Skip to content

Commit f1c750c

Browse files
tssuryatssurya
committed
Add support for selecting external destinations as egress peers
Some FTR things: 1) As an egress peer a user can selector either namespaces, or pods or nodes or externalNetworks. In a given rule more than 1 type of selection is not allowed. 2) An empty externalNetworks selector means it selects all externalNetworkSets in the cluster. 3) externalNetworks can be set only from to.Peer Signed-off-by: Surya Seetharaman <[email protected]>
1 parent 2d2967b commit f1c750c

19 files changed

+913
-0
lines changed

‎apis/v1alpha1/externalnetworkset_types.go‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
/*
2+
Copyright 2023 The Kubernetes Authors.
3+
Licensed under the Apache License, Version 2.0 (the "License");
4+
you may not use this file except in compliance with the License.
5+
You may obtain a copy of the License at
6+
http://www.apache.org/licenses/LICENSE-2.0
7+
Unless required by applicable law or agreed to in writing, software
8+
distributed under the License is distributed on an "AS IS" BASIS,
9+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
10+
See the License for the specific language governing permissions and
11+
limitations under the License.
12+
*/
13+
14+
// All fields in this package are required unless Explicitly marked optional
15+
// +kubebuilder:validation:Required
16+
package v1alpha1
17+
18+
import (
19+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
20+
)
21+
22+
// +genclient
23+
// +genclient:nonNamespaced
24+
// +kubebuilder:object:root=true
25+
// +kubebuilder:subresource:status
26+
// +kubebuilder:resource:shortName=ens,scope=Cluster
27+
// +kubebuilder:printcolumn:name="Networks",type=string,JSONPath=".spec.networks"
28+
// +kubebuilder:printcolumn:name="Age",type="date",JSONPath=".metadata.creationTimestamp"
29+
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
30+
// ExternalNetworkSet is a cluster level resource that is used to define
31+
// a set of networks outside the cluster which can be referred to from
32+
// the AdminNetworkPolicy && BaselineAdminNetworkPolicy APIs as an external peer
33+
type ExternalNetworkSet struct {
34+
metav1.TypeMeta `json:",inline"`
35+
metav1.ObjectMeta `json:"metadata"`
36+
37+
// Specification of the desired behavior of ExternalNetworkSet.
38+
Spec ExternalNetworkSetSpec `json:"spec"`
39+
}
40+
41+
// ExternalNetworkSetSpec defines the desired state of ExternalNetworkSet.
42+
// +kubebuilder:validation:MaxProperties=1
43+
// +kubebuilder:validation:MinProperties=1
44+
type ExternalNetworkSetSpec struct {
45+
// Networks is the list of NetworkCIDR (both v4 & v6) that can be used to define
46+
// external destinations.
47+
// A total of 100 CIDRs will be allowed in each NetworkSet instance.
48+
// ANP & BANP APIs may use the .spec.in(e)gress.from(to).externalNetworks selector
49+
// to select a set of external networks
50+
//
51+
// Support: Core
52+
//
53+
// +optional
54+
// +kubebuilder:validation:MinItems=1
55+
// +kubebuilder:validation:MaxItems=100
56+
Networks []string `json:"networks,omitempty" validate:"omitempty,dive,cidr"`
57+
}
58+
59+
// +kubebuilder:object:root=true
60+
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
61+
// ExternalNetworkSetList contains a list of ExternalNetworkSet
62+
type ExternalNetworkSetList struct {
63+
metav1.TypeMeta `json:",inline"`
64+
metav1.ListMeta `json:"metadata,omitempty"`
65+
Items []ExternalNetworkSet `json:"items"`
66+
}

‎apis/v1alpha1/shared_types.go‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -170,6 +170,15 @@ type AdminNetworkPolicyEgressPeer struct {
170170
//
171171
// +optional
172172
Nodes *metav1.LabelSelector `json:"nodes,omitempty"`
173+
// ExternalNetworks defines a way to select ExternalNetworkSets
174+
// that consist of network CIDRs that live outside the cluster as a peer.
175+
// This field follows standard label selector semantics; if present
176+
// but empty, it selects all ExternalNetworkSets defined in the cluster.
177+
//
178+
// Support: Core
179+
//
180+
// +optional
181+
ExternalNetworks *metav1.LabelSelector `json:"externalNetworks,omitempty"`
173182
}
174183

175184
// NamespacedPeer defines a flexible way to select Namespaces in a cluster.

‎apis/v1alpha1/zz_generated.deepcopy.go‎

Lines changed: 83 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎apis/v1alpha1/zz_generated.register.go‎

Lines changed: 2 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎config/crd/experimental/policy.networking.k8s.io_adminnetworkpolicies.yaml‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -164,6 +164,57 @@ spec:
164164
maxProperties: 1
165165
minProperties: 1
166166
properties:
167+
externalNetworks:
168+
description: "ExternalNetworks defines a way to select
169+
ExternalNetworkSets that consist of network CIDRs that
170+
live outside the cluster as a peer. This field follows
171+
standard label selector semantics; if present but empty,
172+
it selects all ExternalNetworkSets defined in the cluster.
173+
\n Support: Core"
174+
properties:
175+
matchExpressions:
176+
description: matchExpressions is a list of label selector
177+
requirements. The requirements are ANDed.
178+
items:
179+
description: A label selector requirement is a selector
180+
that contains values, a key, and an operator that
181+
relates the key and values.
182+
properties:
183+
key:
184+
description: key is the label key that the selector
185+
applies to.
186+
type: string
187+
operator:
188+
description: operator represents a key's relationship
189+
to a set of values. Valid operators are In,
190+
NotIn, Exists and DoesNotExist.
191+
type: string
192+
values:
193+
description: values is an array of string values.
194+
If the operator is In or NotIn, the values
195+
array must be non-empty. If the operator is
196+
Exists or DoesNotExist, the values array must
197+
be empty. This array is replaced during a
198+
strategic merge patch.
199+
items:
200+
type: string
201+
type: array
202+
required:
203+
- key
204+
- operator
205+
type: object
206+
type: array
207+
matchLabels:
208+
additionalProperties:
209+
type: string
210+
description: matchLabels is a map of {key,value} pairs.
211+
A single {key,value} in the matchLabels map is equivalent
212+
to an element of matchExpressions, whose key field
213+
is "key", the operator is "In", and the values array
214+
contains only "value". The requirements are ANDed.
215+
type: object
216+
type: object
217+
x-kubernetes-map-type: atomic
167218
namespaces:
168219
description: "Namespaces defines a way to select a set
169220
of Namespaces. \n Support: Core"

