Skip to content

K
k3s
Commit c04e5163 authored by Kubernetes Submit Queue's avatar Kubernetes Submit Queue Committed by GitHub
Browse files
Options

Merge pull request #50033 from cmluciano/cml/addnpcidrselector

Automatic merge from submit-queue (batch tested with PRs 50033, 49988, 51132, 49674, 51207) Add IPBlock to Network Policy **What this PR does / why we need it**: Add ipBlockRule to NetworkPolicyPeer. **Which issue this PR fixes** fixes #49978 **Special notes for your reviewer**: - I added this directly as a field on the existing API per guidance from API-Machinery/lazy SIG-Network consensus. Todo: - [ ] Documentation comments to mention this is beta, unless we want to go straight to GA - [ ] e2e tests **Release note**: ``` Support ipBlock in NetworkPolicy ```
parents cb6f32e8 02735c3f
Expand all Hide whitespace changes
Inline Side-by-side
Showing with 1277 additions and 56 deletions
api/openapi-spec/swagger.json
View file @ c04e5163
...@@ -62904,6 +62904,25 @@ ...@@ -62904,6 +62904,25 @@
} }
} }
}, },
"io.k8s.api.extensions.v1beta1.IPBlock": {
"description": "IPBlock describes a particular CIDR (Ex. \"192.168.1.1/24\") that is allowed to the pods matched by a NetworkPolicySpec's podSelector. The except entry describes CIDRs that should not be included within this rule.",
"required": [
"cidr"
],
"properties": {
"cidr": {
"description": "CIDR is a string representing the IP Block Valid examples are \"192.168.1.1/24\"",
"type": "string"
},
"except": {
"description": "Except is a slice of CIDRs that should not be included within an IP Block Valid examples are \"192.168.1.1/24\" Except values will be rejected if they are outside the CIDR range",
"type": "array",
"items": {
"type": "string"
}
}
}
},
"io.k8s.api.extensions.v1beta1.Ingress": { "io.k8s.api.extensions.v1beta1.Ingress": {
"description": "Ingress is a collection of rules that allow inbound connections to reach the endpoints defined by a backend. An Ingress can be configured to give services externally-reachable urls, load balance traffic, terminate SSL, offer name based virtual hosting etc.", "description": "Ingress is a collection of rules that allow inbound connections to reach the endpoints defined by a backend. An Ingress can be configured to give services externally-reachable urls, load balance traffic, terminate SSL, offer name based virtual hosting etc.",
"properties": { "properties": {
...@@ -63130,6 +63149,10 @@ ...@@ -63130,6 +63149,10 @@
}, },
"io.k8s.api.extensions.v1beta1.NetworkPolicyPeer": { "io.k8s.api.extensions.v1beta1.NetworkPolicyPeer": {
"properties": { "properties": {
"ipBlock": {
"description": "IPBlock defines policy on a particular IPBlock",
"$ref": "#/definitions/io.k8s.api.extensions.v1beta1.IPBlock"
},
"namespaceSelector": { "namespaceSelector": {
"description": "Selects Namespaces using cluster scoped-labels. This matches all pods in all namespaces selected by this label selector. This field follows standard label selector semantics. If present but empty, this selector selects all namespaces.", "description": "Selects Namespaces using cluster scoped-labels. This matches all pods in all namespaces selected by this label selector. This field follows standard label selector semantics. If present but empty, this selector selects all namespaces.",
"$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.LabelSelector" "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.LabelSelector"
...@@ -63631,6 +63654,25 @@ ...@@ -63631,6 +63654,25 @@
} }
} }
}, },
"io.k8s.api.networking.v1.IPBlock": {
"description": "IPBlock describes a particular CIDR (Ex. \"192.168.1.1/24\") that is allowed to the pods matched by a NetworkPolicySpec's podSelector. The except entry describes CIDRs that should not be included within this rule.",
"required": [
"cidr"
],
"properties": {
"cidr": {
"description": "CIDR is a string representing the IP Block Valid examples are \"192.168.1.1/24\"",
"type": "string"
},
"except": {
"description": "Except is a slice of CIDRs that should not be included within an IP Block Valid examples are \"192.168.1.1/24\" Except values will be rejected if they are outside the CIDR range",
"type": "array",
"items": {
"type": "string"
}
}
}
},
"io.k8s.api.networking.v1.NetworkPolicy": { "io.k8s.api.networking.v1.NetworkPolicy": {
"description": "NetworkPolicy describes what network traffic is allowed for a set of Pods", "description": "NetworkPolicy describes what network traffic is allowed for a set of Pods",
"properties": { "properties": {
...@@ -63715,6 +63757,10 @@ ...@@ -63715,6 +63757,10 @@
"io.k8s.api.networking.v1.NetworkPolicyPeer": { "io.k8s.api.networking.v1.NetworkPolicyPeer": {
"description": "NetworkPolicyPeer describes a peer to allow traffic from. Exactly one of its fields must be specified.", "description": "NetworkPolicyPeer describes a peer to allow traffic from. Exactly one of its fields must be specified.",
"properties": { "properties": {
"ipBlock": {
"description": "IPBlock defines policy on a particular IPBlock",
"$ref": "#/definitions/io.k8s.api.networking.v1.IPBlock"
},
"namespaceSelector": { "namespaceSelector": {
"description": "Selects Namespaces using cluster scoped-labels. This matches all pods in all namespaces selected by this label selector. This field follows standard label selector semantics. If present but empty, this selector selects all namespaces.", "description": "Selects Namespaces using cluster scoped-labels. This matches all pods in all namespaces selected by this label selector. This field follows standard label selector semantics. If present but empty, this selector selects all namespaces.",
"$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.LabelSelector" "$ref": "#/definitions/io.k8s.apimachinery.pkg.apis.meta.v1.LabelSelector"
api/swagger-spec/extensions_v1beta1.json
View file @ c04e5163
...@@ -9305,6 +9305,30 @@ ...@@ -9305,6 +9305,30 @@
"namespaceSelector": { "namespaceSelector": {
"$ref": "v1.LabelSelector", "$ref": "v1.LabelSelector",
"description": "Selects Namespaces using cluster scoped-labels. This matches all pods in all namespaces selected by this label selector. This field follows standard label selector semantics. If present but empty, this selector selects all namespaces." "description": "Selects Namespaces using cluster scoped-labels. This matches all pods in all namespaces selected by this label selector. This field follows standard label selector semantics. If present but empty, this selector selects all namespaces."
},
"ipBlock": {
"$ref": "v1beta1.IPBlock",
"description": "IPBlock defines policy on a particular IPBlock"
}
}
},
"v1beta1.IPBlock": {
"id": "v1beta1.IPBlock",
"description": "IPBlock describes a particular CIDR (Ex. \"192.168.1.1/24\") that is allowed to the pods matched by a NetworkPolicySpec's podSelector. The except entry describes CIDRs that should not be included within this rule.",
"required": [
"cidr"
],
"properties": {
"cidr": {
"type": "string",
"description": "CIDR is a string representing the IP Block Valid examples are \"192.168.1.1/24\""
},
"except": {
"type": "array",
"items": {
"type": "string"
},
"description": "Except is a slice of CIDRs that should not be included within an IP Block Valid examples are \"192.168.1.1/24\" Except values will be rejected if they are outside the CIDR range"
} }
} }
}, },
......
api/swagger-spec/networking.k8s.io_v1.json
View file @ c04e5163
...@@ -1307,6 +1307,30 @@ ...@@ -1307,6 +1307,30 @@
"namespaceSelector": { "namespaceSelector": {
"$ref": "v1.LabelSelector", "$ref": "v1.LabelSelector",
"description": "Selects Namespaces using cluster scoped-labels. This matches all pods in all namespaces selected by this label selector. This field follows standard label selector semantics. If present but empty, this selector selects all namespaces." "description": "Selects Namespaces using cluster scoped-labels. This matches all pods in all namespaces selected by this label selector. This field follows standard label selector semantics. If present but empty, this selector selects all namespaces."
