Skip to content

Commit a5e3d29

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #233 from rahulkjoshi/main
Add DomainName field to AdminNetworkPolicyEgressPeer
2 parents 964c353 + 4d8f8ea commit a5e3d29

13 files changed

+339
-72
lines changed

‎apis/v1alpha1/adminnetworkpolicy_types.go

+94
Original file line numberDiff line numberDiff line change
@@ -219,6 +219,100 @@ type AdminNetworkPolicyEgressRule struct {
219219
// +kubebuilder:validation:Enum={"Allow", "Deny", "Pass"}
220220
type AdminNetworkPolicyRuleAction string
221221

222+
// AdminNetworkPolicyEgressPeer defines a peer to allow traffic to.
223+
// Exactly one of the selector pointers must be set for a given peer. If a
224+
// consumer observes none of its fields are set, they must assume an unknown
225+
// option has been specified and fail closed.
226+
// +kubebuilder:validation:MaxProperties=1
227+
// +kubebuilder:validation:MinProperties=1
228+
type AdminNetworkPolicyEgressPeer struct {
229+
// Namespaces defines a way to select all pods within a set of Namespaces.
230+
// Note that host-networked pods are not included in this type of peer.
231+
//
232+
// Support: Core
233+
//
234+
// +optional
235+
Namespaces *metav1.LabelSelector `json:"namespaces,omitempty"`
236+
// Pods defines a way to select a set of pods in
237+
// a set of namespaces. Note that host-networked pods
238+
// are not included in this type of peer.
239+
//
240+
// Support: Core
241+
//
242+
// +optional
243+
Pods *NamespacedPod `json:"pods,omitempty"`
244+
// Nodes defines a way to select a set of nodes in
245+
// the cluster. This field follows standard label selector
246+
// semantics; if present but empty, it selects all Nodes.
247+
//
248+
// Support: Extended
249+
//
250+
// <network-policy-api:experimental>
251+
// +optional
252+
Nodes *metav1.LabelSelector `json:"nodes,omitempty"`
253+
// Networks defines a way to select peers via CIDR blocks.
254+
// This is intended for representing entities that live outside the cluster,
255+
// which can't be selected by pods, namespaces and nodes peers, but note
256+
// that cluster-internal traffic will be checked against the rule as
257+
// well. So if you Allow or Deny traffic to `"0.0.0.0/0"`, that will allow
258+
// or deny all IPv4 pod-to-pod traffic as well. If you don't want that,
259+
// add a rule that Passes all pod traffic before the Networks rule.
260+
//
261+
// Each item in Networks should be provided in the CIDR format and should be
262+
// IPv4 or IPv6, for example "10.0.0.0/8" or "fd00::/8".
263+
//
264+
// Networks can have upto 25 CIDRs specified.
265+
//
266+
// Support: Extended
267+
//
268+
// <network-policy-api:experimental>
269+
// +optional
270+
// +listType=set
271+
// +kubebuilder:validation:MinItems=1
272+
// +kubebuilder:validation:MaxItems=25
273+
Networks []CIDR `json:"networks,omitempty"`
274+
275+
// DomainNames provides a way to specify domain names as peers.
276+
//
277+
// DomainNames is only supported for ALLOW rules. In order to control
278+
// access, DomainNames ALLOW rules should be used with a lower priority
279+
// egress deny -- this allows the admin to maintain an explicit "allowlist"
280+
// of reachable domains.
281+
//
282+
// DomainNames can have up to 25 domain names specified in one rule.
283+
//
284+
// Support: Extended
285+
//
286+
// <network-policy-api:experimental>
287+
// +optional
288+
// +listType=set
289+
// +kubebuilder:validation:MinItems=1
290+
// +kubebuilder:validation:MaxItems=25
291+
DomainNames []DomainName `json:"domainNames,omitempty"`
292+
}
293+
294+
// DomainName describes one or more domain names to be used as a peer.
295+
//
296+
// DomainName can be an exact match, or use the wildcard specifier '*' to match
297+
// one or more labels.
298+
//
299+
// '*', the wildcard specifier, matches one or more entire labels. It does not
300+
// support partial matches. '*' may only be specified as a prefix.
301+
//
302+
// Examples:
303+
// - `kubernetes.io` matches only `kubernetes.io`.
304+
// It does not match "www.kubernetes.io", "blog.kubernetes.io",
305+
// "my-kubernetes.io", or "wikipedia.org".
306+
// - `blog.kubernetes.io` matches only "blog.kubernetes.io".
307+
// It does not match "www.kubernetes.io" or "kubernetes.io".
308+
// - `*.kubernetes.io` matches subdomains of kubernetes.io.
309+
// "www.kubernetes.io", "blog.kubernetes.io", and
310+
// "latest.blog.kubernetes.io" match, however "kubernetes.io", and
311+
// "wikipedia.org" do not.
312+
//
313+
// +kubebuilder:validation:Pattern=`^(\*\.)?([a-zA-z0-9]([-a-zA-Z0-9_]*[a-zA-Z0-9])?\.)+[a-zA-z0-9]([-a-zA-Z0-9_]*[a-zA-Z0-9])?\.?$`
314+
type DomainName string
315+
222316
const (
223317
// AdminNetworkPolicyRuleActionAllow indicates that matching traffic will be
224318
// allowed regardless of NetworkPolicy and BaselineAdminNetworkPolicy

