Skip to content

Commit ec3fc38

Browse files
tssuryatssurya
committed
Implement inline CIDR egress peer
This PR adds support for implementing inline CIDR peer blocks. Signed-off-by: Surya Seetharaman <[email protected]>
1 parent dc00b36 commit ec3fc38

9 files changed

+123
-8
lines changed

‎apis/v1alpha1/shared_types.go

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -175,6 +175,26 @@ type AdminNetworkPolicyEgressPeer struct {
175175
// <network-policy-api:experimental>
176176
// +optional
177177
Nodes *metav1.LabelSelector `json:"nodes,omitempty"`
178+
// Networks defines a way to select peers via CIDR blocks.
179+
// This is intended for representing entities that live outside the cluster,
180+
// which can't be selected by pods, namespaces and nodes peers, but note
181+
// that cluster-internal traffic will be checked against the rule as
182+
// well. So if you Allow or Deny traffic to `"0.0.0.0/0"`, that will allow
183+
// or deny all IPv4 pod-to-pod traffic as well. If you don't want that,
184+
// add a rule that Passes all pod traffic before the Networks rule.
185+
//
186+
// Each item in Networks should be provided in the CIDR format and should be
187+
// IPv4 or IPv6, for example "10.0.0.0/8" or "fd00::/8".
188+
//
189+
// Networks can have upto 25 CIDRs specified.
190+
//
191+
// Support: Extended
192+
//
193+
// <network-policy-api:experimental>
194+
// +optional
195+
// +kubebuilder:validation:MinItems=1
196+
// +kubebuilder:validation:MaxItems=25
197+
Networks []CIDR `json:"networks,omitempty"`
178198
}
179199

180200
// NamespacedPeer defines a flexible way to select Namespaces in a cluster.
@@ -237,3 +257,13 @@ type NamespacedPodPeer struct {
237257
//
238258
PodSelector metav1.LabelSelector `json:"podSelector"`
239259
}
260+
261+
// CIDR is an IP address range in CIDR notation (for example, "10.0.0.0/8" or "fd00::/8").
262+
// The regex for the IPv4 and IPv6 CIDR range was taken from
263+
// https://blog.markhatton.co.uk/2011/03/15/regular-expressions-for-ip-addresses-cidr-ranges-and-hostnames/
264+
// The resulting regex is an OR of both regexes. IPv4 address embedded in IPv6 addresses are not supported.
265+
// TODO: Change the CIDR's validation regex to use CEL isCIDR() in Kube 1.31 when it is available.
266+
// +kubebuilder:validation:Pattern=`(^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/(3[0-2]|[1-2][0-9]|[0-9]))$)|(^s*((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:)))(%.+)?s*(\/(12[0-8]|1[0-1][0-9]|[1-9][0-9]|[0-9]))$)`
267+
// +kubebuilder:validation:XValidation:rule="self.contains(':') != self.contains('.')",message="CIDR must be either an IPv4 or IPv6 address. IPv4 address embedded in IPv6 addresses are not supported"
268+
// +kubebuilder:validation:MaxLength=43
269+
type CIDR string

‎apis/v1alpha1/zz_generated.deepcopy.go

Lines changed: 5 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎config/crd/experimental/policy.networking.k8s.io_adminnetworkpolicies.yaml

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -310,6 +310,46 @@ spec:
310310
maxItems: 100
311311
type: array
312312
type: object
313+
networks:
314+
description: |-
315+
Networks defines a way to select peers via CIDR blocks.
316+
This is intended for representing entities that live outside the cluster,
317+
which can't be selected by pods, namespaces and nodes peers, but note
318+
that cluster-internal traffic will be checked against the rule as
319+
well. So if you Allow or Deny traffic to `"0.0.0.0/0"`, that will allow
320+
or deny all IPv4 pod-to-pod traffic as well. If you don't want that,
321+
add a rule that Passes all pod traffic before the Networks rule.
322+
323+
324+
Each item in Networks should be provided in the CIDR format and should be
325+
IPv4 or IPv6, for example "10.0.0.0/8" or "fd00::/8".
326+
327+
328+
Networks can have upto 25 CIDRs specified.
329+
330+
331+
Support: Extended
332+
333+
334+
<network-policy-api:experimental>
335+
items:
336+
description: |-
337+
CIDR is an IP address range in CIDR notation (for example, "10.0.0.0/8" or "fd00::/8").
338+
The regex for the IPv4 and IPv6 CIDR range was taken from
339+
https://blog.markhatton.co.uk/2011/03/15/regular-expressions-for-ip-addresses-cidr-ranges-and-hostnames/
340+
The resulting regex is an OR of both regexes. IPv4 address embedded in IPv6 addresses are not supported.
341+
TODO: Change the CIDR's validation regex to use CEL isCIDR() in Kube 1.31 when it is available.
342+
maxLength: 43
343+
pattern: (^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/(3[0-2]|[1-2][0-9]|[0-9]))$)|(^s*((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:)))(%.+)?s*(\/(12[0-8]|1[0-1][0-9]|[1-9][0-9]|[0-9]))$)
344+
type: string
345+
x-kubernetes-validations:
346+
- message: CIDR must be either an IPv4 or IPv6 address.
347+
IPv4 address embedded in IPv6 addresses are not
348+
supported
349+
rule: self.contains(':') != self.contains('.')
350+
maxItems: 25
351+
minItems: 1
352+
type: array
313353
nodes:
314354
description: |-
315355
Nodes defines a way to select a set of nodes in

