Skip to content

Commit

Permalink
Implement inline CIDR block egress peer
Browse files Browse the repository at this point in the history 
This PR adds support for implementing inline CIDR
peer blocks.

Signed-off-by: Surya Seetharaman <[email protected]>
  • Loading branch information
@tssurya
tssurya committed Feb 13, 2024
1 parent 5862cce commit 96a7cc3
Show file tree
Hide file tree
Showing 8 changed files with 213 additions and 42 deletions.
19 changes: 19 additions & 0 deletions apis/v1alpha1/shared_types.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -175,6 +175,25 @@ type AdminNetworkPolicyEgressPeer struct {
// <network-policy-api:experimental>
// +optional
Nodes *metav1.LabelSelector `json:"nodes,omitempty"`
// Networks defines a way to select peers via CIDR blocks (both v4 & v6).
// This is intended for representing entities that live outside the cluster,
// which can't be selected by pods, namespaces and nodes peers, but note
// that cluster-internal traffic will be checked against the rule as
// well. So if you Allow or Deny traffic to `"0.0.0.0/0"`, that will allow
// or deny all IPv4 pod-to-pod traffic as well. If you don't want that,
// add a rule that Passes all pod traffic before the Networks rule.
//
// Each item in Networks should be provided in the CIDR format and should be
// IPv4 or IPv6, for example "10.0.0.0/8" or "fd00::/8".
//
// Support: Extended
//
// <network-policy-api:experimental>
// +optional
// +kubebuilder:validation:MinItems=1
// +kubebuilder:validation:MaxItems=100
// +kubebuilder:validation:XValidation:rule="self.all(x, isCIDR(x))",message="Invalid CIDR provided"
Networks []string `json:"networks,omitempty"`
}

// NamespacedPeer defines a flexible way to select Namespaces in a cluster.
Expand Down
5 changes: 5 additions & 0 deletions apis/v1alpha1/zz_generated.deepcopy.go
View file

