Skip to content

Commit 23d3882

Browse files
tssuryatssurya
committed
Add support for selecting nodes as egress peers
Some FTR things: 1) As an egress peer a user can selector either namespaces, or pods or nodes. In a given rule more than 1 type of selection is not allowed. 2) An empty node selector means it selects all nodes in the cluster. 3) nodes can be referred only from egress rule peers, since we only support northbound use cases. Signed-off-by: Surya Seetharaman <[email protected]>
1 parent c3ea60b commit 23d3882

6 files changed

+133
-21
lines changed

‎apis/v1alpha1/shared_types.go

+10-1
Original file line numberDiff line numberDiff line change
@@ -144,7 +144,7 @@ type AdminNetworkPolicyIngressPeer struct {
144144
Pods *NamespacedPodPeer `json:"pods,omitempty"`
145145
}
146146

147-
// AdminNetworkPolicyEgressPeer defines an in-cluster peer to allow traffic to.
147+
// AdminNetworkPolicyEgressPeer defines a peer to allow traffic to.
148148
// Exactly one of the selector pointers must be set for a given peer. If a
149149
// consumer observes none of its fields are set, they must assume an unknown
150150
// option has been specified and fail closed.
@@ -166,6 +166,15 @@ type AdminNetworkPolicyEgressPeer struct {
166166
//
167167
// +optional
168168
Pods *NamespacedPodPeer `json:"pods,omitempty"`
169+
// Nodes defines a way to select a set of nodes in
170+
// the cluster. This field follows standard label selector
171+
// semantics; if present but empty, it selects all Nodes.
172+
//
173+
// Support: Extended
174+
//
175+
// <network-policy-api:experimental>
176+
// +optional
177+
Nodes *metav1.LabelSelector `json:"nodes,omitempty"`
169178
}
170179

171180
// NamespacedPeer defines a flexible way to select Namespaces in a cluster.

‎apis/v1alpha1/zz_generated.deepcopy.go

+5
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎config/crd/experimental/policy.networking.k8s.io_adminnetworkpolicies.yaml

+54-5
Original file line numberDiff line numberDiff line change
@@ -156,11 +156,11 @@ spec:
156156
is applied. This field must be defined and contain at least
157157
one item. \n Support: Core"
158158
items:
159-
description: AdminNetworkPolicyEgressPeer defines an in-cluster
160-
peer to allow traffic to. Exactly one of the selector pointers
161-
must be set for a given peer. If a consumer observes none
162-
of its fields are set, they must assume an unknown option
163-
has been specified and fail closed.
159+
description: AdminNetworkPolicyEgressPeer defines a peer to
160+
allow traffic to. Exactly one of the selector pointers must
161+
be set for a given peer. If a consumer observes none of
162+
its fields are set, they must assume an unknown option has
163+
been specified and fail closed.
164164
maxProperties: 1
165165
minProperties: 1
166166
properties:
@@ -249,6 +249,55 @@ spec:
249249
maxItems: 100
250250
type: array
251251
type: object
252+
nodes:
253+
description: "Nodes defines a way to select a set of nodes
254+
in the cluster. This field follows standard label selector
255+
semantics; if present but empty, it selects all Nodes.
256+
\n Support: Extended \n <network-policy-api:experimental>"
257+
properties:
258+
matchExpressions:
259+
description: matchExpressions is a list of label selector
260+
requirements. The requirements are ANDed.
261+
items:
262+
description: A label selector requirement is a selector
263+
that contains values, a key, and an operator that
264+
relates the key and values.
265+
properties:
266+
key:
267+
description: key is the label key that the selector
268+
applies to.
269+
type: string
270+
operator:
271+
description: operator represents a key's relationship
272+
to a set of values. Valid operators are In,
273+
NotIn, Exists and DoesNotExist.
274+
type: string
275+
values:
276+
description: values is an array of string values.
277+
If the operator is In or NotIn, the values
278+
array must be non-empty. If the operator is
279+
Exists or DoesNotExist, the values array must
280+
be empty. This array is replaced during a
281+
strategic merge patch.
282+
items:
283+
type: string
284+
type: array
285+
required:
286+
- key
287+
- operator
288+
type: object
289+
type: array
290+
matchLabels:
291+
additionalProperties:
292+
type: string
293+
description: matchLabels is a map of {key,value} pairs.
294+
A single {key,value} in the matchLabels map is equivalent
295+
to an element of matchExpressions, whose key field
296+
is "key", the operator is "In", and the values array
297+
contains only "value". The requirements are ANDed.
298+
type: object
299+
type: object
300+
x-kubernetes-map-type: atomic
252301
pods:
253302
description: "Pods defines a way to select a set of pods
254303
in a set of namespaces. Note that host-networked pods

‎config/crd/experimental/policy.networking.k8s.io_baselineadminnetworkpolicies.yaml

+54-5
Original file line numberDiff line numberDiff line change
@@ -148,11 +148,11 @@ spec:
148148
is applied. This field must be defined and contain at least
149149
one item. \n Support: Core"
150150
items:
151-
description: AdminNetworkPolicyEgressPeer defines an in-cluster
152-
peer to allow traffic to. Exactly one of the selector pointers
153-
must be set for a given peer. If a consumer observes none
154-
of its fields are set, they must assume an unknown option
155-
has been specified and fail closed.
151+
description: AdminNetworkPolicyEgressPeer defines a peer to
152+
allow traffic to. Exactly one of the selector pointers must
153+
be set for a given peer. If a consumer observes none of
154+
its fields are set, they must assume an unknown option has
155+
been specified and fail closed.
156156
maxProperties: 1
157157
minProperties: 1
158158
properties:
@@ -241,6 +241,55 @@ spec:
241241
maxItems: 100
242242
type: array
243243
type: object
244+
nodes:
245+
description: "Nodes defines a way to select a set of nodes
246+
in the cluster. This field follows standard label selector
247+
semantics; if present but empty, it selects all Nodes.
248+
\n Support: Extended \n <network-policy-api:experimental>"
249+
properties:
250+
matchExpressions:
251+
description: matchExpressions is a list of label selector
252+
requirements. The requirements are ANDed.
253+
items:
254+
description: A label selector requirement is a selector
255+
that contains values, a key, and an operator that
256+
relates the key and values.
257+
properties:
258+
key:
259+
description: key is the label key that the selector
260+
applies to.
261+
type: string
262+
operator:
263+
description: operator represents a key's relationship
264+
to a set of values. Valid operators are In,
265+
NotIn, Exists and DoesNotExist.
266+
type: string
267+
values:
268+
description: values is an array of string values.
269+
If the operator is In or NotIn, the values
270+
array must be non-empty. If the operator is
271+
Exists or DoesNotExist, the values array must
272+
be empty. This array is replaced during a
273+
strategic merge patch.
274+
items:
275+
type: string
276+
type: array
277+
required:
278+
- key
279+
- operator
280+
type: object
281+
type: array
282+
matchLabels:
283+
additionalProperties:
284+
type: string
285+
description: matchLabels is a map of {key,value} pairs.
286+
A single {key,value} in the matchLabels map is equivalent
287+
to an element of matchExpressions, whose key field
288+
is "key", the operator is "In", and the values array
289+
contains only "value". The requirements are ANDed.
290+
type: object
291+
type: object
292+
x-kubernetes-map-type: atomic
244293
pods:
245294
description: "Pods defines a way to select a set of pods
246295
in a set of namespaces. Note that host-networked pods

‎config/crd/standard/policy.networking.k8s.io_adminnetworkpolicies.yaml

+5-5
Original file line numberDiff line numberDiff line change
@@ -152,11 +152,11 @@ spec:
152152
is applied. This field must be defined and contain at least
153153
one item. \n Support: Core"
154154
items:
155-
description: AdminNetworkPolicyEgressPeer defines an in-cluster
156-
peer to allow traffic to. Exactly one of the selector pointers
157-
must be set for a given peer. If a consumer observes none
158-
of its fields are set, they must assume an unknown option
159-
has been specified and fail closed.
155+
description: AdminNetworkPolicyEgressPeer defines a peer to
156+
allow traffic to. Exactly one of the selector pointers must
157+
be set for a given peer. If a consumer observes none of
158+
its fields are set, they must assume an unknown option has
159+
been specified and fail closed.
160160
maxProperties: 1
161161
minProperties: 1
162162
properties:

‎config/crd/standard/policy.networking.k8s.io_baselineadminnetworkpolicies.yaml

+5-5
Original file line numberDiff line numberDiff line change
@@ -144,11 +144,11 @@ spec:
144144
is applied. This field must be defined and contain at least
145145
one item. \n Support: Core"
146146
items:
147-
description: AdminNetworkPolicyEgressPeer defines an in-cluster
148-
peer to allow traffic to. Exactly one of the selector pointers
149-
must be set for a given peer. If a consumer observes none
150-
of its fields are set, they must assume an unknown option
151-
has been specified and fail closed.
147+
description: AdminNetworkPolicyEgressPeer defines a peer to
148+
allow traffic to. Exactly one of the selector pointers must
149+
be set for a given peer. If a consumer observes none of
150+
its fields are set, they must assume an unknown option has
151+
been specified and fail closed.
152152
maxProperties: 1
153153
minProperties: 1
154154
properties:

0 commit comments

Comments
 (0)