Skip to content

Commit 461f58c

Browse files
astoycosastoycos
committed
add release channels and support levels
Add stable and experimental release channels in line with the gateway-api. Currently all of the apis we provide are experimental since they are at the alpha version. Add documentation on the new channels and update our NPEP process slightly. Update our CRD generation tooling to use the newly defined channels. Add documentation for support levels. Add support level annotations to all of our API fields. This will allow us to mark some features as Stable, Extended or Implementation-specific. Signed-off-by: Andrew Stoycos <[email protected]>
1 parent 639f674 commit 461f58c

15 files changed

+2490
-266
lines changed

‎apis/v1alpha1/adminnetworkpolicy_types.go

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,11 +57,17 @@ type AdminNetworkPolicySpec struct {
5757
// All AdminNetworkPolicy rules have higher precedence than NetworkPolicy or
5858
// BaselineAdminNetworkPolicy rules
5959
// The behavior is undefined if two ANP objects have same priority.
60+
//
61+
// Support: Core
62+
//
6063
// +kubebuilder:validation:Minimum=0
6164
// +kubebuilder:validation:Maximum=1000
6265
Priority int32 `json:"priority"`
6366

6467
// Subject defines the pods to which this AdminNetworkPolicy applies.
68+
//
69+
// Support: Core
70+
//
6571
Subject AdminNetworkPolicySubject `json:"subject"`
6672

6773
// Ingress is the list of Ingress rules to be applied to the selected pods.
@@ -71,6 +77,9 @@ type AdminNetworkPolicySpec struct {
7177
// is written. Thus, a rule that appears at the top of the ingress rules
7278
// would take the highest precedence.
7379
// ANPs with no ingress rules do not affect ingress traffic.
80+
//
81+
// Support: Core
82+
//
7483
// +optional
7584
// +kubebuilder:validation:MaxItems=100
7685
Ingress []AdminNetworkPolicyIngressRule `json:"ingress,omitempty"`
@@ -82,6 +91,9 @@ type AdminNetworkPolicySpec struct {
8291
// is written. Thus, a rule that appears at the top of the egress rules
8392
// would take the highest precedence.
8493
// ANPs with no egress rules do not affect egress traffic.
94+
//
95+
// Support: Core
96+
//
8597
// +optional
8698
// +kubebuilder:validation:MaxItems=100
8799
Egress []AdminNetworkPolicyEgressRule `json:"egress,omitempty"`
@@ -95,6 +107,9 @@ type AdminNetworkPolicyIngressRule struct {
95107
// in length. This field should be used by the implementation to help
96108
// improve observability, readability and error-reporting for any applied
97109
// AdminNetworkPolicies.
110+
//
111+
// Support: Core
112+
//
98113
// +optional
99114
// +kubebuilder:validation:MaxLength=100
100115
Name string `json:"name,omitempty"`
@@ -107,12 +122,18 @@ type AdminNetworkPolicyIngressRule struct {
107122
// then pass execution to any NetworkPolicies that select the pod.
108123
// If the pod is not selected by any NetworkPolicies then execution
109124
// is passed to any BaselineAdminNetworkPolicies that select the pod.
125+
//
126+
// Support: Core
127+
//
110128
Action AdminNetworkPolicyRuleAction `json:"action"`
111129