‎config/crd/experimental/policy.networking.k8s.io_baselineadminnetworkpolicies.yaml

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -301,6 +301,46 @@ spec:
301301
maxItems: 100
302302
type: array
303303
type: object
304+
networks:
305+
description: |-
306+
Networks defines a way to select peers via CIDR blocks.
307+
This is intended for representing entities that live outside the cluster,
308+
which can't be selected by pods, namespaces and nodes peers, but note
309+
that cluster-internal traffic will be checked against the rule as
310+
well. So if you Allow or Deny traffic to `"0.0.0.0/0"`, that will allow
311+
or deny all IPv4 pod-to-pod traffic as well. If you don't want that,
312+
add a rule that Passes all pod traffic before the Networks rule.
313+
314+
315+
Each item in Networks should be provided in the CIDR format and should be
316+
IPv4 or IPv6, for example "10.0.0.0/8" or "fd00::/8".
317+
318+
319+
Networks can have upto 25 CIDRs specified.
320+
321+
322+
Support: Extended
323+
324+
325+
<network-policy-api:experimental>
326+
items:
327+
description: |-
328+
CIDR is an IP address range in CIDR notation (for example, "10.0.0.0/8" or "fd00::/8").
329+
The regex for the IPv4 and IPv6 CIDR range was taken from
330+
https://blog.markhatton.co.uk/2011/03/15/regular-expressions-for-ip-addresses-cidr-ranges-and-hostnames/
331+
The resulting regex is an OR of both regexes. IPv4 address embedded in IPv6 addresses are not supported.
332+
TODO: Change the CIDR's validation regex to use CEL isCIDR() in Kube 1.31 when it is available.
333+
maxLength: 43
334+
pattern: (^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/(3[0-2]|[1-2][0-9]|[0-9]))$)|(^s*((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:)))(%.+)?s*(\/(12[0-8]|1[0-1][0-9]|[1-9][0-9]|[0-9]))$)
335+
type: string
336+
x-kubernetes-validations:
337+
- message: CIDR must be either an IPv4 or IPv6 address.
338+
IPv4 address embedded in IPv6 addresses are not
339+
supported
340+
rule: self.contains(':') != self.contains('.')
341+
maxItems: 25
342+
minItems: 1
343+
type: array
304344
nodes:
305345
description: |-
306346
Nodes defines a way to select a set of nodes in

‎mkdocs.yml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -65,11 +65,11 @@ nav:
6565
- Provisional:
6666
- npeps/npep-122.md
6767
- npeps/npep-133.md
68-
- Implementable:
69-
- npeps/npep-137-conformance-profiles.md
68+
# - Implementable:
69+
- Experimental:
7070
- npeps/npep-126-egress-traffic-control.md
71-
# - Experimental:
72-
# - Standard:
71+
- Standard:
72+
- npeps/npep-137-conformance-profiles.md
7373
# - Declined:
7474
- Blog:
7575
- blog/index.md

‎npeps/npep-126-egress-traffic-control.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
# NPEP-126: Add northbound traffic support in (B)ANP API
22

33
* Issue: [#126](https://github.com/kubernetes-sigs/network-policy-api/issues/126)
4-
* Status: Implementable
4+
* Status: Experimental
55

66
## TLDR
77

‎npeps/npep-137-conformance-profiles.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
# NPEP-137: Conformance Profiles
22

33
* Issue: [#137](https://github.com/kubernetes-sigs/network-policy-api/issues/137)
4-
* Status: Implementable
4+
* Status: Standard
55

66
## TLDR
77

‎site-src/npeps/npep-126-egress-traffic-control.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
# NPEP-126: Add northbound traffic support in (B)ANP API
22

33
* Issue: [#126](https://github.com/kubernetes-sigs/network-policy-api/issues/126)
4-
* Status: Implementable
4+
* Status: Experimental
55

66
## TLDR
77

‎site-src/npeps/npep-137-conformance-profiles.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
# NPEP-137: Conformance Profiles
22

33
* Issue: [#137](https://github.com/kubernetes-sigs/network-policy-api/issues/137)
4-
* Status: Implementable
4+
* Status: Standard
55

66
## TLDR
77

0 commit comments

Comments
 (0)