Skip to content

Commit c0938a6

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #30 from astoycos/admin-network-policy-api
Implement the AdminNetworkPolicy api CRD
2 parents c71df7c + 274184a commit c0938a6

29 files changed

+4085
-0
lines changed

‎.dockerignore

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
# More info: https://docs.docker.com/engine/reference/builder/#dockerignore-file
2+
# Ignore all files which are not go type
3+
!**/*.go
4+
!**/*.mod
5+
!**/*.sum

‎.gitignore

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1 +1,2 @@
11
.idea/
2+
vendor/

‎Dockerfile

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# Build the manager binary
2+
FROM golang:1.15 as builder
3+
4+
WORKDIR /workspace
5+
# Copy the Go Modules manifests
6+
COPY go.mod go.mod
7+
COPY go.sum go.sum
8+
# cache deps before building and copying source so that we don't need to re-download as much
9+
# and so that source changes don't invalidate our downloaded layer
10+
RUN go mod download
11+
12+
# Copy the go source
13+
COPY main.go main.go
14+
COPY api/ api/
15+
COPY controllers/ controllers/
16+
17+
# Build
18+
RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 GO111MODULE=on go build -a -o manager main.go
19+
20+
# Use distroless as minimal base image to package the manager binary
21+
# Refer to https://github.com/GoogleContainerTools/distroless for more details
22+
FROM gcr.io/distroless/static:nonroot
23+
WORKDIR /
24+
COPY --from=builder /workspace/manager .
25+
USER 65532:65532
26+
27+
ENTRYPOINT ["/manager"]