},
"ipBlock": {
"$ref": "v1.IPBlock",
"description": "IPBlock defines policy on a particular IPBlock"
}
}
},
"v1.IPBlock": {
"id": "v1.IPBlock",
"description": "IPBlock describes a particular CIDR (Ex. \"192.168.1.1/24\") that is allowed to the pods matched by a NetworkPolicySpec's podSelector. The except entry describes CIDRs that should not be included within this rule.",
"required": [
"cidr"
],
"properties": {
"cidr": {
"type": "string",
"description": "CIDR is a string representing the IP Block Valid examples are \"192.168.1.1/24\""
},
"except": {
"type": "array",
"items": {
"type": "string"
},
"description": "Except is a slice of CIDRs that should not be included within an IP Block Valid examples are \"192.168.1.1/24\" Except values will be rejected if they are outside the CIDR range"
} }
} }
}, },
......
docs/api-reference/extensions/v1beta1/definitions.html
View file @ c04e5163
...@@ -3217,6 +3217,47 @@ When an object is created, the system will populate this list with the current s ...@@ -3217,6 +3217,47 @@ When an object is created, the system will populate this list with the current s
</div> </div>
<div class="sect2"> <div class="sect2">
<h3 id="_v1beta1_ipblock">v1beta1.IPBlock</h3>
<div class="paragraph">
<p>IPBlock describes a particular CIDR (Ex. "192.168.1.1/24") that is allowed to the pods matched by a NetworkPolicySpec&#8217;s podSelector. The except entry describes CIDRs that should not be included within this rule.</p>
</div>
<table class="tableblock frame-all grid-all" style="width:100%; ">
<colgroup>
<col style="width:20%;">
<col style="width:20%;">
<col style="width:20%;">
<col style="width:20%;">
<col style="width:20%;">
</colgroup>
<thead>
<tr>
<th class="tableblock halign-left valign-top">Name</th>
<th class="tableblock halign-left valign-top">Description</th>
<th class="tableblock halign-left valign-top">Required</th>
<th class="tableblock halign-left valign-top">Schema</th>
<th class="tableblock halign-left valign-top">Default</th>
</tr>
</thead>
<tbody>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">cidr</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">CIDR is a string representing the IP Block Valid examples are "192.168.1.1/24"</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">true</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">except</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">Except is a slice of CIDRs that should not be included within an IP Block Valid examples are "192.168.1.1/24" Except values will be rejected if they are outside the CIDR range</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string array</p></td>
<td class="tableblock halign-left valign-top"></td>
</tr>
</tbody>
</table>
</div>
<div class="sect2">
<h3 id="_v1_loadbalanceringress">v1.LoadBalancerIngress</h3> <h3 id="_v1_loadbalanceringress">v1.LoadBalancerIngress</h3>
<div class="paragraph"> <div class="paragraph">
<p>LoadBalancerIngress represents the status of a load-balancer ingress point: traffic intended for the service should be sent to an ingress point.</p> <p>LoadBalancerIngress represents the status of a load-balancer ingress point: traffic intended for the service should be sent to an ingress point.</p>
...@@ -5965,6 +6006,13 @@ Both these may change in the future. Incoming requests are matched against the h ...@@ -5965,6 +6006,13 @@ Both these may change in the future. Incoming requests are matched against the h
<td class="tableblock halign-left valign-top"><p class="tableblock"><a href="#_v1_labelselector">v1.LabelSelector</a></p></td> <td class="tableblock halign-left valign-top"><p class="tableblock"><a href="#_v1_labelselector">v1.LabelSelector</a></p></td>
<td class="tableblock halign-left valign-top"></td> <td class="tableblock halign-left valign-top"></td>
</tr> </tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">ipBlock</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">IPBlock defines policy on a particular IPBlock</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock"><a href="#_v1beta1_ipblock">v1beta1.IPBlock</a></p></td>
<td class="tableblock halign-left valign-top"></td>
</tr>
</tbody> </tbody>
</table> </table>
......
docs/api-reference/networking.k8s.io/v1/definitions.html
View file @ c04e5163
...@@ -939,6 +939,47 @@ span.icon > [class^="icon-"], span.icon > [class*=" icon-"] { cursor: default; } ...@@ -939,6 +939,47 @@ span.icon > [class^="icon-"], span.icon > [class*=" icon-"] { cursor: default; }
</div> </div>
<div class="sect2"> <div class="sect2">
<h3 id="_v1_ipblock">v1.IPBlock</h3>
<div class="paragraph">
<p>IPBlock describes a particular CIDR (Ex. "192.168.1.1/24") that is allowed to the pods matched by a NetworkPolicySpec&#8217;s podSelector. The except entry describes CIDRs that should not be included within this rule.</p>
</div>
<table class="tableblock frame-all grid-all" style="width:100%; ">
<colgroup>
<col style="width:20%;">
<col style="width:20%;">
<col style="width:20%;">
<col style="width:20%;">
<col style="width:20%;">
</colgroup>
<thead>
<tr>
<th class="tableblock halign-left valign-top">Name</th>
<th class="tableblock halign-left valign-top">Description</th>
<th class="tableblock halign-left valign-top">Required</th>
<th class="tableblock halign-left valign-top">Schema</th>
<th class="tableblock halign-left valign-top">Default</th>
</tr>
</thead>
<tbody>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">cidr</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">CIDR is a string representing the IP Block Valid examples are "192.168.1.1/24"</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">true</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">except</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">Except is a slice of CIDRs that should not be included within an IP Block Valid examples are "192.168.1.1/24" Except values will be rejected if they are outside the CIDR range</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string array</p></td>
<td class="tableblock halign-left valign-top"></td>
</tr>
</tbody>
</table>
</div>
<div class="sect2">
<h3 id="_v1_labelselector">v1.LabelSelector</h3> <h3 id="_v1_labelselector">v1.LabelSelector</h3>
<div class="paragraph"> <div class="paragraph">
<p>A label selector is a label query over a set of resources. The result of matchLabels and matchExpressions are ANDed. An empty label selector matches all objects. A null label selector matches no objects.</p> <p>A label selector is a label query over a set of resources. The result of matchLabels and matchExpressions are ANDed. An empty label selector matches all objects. A null label selector matches no objects.</p>
...@@ -1460,6 +1501,13 @@ When an object is created, the system will populate this list with the current s ...@@ -1460,6 +1501,13 @@ When an object is created, the system will populate this list with the current s
<td class="tableblock halign-left valign-top"><p class="tableblock"><a href="#_v1_labelselector">v1.LabelSelector</a></p></td> <td class="tableblock halign-left valign-top"><p class="tableblock"><a href="#_v1_labelselector">v1.LabelSelector</a></p></td>
<td class="tableblock halign-left valign-top"></td> <td class="tableblock halign-left valign-top"></td>
</tr> </tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">ipBlock</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">IPBlock defines policy on a particular IPBlock</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">false</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock"><a href="#_v1_ipblock">v1.IPBlock</a></p></td>
<td class="tableblock halign-left valign-top"></td>
</tr>
</tbody> </tbody>
</table> </table>
......