112130
// From is the list of sources whose traffic this rule applies to.
113131
// If any AdminNetworkPolicyPeer matches the source of incoming
114132
// traffic then the specified action is applied.
115133
// This field must be defined and contain at least one item.
134+
//
135+
// Support: Core
136+
//
116137
// +kubebuilder:validation:MinItems=1
117138
// +kubebuilder:validation:MaxItems=100
118139
From []AdminNetworkPolicyPeer `json:"from"`
@@ -122,6 +143,9 @@ type AdminNetworkPolicyIngressRule struct {
122143
// the pods selected for this policy i.e the subject of the policy.
123144
// So it matches on the destination port for the ingress traffic.
124145
// If Ports is not set then the rule does not filter traffic via port.
146+
//
147+
// Support: Core
148+
//
125149
// +optional
126150
// +kubebuilder:validation:MaxItems=100
127151
Ports *[]AdminNetworkPolicyPort `json:"ports,omitempty"`
@@ -135,6 +159,9 @@ type AdminNetworkPolicyEgressRule struct {
135159
// in length. This field should be used by the implementation to help
136160
// improve observability, readability and error-reporting for any applied
137161
// AdminNetworkPolicies.
162+
//
163+
// Support: Core
164+
//
138165
// +optional
139166
// +kubebuilder:validation:MaxLength=100
140167
Name string `json:"name,omitempty"`
@@ -147,25 +174,37 @@ type AdminNetworkPolicyEgressRule struct {
147174
// then pass execution to any NetworkPolicies that select the pod.
148175
// If the pod is not selected by any NetworkPolicies then execution
149176
// is passed to any BaselineAdminNetworkPolicies that select the pod.
177+
//
178+
// Support: Core
179+
//
150180
Action AdminNetworkPolicyRuleAction `json:"action"`
151181

152182
// To is the List of destinations whose traffic this rule applies to.
153183
// If any AdminNetworkPolicyPeer matches the destination of outgoing
154184
// traffic then the specified action is applied.
155185
// This field must be defined and contain at least one item.
186+
//
187+
// Support: Core
188+
//
156189
// +kubebuilder:validation:MinItems=1
157190
// +kubebuilder:validation:MaxItems=100
158191
To []AdminNetworkPolicyPeer `json:"to"`
159192

160193
// Ports allows for matching traffic based on port and protocols.
161194
// This field is a list of destination ports for the outging egress traffic.
162195
// If Ports is not set then the rule does not filter traffic via port.
196+
//
197+
// Support: Core
198+
//
163199
// +optional
164200
// +kubebuilder:validation:MaxItems=100
165201
Ports *[]AdminNetworkPolicyPort `json:"ports,omitempty"`
166202
}
167203

168204
// AdminNetworkPolicyRuleAction string describes the AdminNetworkPolicy action type.
205+
//
206+
// Support: Core
207+
//
169208
// +enum
170209
type AdminNetworkPolicyRuleAction string
171210

‎apis/v1alpha1/baselineadminnetworkpolicy_types.go

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,9 @@ type BaselineAdminNetworkPolicyStatus struct {
5151
// BaselineAdminNetworkPolicy.
5252
type BaselineAdminNetworkPolicySpec struct {
5353
// Subject defines the pods to which this BaselineAdminNetworkPolicy applies.
54+
//
55+
// Support: Core
56+
//
5457
Subject AdminNetworkPolicySubject `json:"subject"`
5558

5659
// Ingress is the list of Ingress rules to be applied to the selected pods
@@ -61,6 +64,9 @@ type BaselineAdminNetworkPolicySpec struct {
6164
// Thus, a rule that appears at the top of the ingress rules
6265
// would take the highest precedence.
6366
// BANPs with no ingress rules do not affect ingress traffic.
67+
//
68+
// Support: Core
69+
//
6470
// +optional
6571
// +kubebuilder:validation:MaxItems=100
6672
Ingress []BaselineAdminNetworkPolicyIngressRule `json:"ingress,omitempty"`
@@ -73,6 +79,9 @@ type BaselineAdminNetworkPolicySpec struct {
7379
// Thus, a rule that appears at the top of the egress rules
7480
// would take the highest precedence.
7581
// BANPs with no egress rules do not affect egress traffic.
82+
//
83+
// Support: Core
84+
//
7685
// +optional
7786
// +kubebuilder:validation:MaxItems=100
7887
Egress []BaselineAdminNetworkPolicyEgressRule `json:"egress,omitempty"`
@@ -86,6 +95,9 @@ type BaselineAdminNetworkPolicyIngressRule struct {
8695
// in length. This field should be used by the implementation to help
8796
// improve observability, readability and error-reporting for any applied
8897
// BaselineAdminNetworkPolicies.
98+
//
99+
// Support: Core
100+
//
89101
// +optional
90102
// +kubebuilder:validation:MaxLength=100
91103
Name string `json:"name,omitempty"`
@@ -94,12 +106,18 @@ type BaselineAdminNetworkPolicyIngressRule struct {
94106
// Currently the following actions are supported:
95107
// Allow: allows the selected traffic
96108
// Deny: denies the selected traffic
109+
//
110+
// Support: Core
111+
//
97112
Action BaselineAdminNetworkPolicyRuleAction `json:"action"`
98113

