Skip to content

Commit 3735cf6

Browse files
tssuryatssurya
committed
Add support for selecting external destinations
Some FTR things: 1) As a peer a user can selector either namespaces, or pods or nodes or externalNetworks. In a given rule more than 1 type of selection is not allowed. 2) An empty externalNetworks selector means it selects all externalNetworkSets in the cluster. 3) TODO: Need to find a way to select externalNetworks only from to.Peer and validate it cannot be set from from.Peer Signed-off-by: Surya Seetharaman <[email protected]>
1 parent 0819387 commit 3735cf6

17 files changed

+900
-0
lines changed

‎apis/v1alpha1/externalnetworks_types.go‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
/*
2+
Copyright 2023 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
6+
you may not use this file except in compliance with the License.
7+
You may obtain a copy of the License at
8+
9+
http://www.apache.org/licenses/LICENSE-2.0
10+
11+
Unless required by applicable law or agreed to in writing, software
12+
distributed under the License is distributed on an "AS IS" BASIS,
13+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
See the License for the specific language governing permissions and
15+
limitations under the License.
16+
*/
17+
18+
// All fields in this package are required unless Explicitly marked optional
19+
// +kubebuilder:validation:Required
20+
package v1alpha1
21+
22+
import (
23+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
24+
)
25+
26+
// +genclient
27+
// +genclient:nonNamespaced
28+
// +kubebuilder:object:root=true
29+
// +kubebuilder:subresource:status
30+
// +kubebuilder:resource:shortName=ens,scope=Cluster
31+
// +kubebuilder:printcolumn:name="Networks",type=string,JSONPath=".spec.priority"
32+
// +kubebuilder:printcolumn:name="Age",type="date",JSONPath=".metadata.creationTimestamp"
33+
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
34+
// ExternalNetworkSet is a cluster level resource that is used to define
35+
// a set of networks outsides the cluster which can be referred to from
36+
// the AdminNetworkPolicy && BaselineAdminNetworkPolicy APIs as an external peer
37+
type ExternalNetworkSet struct {
38+
metav1.TypeMeta `json:",inline"`
39+
metav1.ObjectMeta `json:"metadata"`
40+
41+
// Specification of the desired behavior of ExternalNetworkSet.
42+
Spec ExternalNetworkSetSpec `json:"spec"`
43+
}
44+
45+
// ExternalNetworkSetSpec defines the desired state of ExternalNetworkSet.
46+
type ExternalNetworkSetSpec struct {
47+
// Networks is the list of NetworkCIDR (both v4 & v6) that can be used to define
48+
// external destinations.
49+
// A total of 100 CIDRs will be allowed in each NetworkSet instance.
50+
// ANP & BANP APIs may use the .spec.in(e)gress.from(to).externalNetworks selector
51+
// to select a set of external networks
52+
// +optional
53+
// +kubebuilder:validation:MaxItems=100
54+
Networks []string `json:"networks,omitempty" validate:"omitempty,dive,cidr"`
55+
}
56+
57+
// +kubebuilder:object:root=true
58+
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
59+
// ExternalNetworkSetList contains a list of ExternalNetworkSet
60+
type ExternalNetworkSetList struct {
61+
metav1.TypeMeta `json:",inline"`
62+
metav1.ListMeta `json:"metadata,omitempty"`
63+
Items []ExternalNetworkSet `json:"items"`
64+
}

‎apis/v1alpha1/shared_types.go‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -114,6 +114,12 @@ type AdminNetworkPolicyPeer struct {
114114
// semantics; if present but empty, it selects all Nodes.
115115
// +optional
116116
Nodes *metav1.LabelSelector `json:"nodes,omitempty"`
117+
// ExternalNetworks defines a way to select ExternalNetworkSets
118+
// that consist of network CIDRs that live outside the cluster as a peer.
119+
// This field follows standard label selector semantics; if present
120+
// but empty, it selects all ExternalNetworkSets defined in the cluster.
121+
// +optional
122+
ExternalNetworks *metav1.LabelSelector `json:"externalNetworks,omitempty"`
117123
}
118124

119125
// NamespacedPeer defines a flexible way to select Namespaces in a cluster.