‎Makefile

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
2+
# Image URL to use all building/pushing image targets
3+
IMG ?= controller:latest
4+
# Produce CRDs that work back to Kubernetes 1.11 (no version conversion)
5+
CRD_OPTIONS ?= "crd:trivialVersions=true,preserveUnknownFields=false"
6+
7+
# Get the currently used golang install path (in GOPATH/bin, unless GOBIN is set)
8+
ifeq (,$(shell go env GOBIN))
9+
GOBIN=$(shell go env GOPATH)/bin
10+
else
11+
GOBIN=$(shell go env GOBIN)
12+
endif
13+
14+
all: generate manifests fmt vet
15+
16+
##@ General
17+
18+
# The help target prints out all targets with their descriptions organized
19+
# beneath their categories. The categories are represented by '##@' and the
20+
# target descriptions by '##'. The awk commands is responsible for reading the
21+
# entire set of makefiles included in this invocation, looking for lines of the
22+
# file as xyz: ## something, and then pretty-format the target and help. Then,
23+
# if there's a line with ##@ something, that gets pretty-printed as a category.
24+
# More info on the usage of ANSI control characters for terminal formatting:
25+
# https://en.wikipedia.org/wiki/ANSI_escape_code#SGR_parameters
26+
# More info on the awk command:
27+
# http://linuxcommand.org/lc3_adv_awk.php
28+
29+
help: ## Display this help.
30+
@awk 'BEGIN {FS = ":.*##"; printf "\nUsage:\n make \033[36m<target>\033[0m\n"} /^[a-zA-Z_0-9-]+:.*?##/ { printf " \033[36m%-15s\033[0m %s\n", $$1, $$2 } /^##@/ { printf "\n\033[1m%s\033[0m\n", substr($$0, 5) } ' $(MAKEFILE_LIST)
31+
32+
##@ Development
33+
34+
manifests: controller-gen ## Generate WebhookConfiguration, ClusterRole and CustomResourceDefinition objects.
35+
$(CONTROLLER_GEN) $(CRD_OPTIONS) rbac:roleName=manager-role webhook paths="./..." output:crd:artifacts:config=config/crd/bases
36+
37+
generate: controller-gen ## Generate code containing DeepCopy, DeepCopyInto, and DeepCopyObject method implementations.
38+
$(CONTROLLER_GEN) object:headerFile="hack/boilerplate.go.txt" paths="./..."
39+
40+
fmt: ## Run go fmt against code.
41+
go fmt ./...
42+
43+
vet: ## Run go vet against code.
44+
go vet ./...
45+
46+
ENVTEST_ASSETS_DIR=$(shell pwd)/testbin
47+
test: manifests generate fmt vet ## Run tests.
48+
mkdir -p ${ENVTEST_ASSETS_DIR}
49+
test -f ${ENVTEST_ASSETS_DIR}/setup-envtest.sh || curl -sSLo ${ENVTEST_ASSETS_DIR}/setup-envtest.sh https://raw.githubusercontent.com/kubernetes-sigs/controller-runtime/v0.7.0/hack/setup-envtest.sh
50+
source ${ENVTEST_ASSETS_DIR}/setup-envtest.sh; fetch_envtest_tools $(ENVTEST_ASSETS_DIR); setup_envtest_env $(ENVTEST_ASSETS_DIR); go test ./... -coverprofile cover.out
51+
52+
##@ Deployment
53+
54+
install: manifests kustomize ## Install CRDs into the K8s cluster specified in ~/.kube/config.
55+
$(KUSTOMIZE) build config/crd | kubectl apply -f -
56+
57+
uninstall: manifests kustomize ## Uninstall CRDs from the K8s cluster specified in ~/.kube/config.
58+
$(KUSTOMIZE) build config/crd | kubectl delete -f -
59+
60+
deploy: manifests kustomize ## Deploy controller to the K8s cluster specified in ~/.kube/config.
61+
cd config/manager && $(KUSTOMIZE) edit set image controller=${IMG}
62+
$(KUSTOMIZE) build config/default | kubectl apply -f -
63+
64+
undeploy: ## Undeploy controller from the K8s cluster specified in ~/.kube/config.
65+
$(KUSTOMIZE) build config/default | kubectl delete -f -
66+
67+
68+
CONTROLLER_GEN = $(shell pwd)/bin/controller-gen
69+
controller-gen: ## Download controller-gen locally if necessary.
70+
$(call go-get-tool,$(CONTROLLER_GEN),sigs.k8s.io/controller-tools/cmd/[email protected])
71+
72+
KUSTOMIZE = $(shell pwd)/bin/kustomize
73+
kustomize: ## Download kustomize locally if necessary.
74+
$(call go-get-tool,$(KUSTOMIZE),sigs.k8s.io/kustomize/kustomize/[email protected])
75+
76+
# go-get-tool will 'go get' any package $2 and install it to $1.
77+
PROJECT_DIR := $(shell dirname $(abspath $(lastword $(MAKEFILE_LIST))))
78+
define go-get-tool
79+
@[ -f $(1) ] || { \
80+
set -e ;\
81+
TMP_DIR=$$(mktemp -d) ;\
82+
cd $$TMP_DIR ;\
83+
go mod init tmp ;\
84+
echo "Downloading $(2)" ;\
85+
GOBIN=$(PROJECT_DIR)/bin go get $(2) ;\
86+
rm -rf $$TMP_DIR ;\
87+
}
88+
endef

‎PROJECT

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
domain: policy.networking.k8s.io
2+
layout: go.kubebuilder.io/v3
3+
projectName: network-policy-api
4+
repo: github.com/kubernetes-sigs/network-policy-api
5+
resources:
6+
- api:
7+
crdVersion: v1
8+
namespaced: true
9+
controller: false
10+
domain: policy.networking.k8s.io
11+
group: policy.networking.k8s.io
12+
kind: AdminNetworkPolicy
13+
path: github.com/kubernetes-sigs/network-policy-api/apis/v1alpha1
14+
version: v1alpha1
15+
- api:
16+
crdVersion: v1
17+
namespaced: true
18+
controller: false
19+
domain: policy.networking.k8s.io
20+
group: policy.networking.k8s.io
21+
kind: BaselineAdminNetworkPolicy
22+
path: github.com/kubernetes-sigs/network-policy-api/apis/v1alpha1
23+
version: v1alpha1
24+
version: "3"