99114
// From is the list of sources whose traffic this rule applies to.
100115
// If any AdminNetworkPolicyPeer matches the source of incoming
101116
// traffic then the specified action is applied.
102117
// This field must be defined and contain at least one item.
118+
//
119+
// Support: Core
120+
//
103121
// +kubebuilder:validation:MinItems=1
104122
From []AdminNetworkPolicyPeer `json:"from"`
105123

@@ -108,6 +126,9 @@ type BaselineAdminNetworkPolicyIngressRule struct {
108126
// the pods selected for this policy i.e the subject of the policy.
109127
// So it matches on the destination port for the ingress traffic.
110128
// If Ports is not set then the rule does not filter traffic via port.
129+
//
130+
// Support: Core
131+
//
111132
// +optional
112133
// +kubebuilder:validation:MaxItems=100
113134
Ports *[]AdminNetworkPolicyPort `json:"ports,omitempty"`
@@ -121,6 +142,9 @@ type BaselineAdminNetworkPolicyEgressRule struct {
121142
// in length. This field should be used by the implementation to help
122143
// improve observability, readability and error-reporting for any applied
123144
// BaselineAdminNetworkPolicies.
145+
//
146+
// Support: Core
147+
//
124148
// +optional
125149
// +kubebuilder:validation:MaxLength=100
126150
Name string `json:"name,omitempty"`
@@ -129,13 +153,19 @@ type BaselineAdminNetworkPolicyEgressRule struct {
129153
// Currently the following actions are supported:
130154
// Allow: allows the selected traffic
131155
// Deny: denies the selected traffic
156+
//
157+
// Support: Core
158+
//
132159
Action BaselineAdminNetworkPolicyRuleAction `json:"action"`
133160

134161
// To is the list of destinations whose traffic this rule applies to.
135162
// If any AdminNetworkPolicyPeer matches the destination of outgoing
136163
// traffic then the specified action is applied.
137164
// This field must be defined and contain at least one item.
138165
// +kubebuilder:validation:MinItems=1
166+
//
167+
// Support: Core
168+
//
139169
To []AdminNetworkPolicyPeer `json:"to"`
140170

141171
// Ports allows for matching traffic based on port and protocols.
@@ -148,6 +178,9 @@ type BaselineAdminNetworkPolicyEgressRule struct {
148178

149179
// BaselineAdminNetworkPolicyRuleAction string describes the BaselineAdminNetworkPolicy
150180
// action type.
181+
//
182+
// Support: Core
183+
//
151184
// +enum
152185
type BaselineAdminNetworkPolicyRuleAction string
153186

‎apis/v1alpha1/shared_types.go

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,27 +51,43 @@ type NamespacedPodSubject struct {
5151
// +kubebuilder:validation:MinProperties=1
5252
type AdminNetworkPolicyPort struct {
5353
// Port selects a port on a pod(s) based on number.
54+
//
55+
// Support: Core
56+
//
5457
// +optional
5558
PortNumber *Port `json:"portNumber,omitempty"`
5659

5760
// NamedPort selects a port on a pod(s) based on name.
61+
//
62+
// Support: Extended
63+
//
64+
// <network-policy-api:experimental>
5865
// +optional
5966
NamedPort *string `json:"namedPort,omitempty"`
6067

6168
// PortRange selects a port range on a pod(s) based on provided start and end
6269
// values.
70+
//
71+
// Support: Core
72+
//
6373
// +optional
6474
PortRange *PortRange `json:"portRange,omitempty"`
6575
}
6676

6777
type Port struct {
6878
// Protocol is the network protocol (TCP, UDP, or SCTP) which traffic must
6979
// match. If not specified, this field defaults to TCP.
80+
//
81+
// Support: Core
82+
//
7083
Protocol v1.Protocol `json:"protocol"`
7184

