Skip to content

Commit d736d64

Browse files
zhaohuabingguydc
authored and
kkk777-7
committed
feat: cross ns policy attachment (#8676)
* api: cross-namespace policy target selectors Signed-off-by: Guy Daich <guy.daich@sap.com> * use gw-api style for namespace selector Signed-off-by: Guy Daich <guy.daich@sap.com> * fix json tag Signed-off-by: Guy Daich <guy.daich@sap.com> * update API Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * update API Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * implmentation Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * add e2e tests for cross ns policy attachment Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * update test Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * fix lint Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * update test Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * add referencegrants to the provider Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * fix test Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * fix test Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * simplify code Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * address comments Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * simplify code Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * simplify code Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * rename Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * fix race Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * remove unnecessary change Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * simplify code Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * rename Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * refactor Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * address comments Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * address comments Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * add referencegrants for extension server policies Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * Revert "add referencegrants for extension server policies" This reverts commit a0fbe68. Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * remove cross-ns policy attachment for extension server Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * fix gen Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * fix lint Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * fix test Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * address comments Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * remove unnecessary change Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * fix cel validation Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * add warning for partially accepted targets Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> --------- Signed-off-by: Guy Daich <guy.daich@sap.com> Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Co-authored-by: Guy Daich <guy.daich@sap.com>
1 parent 32c6911 commit d736d64

54 files changed

Lines changed: 6290 additions & 270 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎api/v1alpha1/envoygateway_types.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -687,7 +687,8 @@ type ExtensionManager struct {
687687
Resources []GroupVersionKind `json:"resources,omitempty"`
688688

689689
// PolicyResources defines the set of K8S resources the extension server will handle
690-
// as directly attached GatewayAPI policies
690+
// as directly attached Gateway API policies. Only policies in the same namespace as
691+
// the target Gateway resources are supported. Cross-namespace attachments are not supported.
691692
//
692693
// +optional
693694
PolicyResources []GroupVersionKind `json:"policyResources,omitempty"`

‎api/v1alpha1/policy_helpers.go‎

Lines changed: 41 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,18 @@ type TargetSelector struct {
5151
// Kind is the resource kind that this selector targets.
5252
Kind gwapiv1.Kind `json:"kind"`
5353

54-
// MatchLabels are the set of label selectors for identifying the targeted resource
54+
// Namespaces determines which namespaces are considered for target selection.
55+
//
56+
// If unspecified, only targets in the same namespace as this policy are considered.
57+
//
58+
// When specified, the effective set of namespaces is always constrained to the
59+
// namespaces watched by Envoy Gateway.
60+
//
61+
// +optional
62+
Namespaces *TargetSelectorNamespaces `json:"namespaces,omitempty"`
63+
64+
// MatchLabels are the set of label selectors for identifying the targeted resource.
65+
//
5566
// +optional
5667
MatchLabels map[string]string `json:"matchLabels,omitempty"`
5768

@@ -62,6 +73,35 @@ type TargetSelector struct {
6273
MatchExpressions []metav1.LabelSelectorRequirement `json:"matchExpressions,omitempty"`
6374
}
6475

76+
type TargetNamespaceFrom string
77+
78+
const (
79+
// TargetNamespaceFromSame limits target selection to the policy's namespace.
80+
TargetNamespaceFromSame TargetNamespaceFrom = "Same"
81+
// TargetNamespaceFromAll allows target selection from all watched namespaces.
82+
TargetNamespaceFromAll TargetNamespaceFrom = "All"
83+
// TargetNamespaceFromSelector allows target selection from watched namespaces matching the selector.
84+
TargetNamespaceFromSelector TargetNamespaceFrom = "Selector"
85+
)
86+
87+
// TargetSelectorNamespaces determines which namespaces are considered for target selection.
88+
// +kubebuilder:validation:XValidation:rule="self.from != 'Selector' || has(self.selector)", message="selector must be specified when from is Selector"
89+
type TargetSelectorNamespaces struct {
90+
// From indicates how namespaces are selected for this target selector.
91+
//
92+
// All means all namespaces watched by Envoy Gateway.
93+
// Selector means namespaces watched by Envoy Gateway that match Selector.
94+
//
95+
// +kubebuilder:validation:Enum=Same;All;Selector
96+
// +kubebuilder:default:=Same
97+
From TargetNamespaceFrom `json:"from"`
98+
99+
// Selector selects namespaces when From is set to Selector.
100+
//
101+
// +optional
102+
Selector *metav1.LabelSelector `json:"selector,omitempty"`
103+
}
104+
65105
func (p PolicyTargetReferences) GetTargetRefs() []gwapiv1.LocalPolicyTargetReferenceWithSectionName {
66106
if p.TargetRef != nil {
67107
return []gwapiv1.LocalPolicyTargetReferenceWithSectionName{*p.TargetRef}

‎api/v1alpha1/shared_types.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,10 @@ const (
7070
// PolicyReasonDeprecatedField is used with the "Warning" condition when the policy
7171
// uses deprecated fields that should be migrated to newer alternatives.
7272
PolicyReasonDeprecatedField gwapiv1.PolicyConditionReason = "DeprecatedField"
73+
74+
// PolicyReasonRefNotPermitted is used when the policy targets a cross-namespace
75+
// object without a matching ReferenceGrant.
76+
PolicyReasonRefNotPermitted gwapiv1.PolicyConditionReason = "RefNotPermitted"
7377
)
7478

7579
// GroupVersionKind unambiguously identifies a Kind.