pkg/api/testing/BUILD
View file @ c04e5163
...@@ -24,6 +24,7 @@ go_library( ...@@ -24,6 +24,7 @@ go_library(
"//pkg/apis/extensions:go_default_library", "//pkg/apis/extensions:go_default_library",
"//pkg/apis/extensions/fuzzer:go_default_library", "//pkg/apis/extensions/fuzzer:go_default_library",
"//pkg/apis/extensions/v1beta1:go_default_library", "//pkg/apis/extensions/v1beta1:go_default_library",
"//pkg/apis/networking/fuzzer:go_default_library",
"//pkg/apis/policy/fuzzer:go_default_library", "//pkg/apis/policy/fuzzer:go_default_library",
"//pkg/apis/rbac/fuzzer:go_default_library", "//pkg/apis/rbac/fuzzer:go_default_library",
"//pkg/apis/storage/fuzzer:go_default_library", "//pkg/apis/storage/fuzzer:go_default_library",
......
pkg/api/testing/fuzzer.go
View file @ c04e5163
...@@ -19,7 +19,7 @@ package testing ...@@ -19,7 +19,7 @@ package testing
import ( import (
"fmt" "fmt"
"github.com/google/gofuzz" fuzz "github.com/google/gofuzz"
"k8s.io/api/core/v1" "k8s.io/api/core/v1"
apitesting "k8s.io/apimachinery/pkg/api/testing" apitesting "k8s.io/apimachinery/pkg/api/testing"
...@@ -38,6 +38,7 @@ import ( ...@@ -38,6 +38,7 @@ import (
"k8s.io/kubernetes/pkg/apis/extensions" "k8s.io/kubernetes/pkg/apis/extensions"
extensionsfuzzer "k8s.io/kubernetes/pkg/apis/extensions/fuzzer" extensionsfuzzer "k8s.io/kubernetes/pkg/apis/extensions/fuzzer"
extensionsv1beta1 "k8s.io/kubernetes/pkg/apis/extensions/v1beta1" extensionsv1beta1 "k8s.io/kubernetes/pkg/apis/extensions/v1beta1"
networkingfuzzer "k8s.io/kubernetes/pkg/apis/networking/fuzzer"
policyfuzzer "k8s.io/kubernetes/pkg/apis/policy/fuzzer" policyfuzzer "k8s.io/kubernetes/pkg/apis/policy/fuzzer"
rbacfuzzer "k8s.io/kubernetes/pkg/apis/rbac/fuzzer" rbacfuzzer "k8s.io/kubernetes/pkg/apis/rbac/fuzzer"
storagefuzzer "k8s.io/kubernetes/pkg/apis/storage/fuzzer" storagefuzzer "k8s.io/kubernetes/pkg/apis/storage/fuzzer"
...@@ -102,4 +103,5 @@ var FuzzerFuncs = fuzzer.MergeFuzzerFuncs( ...@@ -102,4 +103,5 @@ var FuzzerFuncs = fuzzer.MergeFuzzerFuncs(
certificatesfuzzer.Funcs, certificatesfuzzer.Funcs,
admissionregistrationfuzzer.Funcs, admissionregistrationfuzzer.Funcs,
storagefuzzer.Funcs, storagefuzzer.Funcs,
networkingfuzzer.Funcs,
) )
pkg/apis/extensions/v1beta1/conversion.go
View file @ c04e5163
...@@ -60,6 +60,8 @@ func addConversionFuncs(scheme *runtime.Scheme) error { ...@@ -60,6 +60,8 @@ func addConversionFuncs(scheme *runtime.Scheme) error {
Convert_v1beta1_NetworkPolicySpec_To_networking_NetworkPolicySpec, Convert_v1beta1_NetworkPolicySpec_To_networking_NetworkPolicySpec,
Convert_networking_NetworkPolicySpec_To_v1beta1_NetworkPolicySpec, Convert_networking_NetworkPolicySpec_To_v1beta1_NetworkPolicySpec,
Convert_extensions_PodSecurityPolicySpec_To_v1beta1_PodSecurityPolicySpec, Convert_extensions_PodSecurityPolicySpec_To_v1beta1_PodSecurityPolicySpec,
Convert_v1beta1_IPBlock_To_networking_IPBlock,
Convert_networking_IPBlock_To_v1beta1_IPBlock,
) )
if err != nil { if err != nil {
return err return err
...@@ -346,6 +348,14 @@ func Convert_v1beta1_NetworkPolicyPeer_To_networking_NetworkPolicyPeer(in *exten ...@@ -346,6 +348,14 @@ func Convert_v1beta1_NetworkPolicyPeer_To_networking_NetworkPolicyPeer(in *exten
} else { } else {
out.NamespaceSelector = nil out.NamespaceSelector = nil
} }
if in.IPBlock != nil {
out.IPBlock = new(networking.IPBlock)
if err := s.Convert(in.IPBlock, out.IPBlock, 0); err != nil {
return err
}
} else {
out.IPBlock = nil
}
return nil return nil
} }
...@@ -366,6 +376,30 @@ func Convert_networking_NetworkPolicyPeer_To_v1beta1_NetworkPolicyPeer(in *netwo ...@@ -366,6 +376,30 @@ func Convert_networking_NetworkPolicyPeer_To_v1beta1_NetworkPolicyPeer(in *netwo
} else { } else {
out.NamespaceSelector = nil out.NamespaceSelector = nil
} }
if in.IPBlock != nil {
out.IPBlock = new(extensionsv1beta1.IPBlock)
if err := s.Convert(in.IPBlock, out.IPBlock, 0); err != nil {
return err
}
} else {
out.IPBlock = nil
}
return nil
}
func Convert_v1beta1_IPBlock_To_networking_IPBlock(in *extensionsv1beta1.IPBlock, out *networking.IPBlock, s conversion.Scope) error {
out.CIDR = in.CIDR
out.Except = make([]string, len(in.Except))
copy(out.Except, in.Except)
return nil
}
func Convert_networking_IPBlock_To_v1beta1_IPBlock(in *networking.IPBlock, out *extensionsv1beta1.IPBlock, s conversion.Scope) error {
out.CIDR = in.CIDR
out.Except = make([]string, len(in.Except))
copy(out.Except, in.Except)
return nil return nil
} }
......
pkg/apis/networking/fuzzer/BUILD
View file @ c04e5163
...@@ -8,7 +8,11 @@ load( ...@@ -8,7 +8,11 @@ load(
go_library( go_library(
name = "go_default_library", name = "go_default_library",
srcs = ["fuzzer.go"], srcs = ["fuzzer.go"],
deps = ["//vendor/k8s.io/apimachinery/pkg/runtime/serializer:go_default_library"], deps = [
"//pkg/apis/networking:go_default_library",
"//vendor/github.com/google/gofuzz:go_default_library",
"//vendor/k8s.io/apimachinery/pkg/runtime/serializer:go_default_library",
],
) )
filegroup( filegroup(
......
pkg/apis/networking/fuzzer/fuzzer.go
View file @ c04e5163
...@@ -17,10 +17,24 @@ limitations under the License. ...@@ -17,10 +17,24 @@ limitations under the License.
package fuzzer package fuzzer
import ( import (
fuzz "github.com/google/gofuzz"
runtimeserializer "k8s.io/apimachinery/pkg/runtime/serializer" runtimeserializer "k8s.io/apimachinery/pkg/runtime/serializer"
"k8s.io/kubernetes/pkg/apis/networking"
) )
// Funcs returns the fuzzer functions for the networking api group. // Funcs returns the fuzzer functions for the networking api group.
