Skip to content

Commit f797133

Browse files
committed
Include domainnames in validation against namedPorts for ANP
Signed-off-by: Surya Seetharaman <[email protected]>
1 parent bbcc208 commit f797133

File tree

2 files changed

+6
-5
lines changed

2 files changed

+6
-5
lines changed

apis/v1alpha1/adminnetworkpolicy_types.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -150,7 +150,7 @@ type AdminNetworkPolicyIngressRule struct {
150150
// set of traffic originating from pods selected by a AdminNetworkPolicy's
151151
// Subject field.
152152
// <network-policy-api:experimental:validation>
153-
// +kubebuilder:validation:XValidation:rule="!(self.to.exists(peer, has(peer.networks) || has(peer.nodes)) && has(self.ports) && self.ports.exists(port, has(port.namedPort)))",message="networks/nodes peer cannot be set with namedPorts since there are no namedPorts for networks/nodes"
153+
// +kubebuilder:validation:XValidation:rule="!(self.to.exists(peer, has(peer.networks) || has(peer.nodes) || has(peer.domainNames)) && has(self.ports) && self.ports.exists(port, has(port.namedPort)))",message="networks/nodes/domainNames peer cannot be set with namedPorts since there are no namedPorts for networks/nodes/domainNames"
154154
type AdminNetworkPolicyEgressRule struct {
155155
// Name is an identifier for this rule, that may be no more than 100 characters
156156
// in length. This field should be used by the implementation to help

config/crd/experimental/policy.networking.k8s.io_adminnetworkpolicies.yaml

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -468,10 +468,11 @@ spec:
468468
- to
469469
type: object
470470
x-kubernetes-validations:
471-
- message: networks/nodes peer cannot be set with namedPorts since
472-
there are no namedPorts for networks/nodes
473-
rule: '!(self.to.exists(peer, has(peer.networks) || has(peer.nodes))
474-
&& has(self.ports) && self.ports.exists(port, has(port.namedPort)))'
471+
- message: networks/nodes/domainNames peer cannot be set with namedPorts
472+
since there are no namedPorts for networks/nodes/domainNames
473+
rule: '!(self.to.exists(peer, has(peer.networks) || has(peer.nodes)
474+
|| has(peer.domainNames)) && has(self.ports) && self.ports.exists(port,
475+
has(port.namedPort)))'
475476
maxItems: 100
476477
type: array
477478
ingress:

0 commit comments

Comments
 (0)