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

41 changes: 41 additions & 0 deletions config/crd/experimental/policy.networking.k8s.io_adminnetworkpolicies.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -206,11 +206,13 @@ spec:
items:
type: string
type: array
x-kubernetes-list-type: atomic
required:
- key
- operator
type: object
type: array
x-kubernetes-list-type: atomic
matchLabels:
additionalProperties:
type: string
Expand Down Expand Up @@ -249,6 +251,27 @@ spec:
maxItems: 100
type: array
type: object
networks:
description: "Networks defines a way to select peers via
CIDR blocks (both v4 & v6). This is intended for representing
entities that live outside the cluster, which can't
be selected by pods, namespaces and nodes peers, but
note that cluster-internal traffic will be checked against
the rule as well. So if you Allow or Deny traffic to
`\"0.0.0.0/0\"`, that will allow or deny all IPv4 pod-to-pod
traffic as well. If you don't want that, add a rule
that Passes all pod traffic before the Networks rule.
\n Each item in Networks should be provided in the CIDR
format and should be IPv4 or IPv6, for example \"10.0.0.0/8\"
or \"fd00::/8\". \n Support: Extended \n <network-policy-api:experimental>"
items:
type: string
maxItems: 100
minItems: 1
type: array
x-kubernetes-validations:
- message: Invalid CIDR provided
rule: self.all(x, isCIDR(x))
nodes:
description: "Nodes defines a way to select a set of nodes
in the cluster. This field follows standard label selector
Expand Down Expand Up @@ -282,11 +305,13 @@ spec:
items:
type: string
type: array
x-kubernetes-list-type: atomic
required:
- key
- operator
type: object
type: array
x-kubernetes-list-type: atomic
matchLabels:
additionalProperties:
type: string
Expand Down Expand Up @@ -347,11 +372,13 @@ spec:
items:
type: string
type: array
x-kubernetes-list-type: atomic
required:
- key
- operator
type: object
type: array
x-kubernetes-list-type: atomic
matchLabels:
additionalProperties:
type: string
Expand Down Expand Up @@ -425,11 +452,13 @@ spec:
items:
type: string
type: array
x-kubernetes-list-type: atomic
required:
- key
- operator
type: object
type: array
x-kubernetes-list-type: atomic
matchLabels:
additionalProperties:
type: string
Expand Down Expand Up @@ -538,11 +567,13 @@ spec:
items:
type: string
type: array
x-kubernetes-list-type: atomic
required:
- key
- operator
type: object
type: array
x-kubernetes-list-type: atomic
matchLabels:
additionalProperties:
type: string
Expand Down Expand Up @@ -630,11 +661,13 @@ spec:
items:
type: string
type: array
x-kubernetes-list-type: atomic
required:
- key
- operator
type: object
type: array
x-kubernetes-list-type: atomic
matchLabels:
additionalProperties:
type: string
Expand Down Expand Up @@ -708,11 +741,13 @@ spec:
items:
type: string
type: array
x-kubernetes-list-type: atomic
required:
- key
- operator
type: object
type: array
x-kubernetes-list-type: atomic
matchLabels:
additionalProperties:
type: string
Expand Down Expand Up @@ -865,11 +900,13 @@ spec:
items:
type: string
type: array
x-kubernetes-list-type: atomic
required:
- key
- operator
type: object
type: array
x-kubernetes-list-type: atomic
matchLabels:
additionalProperties:
type: string
Expand Down Expand Up @@ -916,11 +953,13 @@ spec:
items:
type: string
type: array
x-kubernetes-list-type: atomic
required:
- key
- operator
type: object
type: array
x-kubernetes-list-type: atomic
matchLabels:
additionalProperties:
type: string
Expand Down Expand Up @@ -963,11 +1002,13 @@ spec:
items:
type: string
type: array
x-kubernetes-list-type: atomic
required:
- key
- operator
type: object
type: array
x-kubernetes-list-type: atomic
matchLabels:
additionalProperties:
type: string
Expand Down
41 changes: 41 additions & 0 deletions config/crd/experimental/policy.networking.k8s.io_baselineadminnetworkpolicies.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -198,11 +198,13 @@ spec:
items:
type: string
type: array
x-kubernetes-list-type: atomic
required:
- key
- operator
type: object
type: array
x-kubernetes-list-type: atomic
matchLabels:
additionalProperties:
type: string
Expand Down Expand Up @@ -241,6 +243,27 @@ spec:
maxItems: 100
type: array
type: object
networks:
description: "Networks defines a way to select peers via
CIDR blocks (both v4 & v6). This is intended for representing
entities that live outside the cluster, which can't
be selected by pods, namespaces and nodes peers, but
note that cluster-internal traffic will be checked against
the rule as well. So if you Allow or Deny traffic to
`\"0.0.0.0/0\"`, that will allow or deny all IPv4 pod-to-pod
traffic as well. If you don't want that, add a rule
that Passes all pod traffic before the Networks rule.
\n Each item in Networks should be provided in the CIDR
format and should be IPv4 or IPv6, for example \"10.0.0.0/8\"
or \"fd00::/8\". \n Support: Extended \n <network-policy-api:experimental>"
items:
type: string
maxItems: 100
minItems: 1
type: array
x-kubernetes-validations:
- message: Invalid CIDR provided
rule: self.all(x, isCIDR(x))
nodes:
description: "Nodes defines a way to select a set of nodes
in the cluster. This field follows standard label selector
Expand Down Expand Up @@ -274,11 +297,13 @@ spec:
items:
type: string
type: array
x-kubernetes-list-type: atomic
required:
- key
- operator
type: object
type: array
x-kubernetes-list-type: atomic
matchLabels:
additionalProperties:
type: string
Expand Down Expand Up @@ -339,11 +364,13 @@ spec:
items:
type: string
type: array
x-kubernetes-list-type: atomic
required:
- key
- operator
type: object
type: array
x-kubernetes-list-type: atomic
matchLabels:
additionalProperties:
type: string
Expand Down Expand Up @@ -417,11 +444,13 @@ spec:
items:
type: string
type: array
x-kubernetes-list-type: atomic
required:
- key
- operator
type: object
type: array
x-kubernetes-list-type: atomic
matchLabels:
additionalProperties:
type: string
Expand Down Expand Up @@ -525,11 +554,13 @@ spec:
items:
type: string
type: array
x-kubernetes-list-type: atomic
required:
- key
- operator
type: object
type: array
x-kubernetes-list-type: atomic
matchLabels:
additionalProperties:
type: string
Expand Down Expand Up @@ -617,11 +648,13 @@ spec:
items:
type: string
type: array
x-kubernetes-list-type: atomic
required:
- key
- operator
type: object
type: array
x-kubernetes-list-type: atomic
matchLabels:
additionalProperties:
type: string
Expand Down Expand Up @@ -695,11 +728,13 @@ spec:
items:
type: string
type: array
x-kubernetes-list-type: atomic
required:
- key
- operator
type: object
type: array
x-kubernetes-list-type: atomic
matchLabels:
additionalProperties:
type: string
Expand Down Expand Up @@ -841,11 +876,13 @@ spec:
items:
type: string
type: array
x-kubernetes-list-type: atomic
required:
- key
- operator
type: object
type: array
x-kubernetes-list-type: atomic
matchLabels:
additionalProperties:
type: string
Expand Down Expand Up @@ -892,11 +929,13 @@ spec:
items:
type: string
type: array
x-kubernetes-list-type: atomic
required:
- key
- operator
type: object
type: array
x-kubernetes-list-type: atomic
matchLabels:
additionalProperties:
type: string
Expand Down Expand Up @@ -939,11 +978,13 @@ spec:
items:
type: string
type: array
x-kubernetes-list-type: atomic
required:
- key
- operator
type: object
type: array
x-kubernetes-list-type: atomic
matchLabels:
additionalProperties:
type: string
Expand Down
Loading

0 comments on commit 96a7cc3

Please sign in to comment.