var Funcs = func(codecs runtimeserializer.CodecFactory) []interface{} { var Funcs = func(codecs runtimeserializer.CodecFactory) []interface{} {
return []interface{}{} return []interface{}{
func(np *networking.NetworkPolicyPeer, c fuzz.Continue) {
c.FuzzNoCustom(np) // fuzz self without calling this function again
// TODO: Implement a fuzzer to generate valid keys, values and operators for
// selector requirements.
if np.IPBlock != nil {
np.IPBlock = &networking.IPBlock{
CIDR: "192.168.1.0/24",
Except: []string{"192.168.1.1/24", "192.168.1.2/24"},
}
}
},
}
} }
pkg/apis/networking/types.go
View file @ c04e5163
...@@ -90,6 +90,20 @@ type NetworkPolicyPort struct { ...@@ -90,6 +90,20 @@ type NetworkPolicyPort struct {
Port *intstr.IntOrString Port *intstr.IntOrString
} }
// IPBlock describes a particular CIDR (Ex. "192.168.1.1/24") that is allowed to the pods
// matched by a NetworkPolicySpec's podSelector. The except entry describes CIDRs that should
// not be included within this rule.
type IPBlock struct {
// CIDR is a string representing the IP Block
// Valid examples are "192.168.1.1/24"
CIDR string
// Except is a slice of CIDRs that should not be included within an IP Block
// Valid examples are "192.168.1.1/24"
// Except values will be rejected if they are outside the CIDR range
// +optional
Except []string
}
// NetworkPolicyPeer describes a peer to allow traffic from. Exactly one of its fields // NetworkPolicyPeer describes a peer to allow traffic from. Exactly one of its fields
// must be specified. // must be specified.
type NetworkPolicyPeer struct { type NetworkPolicyPeer struct {
...@@ -104,6 +118,10 @@ type NetworkPolicyPeer struct { ...@@ -104,6 +118,10 @@ type NetworkPolicyPeer struct {
// selector semantics. If present but empty, this selector selects all namespaces. // selector semantics. If present but empty, this selector selects all namespaces.
// +optional // +optional
NamespaceSelector *metav1.LabelSelector NamespaceSelector *metav1.LabelSelector
// IPBlock defines policy on a particular IPBlock
// +optional
IPBlock *IPBlock
} }
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
......
pkg/apis/networking/v1/zz_generated.conversion.go
View file @ c04e5163
...@@ -40,6 +40,8 @@ func init() { ...@@ -40,6 +40,8 @@ func init() {
// Public to allow building arbitrary schemes. // Public to allow building arbitrary schemes.
func RegisterConversions(scheme *runtime.Scheme) error { func RegisterConversions(scheme *runtime.Scheme) error {
return scheme.AddGeneratedConversionFuncs( return scheme.AddGeneratedConversionFuncs(
Convert_v1_IPBlock_To_networking_IPBlock,
Convert_networking_IPBlock_To_v1_IPBlock,
Convert_v1_NetworkPolicy_To_networking_NetworkPolicy, Convert_v1_NetworkPolicy_To_networking_NetworkPolicy,
Convert_networking_NetworkPolicy_To_v1_NetworkPolicy, Convert_networking_NetworkPolicy_To_v1_NetworkPolicy,
Convert_v1_NetworkPolicyIngressRule_To_networking_NetworkPolicyIngressRule, Convert_v1_NetworkPolicyIngressRule_To_networking_NetworkPolicyIngressRule,
...@@ -55,6 +57,28 @@ func RegisterConversions(scheme *runtime.Scheme) error { ...@@ -55,6 +57,28 @@ func RegisterConversions(scheme *runtime.Scheme) error {
) )
} }
func autoConvert_v1_IPBlock_To_networking_IPBlock(in *v1.IPBlock, out *networking.IPBlock, s conversion.Scope) error {
out.CIDR = in.CIDR
out.Except = *(*[]string)(unsafe.Pointer(&in.Except))
return nil
}
// Convert_v1_IPBlock_To_networking_IPBlock is an autogenerated conversion function.
func Convert_v1_IPBlock_To_networking_IPBlock(in *v1.IPBlock, out *networking.IPBlock, s conversion.Scope) error {
return autoConvert_v1_IPBlock_To_networking_IPBlock(in, out, s)
}
func autoConvert_networking_IPBlock_To_v1_IPBlock(in *networking.IPBlock, out *v1.IPBlock, s conversion.Scope) error {
out.CIDR = in.CIDR
out.Except = *(*[]string)(unsafe.Pointer(&in.Except))
return nil
}
// Convert_networking_IPBlock_To_v1_IPBlock is an autogenerated conversion function.
func Convert_networking_IPBlock_To_v1_IPBlock(in *networking.IPBlock, out *v1.IPBlock, s conversion.Scope) error {
return autoConvert_networking_IPBlock_To_v1_IPBlock(in, out, s)
}
func autoConvert_v1_NetworkPolicy_To_networking_NetworkPolicy(in *v1.NetworkPolicy, out *networking.NetworkPolicy, s conversion.Scope) error { func autoConvert_v1_NetworkPolicy_To_networking_NetworkPolicy(in *v1.NetworkPolicy, out *networking.NetworkPolicy, s conversion.Scope) error {
out.ObjectMeta = in.ObjectMeta out.ObjectMeta = in.ObjectMeta
if err := Convert_v1_NetworkPolicySpec_To_networking_NetworkPolicySpec(&in.Spec, &out.Spec, s); err != nil { if err := Convert_v1_NetworkPolicySpec_To_networking_NetworkPolicySpec(&in.Spec, &out.Spec, s); err != nil {
...@@ -132,6 +156,7 @@ func Convert_networking_NetworkPolicyList_To_v1_NetworkPolicyList(in *networking ...@@ -132,6 +156,7 @@ func Convert_networking_NetworkPolicyList_To_v1_NetworkPolicyList(in *networking
func autoConvert_v1_NetworkPolicyPeer_To_networking_NetworkPolicyPeer(in *v1.NetworkPolicyPeer, out *networking.NetworkPolicyPeer, s conversion.Scope) error { func autoConvert_v1_NetworkPolicyPeer_To_networking_NetworkPolicyPeer(in *v1.NetworkPolicyPeer, out *networking.NetworkPolicyPeer, s conversion.Scope) error {
out.PodSelector = (*meta_v1.LabelSelector)(unsafe.Pointer(in.PodSelector)) out.PodSelector = (*meta_v1.LabelSelector)(unsafe.Pointer(in.PodSelector))
out.NamespaceSelector = (*meta_v1.LabelSelector)(unsafe.Pointer(in.NamespaceSelector)) out.NamespaceSelector = (*meta_v1.LabelSelector)(unsafe.Pointer(in.NamespaceSelector))
out.IPBlock = (*networking.IPBlock)(unsafe.Pointer(in.IPBlock))
return nil return nil
} }
...@@ -143,6 +168,7 @@ func Convert_v1_NetworkPolicyPeer_To_networking_NetworkPolicyPeer(in *v1.Network ...@@ -143,6 +168,7 @@ func Convert_v1_NetworkPolicyPeer_To_networking_NetworkPolicyPeer(in *v1.Network
func autoConvert_networking_NetworkPolicyPeer_To_v1_NetworkPolicyPeer(in *networking.NetworkPolicyPeer, out *v1.NetworkPolicyPeer, s conversion.Scope) error { func autoConvert_networking_NetworkPolicyPeer_To_v1_NetworkPolicyPeer(in *networking.NetworkPolicyPeer, out *v1.NetworkPolicyPeer, s conversion.Scope) error {
out.PodSelector = (*meta_v1.LabelSelector)(unsafe.Pointer(in.PodSelector)) out.PodSelector = (*meta_v1.LabelSelector)(unsafe.Pointer(in.PodSelector))
out.NamespaceSelector = (*meta_v1.LabelSelector)(unsafe.Pointer(in.NamespaceSelector)) out.NamespaceSelector = (*meta_v1.LabelSelector)(unsafe.Pointer(in.NamespaceSelector))
out.IPBlock = (*v1.IPBlock)(unsafe.Pointer(in.IPBlock))
return nil return nil
} }
......