‎config/crd/experimental/policy.networking.k8s.io_baselineadminnetworkpolicies.yaml‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -156,6 +156,57 @@ spec:
156156
maxProperties: 1
157157
minProperties: 1
158158
properties:
159+
externalNetworks:
160+
description: "ExternalNetworks defines a way to select
161+
ExternalNetworkSets that consist of network CIDRs that
162+
live outside the cluster as a peer. This field follows
163+
standard label selector semantics; if present but empty,
164+
it selects all ExternalNetworkSets defined in the cluster.
165+
\n Support: Core"
166+
properties:
167+
matchExpressions:
168+
description: matchExpressions is a list of label selector
169+
requirements. The requirements are ANDed.
170+
items:
171+
description: A label selector requirement is a selector
172+
that contains values, a key, and an operator that
173+
relates the key and values.
174+
properties:
175+
key:
176+
description: key is the label key that the selector
177+
applies to.
178+
type: string
179+
operator:
180+
description: operator represents a key's relationship
181+
to a set of values. Valid operators are In,
182+
NotIn, Exists and DoesNotExist.
183+
type: string
184+
values:
185+
description: values is an array of string values.
186+
If the operator is In or NotIn, the values
187+
array must be non-empty. If the operator is
188+
Exists or DoesNotExist, the values array must
189+
be empty. This array is replaced during a
190+
strategic merge patch.
191+
items:
192+
type: string
193+
type: array
194+
required:
195+
- key
196+
- operator
197+
type: object
198+
type: array
199+
matchLabels:
200+
additionalProperties:
201+
type: string
202+
description: matchLabels is a map of {key,value} pairs.
203+
A single {key,value} in the matchLabels map is equivalent
204+
to an element of matchExpressions, whose key field
205+
is "key", the operator is "In", and the values array
206+
contains only "value". The requirements are ANDed.
207+
type: object
208+
type: object
209+
x-kubernetes-map-type: atomic
159210
namespaces:
160211
description: "Namespaces defines a way to select a set
161212
of Namespaces. \n Support: Core"

‎config/crd/experimental/policy.networking.k8s.io_externalnetworksets.yaml‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
apiVersion: apiextensions.k8s.io/v1
2+
kind: CustomResourceDefinition
3+
metadata:
4+
annotations:
5+
api-approved.kubernetes.io: https://github.com/kubernetes-sigs/network-policy-api/pull/135
6+
policy.networking.k8s.io/bundle-version: v0.1.1
7+
policy.networking.k8s.io/channel: experimental
8+
creationTimestamp: null
9+
name: externalnetworksets.policy.networking.k8s.io
10+
spec:
11+
group: policy.networking.k8s.io
12+
names:
13+
kind: ExternalNetworkSet
14+
listKind: ExternalNetworkSetList
15+
plural: externalnetworksets
16+
shortNames:
17+
- ens
18+
singular: externalnetworkset
19+
scope: Cluster
20+
versions:
21+
- additionalPrinterColumns:
22+
- jsonPath: .spec.networks
23+
name: Networks
24+
type: string
25+
- jsonPath: .metadata.creationTimestamp
26+
name: Age
27+
type: date
28+
name: v1alpha1
29+
schema:
30+
openAPIV3Schema:
31+
description: ExternalNetworkSet is a cluster level resource that is used to
32+
define a set of networks outside the cluster which can be referred to from
33+
the AdminNetworkPolicy && BaselineAdminNetworkPolicy APIs as an external
34+
peer
35+
properties:
36+
apiVersion:
37+
description: 'APIVersion defines the versioned schema of this representation
38+
of an object. Servers should convert recognized schemas to the latest
39+
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
40+
type: string
41+
kind:
42+
description: 'Kind is a string value representing the REST resource this
43+
object represents. Servers may infer this from the endpoint the client
44+
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
45+
type: string
46+
metadata:
47+
type: object
48+
spec:
49+
description: Specification of the desired behavior of ExternalNetworkSet.
50+
maxProperties: 1
51+
minProperties: 1
52+
properties:
53+
networks:
54+
description: "Networks is the list of NetworkCIDR (both v4 & v6) that
55+
can be used to define external destinations. A total of 100 CIDRs
56+
will be allowed in each NetworkSet instance. ANP & BANP APIs may
57+
use the .spec.in(e)gress.from(to).externalNetworks selector to select
58+
a set of external networks \n Support: Core"
59+
items:
60+
type: string
61+
maxItems: 100
62+
minItems: 1
63+
type: array
64+
type: object
65+
required:
66+
- metadata
67+
- spec
68+
type: object
69+
served: true
70+
storage: true
71+
subresources:
72+
status: {}
73+
status:
74+
acceptedNames:
75+
kind: ""
76+
plural: ""
77+
conditions: null
78+
storedVersions: null

0 commit comments

Comments
 (0)