‎apis/v1alpha1/baselineadminnetworkpolicy_types.go

+56-2
Original file line numberDiff line numberDiff line change
@@ -167,15 +167,15 @@ type BaselineAdminNetworkPolicyEgressRule struct {
167167
Action BaselineAdminNetworkPolicyRuleAction `json:"action"`
168168

169169
// To is the list of destinations whose traffic this rule applies to.
170-
// If any AdminNetworkPolicyEgressPeer matches the destination of outgoing
170+
// If any BaselineAdminNetworkPolicyEgressPeer matches the destination of outgoing
171171
// traffic then the specified action is applied.
172172
// This field must be defined and contain at least one item.
173173
// +kubebuilder:validation:MinItems=1
174174
// +kubebuilder:validation:MaxItems=100
175175
//
176176
// Support: Core
177177
//
178-
To []AdminNetworkPolicyEgressPeer `json:"to"`
178+
To []BaselineAdminNetworkPolicyEgressPeer `json:"to"`
179179

180180
// Ports allows for matching traffic based on port and protocols.
181181
// This field is a list of destination ports for the outgoing egress traffic.
@@ -194,6 +194,60 @@ type BaselineAdminNetworkPolicyEgressRule struct {
194194
// +kubebuilder:validation:Enum={"Allow", "Deny"}
195195
type BaselineAdminNetworkPolicyRuleAction string
196196

197+
// BaselineAdminNetworkPolicyEgressPeer defines a peer to allow traffic to.
198+
// Exactly one of the selector pointers must be set for a given peer. If a
199+
// consumer observes none of its fields are set, they must assume an unknown
200+
// option has been specified and fail closed.
201+
// +kubebuilder:validation:MaxProperties=1
202+
// +kubebuilder:validation:MinProperties=1
203+
type BaselineAdminNetworkPolicyEgressPeer struct {
204+
// Namespaces defines a way to select all pods within a set of Namespaces.
205+
// Note that host-networked pods are not included in this type of peer.
206+
//
207+
// Support: Core
208+
//
209+
// +optional
210+
Namespaces *metav1.LabelSelector `json:"namespaces,omitempty"`
211+
// Pods defines a way to select a set of pods in
212+
// a set of namespaces. Note that host-networked pods
213+
// are not included in this type of peer.
214+
//
215+
// Support: Core
216+
//
217+
// +optional
218+
Pods *NamespacedPod `json:"pods,omitempty"`
219+
// Nodes defines a way to select a set of nodes in
220+
// the cluster. This field follows standard label selector
221+
// semantics; if present but empty, it selects all Nodes.
222+
//
223+
// Support: Extended
224+
//
225+
// <network-policy-api:experimental>
226+
// +optional
227+
Nodes *metav1.LabelSelector `json:"nodes,omitempty"`
228+
// Networks defines a way to select peers via CIDR blocks.
229+
// This is intended for representing entities that live outside the cluster,
230+
// which can't be selected by pods, namespaces and nodes peers, but note
231+
// that cluster-internal traffic will be checked against the rule as
232+
// well. So if you Allow or Deny traffic to `"0.0.0.0/0"`, that will allow
233+
// or deny all IPv4 pod-to-pod traffic as well. If you don't want that,
234+
// add a rule that Passes all pod traffic before the Networks rule.
235+
//
236+
// Each item in Networks should be provided in the CIDR format and should be
237+
// IPv4 or IPv6, for example "10.0.0.0/8" or "fd00::/8".
238+
//
239+
// Networks can have upto 25 CIDRs specified.
240+
//
241+
// Support: Extended
242+
//
243+
// <network-policy-api:experimental>
244+
// +optional
245+
// +listType=set
246+
// +kubebuilder:validation:MinItems=1
247+
// +kubebuilder:validation:MaxItems=25
248+
Networks []CIDR `json:"networks,omitempty"`
249+
}
250+
197251
const (
198252
// BaselineAdminNetworkPolicyRuleActionDeny enables admins to deny traffic.
199253
BaselineAdminNetworkPolicyRuleActionDeny BaselineAdminNetworkPolicyRuleAction = "Deny"

