Skip to content

Commit 8bfeda6

Browse files
tssuryatssurya
committed
Implement inline CIDR block egress peer
This PR adds support for implementing inline CIDR peer blocks. Signed-off-by: Surya Seetharaman <[email protected]>
1 parent 6b1cf9f commit 8bfeda6

File tree

4 files changed

+73
-0
lines changed

4 files changed

+73
-0
lines changed

‎apis/v1alpha1/shared_types.go

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -175,6 +175,24 @@ type AdminNetworkPolicyEgressPeer struct {
175175
// <network-policy-api:experimental>
176176
// +optional
177177
Nodes *metav1.LabelSelector `json:"nodes,omitempty"`
178+
// Networks defines a way to select peers via CIDR blocks (both v4 & v6).
179+
// This is intended for representing entities that live outside the cluster,
180+
// which can't be selected by pods, namespaces and nodes peers, but note
181+
// that cluster-internal traffic will be checked against the rule as
182+
// well. So if you Allow or Deny traffic to `"0.0.0.0/0"`, that will allow
183+
// or deny all IPv4 pod-to-pod traffic as well. If you don't want that,
184+
// add a rule that Passes all pod traffic before the Networks rule.
185+
//
186+
// Each item in Networks should be provided in the CIDR format and should be
187+
// IPv4 or IPv6, for example "10.0.0.0/8" or "fd00::/8".
188+
//
189+
// Support: Extended
190+
//
191+
// <network-policy-api:experimental>
192+
// +optional
193+
// +kubebuilder:validation:MinItems=1
194+
// +kubebuilder:validation:MaxItems=100
195+
Networks []CIDR `json:"networks,omitempty"`
178196
}
179197

180198
// NamespacedPeer defines a flexible way to select Namespaces in a cluster.
@@ -237,3 +255,11 @@ type NamespacedPodPeer struct {
237255
//
238256
PodSelector metav1.LabelSelector `json:"podSelector"`
239257
}
258+
259+
// CIDR is an IP address range in CIDR notation (for example, "10.0.0.0/8" or "fd00::/8").
260+
// +kubebuilder:validation:Pattern=`(^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/(3[0-2]|[1-2][0-9]|[0-9]))$)|(^s*((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:)))(%.+)?s*(\/(12[0-8]|1[0-1][0-9]|[1-9][0-9]|[0-9]))$)`
261+
// + ---
262+
// + The regex for the IPv4 and IPv6 CIDR range was taken from
263+
// + https://blog.markhatton.co.uk/2011/03/15/regular-expressions-for-ip-addresses-cidr-ranges-and-hostnames/
264+
// + The resulting regex is an OR of both regexes.
265+
type CIDR string

‎apis/v1alpha1/zz_generated.deepcopy.go

Lines changed: 5 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎config/crd/experimental/policy.networking.k8s.io_adminnetworkpolicies.yaml

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -249,6 +249,27 @@ spec:
249249
maxItems: 100
250250
type: array
251251
type: object
252+
networks:
253+
description: "Networks defines a way to select peers via
254+
CIDR blocks (both v4 & v6). This is intended for representing
255+
entities that live outside the cluster, which can't
256+
be selected by pods, namespaces and nodes peers, but
257+
note that cluster-internal traffic will be checked against
258+
the rule as well. So if you Allow or Deny traffic to
259+
`\"0.0.0.0/0\"`, that will allow or deny all IPv4 pod-to-pod
260+
traffic as well. If you don't want that, add a rule
261+
that Passes all pod traffic before the Networks rule.
262+
\n Each item in Networks should be provided in the CIDR
263+
format and should be IPv4 or IPv6, for example \"10.0.0.0/8\"
264+
or \"fd00::/8\". \n Support: Extended \n <network-policy-api:experimental>"
265+
items:
266+
description: CIDR is an IP address range in CIDR notation
267+
(for example, "10.0.0.0/8" or "fd00::/8").
268+
pattern: (^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/(3[0-2]|[1-2][0-9]|[0-9]))$)|(^s*((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:)))(%.+)?s*(\/(12[0-8]|1[0-1][0-9]|[1-9][0-9]|[0-9]))$)
269+
type: string
270+
maxItems: 100
271+
minItems: 1
272+
type: array
252273
nodes:
253274
description: "Nodes defines a way to select a set of nodes
254275
in the cluster. This field follows standard label selector

‎config/crd/experimental/policy.networking.k8s.io_baselineadminnetworkpolicies.yaml

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -241,6 +241,27 @@ spec:
241241
maxItems: 100
242242
type: array
243243
type: object
244+
networks:
245+
description: "Networks defines a way to select peers via
246+
CIDR blocks (both v4 & v6). This is intended for representing
247+
entities that live outside the cluster, which can't
248+
be selected by pods, namespaces and nodes peers, but
249+
note that cluster-internal traffic will be checked against
250+
the rule as well. So if you Allow or Deny traffic to
251+
`\"0.0.0.0/0\"`, that will allow or deny all IPv4 pod-to-pod
252+
traffic as well. If you don't want that, add a rule
253+
that Passes all pod traffic before the Networks rule.
254+
\n Each item in Networks should be provided in the CIDR
255+
format and should be IPv4 or IPv6, for example \"10.0.0.0/8\"
256+
or \"fd00::/8\". \n Support: Extended \n <network-policy-api:experimental>"
257+
items:
258+
description: CIDR is an IP address range in CIDR notation
259+
(for example, "10.0.0.0/8" or "fd00::/8").
260+
pattern: (^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/(3[0-2]|[1-2][0-9]|[0-9]))$)|(^s*((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:)))(%.+)?s*(\/(12[0-8]|1[0-1][0-9]|[1-9][0-9]|[0-9]))$)
261+
type: string
262+
maxItems: 100
263+
minItems: 1
264+
type: array
244265
nodes:
245266
description: "Nodes defines a way to select a set of nodes
246267
in the cluster. This field follows standard label selector

0 commit comments

Comments
 (0)