pkg/apis/networking/validation/validation.go
View file @ c04e5163
...@@ -17,6 +17,8 @@ limitations under the License. ...@@ -17,6 +17,8 @@ limitations under the License.
package validation package validation
import ( import (
"net"
unversionedvalidation "k8s.io/apimachinery/pkg/apis/meta/v1/validation" unversionedvalidation "k8s.io/apimachinery/pkg/apis/meta/v1/validation"
"k8s.io/apimachinery/pkg/util/intstr" "k8s.io/apimachinery/pkg/util/intstr"
"k8s.io/apimachinery/pkg/util/validation" "k8s.io/apimachinery/pkg/util/validation"
...@@ -68,7 +70,10 @@ func ValidateNetworkPolicySpec(spec *networking.NetworkPolicySpec, fldPath *fiel ...@@ -68,7 +70,10 @@ func ValidateNetworkPolicySpec(spec *networking.NetworkPolicySpec, fldPath *fiel
numFroms++ numFroms++
allErrs = append(allErrs, unversionedvalidation.ValidateLabelSelector(from.NamespaceSelector, fromPath.Child("namespaceSelector"))...) allErrs = append(allErrs, unversionedvalidation.ValidateLabelSelector(from.NamespaceSelector, fromPath.Child("namespaceSelector"))...)
} }
if from.IPBlock != nil {
numFroms++
allErrs = append(allErrs, ValidateIPBlock(from.IPBlock, fromPath.Child("ipBlock"))...)
}
if numFroms == 0 { if numFroms == 0 {
allErrs = append(allErrs, field.Required(fromPath, "must specify a from type")) allErrs = append(allErrs, field.Required(fromPath, "must specify a from type"))
} else if numFroms > 1 { } else if numFroms > 1 {
...@@ -93,3 +98,39 @@ func ValidateNetworkPolicyUpdate(update, old *networking.NetworkPolicy) field.Er ...@@ -93,3 +98,39 @@ func ValidateNetworkPolicyUpdate(update, old *networking.NetworkPolicy) field.Er
allErrs = append(allErrs, ValidateNetworkPolicySpec(&update.Spec, field.NewPath("spec"))...) allErrs = append(allErrs, ValidateNetworkPolicySpec(&update.Spec, field.NewPath("spec"))...)
return allErrs return allErrs
} }
// ValidateIPBlock validates a cidr and the except fields of an IpBlock NetworkPolicyPeer
func ValidateIPBlock(ipb *networking.IPBlock, fldPath *field.Path) field.ErrorList {
allErrs := field.ErrorList{}
if len(ipb.CIDR) == 0 || ipb.CIDR == "" {
allErrs = append(allErrs, field.Required(fldPath.Child("cidr"), ""))
return allErrs
}
cidrIPNet, err := validateCIDR(ipb.CIDR)
if err != nil {
allErrs = append(allErrs, field.Invalid(fldPath.Child("cidr"), ipb.CIDR, "not a valid CIDR"))
return allErrs
}
exceptCIDR := ipb.Except
for i, exceptIP := range exceptCIDR {
exceptPath := fldPath.Child("except").Index(i)
exceptCIDR, err := validateCIDR(exceptIP)
if err != nil {
allErrs = append(allErrs, field.Invalid(exceptPath, exceptIP, "not a valid CIDR"))
return allErrs
}
if !cidrIPNet.Contains(exceptCIDR.IP) {
allErrs = append(allErrs, field.Invalid(exceptPath, exceptCIDR.IP, "not within CIDR range"))
}
}
return allErrs
}
// validateCIDR validates whether a CIDR matches the conventions expected by net.ParseCIDR
func validateCIDR(cidr string) (*net.IPNet, error) {
_, net, err := net.ParseCIDR(cidr)
if err != nil {
return nil, err
}
return net, nil
}
pkg/apis/networking/validation/validation_test.go
View file @ c04e5163
...@@ -122,6 +122,26 @@ func TestValidateNetworkPolicy(t *testing.T) { ...@@ -122,6 +122,26 @@ func TestValidateNetworkPolicy(t *testing.T) {
}, },
}, },
}, },
{
ObjectMeta: metav1.ObjectMeta{Name: "foo", Namespace: "bar"},
Spec: networking.NetworkPolicySpec{
PodSelector: metav1.LabelSelector{
MatchLabels: map[string]string{"a": "b"},
},
Ingress: []networking.NetworkPolicyIngressRule{
{
From: []networking.NetworkPolicyPeer{
{
IPBlock: &networking.IPBlock{
CIDR: "192.168.0.0/16",
Except: []string{"192.168.3.0/24", "192.168.4.0/24"},
},
},
},
},
},
},
},
} }
// Success cases are expected to pass validation. // Success cases are expected to pass validation.
...@@ -256,6 +276,83 @@ func TestValidateNetworkPolicy(t *testing.T) { ...@@ -256,6 +276,83 @@ func TestValidateNetworkPolicy(t *testing.T) {
}, },
}, },
}, },
"missing cidr field": {
ObjectMeta: metav1.ObjectMeta{Name: "foo", Namespace: "bar"},
Spec: networking.NetworkPolicySpec{
PodSelector: metav1.LabelSelector{},
Ingress: []networking.NetworkPolicyIngressRule{
{
From: []networking.NetworkPolicyPeer{
{
IPBlock: &networking.IPBlock{
Except: []string{"192.168.8.0/24", "192.168.9.0/24"},
},
},
},
},
},
},
},
"invalid cidr format": {
ObjectMeta: metav1.ObjectMeta{Name: "foo", Namespace: "bar"},
Spec: networking.NetworkPolicySpec{
PodSelector: metav1.LabelSelector{
MatchLabels: map[string]string{"a": "b"},
},
Ingress: []networking.NetworkPolicyIngressRule{
{
From: []networking.NetworkPolicyPeer{
{
IPBlock: &networking.IPBlock{
CIDR: "192.168.5.6",
Except: []string{"192.168.1.0/24", "192.168.2.0/24"},
},
},
},
},
},
},
},
"except field is an empty string": {
ObjectMeta: metav1.ObjectMeta{Name: "foo", Namespace: "bar"},
Spec: networking.NetworkPolicySpec{
PodSelector: metav1.LabelSelector{
MatchLabels: map[string]string{"a": "b"},
},
Ingress: []networking.NetworkPolicyIngressRule{
{
From: []networking.NetworkPolicyPeer{
{
IPBlock: &networking.IPBlock{
CIDR: "192.168.8.0/24",
Except: []string{"", " "},
},
},
},
},
},
},
},
"except IP is outside of CIDR range": {
ObjectMeta: metav1.ObjectMeta{Name: "foo", Namespace: "bar"},
Spec: networking.NetworkPolicySpec{
PodSelector: metav1.LabelSelector{
MatchLabels: map[string]string{"a": "b"},
},
Ingress: []networking.NetworkPolicyIngressRule{
{
From: []networking.NetworkPolicyPeer{
{
IPBlock: &networking.IPBlock{
CIDR: "192.168.8.0/24",
Except: []string{"192.168.9.1/24"},
},
},
},
},
},
},
},
} }
// Error cases are not expected to pass validation. // Error cases are not expected to pass validation.
