Skip to content

Commit 2d2967b

Browse files
tssuryatssurya
committed
Add support for selecting nodes as egress peers
Some FTR things: 1) As an egress peer a user can selector either namespaces, or pods or nodes. In a given rule more than 1 type of selection is not allowed. 2) An empty node selector means it selects all nodes in the cluster. 3) nodes can be referred only from egress rule peers, since we only support northbound use cases. Signed-off-by: Surya Seetharaman <[email protected]>
1 parent 81a0070 commit 2d2967b

6 files changed

+230
-21
lines changed

‎apis/v1alpha1/shared_types.go‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -142,7 +142,7 @@ type AdminNetworkPolicyIngressPeer struct {
142142
Pods *NamespacedPodPeer `json:"pods,omitempty"`
143143
}
144144

145-
// AdminNetworkPolicyEgressPeer defines an in-cluster peer to allow traffic to.
145+
// AdminNetworkPolicyEgressPeer defines a peer to allow traffic to.
146146
// Exactly one of the selector pointers must be set for a given peer. If a
147147
// consumer observes none of its fields are set, they must assume an unknown
148148
// option has been specified and fail closed.
@@ -162,6 +162,14 @@ type AdminNetworkPolicyEgressPeer struct {
162162
//
163163
// +optional
164164
Pods *NamespacedPodPeer `json:"pods,omitempty"`
165+
// Nodes defines a way to select a set of nodes in
166+
// in the cluster. This field follows standard label selector
167+
// semantics; if present but empty, it selects all Nodes.
168+
//
169+
// Support: Core
170+
//
171+
// +optional
172+
Nodes *metav1.LabelSelector `json:"nodes,omitempty"`
165173
}
166174

167175
// NamespacedPeer defines a flexible way to select Namespaces in a cluster.

‎apis/v1alpha1/zz_generated.deepcopy.go‎

Lines changed: 5 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎config/crd/experimental/policy.networking.k8s.io_adminnetworkpolicies.yaml‎

Lines changed: 54 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -156,11 +156,11 @@ spec:
156156
is applied. This field must be defined and contain at least
157157
one item. \n Support: Core"
158158
items:
159-
description: AdminNetworkPolicyEgressPeer defines an in-cluster
160-
peer to allow traffic to. Exactly one of the selector pointers
161-
must be set for a given peer. If a consumer observes none
162-
of its fields are set, they must assume an unknown option
163-
has been specified and fail closed.
159+
description: AdminNetworkPolicyEgressPeer defines a peer to
160+
allow traffic to. Exactly one of the selector pointers must
161+
be set for a given peer. If a consumer observes none of
162+
its fields are set, they must assume an unknown option has
163+
been specified and fail closed.
164164
maxProperties: 1
165165
minProperties: 1
166166
properties:
@@ -247,6 +247,55 @@ spec:
247247
maxItems: 100
248248
type: array
249249
type: object
250+
nodes:
251+
description: "Nodes defines a way to select a set of nodes
252+
in in the cluster. This field follows standard label
253+
selector semantics; if present but empty, it selects
254+
all Nodes. \n Support: Core"
255+
properties:
256+
matchExpressions:
257+
description: matchExpressions is a list of label selector
258+
requirements. The requirements are ANDed.
259+
items:
260+
description: A label selector requirement is a selector
261+
that contains values, a key, and an operator that
262+
relates the key and values.
263+
properties:
264+
key:
265+
description: key is the label key that the selector
266+
applies to.
267+
type: string
268+
operator:
269+
description: operator represents a key's relationship
270+
to a set of values. Valid operators are In,
271+
NotIn, Exists and DoesNotExist.
272+
type: string
273+
values:
274+
description: values is an array of string values.
275+
If the operator is In or NotIn, the values
276+
array must be non-empty. If the operator is
277+
Exists or DoesNotExist, the values array must
278+
be empty. This array is replaced during a
279+
strategic merge patch.
280+
items:
281+
type: string
282+
type: array
283+
required:
284+
- key
285+
- operator
286+
type: object
287+
type: array
288+
matchLabels:
289+
additionalProperties:
290+
type: string
291+
description: matchLabels is a map of {key,value} pairs.
292+
A single {key,value} in the matchLabels map is equivalent
293+
to an element of matchExpressions, whose key field
294+
is "key", the operator is "In", and the values array
295+
contains only "value". The requirements are ANDed.
296+
type: object
297+
type: object
298+
x-kubernetes-map-type: atomic
250299
pods:
251300
description: "Pods defines a way to select a set of pods
252301
in in a set of namespaces. \n Support: Core"