‎apis/v1alpha1/adminnetworkpolicy_types.go

Lines changed: 179 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,179 @@
1+
/*
2+
Copyright 2022.
3+
Licensed under the Apache License, Version 2.0 (the "License");
4+
you may not use this file except in compliance with the License.
5+
You may obtain a copy of the License at
6+
http://www.apache.org/licenses/LICENSE-2.0
7+
Unless required by applicable law or agreed to in writing, software
8+
distributed under the License is distributed on an "AS IS" BASIS,
9+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
10+
See the License for the specific language governing permissions and
11+
limitations under the License.
12+
*/
13+
14+
// All fields in this package are required unless Explicitly marked optional
15+
// +kubebuilder:validation:Required
16+
package v1alpha1
17+
18+
import (
19+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
20+
)
21+
22+
//+kubebuilder:object:root=true
23+
//+kubebuilder:subresource:status
24+
25+
// AdminNetworkPolicy is a cluster level resource that is part of the
26+
// AdminNetworkPolicy API.
27+
type AdminNetworkPolicy struct {
28+
metav1.TypeMeta `json:",inline"`
29+
metav1.ObjectMeta `json:"metadata"`
30+
31+
// Specification of the desired behavior of AdminNetworkPolicy.
32+
Spec AdminNetworkPolicySpec `json:"spec"`
33+
34+
// Status is the status to be reported by the implementation.
35+
// +optional
36+
Status AdminNetworkPolicyStatus `json:"status,omitempty"`
37+
}
38+
39+
// AdminNetworkPolicyStatus defines the observed state of AdminNetworkPolicy.
40+
type AdminNetworkPolicyStatus struct {
41+
Conditions []metav1.Condition `json:"conditions"`
42+
}
43+
44+
// AdminNetworkPolicySpec defines the desired state of AdminNetworkPolicy.
45+
type AdminNetworkPolicySpec struct {
46+
// Priority is a value from 0 to 1000. Rules with lower priority values have
47+
// higher precedence, and are checked before rules with higher priority values.
48+
// All AdminNetworkPolicy rules have higher precedence than NetworkPolicy or
49+
// BaselineAdminNetworkPolicy rules
50+
// +kubebuilder:validation:Minimum=0
51+
// +kubebuilder:validation:Maximum=1000
52+
Priority int32 `json:"priority"`
53+
54+
// Subject defines the pods to which this AdminNetworkPolicy applies.
55+
Subject AdminNetworkPolicySubject `json:"subject"`
56+
57+
// Ingress is the list of Ingress rules to be applied to the selected pods.
58+
// A total of 100 rules will be allowed in each ANP instance. ANPs with no
59+
// ingress rules do not affect ingress traffic.
60+
// +optional
61+
// +kubebuilder:validation:MaxItems=100
62+
Ingress []AdminNetworkPolicyIngressRule `json:"ingress,omitempty"`
63+
64+
// Egress is the list of Egress rules to be applied to the selected pods.
65+
// A total of 100 rules will be allowed in each ANP instance. ANPs with no
66+
// egress rules do not affect egress traffic.
67+
// +optional
68+
// +kubebuilder:validation:MaxItems=100
69+
Egress []AdminNetworkPolicyEgressRule `json:"egress,omitempty"`
70+
}
71+
72+
// AdminNetworkPolicyIngressRule describes an action to take on a particular
73+
// set of traffic destined for pods selected by an AdminNetworkPolicy's
74+
// Subject field.
75+
type AdminNetworkPolicyIngressRule struct {
76+
// Name is an identifier for this rule, that may be no more than 100 characters
77+
// in length. This field should be used by the implementation to help
78+
// improve observability, readability and error-reporting for any applied
79+
// AdminNetworkPolicies.
80+
// +optional
81+
// +kubebuilder:validation:MaxLength=100
82+
Name string `json:"name,omitempty"`
83+
84+
// Action specifies the effect this rule will have on matching traffic.
85+
// Currently the following actions are supported:
86+
// Allow: allows the selected traffic (even if it would otherwise have been denied by NetworkPolicy)
87+
// Deny: denies the selected traffic
88+
// Pass: instructs the selected traffic to skip any remaining ANP rules, and
89+
// then pass execution to any NetworkPolicies that select the pod.
90+
// If the pod is not selected by any NetworkPolicies then execution
91+
// is passed to any BaselineAdminNetworkPolicies that select the pod.
92+
Action AdminNetworkPolicyRuleAction `json:"action"`
93+
94+