......
pkg/apis/networking/zz_generated.deepcopy.go
View file @ c04e5163
...@@ -40,6 +40,10 @@ func init() { ...@@ -40,6 +40,10 @@ func init() {
func RegisterDeepCopies(scheme *runtime.Scheme) error { func RegisterDeepCopies(scheme *runtime.Scheme) error {
return scheme.AddGeneratedDeepCopyFuncs( return scheme.AddGeneratedDeepCopyFuncs(
conversion.GeneratedDeepCopyFunc{Fn: func(in interface{}, out interface{}, c *conversion.Cloner) error { conversion.GeneratedDeepCopyFunc{Fn: func(in interface{}, out interface{}, c *conversion.Cloner) error {
in.(*IPBlock).DeepCopyInto(out.(*IPBlock))
return nil
}, InType: reflect.TypeOf(&IPBlock{})},
conversion.GeneratedDeepCopyFunc{Fn: func(in interface{}, out interface{}, c *conversion.Cloner) error {
in.(*NetworkPolicy).DeepCopyInto(out.(*NetworkPolicy)) in.(*NetworkPolicy).DeepCopyInto(out.(*NetworkPolicy))
return nil return nil
}, InType: reflect.TypeOf(&NetworkPolicy{})}, }, InType: reflect.TypeOf(&NetworkPolicy{})},
...@@ -67,6 +71,27 @@ func RegisterDeepCopies(scheme *runtime.Scheme) error { ...@@ -67,6 +71,27 @@ func RegisterDeepCopies(scheme *runtime.Scheme) error {
} }
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (in *IPBlock) DeepCopyInto(out *IPBlock) {
*out = *in
if in.Except != nil {
in, out := &in.Except, &out.Except
*out = make([]string, len(*in))
copy(*out, *in)
}
return
}
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IPBlock.
func (in *IPBlock) DeepCopy() *IPBlock {
if in == nil {
return nil
}
out := new(IPBlock)
in.DeepCopyInto(out)
return out
}
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (in *NetworkPolicy) DeepCopyInto(out *NetworkPolicy) { func (in *NetworkPolicy) DeepCopyInto(out *NetworkPolicy) {
*out = *in *out = *in
out.TypeMeta = in.TypeMeta out.TypeMeta = in.TypeMeta
...@@ -179,6 +204,15 @@ func (in *NetworkPolicyPeer) DeepCopyInto(out *NetworkPolicyPeer) { ...@@ -179,6 +204,15 @@ func (in *NetworkPolicyPeer) DeepCopyInto(out *NetworkPolicyPeer) {
(*in).DeepCopyInto(*out) (*in).DeepCopyInto(*out)
} }
} }
if in.IPBlock != nil {
in, out := &in.IPBlock, &out.IPBlock
if *in == nil {
*out = nil
} else {
*out = new(IPBlock)
(*in).DeepCopyInto(*out)
}
}
return return
} }
......
staging/src/k8s.io/api/extensions/v1beta1/generated.proto
View file @ c04e5163
...@@ -421,6 +421,21 @@ message IDRange { ...@@ -421,6 +421,21 @@ message IDRange {
optional int64 max = 2; optional int64 max = 2;
} }
// IPBlock describes a particular CIDR (Ex. "192.168.1.1/24") that is allowed to the pods
// matched by a NetworkPolicySpec's podSelector. The except entry describes CIDRs that should
// not be included within this rule.
message IPBlock {
// CIDR is a string representing the IP Block
// Valid examples are "192.168.1.1/24"
optional string cidr = 1;
// Except is a slice of CIDRs that should not be included within an IP Block
// Valid examples are "192.168.1.1/24"
// Except values will be rejected if they are outside the CIDR range
// +optional
repeated string except = 2;
}
// Ingress is a collection of rules that allow inbound connections to reach the // Ingress is a collection of rules that allow inbound connections to reach the
// endpoints defined by a backend. An Ingress can be configured to give services // endpoints defined by a backend. An Ingress can be configured to give services
// externally-reachable urls, load balance traffic, terminate SSL, offer name // externally-reachable urls, load balance traffic, terminate SSL, offer name
...@@ -602,6 +617,10 @@ message NetworkPolicyPeer { ...@@ -602,6 +617,10 @@ message NetworkPolicyPeer {
// If present but empty, this selector selects all namespaces. // If present but empty, this selector selects all namespaces.
// +optional // +optional
optional k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector namespaceSelector = 2; optional k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector namespaceSelector = 2;
// IPBlock defines policy on a particular IPBlock
// +optional
optional IPBlock ipBlock = 3;
} }
message NetworkPolicyPort { message NetworkPolicyPort {
......
staging/src/k8s.io/api/extensions/v1beta1/types.go
View file @ c04e5163
...@@ -1181,6 +1181,20 @@ type NetworkPolicyPort struct { ...@@ -1181,6 +1181,20 @@ type NetworkPolicyPort struct {
Port *intstr.IntOrString `json:"port,omitempty" protobuf:"bytes,2,opt,name=port"` Port *intstr.IntOrString `json:"port,omitempty" protobuf:"bytes,2,opt,name=port"`
} }
// IPBlock describes a particular CIDR (Ex. "192.168.1.1/24") that is allowed to the pods
// matched by a NetworkPolicySpec's podSelector. The except entry describes CIDRs that should
// not be included within this rule.
type IPBlock struct {
// CIDR is a string representing the IP Block
// Valid examples are "192.168.1.1/24"
CIDR string `json:"cidr" protobuf:"bytes,1,name=cidr"`
// Except is a slice of CIDRs that should not be included within an IP Block
// Valid examples are "192.168.1.1/24"
// Except values will be rejected if they are outside the CIDR range
// +optional
Except []string `json:"except,omitempty" protobuf:"bytes,2,rep,name=except"`
}
type NetworkPolicyPeer struct { type NetworkPolicyPeer struct {
// Exactly one of the following must be specified. // Exactly one of the following must be specified.
...@@ -1196,6 +1210,10 @@ type NetworkPolicyPeer struct { ...@@ -1196,6 +1210,10 @@ type NetworkPolicyPeer struct {
// If present but empty, this selector selects all namespaces. // If present but empty, this selector selects all namespaces.