‎config/crd/experimental/policy.networking.k8s.io_baselineadminnetworkpolicies.yaml‎

Lines changed: 54 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -148,11 +148,11 @@ spec:
148148
is applied. This field must be defined and contain at least
149149
one item. \n Support: Core"
150150
items:
151-
description: AdminNetworkPolicyEgressPeer defines an in-cluster
152-
peer to allow traffic to. Exactly one of the selector pointers
153-
must be set for a given peer. If a consumer observes none
154-
of its fields are set, they must assume an unknown option
155-
has been specified and fail closed.
151+
description: AdminNetworkPolicyEgressPeer defines a peer to
152+
allow traffic to. Exactly one of the selector pointers must
153+
be set for a given peer. If a consumer observes none of
154+
its fields are set, they must assume an unknown option has
155+
been specified and fail closed.
156156
maxProperties: 1
157157
minProperties: 1
158158
properties:
@@ -239,6 +239,55 @@ spec:
239239
maxItems: 100
240240
type: array
241241
type: object
242+
nodes:
243+
description: "Nodes defines a way to select a set of nodes
244+
in in the cluster. This field follows standard label
245+
selector semantics; if present but empty, it selects
246+
all Nodes. \n Support: Core"
247+
properties:
248+
matchExpressions:
249+
description: matchExpressions is a list of label selector
250+
requirements. The requirements are ANDed.
251+
items:
252+
description: A label selector requirement is a selector
253+
that contains values, a key, and an operator that
254+
relates the key and values.
255+
properties:
256+
key:
257+
description: key is the label key that the selector
258+
applies to.
259+
type: string
260+
operator:
261+
description: operator represents a key's relationship
262+
to a set of values. Valid operators are In,
263+
NotIn, Exists and DoesNotExist.
264+
type: string
265+
values:
266+
description: values is an array of string values.
267+
If the operator is In or NotIn, the values
268+
array must be non-empty. If the operator is
269+
Exists or DoesNotExist, the values array must
270+
be empty. This array is replaced during a
271+
strategic merge patch.
272+
items:
273+
type: string
274+
type: array
275+
required:
276+
- key
277+
- operator
278+
type: object
279+
type: array
280+
matchLabels:
281+
additionalProperties:
282+
type: string
283+
description: matchLabels is a map of {key,value} pairs.
284+
A single {key,value} in the matchLabels map is equivalent
285+
to an element of matchExpressions, whose key field
286+
is "key", the operator is "In", and the values array
287+
contains only "value". The requirements are ANDed.
288+
type: object
289+
type: object
290+
x-kubernetes-map-type: atomic
242291
pods:
243292
description: "Pods defines a way to select a set of pods
244293
in in a set of namespaces. \n Support: Core"