‎api/v1alpha1/zz_generated.deepcopy.go‎

Lines changed: 25 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_backendtrafficpolicies.yaml‎

Lines changed: 75 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2805,8 +2805,82 @@ spec:
28052805
additionalProperties:
28062806
type: string
28072807
description: MatchLabels are the set of label selectors for
2808-
identifying the targeted resource
2808+
identifying the targeted resource.
28092809
type: object
2810+
namespaces:
2811+
description: |-
2812+
Namespaces determines which namespaces are considered for target selection.
2813+
2814+
If unspecified, only targets in the same namespace as this policy are considered.
2815+
2816+
When specified, the effective set of namespaces is always constrained to the
2817+
namespaces watched by Envoy Gateway.
2818+
properties:
2819+
from:
2820+
default: Same
2821+
description: |-
2822+
From indicates how namespaces are selected for this target selector.
2823+
2824+
All means all namespaces watched by Envoy Gateway.
2825+
Selector means namespaces watched by Envoy Gateway that match Selector.
2826+
enum:
2827+
- Same
2828+
- All
2829+
- Selector
2830+
type: string
2831+
selector:
2832+
description: Selector selects namespaces when From is set
2833+
to Selector.
2834+
properties:
2835+
matchExpressions:
2836+
description: matchExpressions is a list of label selector
2837+
requirements. The requirements are ANDed.
2838+
items:
2839+
description: |-
2840+
A label selector requirement is a selector that contains values, a key, and an operator that
2841+
relates the key and values.
2842+
properties:
2843+
key:
2844+
description: key is the label key that the selector
2845+
applies to.
2846+
type: string
2847+
operator:
2848+
description: |-
2849+
operator represents a key's relationship to a set of values.
2850+
Valid operators are In, NotIn, Exists and DoesNotExist.
2851+
type: string
2852+
values:
2853+
description: |-
2854+
values is an array of string values. If the operator is In or NotIn,
2855+
the values array must be non-empty. If the operator is Exists or DoesNotExist,
2856+
the values array must be empty. This array is replaced during a strategic
2857+
merge patch.
2858+
items:
2859+
type: string
2860+
type: array
2861+
x-kubernetes-list-type: atomic
2862+
required:
2863+
- key
2864+
- operator
2865+
type: object
2866+
type: array
2867+
x-kubernetes-list-type: atomic
2868+
matchLabels:
2869+
additionalProperties:
2870+
type: string
2871+
description: |-
2872+
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
2873+
map is equivalent to an element of matchExpressions, whose key field is "key", the
2874+
operator is "In", and the values array contains only "value". The requirements are ANDed.
2875+
type: object
2876+
type: object
2877+
x-kubernetes-map-type: atomic
2878+
required:
2879+
- from
2880+
type: object
2881+
x-kubernetes-validations:
2882+
- message: selector must be specified when from is Selector
2883+
rule: self.from != 'Selector' || has(self.selector)
28102884
required:
28112885
- kind
28122886
type: object