// +optional // +optional
NamespaceSelector *metav1.LabelSelector `json:"namespaceSelector,omitempty" protobuf:"bytes,2,opt,name=namespaceSelector"` NamespaceSelector *metav1.LabelSelector `json:"namespaceSelector,omitempty" protobuf:"bytes,2,opt,name=namespaceSelector"`
// IPBlock defines policy on a particular IPBlock
// +optional
IPBlock *IPBlock `json:"ipBlock,omitempty" protobuf:"bytes,3,rep,name=ipBlock"`
} }
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
......
staging/src/k8s.io/api/extensions/v1beta1/types_swagger_doc_generated.go
View file @ c04e5163
...@@ -254,6 +254,16 @@ func (IDRange) SwaggerDoc() map[string]string { ...@@ -254,6 +254,16 @@ func (IDRange) SwaggerDoc() map[string]string {
return map_IDRange return map_IDRange
} }
var map_IPBlock = map[string]string{
"": "IPBlock describes a particular CIDR (Ex. \"192.168.1.1/24\") that is allowed to the pods matched by a NetworkPolicySpec's podSelector. The except entry describes CIDRs that should not be included within this rule.",
"cidr": "CIDR is a string representing the IP Block Valid examples are \"192.168.1.1/24\"",
"except": "Except is a slice of CIDRs that should not be included within an IP Block Valid examples are \"192.168.1.1/24\" Except values will be rejected if they are outside the CIDR range",
}
func (IPBlock) SwaggerDoc() map[string]string {
return map_IPBlock
}
var map_Ingress = map[string]string{ var map_Ingress = map[string]string{
"": "Ingress is a collection of rules that allow inbound connections to reach the endpoints defined by a backend. An Ingress can be configured to give services externally-reachable urls, load balance traffic, terminate SSL, offer name based virtual hosting etc.", "": "Ingress is a collection of rules that allow inbound connections to reach the endpoints defined by a backend. An Ingress can be configured to give services externally-reachable urls, load balance traffic, terminate SSL, offer name based virtual hosting etc.",
"metadata": "Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata", "metadata": "Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata",
...@@ -365,6 +375,7 @@ func (NetworkPolicyList) SwaggerDoc() map[string]string { ...@@ -365,6 +375,7 @@ func (NetworkPolicyList) SwaggerDoc() map[string]string {
var map_NetworkPolicyPeer = map[string]string{ var map_NetworkPolicyPeer = map[string]string{
"podSelector": "This is a label selector which selects Pods in this namespace. This field follows standard label selector semantics. If present but empty, this selector selects all pods in this namespace.", "podSelector": "This is a label selector which selects Pods in this namespace. This field follows standard label selector semantics. If present but empty, this selector selects all pods in this namespace.",
"namespaceSelector": "Selects Namespaces using cluster scoped-labels. This matches all pods in all namespaces selected by this label selector. This field follows standard label selector semantics. If present but empty, this selector selects all namespaces.", "namespaceSelector": "Selects Namespaces using cluster scoped-labels. This matches all pods in all namespaces selected by this label selector. This field follows standard label selector semantics. If present but empty, this selector selects all namespaces.",
"ipBlock": "IPBlock defines policy on a particular IPBlock",
} }
func (NetworkPolicyPeer) SwaggerDoc() map[string]string { func (NetworkPolicyPeer) SwaggerDoc() map[string]string {
......
staging/src/k8s.io/api/extensions/v1beta1/zz_generated.deepcopy.go
View file @ c04e5163
...@@ -128,6 +128,10 @@ func RegisterDeepCopies(scheme *runtime.Scheme) error { ...@@ -128,6 +128,10 @@ func RegisterDeepCopies(scheme *runtime.Scheme) error {
return nil return nil
}, InType: reflect.TypeOf(&IDRange{})}, }, InType: reflect.TypeOf(&IDRange{})},
conversion.GeneratedDeepCopyFunc{Fn: func(in interface{}, out interface{}, c *conversion.Cloner) error { conversion.GeneratedDeepCopyFunc{Fn: func(in interface{}, out interface{}, c *conversion.Cloner) error {
in.(*IPBlock).DeepCopyInto(out.(*IPBlock))
return nil
}, InType: reflect.TypeOf(&IPBlock{})},
conversion.GeneratedDeepCopyFunc{Fn: func(in interface{}, out interface{}, c *conversion.Cloner) error {
in.(*Ingress).DeepCopyInto(out.(*Ingress)) in.(*Ingress).DeepCopyInto(out.(*Ingress))
return nil return nil
}, InType: reflect.TypeOf(&Ingress{})}, }, InType: reflect.TypeOf(&Ingress{})},
...@@ -846,6 +850,27 @@ func (in *IDRange) DeepCopy() *IDRange { ...@@ -846,6 +850,27 @@ func (in *IDRange) DeepCopy() *IDRange {
} }
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (in *IPBlock) DeepCopyInto(out *IPBlock) {
*out = *in
if in.Except != nil {
in, out := &in.Except, &out.Except
*out = make([]string, len(*in))
copy(*out, *in)
}
return
}
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IPBlock.
func (in *IPBlock) DeepCopy() *IPBlock {
if in == nil {
return nil
}
out := new(IPBlock)
in.DeepCopyInto(out)
return out
}
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (in *Ingress) DeepCopyInto(out *Ingress) { func (in *Ingress) DeepCopyInto(out *Ingress) {
*out = *in *out = *in
out.TypeMeta = in.TypeMeta out.TypeMeta = in.TypeMeta
...@@ -1157,6 +1182,15 @@ func (in *NetworkPolicyPeer) DeepCopyInto(out *NetworkPolicyPeer) { ...@@ -1157,6 +1182,15 @@ func (in *NetworkPolicyPeer) DeepCopyInto(out *NetworkPolicyPeer) {
(*in).DeepCopyInto(*out) (*in).DeepCopyInto(*out)
} }
} }
if in.IPBlock != nil {
in, out := &in.IPBlock, &out.IPBlock
if *in == nil {
*out = nil
} else {
*out = new(IPBlock)
(*in).DeepCopyInto(*out)
}
}
return return
} }
......
staging/src/k8s.io/api/networking/v1/generated.proto
View file @ c04e5163
...@@ -32,6 +32,21 @@ import "k8s.io/apimachinery/pkg/util/intstr/generated.proto"; ...@@ -32,6 +32,21 @@ import "k8s.io/apimachinery/pkg/util/intstr/generated.proto";
// Package-wide variables from generator "generated". // Package-wide variables from generator "generated".
option go_package = "v1"; option go_package = "v1";
// IPBlock describes a particular CIDR (Ex. "192.168.1.1/24") that is allowed to the pods
// matched by a NetworkPolicySpec's podSelector. The except entry describes CIDRs that should
// not be included within this rule.
message IPBlock {
// CIDR is a string representing the IP Block
// Valid examples are "192.168.1.1/24"
optional string cidr = 1;
// Except is a slice of CIDRs that should not be included within an IP Block
// Valid examples are "192.168.1.1/24"
// Except values will be rejected if they are outside the CIDR range
// +optional
repeated string except = 2;
}
// NetworkPolicy describes what network traffic is allowed for a set of Pods // NetworkPolicy describes what network traffic is allowed for a set of Pods
message NetworkPolicy { message NetworkPolicy {
// Standard object's metadata. // Standard object's metadata.
...@@ -89,6 +104,10 @@ message NetworkPolicyPeer { ...@@ -89,6 +104,10 @@ message NetworkPolicyPeer {
// selector semantics. If present but empty, this selector selects all namespaces. // selector semantics. If present but empty, this selector selects all namespaces.