‎apis/v1alpha1/shared_types.go

-54
Original file line numberDiff line numberDiff line change
@@ -144,60 +144,6 @@ type AdminNetworkPolicyIngressPeer struct {
144144
Pods *NamespacedPod `json:"pods,omitempty"`
145145
}
146146

147-
// AdminNetworkPolicyEgressPeer defines a peer to allow traffic to.
148-
// Exactly one of the selector pointers must be set for a given peer. If a
149-
// consumer observes none of its fields are set, they must assume an unknown
150-
// option has been specified and fail closed.
151-
// +kubebuilder:validation:MaxProperties=1
152-
// +kubebuilder:validation:MinProperties=1
153-
type AdminNetworkPolicyEgressPeer struct {
154-
// Namespaces defines a way to select all pods within a set of Namespaces.
155-
// Note that host-networked pods are not included in this type of peer.
156-
//
157-
// Support: Core
158-
//
159-
// +optional
160-
Namespaces *metav1.LabelSelector `json:"namespaces,omitempty"`
161-
// Pods defines a way to select a set of pods in
162-
// a set of namespaces. Note that host-networked pods
163-
// are not included in this type of peer.
164-
//
165-
// Support: Core
166-
//
167-
// +optional
168-
Pods *NamespacedPod `json:"pods,omitempty"`
169-
// Nodes defines a way to select a set of nodes in
170-
// the cluster. This field follows standard label selector
171-
// semantics; if present but empty, it selects all Nodes.
172-
//
173-
// Support: Extended
174-
//
175-
// <network-policy-api:experimental>
176-
// +optional
177-
Nodes *metav1.LabelSelector `json:"nodes,omitempty"`
178-
// Networks defines a way to select peers via CIDR blocks.
179-
// This is intended for representing entities that live outside the cluster,
180-
// which can't be selected by pods, namespaces and nodes peers, but note
181-
// that cluster-internal traffic will be checked against the rule as
182-
// well. So if you Allow or Deny traffic to `"0.0.0.0/0"`, that will allow
183-
// or deny all IPv4 pod-to-pod traffic as well. If you don't want that,
184-
// add a rule that Passes all pod traffic before the Networks rule.
185-
//
186-
// Each item in Networks should be provided in the CIDR format and should be
187-
// IPv4 or IPv6, for example "10.0.0.0/8" or "fd00::/8".
188-
//
189-
// Networks can have upto 25 CIDRs specified.
190-
//
191-
// Support: Extended
192-
//
193-
// <network-policy-api:experimental>
194-
// +optional
195-
// +listType=set
196-
// +kubebuilder:validation:MinItems=1
197-
// +kubebuilder:validation:MaxItems=25
198-
Networks []CIDR `json:"networks,omitempty"`
199-
}
200-
201147
// CIDR is an IP address range in CIDR notation (for example, "10.0.0.0/8" or "fd00::/8").
202148
// This string must be validated by implementations using net.ParseCIDR
203149
// TODO: Introduce CEL CIDR validation regex isCIDR() in Kube 1.31 when it is available.

‎apis/v1alpha1/zz_generated.deepcopy.go

+41-1
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎config/crd/experimental/policy.networking.k8s.io_adminnetworkpolicies.yaml

+47
Original file line numberDiff line numberDiff line change
@@ -219,6 +219,53 @@ spec:
219219
maxProperties: 1
220220
minProperties: 1
221221
properties:
222+
domainNames:
223+
description: |-
224+
DomainNames provides a way to specify domain names as peers.
225+
226+
227+
DomainNames is only supported for ALLOW rules. In order to control
228+
access, DomainNames ALLOW rules should be used with a lower priority
229+
egress deny -- this allows the admin to maintain an explicit "allowlist"
230+
of reachable domains.
231+
232+
233+
DomainNames can have up to 25 domain names specified in one rule.
234+
235+
236+
Support: Extended
237+
238+
239+
<network-policy-api:experimental>
240+
items:
241+
description: |-
242+
DomainName describes one or more domain names to be used as a peer.
243+
244+
245+
DomainName can be an exact match, or use the wildcard specifier '*' to match
246+
one or more labels.
247+
248+
249+
'*', the wildcard specifier, matches one or more entire labels. It does not
250+
support partial matches. '*' may only be specified as a prefix.
251+
252+
253+
Examples:
254+
- `kubernetes.io` matches only `kubernetes.io`.
255+
It does not match "www.kubernetes.io", "blog.kubernetes.io",
256+
"my-kubernetes.io", or "wikipedia.org".
257+
- `blog.kubernetes.io` matches only "blog.kubernetes.io".
258+
It does not match "www.kubernetes.io" or "kubernetes.io".
259+
- `*.kubernetes.io` matches subdomains of kubernetes.io.
260+
"www.kubernetes.io", "blog.kubernetes.io", and
261+
"latest.blog.kubernetes.io" match, however "kubernetes.io", and
262+
"wikipedia.org" do not.
263+
pattern: ^(\*\.)?([a-zA-z0-9]([-a-zA-Z0-9_]*[a-zA-Z0-9])?\.)+[a-zA-z0-9]([-a-zA-Z0-9_]*[a-zA-Z0-9])?\.?$
264+
type: string
265+
maxItems: 25
266+
minItems: 1
267+
type: array
268+
x-kubernetes-list-type: set
222269
namespaces:
223270
description: |-
224271
Namespaces defines a way to select all pods within a set of Namespaces.

‎config/crd/experimental/policy.networking.k8s.io_baselineadminnetworkpolicies.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -194,15 +194,15 @@ spec:
194194
to:
195195
description: |-
196196
To is the list of destinations whose traffic this rule applies to.
197-
If any AdminNetworkPolicyEgressPeer matches the destination of outgoing
197+
If any BaselineAdminNetworkPolicyEgressPeer matches the destination of outgoing
198198
traffic then the specified action is applied.
199199
This field must be defined and contain at least one item.
200200
201201
202202
Support: Core
203203
items:
204204
description: |-
205-
AdminNetworkPolicyEgressPeer defines a peer to allow traffic to.
205+
BaselineAdminNetworkPolicyEgressPeer defines a peer to allow traffic to.
206206
Exactly one of the selector pointers must be set for a given peer. If a
207207
consumer observes none of its fields are set, they must assume an unknown
208208
option has been specified and fail closed.

‎config/crd/standard/policy.networking.k8s.io_baselineadminnetworkpolicies.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -184,15 +184,15 @@ spec:
184184
to:
185185
description: |-
186186
To is the list of destinations whose traffic this rule applies to.
187-
If any AdminNetworkPolicyEgressPeer matches the destination of outgoing
187+
If any BaselineAdminNetworkPolicyEgressPeer matches the destination of outgoing
188188
traffic then the specified action is applied.
189189
This field must be defined and contain at least one item.
190190
191191
192192
Support: Core
193193
items:
194194
description: |-
195-
AdminNetworkPolicyEgressPeer defines a peer to allow traffic to.
195+
BaselineAdminNetworkPolicyEgressPeer defines a peer to allow traffic to.
196196
Exactly one of the selector pointers must be set for a given peer. If a
197197
consumer observes none of its fields are set, they must assume an unknown
198198
option has been specified and fail closed.

0 commit comments

Comments
 (0)