‎charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml‎

Lines changed: 75 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1171,8 +1171,82 @@ spec:
11711171
additionalProperties:
11721172
type: string
11731173
description: MatchLabels are the set of label selectors for
1174-
identifying the targeted resource
1174+
identifying the targeted resource.
11751175
type: object
1176+
namespaces:
1177+
description: |-
1178+
Namespaces determines which namespaces are considered for target selection.
1179+
1180+
If unspecified, only targets in the same namespace as this policy are considered.
1181+
1182+
When specified, the effective set of namespaces is always constrained to the
1183+
namespaces watched by Envoy Gateway.
1184+
properties:
1185+
from:
1186+
default: Same
1187+
description: |-
1188+
From indicates how namespaces are selected for this target selector.
1189+
1190+
All means all namespaces watched by Envoy Gateway.
1191+
Selector means namespaces watched by Envoy Gateway that match Selector.
1192+
enum:
1193+
- Same
1194+
- All
1195+
- Selector
1196+
type: string
1197+
selector:
1198+
description: Selector selects namespaces when From is set
1199+
to Selector.
1200+
properties:
1201+
matchExpressions:
1202+
description: matchExpressions is a list of label selector
1203+
requirements. The requirements are ANDed.
1204+
items:
1205+
description: |-
1206+
A label selector requirement is a selector that contains values, a key, and an operator that
1207+
relates the key and values.
1208+
properties:
1209+
key:
1210+
description: key is the label key that the selector
1211+
applies to.
1212+
type: string
1213+
operator:
1214+
description: |-
1215+
operator represents a key's relationship to a set of values.
1216+
Valid operators are In, NotIn, Exists and DoesNotExist.
1217+
type: string
1218+
values:
1219+
description: |-
1220+
values is an array of string values. If the operator is In or NotIn,
1221+
the values array must be non-empty. If the operator is Exists or DoesNotExist,
1222+
the values array must be empty. This array is replaced during a strategic
1223+
merge patch.
1224+
items:
1225+
type: string
1226+
type: array
1227+
x-kubernetes-list-type: atomic
1228+
required:
1229+
- key
1230+
- operator
1231+
type: object
1232+
type: array
1233+
x-kubernetes-list-type: atomic
1234+
matchLabels:
1235+
additionalProperties:
1236+
type: string
1237+
description: |-
1238+
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
1239+
map is equivalent to an element of matchExpressions, whose key field is "key", the
1240+
operator is "In", and the values array contains only "value". The requirements are ANDed.
1241+
type: object
1242+
type: object
1243+
x-kubernetes-map-type: atomic
1244+
required:
1245+
- from
1246+
type: object
1247+
x-kubernetes-validations:
1248+
- message: selector must be specified when from is Selector
1249+
rule: self.from != 'Selector' || has(self.selector)
11761250
required:
11771251
- kind
11781252
type: object

‎charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyextensionpolicies.yaml‎

Lines changed: 75 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1814,8 +1814,82 @@ spec:
18141814
additionalProperties:
18151815
type: string
18161816
description: MatchLabels are the set of label selectors for
1817-
identifying the targeted resource
1817+
identifying the targeted resource.
18181818
type: object
1819+
namespaces:
1820+
description: |-
1821+
Namespaces determines which namespaces are considered for target selection.
1822+
1823+
If unspecified, only targets in the same namespace as this policy are considered.
1824+
1825+
When specified, the effective set of namespaces is always constrained to the
1826+
namespaces watched by Envoy Gateway.
1827+
properties:
1828+
from:
1829+
default: Same
1830+
description: |-
1831+
From indicates how namespaces are selected for this target selector.
1832+
1833+
All means all namespaces watched by Envoy Gateway.
1834+
Selector means namespaces watched by Envoy Gateway that match Selector.
1835+
enum:
1836+
- Same
1837+
- All
1838+
- Selector
1839+
type: string
1840+
selector:
1841+
description: Selector selects namespaces when From is set
1842+
to Selector.
1843+
properties:
1844+
matchExpressions:
1845+
description: matchExpressions is a list of label selector
1846+
requirements. The requirements are ANDed.
1847+
items:
1848+
description: |-
1849+
A label selector requirement is a selector that contains values, a key, and an operator that
1850+
relates the key and values.
1851+
properties:
1852+
key:
1853+
description: key is the label key that the selector
1854+
applies to.
1855+
type: string
1856+
operator:
1857+
description: |-
1858+
operator represents a key's relationship to a set of values.
1859+
Valid operators are In, NotIn, Exists and DoesNotExist.
1860+
type: string
1861+
values:
1862+
description: |-
1863+
values is an array of string values. If the operator is In or NotIn,
1864+
the values array must be non-empty. If the operator is Exists or DoesNotExist,
1865+
the values array must be empty. This array is replaced during a strategic
1866+
merge patch.
1867+
items:
1868+
type: string
1869+
type: array
1870+
x-kubernetes-list-type: atomic
1871+
required:
1872+
- key
1873+
- operator
1874+
type: object
1875+
type: array
1876+
x-kubernetes-list-type: atomic
1877+
matchLabels:
1878+
additionalProperties:
1879+
type: string
1880+
description: |-
1881+
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
1882+
map is equivalent to an element of matchExpressions, whose key field is "key", the
1883+
operator is "In", and the values array contains only "value". The requirements are ANDed.
1884+
type: object
1885+
type: object
1886+
x-kubernetes-map-type: atomic
1887+
required:
1888+
- from
1889+
type: object
1890+
x-kubernetes-validations:
1891+
- message: selector must be specified when from is Selector
1892+
rule: self.from != 'Selector' || has(self.selector)
18191893
required:
18201894
- kind
18211895
type: object

0 commit comments

Comments
 (0)