// +optional // +optional
optional k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector namespaceSelector = 2; optional k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector namespaceSelector = 2;
// IPBlock defines policy on a particular IPBlock
// +optional
optional IPBlock ipBlock = 3;
} }
// NetworkPolicyPort describes a port to allow traffic on // NetworkPolicyPort describes a port to allow traffic on
......
staging/src/k8s.io/api/networking/v1/types.go
View file @ c04e5163
...@@ -92,6 +92,20 @@ type NetworkPolicyPort struct { ...@@ -92,6 +92,20 @@ type NetworkPolicyPort struct {
Port *intstr.IntOrString `json:"port,omitempty" protobuf:"bytes,2,opt,name=port"` Port *intstr.IntOrString `json:"port,omitempty" protobuf:"bytes,2,opt,name=port"`
} }
// IPBlock describes a particular CIDR (Ex. "192.168.1.1/24") that is allowed to the pods
// matched by a NetworkPolicySpec's podSelector. The except entry describes CIDRs that should
// not be included within this rule.
type IPBlock struct {
// CIDR is a string representing the IP Block
// Valid examples are "192.168.1.1/24"
CIDR string `json:"cidr" protobuf:"bytes,1,name=cidr"`
// Except is a slice of CIDRs that should not be included within an IP Block
// Valid examples are "192.168.1.1/24"
// Except values will be rejected if they are outside the CIDR range
// +optional
Except []string `json:"except,omitempty" protobuf:"bytes,2,rep,name=except"`
}
// NetworkPolicyPeer describes a peer to allow traffic from. Exactly one of its fields // NetworkPolicyPeer describes a peer to allow traffic from. Exactly one of its fields
// must be specified. // must be specified.
type NetworkPolicyPeer struct { type NetworkPolicyPeer struct {
...@@ -106,6 +120,10 @@ type NetworkPolicyPeer struct { ...@@ -106,6 +120,10 @@ type NetworkPolicyPeer struct {
// selector semantics. If present but empty, this selector selects all namespaces. // selector semantics. If present but empty, this selector selects all namespaces.
// +optional // +optional
NamespaceSelector *metav1.LabelSelector `json:"namespaceSelector,omitempty" protobuf:"bytes,2,opt,name=namespaceSelector"` NamespaceSelector *metav1.LabelSelector `json:"namespaceSelector,omitempty" protobuf:"bytes,2,opt,name=namespaceSelector"`
// IPBlock defines policy on a particular IPBlock
// +optional
IPBlock *IPBlock `json:"ipBlock,omitempty" protobuf:"bytes,3,rep,name=ipBlock"`
} }
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
......
staging/src/k8s.io/api/networking/v1/types_swagger_doc_generated.go
View file @ c04e5163
...@@ -27,6 +27,16 @@ package v1 ...@@ -27,6 +27,16 @@ package v1
// Those methods can be generated by using hack/update-generated-swagger-docs.sh // Those methods can be generated by using hack/update-generated-swagger-docs.sh
// AUTO-GENERATED FUNCTIONS START HERE // AUTO-GENERATED FUNCTIONS START HERE
var map_IPBlock = map[string]string{
"": "IPBlock describes a particular CIDR (Ex. \"192.168.1.1/24\") that is allowed to the pods matched by a NetworkPolicySpec's podSelector. The except entry describes CIDRs that should not be included within this rule.",
"cidr": "CIDR is a string representing the IP Block Valid examples are \"192.168.1.1/24\"",
"except": "Except is a slice of CIDRs that should not be included within an IP Block Valid examples are \"192.168.1.1/24\" Except values will be rejected if they are outside the CIDR range",
}
func (IPBlock) SwaggerDoc() map[string]string {
return map_IPBlock
}
var map_NetworkPolicy = map[string]string{ var map_NetworkPolicy = map[string]string{
"": "NetworkPolicy describes what network traffic is allowed for a set of Pods", "": "NetworkPolicy describes what network traffic is allowed for a set of Pods",
"metadata": "Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata", "metadata": "Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata",
...@@ -61,6 +71,7 @@ var map_NetworkPolicyPeer = map[string]string{ ...@@ -61,6 +71,7 @@ var map_NetworkPolicyPeer = map[string]string{
"": "NetworkPolicyPeer describes a peer to allow traffic from. Exactly one of its fields must be specified.", "": "NetworkPolicyPeer describes a peer to allow traffic from. Exactly one of its fields must be specified.",
"podSelector": "This is a label selector which selects Pods in this namespace. This field follows standard label selector semantics. If present but empty, this selector selects all pods in this namespace.", "podSelector": "This is a label selector which selects Pods in this namespace. This field follows standard label selector semantics. If present but empty, this selector selects all pods in this namespace.",
"namespaceSelector": "Selects Namespaces using cluster scoped-labels. This matches all pods in all namespaces selected by this label selector. This field follows standard label selector semantics. If present but empty, this selector selects all namespaces.", "namespaceSelector": "Selects Namespaces using cluster scoped-labels. This matches all pods in all namespaces selected by this label selector. This field follows standard label selector semantics. If present but empty, this selector selects all namespaces.",
"ipBlock": "IPBlock defines policy on a particular IPBlock",
} }
func (NetworkPolicyPeer) SwaggerDoc() map[string]string { func (NetworkPolicyPeer) SwaggerDoc() map[string]string {
......
staging/src/k8s.io/api/networking/v1/zz_generated.deepcopy.go
View file @ c04e5163
...@@ -40,6 +40,10 @@ func init() { ...@@ -40,6 +40,10 @@ func init() {
func RegisterDeepCopies(scheme *runtime.Scheme) error { func RegisterDeepCopies(scheme *runtime.Scheme) error {
return scheme.AddGeneratedDeepCopyFuncs( return scheme.AddGeneratedDeepCopyFuncs(
conversion.GeneratedDeepCopyFunc{Fn: func(in interface{}, out interface{}, c *conversion.Cloner) error { conversion.GeneratedDeepCopyFunc{Fn: func(in interface{}, out interface{}, c *conversion.Cloner) error {
in.(*IPBlock).DeepCopyInto(out.(*IPBlock))
return nil
}, InType: reflect.TypeOf(&IPBlock{})},
conversion.GeneratedDeepCopyFunc{Fn: func(in interface{}, out interface{}, c *conversion.Cloner) error {
in.(*NetworkPolicy).DeepCopyInto(out.(*NetworkPolicy)) in.(*NetworkPolicy).DeepCopyInto(out.(*NetworkPolicy))
return nil return nil
}, InType: reflect.TypeOf(&NetworkPolicy{})}, }, InType: reflect.TypeOf(&NetworkPolicy{})},
...@@ -67,6 +71,27 @@ func RegisterDeepCopies(scheme *runtime.Scheme) error { ...@@ -67,6 +71,27 @@ func RegisterDeepCopies(scheme *runtime.Scheme) error {
} }
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (in *IPBlock) DeepCopyInto(out *IPBlock) {
*out = *in
if in.Except != nil {
in, out := &in.Except, &out.Except
*out = make([]string, len(*in))
copy(*out, *in)
}
return
}
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IPBlock.
func (in *IPBlock) DeepCopy() *IPBlock {
if in == nil {
return nil
}
out := new(IPBlock)
in.DeepCopyInto(out)
return out
}
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (in *NetworkPolicy) DeepCopyInto(out *NetworkPolicy) { func (in *NetworkPolicy) DeepCopyInto(out *NetworkPolicy) {
*out = *in *out = *in
out.TypeMeta = in.TypeMeta out.TypeMeta = in.TypeMeta
...@@ -179,6 +204,15 @@ func (in *NetworkPolicyPeer) DeepCopyInto(out *NetworkPolicyPeer) { ...@@ -179,6 +204,15 @@ func (in *NetworkPolicyPeer) DeepCopyInto(out *NetworkPolicyPeer) {
(*in).DeepCopyInto(*out) (*in).DeepCopyInto(*out)
} }
} }
if in.IPBlock != nil {
in, out := &in.IPBlock, &out.IPBlock
if *in == nil {
*out = nil
} else {
*out = new(IPBlock)
(*in).DeepCopyInto(*out)
}
}
return return
} }
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment