forked from antrea-io/antrea
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Add support for Namespace scoped NetworkPolicy CRD (antrea-io#775)
* Add API types for Namespaced Antrea NetworkPolicy * Update priority to float64 Add new CRD yamls only when explicitly set. * Update apigroup for ExternalEndpoint CRD Move ExternalEndpoint to core group. * Fix name mismatch for externalNode field * Move security and core group to v1alpha1 Address comments. * Minor patches to ANP CRD types - Nameport.protocol is no longer a pointer --> consistent with k8s core.servicePort - ExternalEndPoint.ip is a string ---> so it is readable to end user. - Add "omitempty" to all fields ---> we potentially can have some fields unset. - added webhook methods ---> allows ExternalEntity to hookup to webhook service. Co-authored-by: Abhishek Raut <rauta@vmware.com> Co-authored-by: Su Wang <suw@vmware.com>
- Loading branch information
Showing
49 changed files
with
3,014 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,48 @@ | ||
--- | ||
apiVersion: apiextensions.k8s.io/v1beta1 | ||
kind: CustomResourceDefinition | ||
metadata: | ||
name: externalentities.core.antrea.tanzu.vmware.com | ||
spec: | ||
group: core.antrea.tanzu.vmware.com | ||
versions: | ||
- name: v1alpha1 | ||
served: true | ||
storage: true | ||
scope: Namespaced | ||
names: | ||
plural: externalentities | ||
singular: externalentity | ||
kind: ExternalEntity | ||
shortNames: | ||
- ee | ||
# Prune any unknown fields | ||
preserveUnknownFields: false | ||
validation: | ||
openAPIV3Schema: | ||
type: object | ||
properties: | ||
spec: | ||
type: object | ||
properties: | ||
endpoints: | ||
type: array | ||
items: | ||
type: object | ||
properties: | ||
ip: | ||
type: string | ||
format: ipv4 | ||
name: | ||
type: string | ||
ports: | ||
type: array | ||
items: | ||
type: object | ||
properties: | ||
protocol: | ||
type: string | ||
port: | ||
x-kubernetes-int-or-string: true | ||
externalNode: | ||
type: string |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,121 @@ | ||
--- | ||
apiVersion: apiextensions.k8s.io/v1beta1 | ||
kind: CustomResourceDefinition | ||
metadata: | ||
name: networkpolicies.security.antrea.tanzu.vmware.com | ||
spec: | ||
group: security.antrea.tanzu.vmware.com | ||
versions: | ||
- name: v1alpha1 | ||
served: true | ||
storage: true | ||
scope: Namespaced | ||
names: | ||
plural: networkpolicies | ||
singular: networkpolicy | ||
kind: NetworkPolicy | ||
shortNames: | ||
- anp | ||
# Prune any unknown fields | ||
preserveUnknownFields: false | ||
validation: | ||
openAPIV3Schema: | ||
type: object | ||
properties: | ||
spec: | ||
# Ensure that Spec.AppliedTo and Spec.Priority fields are set | ||
required: | ||
- appliedTo | ||
- priority | ||
type: object | ||
properties: | ||
priority: | ||
type: number | ||
format: float | ||
# Ensure that Spec.Priority field is between 1 and 10000 | ||
minimum: 1.0 | ||
maximum: 10000.0 | ||
appliedTo: | ||
type: array | ||
items: | ||
type: object | ||
# Ensure that Spec.AppliedTo does not allow NamespaceSelector/IPBlock field | ||
properties: | ||
podSelector: | ||
type: object | ||
additionalProperties: | ||
type: object | ||
externalEntitySelector: | ||
type: object | ||
additionalProperties: | ||
type: object | ||
ingress: | ||
type: array | ||
items: | ||
type: object | ||
required: | ||
- action | ||
properties: | ||
# Ensure that Action field allows only ALLOW and DROP values | ||
action: | ||
type: string | ||
pattern: '\bALLOW|\bAllow|\ballow|\bDROP|\bDrop|\bdrop' | ||
ports: | ||
type: array | ||
items: | ||
type: object | ||
properties: | ||
protocol: | ||
type: string | ||
port: | ||
x-kubernetes-int-or-string: true | ||
from: | ||
type: array | ||
items: | ||
type: object | ||
properties: | ||
podSelector: | ||
x-kubernetes-preserve-unknown-fields: true | ||
namespaceSelector: | ||
x-kubernetes-preserve-unknown-fields: true | ||
ipBlock: | ||
type: object | ||
properties: | ||
cidr: | ||
type: string | ||
format: cidr | ||
egress: | ||
type: array | ||
items: | ||
type: object | ||
required: | ||
- action | ||
properties: | ||
# Ensure that Action field allows only ALLOW and DROP values | ||
action: | ||
type: string | ||
pattern: '\bALLOW|\bAllow|\ballow|\bDROP|\bDrop|\bdrop' | ||
ports: | ||
type: array | ||
items: | ||
type: object | ||
properties: | ||
protocol: | ||
type: string | ||
port: | ||
x-kubernetes-int-or-string: true | ||
to: | ||
type: array | ||
items: | ||
type: object | ||
properties: | ||
podSelector: | ||
x-kubernetes-preserve-unknown-fields: true | ||
namespaceSelector: | ||
x-kubernetes-preserve-unknown-fields: true | ||
ipBlock: | ||
type: object | ||
properties: | ||
cidr: | ||
type: string | ||
format: cidr |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,22 @@ | ||
--- | ||
kind: ClusterRole | ||
apiVersion: rbac.authorization.k8s.io/v1 | ||
metadata: | ||
name: antrea-controller | ||
rules: | ||
- apiGroups: | ||
- security.antrea.tanzu.vmware.com | ||
resources: | ||
- networkpolicies | ||
verbs: | ||
- get | ||
- watch | ||
- list | ||
- apiGroups: | ||
- core.antrea.tanzu.vmware.com | ||
resources: | ||
- externalentities | ||
verbs: | ||
- get | ||
- watch | ||
- list |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,18 @@ | ||
// Copyright 2020 Antrea Authors | ||
// | ||
// Licensed under the Apache License, Version 2.0 (the "License"); | ||
// you may not use this file except in compliance with the License. | ||
// You may obtain a copy of the License at | ||
// | ||
// http://www.apache.org/licenses/LICENSE-2.0 | ||
// | ||
// Unless required by applicable law or agreed to in writing, software | ||
// distributed under the License is distributed on an "AS IS" BASIS, | ||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
// See the License for the specific language governing permissions and | ||
// limitations under the License. | ||
|
||
// +k8s:deepcopy-gen=package | ||
// +groupName=core.antrea.tanzu.vmware.com | ||
|
||
package core |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,20 @@ | ||
// Copyright 2020 Antrea Authors | ||
// | ||
// Licensed under the Apache License, Version 2.0 (the "License"); | ||
// you may not use this file except in compliance with the License. | ||
// You may obtain a copy of the License at | ||
// | ||
// http://www.apache.org/licenses/LICENSE-2.0 | ||
// | ||
// Unless required by applicable law or agreed to in writing, software | ||
// distributed under the License is distributed on an "AS IS" BASIS, | ||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
// See the License for the specific language governing permissions and | ||
// limitations under the License. | ||
|
||
package core | ||
|
||
// GroupName is the group name used in this package | ||
const ( | ||
GroupName = "core.antrea.tanzu.vmware.com" | ||
) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,19 @@ | ||
// Copyright 2020 Antrea Authors | ||
// | ||
// Licensed under the Apache License, Version 2.0 (the "License"); | ||
// you may not use this file except in compliance with the License. | ||
// You may obtain a copy of the License at | ||
// | ||
// http://www.apache.org/licenses/LICENSE-2.0 | ||
// | ||
// Unless required by applicable law or agreed to in writing, software | ||
// distributed under the License is distributed on an "AS IS" BASIS, | ||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
// See the License for the specific language governing permissions and | ||
// limitations under the License. | ||
|
||
// +k8s:openapi-gen=true | ||
// +k8s:deepcopy-gen=package | ||
// +groupName=core.antrea.tanzu.vmware.com | ||
|
||
package v1alpha1 // import "github.com/vmware-tanzu/antrea/pkg/apis/core/v1alpha1" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,53 @@ | ||
// Copyright 2020 Antrea Authors | ||
// | ||
// Licensed under the Apache License, Version 2.0 (the "License"); | ||
// you may not use this file except in compliance with the License. | ||
// You may obtain a copy of the License at | ||
// | ||
// http://www.apache.org/licenses/LICENSE-2.0 | ||
// | ||
// Unless required by applicable law or agreed to in writing, software | ||
// distributed under the License is distributed on an "AS IS" BASIS, | ||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
// See the License for the specific language governing permissions and | ||
// limitations under the License. | ||
|
||
package v1alpha1 | ||
|
||
import ( | ||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" | ||
"k8s.io/apimachinery/pkg/runtime" | ||
"k8s.io/apimachinery/pkg/runtime/schema" | ||
) | ||
|
||
// GroupName is the group name used in this package. | ||
const GroupName = "core.antrea.tanzu.vmware.com" | ||
|
||
// SchemeGroupVersion is group version used to register these objects. | ||
var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1alpha1"} | ||
|
||
// Kind takes an unqualified kind and returns back a Group qualified GroupKind | ||
func Kind(kind string) schema.GroupKind { | ||
return SchemeGroupVersion.WithKind(kind).GroupKind() | ||
} | ||
|
||
// Resource takes an unqualified resource and returns a Group qualified GroupResource. | ||
func Resource(resource string) schema.GroupResource { | ||
return SchemeGroupVersion.WithResource(resource).GroupResource() | ||
} | ||
|
||
var ( | ||
SchemeBuilder = runtime.NewSchemeBuilder(addKnownTypes) | ||
AddToScheme = SchemeBuilder.AddToScheme | ||
) | ||
|
||
// Adds the list of known types to the given scheme. | ||
func addKnownTypes(scheme *runtime.Scheme) error { | ||
scheme.AddKnownTypes(SchemeGroupVersion, | ||
&ExternalEntity{}, | ||
&ExternalEntityList{}, | ||
) | ||
|
||
metav1.AddToGroupVersion(scheme, SchemeGroupVersion) | ||
return nil | ||
} |
Oops, something went wrong.