+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
10+
See the License for the specific language governing permissions and
11+
limitations under the License.
12+
*/
13+
14+
// All fields in this package are required unless Explicitly marked optional
15+
// +kubebuilder:validation:Required
16+
package v1alpha1
17+
18+
import (
19+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
20+
)
21+
22+
// +genclient
23+
// +genclient:nonNamespaced
24+
// +kubebuilder:object:root=true
25+
// +kubebuilder:subresource:status
26+
// +kubebuilder:resource:shortName=ens,scope=Cluster
27+
// +kubebuilder:printcolumn:name="Networks",type=string,JSONPath=".spec.networks"
28+
// +kubebuilder:printcolumn:name="Age",type="date",JSONPath=".metadata.creationTimestamp"
29+
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
30+
// ExternalNetworkSet is a cluster level resource that is used to define
31+
// a set of networks outside the cluster which can be referred to from
32+
// the AdminNetworkPolicy && BaselineAdminNetworkPolicy APIs as an external peer
33+
type ExternalNetworkSet struct {
34+
metav1.TypeMeta `json:",inline"`
35+
metav1.ObjectMeta `json:"metadata"`
36+
37+
// Specification of the desired behavior of ExternalNetworkSet.
38+
Spec ExternalNetworkSetSpec `json:"spec"`
39+
}
40+
41+
// ExternalNetworkSetSpec defines the desired state of ExternalNetworkSet.
42+
// +kubebuilder:validation:MaxProperties=1
43+
// +kubebuilder:validation:MinProperties=1
44+
type ExternalNetworkSetSpec struct {
45+
// Networks is the list of NetworkCIDR (both v4 & v6) that can be used to define
46+
// external destinations.
47+
// A total of 100 CIDRs will be allowed in each NetworkSet instance.
48+
// ANP & BANP APIs may use the .spec.in(e)gress.from(to).externalNetworks selector
49+
// to select a set of external networks
50+
//
51+
// Support: Core
52+
//
53+
// +optional
54+
// +kubebuilder:validation:MinItems=1
55+
// +kubebuilder:validation:MaxItems=100
56+
Networks []string `json:"networks,omitempty" validate:"omitempty,dive,cidr"`
57+
}
58+
59+
// +kubebuilder:object:root=true
60+
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
61+
// ExternalNetworkSetList contains a list of ExternalNetworkSet
62+
type ExternalNetworkSetList struct {
63+
metav1.TypeMeta `json:",inline"`
64+
metav1.ListMeta `json:"metadata,omitempty"`
65+
Items []ExternalNetworkSet `json:"items"`
66+
}

‎apis/v1alpha1/shared_types.go

+9
Original file line numberDiff line numberDiff line change
@@ -148,6 +148,15 @@ type AdminNetworkPolicyPeer struct {
148148
//
149149
// +optional
150150
Nodes *metav1.LabelSelector `json:"nodes,omitempty"`
151+
// ExternalNetworks defines a way to select ExternalNetworkSets
152+
// that consist of network CIDRs that live outside the cluster as a peer.
153+
// This field follows standard label selector semantics; if present
154+
// but empty, it selects all ExternalNetworkSets defined in the cluster.
155+
//
156+
// Support: Core
157+
//
158+
// +optional
159+
ExternalNetworks *metav1.LabelSelector `json:"externalNetworks,omitempty"`
151160
}
152161

153162
// NamespacedPeer defines a flexible way to select Namespaces in a cluster.

‎apis/v1alpha1/zz_generated.deepcopy.go

+83
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎apis/v1alpha1/zz_generated.register.go

+2
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎config/crd/experimental/policy.networking.k8s.io_adminnetworkpolicies.yaml