‎config/crd/standard/policy.networking.k8s.io_adminnetworkpolicies.yaml‎

Lines changed: 54 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -152,11 +152,11 @@ spec:
152152
is applied. This field must be defined and contain at least
153153
one item. \n Support: Core"
154154
items:
155-
description: AdminNetworkPolicyEgressPeer defines an in-cluster
156-
peer to allow traffic to. Exactly one of the selector pointers
157-
must be set for a given peer. If a consumer observes none
158-
of its fields are set, they must assume an unknown option
159-
has been specified and fail closed.
155+
description: AdminNetworkPolicyEgressPeer defines a peer to
156+
allow traffic to. Exactly one of the selector pointers must
157+
be set for a given peer. If a consumer observes none of
158+
its fields are set, they must assume an unknown option has
159+
been specified and fail closed.
160160
maxProperties: 1
161161
minProperties: 1
162162
properties:
@@ -218,6 +218,55 @@ spec:
218218
type: object
219219
x-kubernetes-map-type: atomic
220220
type: object
221+
nodes:
222+
description: "Nodes defines a way to select a set of nodes
223+
in in the cluster. This field follows standard label
224+
selector semantics; if present but empty, it selects
225+
all Nodes. \n Support: Core"
226+
properties:
227+
matchExpressions:
228+
description: matchExpressions is a list of label selector
229+
requirements. The requirements are ANDed.
230+
items:
231+
description: A label selector requirement is a selector
232+
that contains values, a key, and an operator that
233+
relates the key and values.
234+
properties:
235+
key:
236+
description: key is the label key that the selector
237+
applies to.
238+
type: string
239+
operator:
240+
description: operator represents a key's relationship
241+
to a set of values. Valid operators are In,
242+
NotIn, Exists and DoesNotExist.
243+
type: string
244+
values:
245+
description: values is an array of string values.
246+
If the operator is In or NotIn, the values
247+
array must be non-empty. If the operator is
248+
Exists or DoesNotExist, the values array must
249+
be empty. This array is replaced during a
250+
strategic merge patch.
251+
items:
252+
type: string
253+
type: array
254+
required:
255+
- key
256+
- operator
257+
type: object
258+
type: array
259+
matchLabels:
260+
additionalProperties:
261+
type: string
262+
description: matchLabels is a map of {key,value} pairs.
263+
A single {key,value} in the matchLabels map is equivalent
264+
to an element of matchExpressions, whose key field
265+
is "key", the operator is "In", and the values array
266+
contains only "value". The requirements are ANDed.
267+
type: object
268+
type: object
269+
x-kubernetes-map-type: atomic
221270
pods:
222271
description: "Pods defines a way to select a set of pods
223272
in in a set of namespaces. \n Support: Core"

‎config/crd/standard/policy.networking.k8s.io_baselineadminnetworkpolicies.yaml‎

Lines changed: 54 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -144,11 +144,11 @@ spec:
144144
is applied. This field must be defined and contain at least
145145
one item. \n Support: Core"
146146
items:
147-
description: AdminNetworkPolicyEgressPeer defines an in-cluster
148-
peer to allow traffic to. Exactly one of the selector pointers
149-
must be set for a given peer. If a consumer observes none
150-
of its fields are set, they must assume an unknown option
151-
has been specified and fail closed.
147+
description: AdminNetworkPolicyEgressPeer defines a peer to
148+
allow traffic to. Exactly one of the selector pointers must
149+
be set for a given peer. If a consumer observes none of
150+
its fields are set, they must assume an unknown option has
151+
been specified and fail closed.
152152
maxProperties: 1
153153
minProperties: 1
154154
properties:
@@ -210,6 +210,55 @@ spec:
210210
type: object
211211
x-kubernetes-map-type: atomic
212212
type: object
213+
nodes:
214+
description: "Nodes defines a way to select a set of nodes
215+
in in the cluster. This field follows standard label
216+
selector semantics; if present but empty, it selects
217+
all Nodes. \n Support: Core"
218+
properties:
219+
matchExpressions:
220+
description: matchExpressions is a list of label selector
221+
requirements. The requirements are ANDed.
222+
items:
223+
description: A label selector requirement is a selector
224+
that contains values, a key, and an operator that
225+
relates the key and values.
226+
properties:
227+
key:
228+
description: key is the label key that the selector
229+
applies to.
230+
type: string
231+
operator:
232+
description: operator represents a key's relationship
233+
to a set of values. Valid operators are In,
234+
NotIn, Exists and DoesNotExist.
235+
type: string
236+
values:
237+
description: values is an array of string values.
238+
If the operator is In or NotIn, the values
239+
array must be non-empty. If the operator is
240+
Exists or DoesNotExist, the values array must
241+
be empty. This array is replaced during a
242+
strategic merge patch.
243+
items:
244+
type: string
245+
type: array
246+
required:
247+
- key
248+
- operator
249+
type: object
250+
type: array
251+
matchLabels:
252+
additionalProperties:
253+
type: string
254+
description: matchLabels is a map of {key,value} pairs.
255+
A single {key,value} in the matchLabels map is equivalent
256+
to an element of matchExpressions, whose key field
257+
is "key", the operator is "In", and the values array
258+
contains only "value". The requirements are ANDed.
259+
type: object
260+
type: object
261+
x-kubernetes-map-type: atomic
213262
pods:
214263
description: "Pods defines a way to select a set of pods
215264
in in a set of namespaces. \n Support: Core"

0 commit comments

Comments
 (0)