// From is the list of sources whose traffic this rule applies to.
95+
// If any AdminNetworkPolicyPeer matches the source of incoming
96+
// traffic then the specified action is applied.
97+
// This field must be defined and contain at least one item.
98+
// +kubebuilder:validation:MinItems=1
99+
// +kubebuilder:validation:MaxItems=100
100+
From []AdminNetworkPolicyPeer `json:"from"`
101+
102+
// Ports allows for matching traffic based on port and protocols.
103+
// If Ports is not set then the rule does not filter traffic via port.
104+
// +optional
105+
// +kubebuilder:validation:MaxItems=100
106+
Ports *[]AdminNetworkPolicyPort `json:"ports,omitempty"`
107+
}
108+
109+
// AdminNetworkPolicyEgressRule describes an action to take on a particular
110+
// set of traffic originating from pods selected by a AdminNetworkPolicy's
111+
// Subject field.
112+
type AdminNetworkPolicyEgressRule struct {
113+
// Name is an identifier for this rule, that may be no more than 100 characters
114+
// in length. This field should be used by the implementation to help
115+
// improve observability, readability and error-reporting for any applied
116+
// AdminNetworkPolicies.
117+
// +optional
118+
// +kubebuilder:validation:MaxLength=100
119+
Name string `json:"name,omitempty"`
120+
121+
// Action specifies the effect this rule will have on matching traffic.
122+
// Currently the following actions are supported:
123+
// Allow: allows the selected traffic (even if it would otherwise have been denied by NetworkPolicy)
124+
// Deny: denies the selected traffic
125+
// Pass: instructs the selected traffic to skip any remaining ANP rules, and
126+
// then pass execution to any NetworkPolicies that select the pod.
127+
// If the pod is not selected by any NetworkPolicies then execution
128+
// is passed to any BaselineAdminNetworkPolicies that select the pod.
129+
Action AdminNetworkPolicyRuleAction `json:"action"`
130+
131+
// To is the List of destinations whose traffic this rule applies to.
132+
// If any AdminNetworkPolicyPeer matches the destination of outgoing
133+
// traffic then the specified action is applied.
134+
// This field must be defined and contain at least one item.
135+
// +kubebuilder:validation:MinItems=1
136+
// +kubebuilder:validation:MaxItems=100
137+
To []AdminNetworkPolicyPeer `json:"to"`
138+
139+
// Ports allows for matching traffic based on port and protocols.
140+
// If Ports is not set then the rule does not filter traffic via port.
141+
// +optional
142+
// +kubebuilder:validation:MaxItems=100
143+
Ports *[]AdminNetworkPolicyPort `json:"ports,omitempty"`
144+
}
145+
146+
// AdminNetworkPolicyRuleAction string describes the AdminNetworkPolicy action type.
147+
// +enum
148+
type AdminNetworkPolicyRuleAction string
149+
150+
const (
151+
// AdminNetworkPolicyRuleActionAllow indicates that matching traffic will be
152+
// allowed regardless of NetworkPolicy and BaselineAdminNetworkPolicy
153+
// rules. Users cannot block traffic which has been matched by an "Allow"
154+
// rule in an AdminNetworkPolicy.
155+
AdminNetworkPolicyRuleActionAllow AdminNetworkPolicyRuleAction = "Allow"
156+
// AdminNetworkPolicyRuleActionDeny indicates that matching traffic will be
157+
// denied before being checked against NetworkPolicy or
158+
// BaselineAdminNetworkPolicy rules. Pods will never receive traffic which
159+
// has been matched by a "Deny" rule in an AdminNetworkPolicy.
160+
AdminNetworkPolicyRuleActionDeny AdminNetworkPolicyRuleAction = "Deny"
161+
// AdminNetworkPolicyRuleActionPass indicates that matching traffic will
162+
// bypass further AdminNetworkPolicy processing (ignoring rules with lower
163+
// precedence) and be allowed or denied based on NetworkPolicy and
164+
// BaselineAdminNetworkPolicy rules.
165+
AdminNetworkPolicyRuleActionPass AdminNetworkPolicyRuleAction = "Pass"
166+
)
167+
168+
//+kubebuilder:object:root=true
169+
170+
// AdminNetworkPolicyList contains a list of AdminNetworkPolicy
171+
type AdminNetworkPolicyList struct {
172+
metav1.TypeMeta `json:",inline"`
173+
metav1.ListMeta `json:"metadata,omitempty"`
174+
Items []AdminNetworkPolicy `json:"items"`
175+
}
176+
177+
func init() {
178+
SchemeBuilder.Register(&AdminNetworkPolicy{}, &AdminNetworkPolicyList{})
179+
}

0 commit comments

Comments
 (0)