+104
Original file line numberDiff line numberDiff line change
@@ -164,6 +164,57 @@ spec:
164164
maxProperties: 1
165165
minProperties: 1
166166
properties:
167+
externalNetworks:
168+
description: "ExternalNetworks defines a way to select
169+
ExternalNetworkSets that consist of network CIDRs that
170+
live outside the cluster as a peer. This field follows
171+
standard label selector semantics; if present but empty,
172+
it selects all ExternalNetworkSets defined in the cluster.
173+
\n Support: Core"
174+
properties:
175+
matchExpressions:
176+
description: matchExpressions is a list of label selector
177+
requirements. The requirements are ANDed.
178+
items:
179+
description: A label selector requirement is a selector
180+
that contains values, a key, and an operator that
181+
relates the key and values.
182+
properties:
183+
key:
184+
description: key is the label key that the selector
185+
applies to.
186+
type: string
187+
operator:
188+
description: operator represents a key's relationship
189+
to a set of values. Valid operators are In,
190+
NotIn, Exists and DoesNotExist.
191+
type: string
192+
values:
193+
description: values is an array of string values.
194+
If the operator is In or NotIn, the values
195+
array must be non-empty. If the operator is
196+
Exists or DoesNotExist, the values array must
197+
be empty. This array is replaced during a
198+
strategic merge patch.
199+
items:
200+
type: string
201+
type: array
202+
required:
203+
- key
204+
- operator
205+
type: object
206+
type: array
207+
matchLabels:
208+
additionalProperties:
209+
type: string
210+
description: matchLabels is a map of {key,value} pairs.
211+
A single {key,value} in the matchLabels map is equivalent
212+
to an element of matchExpressions, whose key field
213+
is "key", the operator is "In", and the values array
214+
contains only "value". The requirements are ANDed.
215+
type: object
216+
type: object
217+
x-kubernetes-map-type: atomic
167218
namespaces:
168219
description: "Namespaces defines a way to select a set
169220
of Namespaces. \n Support: Core"
@@ -493,6 +544,57 @@ spec:
493544
maxProperties: 1
494545
minProperties: 1
495546
properties:
547+
externalNetworks:
548+
description: "ExternalNetworks defines a way to select
549+
ExternalNetworkSets that consist of network CIDRs that
550+
live outside the cluster as a peer. This field follows
551+
standard label selector semantics; if present but empty,
552+
it selects all ExternalNetworkSets defined in the cluster.
553+
\n Support: Core"
554+
properties:
555+
matchExpressions:
556+
description: matchExpressions is a list of label selector
557+
requirements. The requirements are ANDed.
558+
items:
559+
description: A label selector requirement is a selector
560+
that contains values, a key, and an operator that
561+
relates the key and values.
562+
properties:
563+
key:
564+
description: key is the label key that the selector
565+
applies to.
566+
type: string
567+
operator:
568+
description: operator represents a key's relationship
569+
to a set of values. Valid operators are In,
570+
NotIn, Exists and DoesNotExist.
571+
type: string
572+
values:
573+
description: values is an array of string values.
574+
If the operator is In or NotIn, the values
575+
array must be non-empty. If the operator is
576+
Exists or DoesNotExist, the values array must
577+
be empty. This array is replaced during a
578+
strategic merge patch.
579+
items:
580+
type: string
581+
type: array
582+
required:
583+
- key
584+
- operator
585+
type: object
586+
type: array
587+
matchLabels:
588+
additionalProperties:
589+
type: string
590+
description: matchLabels is a map of {key,value} pairs.
591+
A single {key,value} in the matchLabels map is equivalent
592+
to an element of matchExpressions, whose key field
593+
is "key", the operator is "In", and the values array
594+
contains only "value". The requirements are ANDed.
595+
type: object
596+
type: object
597+
x-kubernetes-map-type: atomic
496598
namespaces:
497599
description: "Namespaces defines a way to select a set
498600
of Namespaces. \n Support: Core"
@@ -779,6 +881,8 @@ spec:
779881
x-kubernetes-validations:
780882
- message: cluster-ingress traffic controls are unsupported
781883
rule: self.all(value, !has(value.nodes))
884+
- message: cluster-ingress traffic controls are unsupported
885+
rule: self.all(value, !has(value.externalNetworks))
782886
name:
783887
description: "Name is an identifier for this rule, that may
784888
be no more than 100 characters in length. This field should

0 commit comments

Comments
 (0)