Skip to content

Commit 43ef2d3

Browse files
tssuryatssurya
committed
Add support for selecting external destinations as egress peers
Some FTR things: 1) As an egress peer a user can selector either namespaces, or pods or nodes or externalNetworks. In a given rule more than 1 type of selection is not allowed. 2) An empty externalNetworks selector means it selects all externalNetworkSets in the cluster. 3) externalNetworks can be set only from to.Peer Signed-off-by: Surya Seetharaman <[email protected]>
1 parent d61fdc7 commit 43ef2d3

6 files changed

+74
-0
lines changed

‎apis/v1alpha1/shared_types.go

+13
Original file line numberDiff line numberDiff line change
@@ -170,6 +170,19 @@ type AdminNetworkPolicyEgressPeer struct {
170170
//
171171
// +optional
172172
Nodes *metav1.LabelSelector `json:"nodes,omitempty"`
173+
// ExternalNetworks defines a way to select ExternalNetworkSets
174+
// that consist of network CIDRs that live outside the cluster as a peer.
175+
// It is the list of NetworkCIDR (both v4 & v6) that can be used to define
176+
// external destinations.
177+
// This field follows standard label selector semantics; if present
178+
// but empty, it selects all ExternalNetworkSets defined in the cluster.
179+
//
180+
// Support: Core
181+
//
182+
// +optional
183+
// +kubebuilder:validation:MinItems=1
184+
// +kubebuilder:validation:MaxItems=100
185+
ExternalNetworks []string `json:"externalNetworks,omitempty" validate:"omitempty,dive,cidr"`
173186
}
174187

175188
// NamespacedPeer defines a flexible way to select Namespaces in a cluster.

‎apis/v1alpha1/zz_generated.deepcopy.go

+5
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎config/crd/experimental/policy.networking.k8s.io_adminnetworkpolicies.yaml

+14
Original file line numberDiff line numberDiff line change
@@ -164,6 +164,20 @@ spec:
164164
maxProperties: 1
165165
minProperties: 1
166166
properties:
167+
externalNetworks:
168+
description: "ExternalNetworks defines a way to select
169+
ExternalNetworkSets that consist of network CIDRs that
170+
live outside the cluster as a peer. It is the list of
171+
NetworkCIDR (both v4 & v6) that can be used to define
172+
external destinations. This field follows standard label
173+
selector semantics; if present but empty, it selects
174+
all ExternalNetworkSets defined in the cluster. \n Support:
175+
Core"
176+
items:
177+
type: string
178+
maxItems: 100
179+
minItems: 1
180+
type: array
167181
namespaces:
168182
description: "Namespaces defines a way to select a set
169183
of Namespaces. \n Support: Core"

‎config/crd/experimental/policy.networking.k8s.io_baselineadminnetworkpolicies.yaml

+14
Original file line numberDiff line numberDiff line change
@@ -156,6 +156,20 @@ spec:
156156
maxProperties: 1
157157
minProperties: 1
158158
properties:
159+
externalNetworks:
160+
description: "ExternalNetworks defines a way to select
161+
ExternalNetworkSets that consist of network CIDRs that
162+
live outside the cluster as a peer. It is the list of
163+
NetworkCIDR (both v4 & v6) that can be used to define
164+
external destinations. This field follows standard label
165+
selector semantics; if present but empty, it selects
166+
all ExternalNetworkSets defined in the cluster. \n Support:
167+
Core"
168+
items:
169+
type: string
170+
maxItems: 100
171+
minItems: 1
172+
type: array
159173
namespaces:
160174
description: "Namespaces defines a way to select a set
161175
of Namespaces. \n Support: Core"

‎config/crd/standard/policy.networking.k8s.io_adminnetworkpolicies.yaml

+14
Original file line numberDiff line numberDiff line change
@@ -160,6 +160,20 @@ spec:
160160
maxProperties: 1
161161
minProperties: 1
162162
properties:
163+
externalNetworks:
164+
description: "ExternalNetworks defines a way to select
165+
ExternalNetworkSets that consist of network CIDRs that
166+
live outside the cluster as a peer. It is the list of
167+
NetworkCIDR (both v4 & v6) that can be used to define
168+
external destinations. This field follows standard label
169+
selector semantics; if present but empty, it selects
170+
all ExternalNetworkSets defined in the cluster. \n Support:
171+
Core"
172+
items:
173+
type: string
174+
maxItems: 100
175+
minItems: 1
176+
type: array
163177
namespaces:
164178
description: "Namespaces defines a way to select a set
165179
of Namespaces. \n Support: Core"

‎config/crd/standard/policy.networking.k8s.io_baselineadminnetworkpolicies.yaml

+14
Original file line numberDiff line numberDiff line change
@@ -152,6 +152,20 @@ spec:
152152
maxProperties: 1
153153
minProperties: 1
154154
properties:
155+
externalNetworks:
156+
description: "ExternalNetworks defines a way to select
157+
ExternalNetworkSets that consist of network CIDRs that
158+
live outside the cluster as a peer. It is the list of
159+
NetworkCIDR (both v4 & v6) that can be used to define
160+
external destinations. This field follows standard label
161+
selector semantics; if present but empty, it selects
162+
all ExternalNetworkSets defined in the cluster. \n Support:
163+
Core"
164+
items:
165+
type: string
166+
maxItems: 100
167+
minItems: 1
168+
type: array
155169
namespaces:
156170
description: "Namespaces defines a way to select a set
157171
of Namespaces. \n Support: Core"

0 commit comments

Comments
 (0)