‎apis/v1alpha1/zz_generated.deepcopy.go‎

Lines changed: 83 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎apis/v1alpha1/zz_generated.register.go‎

Lines changed: 2 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎config/crd/policy.networking.k8s.io_adminnetworkpolicies.yaml‎

Lines changed: 100 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -159,6 +159,56 @@ spec:
159159
maxProperties: 1
160160
minProperties: 1
161161
properties:
162+
externalNetworks:
163+
description: ExternalNetworks defines a way to select
164+
ExternalNetworkSets that consist of network CIDRs that
165+
live outside the cluster as a peer. This field follows
166+
standard label selector semantics; if present but empty,
167+
it selects all ExternalNetworkSets defined in the cluster.
168+
properties:
169+
matchExpressions:
170+
description: matchExpressions is a list of label selector
171+
requirements. The requirements are ANDed.
172+
items:
173+
description: A label selector requirement is a selector
174+
that contains values, a key, and an operator that
175+
relates the key and values.
176+
properties:
177+
key:
178+
description: key is the label key that the selector
179+
applies to.
180+
type: string
181+
operator:
182+
description: operator represents a key's relationship
183+
to a set of values. Valid operators are In,
184+
NotIn, Exists and DoesNotExist.
185+
type: string
186+
values:
187+
description: values is an array of string values.
188+
If the operator is In or NotIn, the values
189+
array must be non-empty. If the operator is
190+
Exists or DoesNotExist, the values array must
191+
be empty. This array is replaced during a
192+
strategic merge patch.
193+
items:
194+
type: string
195+
type: array
196+
required:
197+
- key
198+
- operator
199+
type: object
200+
type: array
201+
matchLabels:
202+
additionalProperties:
203+
type: string
204+
description: matchLabels is a map of {key,value} pairs.
205+
A single {key,value} in the matchLabels map is equivalent
206+
to an element of matchExpressions, whose key field
207+
is "key", the operator is "In", and the values array
208+
contains only "value". The requirements are ANDed.
209+
type: object
210+
type: object
211+
x-kubernetes-map-type: atomic
162212
namespaces:
163213
description: Namespaces defines a way to select a set
164214
of Namespaces.
@@ -481,6 +531,56 @@ spec:
481531
maxProperties: 1
482532
minProperties: 1
483533
properties:
534+
externalNetworks:
535+
description: ExternalNetworks defines a way to select
536+
ExternalNetworkSets that consist of network CIDRs that
537+
live outside the cluster as a peer. This field follows
538+
standard label selector semantics; if present but empty,
539+
it selects all ExternalNetworkSets defined in the cluster.
540+
properties:
541+
matchExpressions:
542+
description: matchExpressions is a list of label selector
543+
requirements. The requirements are ANDed.
544+
items:
545+
description: A label selector requirement is a selector
546+
that contains values, a key, and an operator that
547+
relates the key and values.
548+
properties:
549+
key:
550+
description: key is the label key that the selector
551+
applies to.
552+
type: string
553+
operator:
554+
description: operator represents a key's relationship
555+
to a set of values. Valid operators are In,
556+
NotIn, Exists and DoesNotExist.
557+
type: string
558+
values:
559+
description: values is an array of string values.
560+
If the operator is In or NotIn, the values
561+
array must be non-empty. If the operator is
562+
Exists or DoesNotExist, the values array must
563+
be empty. This array is replaced during a
564+
strategic merge patch.
565+
items:
566+
type: string
567+
type: array
568+
required:
569+
- key
570+
- operator
571+
type: object
572+
type: array
573+
matchLabels:
574+
additionalProperties:
575+
type: string
576+
description: matchLabels is a map of {key,value} pairs.
577+
A single {key,value} in the matchLabels map is equivalent
578+
to an element of matchExpressions, whose key field
579+
is "key", the operator is "In", and the values array
580+
contains only "value". The requirements are ANDed.
581+
type: object
582+
type: object
583+
x-kubernetes-map-type: atomic
484584
namespaces:
485585
description: Namespaces defines a way to select a set
486586
of Namespaces.

0 commit comments

Comments
 (0)