7285
// Number defines a network port value.
7386
// +kubebuilder:validation:Minimum=1
7487
// +kubebuilder:validation:Maximum=65535
88+
//
89+
// Support: Core
90+
//
7591
Port int32 `json:"port"`
7692
}
7793

@@ -80,18 +96,27 @@ type Port struct {
8096
type PortRange struct {
8197
// Protocol is the network protocol (TCP, UDP, or SCTP) which traffic must
8298
// match. If not specified, this field defaults to TCP.
99+
//
100+
// Support: Core
101+
//
83102
Protocol v1.Protocol `json:"protocol,omitempty"`
84103

85104
// Start defines a network port that is the start of a port range, the Start
86105
// value must be less than End.
87106
// +kubebuilder:validation:Minimum=1
88107
// +kubebuilder:validation:Maximum=65535
108+
//
109+
// Support: Core
110+
//
89111
Start int32 `json:"start"`
90112

91113
// End defines a network port that is the end of a port range, the End value
92114
// must be greater than Start.
93115
// +kubebuilder:validation:Minimum=1
94116
// +kubebuilder:validation:Maximum=65535
117+
//
118+
// Support: Core
119+
//
95120
End int32 `json:"end"`
96121
}
97122

@@ -103,10 +128,16 @@ type PortRange struct {
103128
// +kubebuilder:validation:MinProperties=1
104129
type AdminNetworkPolicyPeer struct {
105130
// Namespaces defines a way to select a set of Namespaces.
131+
//
132+
// Support: Core
133+
//
106134
// +optional
107135
Namespaces *NamespacedPeer `json:"namespaces,omitempty"`
108136
// Pods defines a way to select a set of pods in
109137
// in a set of namespaces.
138+
//
139+
// Support: Core
140+
//
110141
// +optional
111142
Pods *NamespacedPodPeer `json:"pods,omitempty"`
112143
}
@@ -121,6 +152,9 @@ type NamespacedPeer struct {
121152
// NamespaceSelector is a labelSelector used to select Namespaces, This field
122153
// follows standard label selector semantics; if present but empty, it selects
123154
// all Namespaces.
155+
//
156+
// Support: Core
157+
//
124158
// +optional
125159
NamespaceSelector *metav1.LabelSelector `json:"namespaceSelector,omitempty"`
126160

@@ -129,6 +163,10 @@ type NamespacedPeer struct {
129163
// To be selected a Namespace must have all of the labels defined in SameLabels,
130164
// AND they must all have the same value as the subject of this policy.
131165
// If Samelabels is Empty then nothing is selected.
166+
//
167+
// Support: Extended
168+
//
169+
// <network-policy-api:experimental>
132170
// +optional
133171
// +kubebuilder:validation:MaxItems=100
134172
SameLabels []string `json:"sameLabels,omitempty"`
@@ -138,6 +176,10 @@ type NamespacedPeer struct {
138176
// To be selected a Namespace must have all of the labels defined in NotSameLabels,
139177
// AND at least one of them must have different values than the subject of this policy.
140178
// If NotSameLabels is empty then nothing is selected.
179+
//
180+
// Support: Extended
181+
//
182+
// <network-policy-api:experimental>
141183
// +optional
142184
// +kubebuilder:validation:MaxItems=100
143185
NotSameLabels []string `json:"notSameLabels,omitempty"`
@@ -147,10 +189,16 @@ type NamespacedPeer struct {
147189
// cluster. The `Namespaces` and `PodSelector` fields are required.
148190
type NamespacedPodPeer struct {
149191
// Namespaces is used to select a set of Namespaces.
192+
//
193+
// Support: Core
194+
//
150195
Namespaces NamespacedPeer `json:"namespaces"`
151196

152197
// PodSelector is a labelSelector used to select Pods, This field is NOT optional,
153198
// follows standard label selector semantics and if present but empty, it selects
154199
// all Pods.
200+
//
201+
// Support: Core
202+
//
155203
PodSelector metav1.LabelSelector `json:"podSelector"`
156204
}

0 commit comments

Comments
 (0)