k8s-operator,cmd/k8s-operator: define ProxyGroupPolicy CRD (#18614)
This commit adds a new custom resource definition to the kubernetes operator named `ProxyGroupPolicy`. This resource is namespace scoped and is used as an allow list for which `ProxyGroup` resources can be used within its namespace. The `spec` contains two fields, `ingress` and `egress`. These should contain the names of `ProxyGroup` resources to denote which can be used as values in the `tailscale.com/proxy-group` annotation within `Service` and `Ingress` resources. The intention is for these policies to be merged within a namespace and produce a `ValidatingAdmissionPolicy` and `ValidatingAdmissionPolicyBinding` for both ingress and egress that prevents users from using names of `ProxyGroup` resources in those annotations. Closes: https://github.com/tailscale/corp/issues/36829 Signed-off-by: David Bond <davidsbond93@gmail.com>main
David Bond
3 months ago
committed by
GitHub
parent
d468870310
commit
a341eea00b
@ -0,0 +1,139 @@ |
|||||||
|
apiVersion: apiextensions.k8s.io/v1 |
||||||
|
kind: CustomResourceDefinition |
||||||
|
metadata: |
||||||
|
annotations: |
||||||
|
controller-gen.kubebuilder.io/version: v0.17.0 |
||||||
|
name: proxygrouppolicies.tailscale.com |
||||||
|
spec: |
||||||
|
group: tailscale.com |
||||||
|
names: |
||||||
|
kind: ProxyGroupPolicy |
||||||
|
listKind: ProxyGroupPolicyList |
||||||
|
plural: proxygrouppolicies |
||||||
|
shortNames: |
||||||
|
- pgp |
||||||
|
singular: proxygrouppolicy |
||||||
|
scope: Namespaced |
||||||
|
versions: |
||||||
|
- additionalPrinterColumns: |
||||||
|
- jsonPath: .metadata.creationTimestamp |
||||||
|
name: Age |
||||||
|
type: date |
||||||
|
- description: Status of the deployed ProxyGroupPolicy resources. |
||||||
|
jsonPath: .status.conditions[?(@.type == "ProxyGroupPolicyReady")].reason |
||||||
|
name: Status |
||||||
|
type: string |
||||||
|
name: v1alpha1 |
||||||
|
schema: |
||||||
|
openAPIV3Schema: |
||||||
|
type: object |
||||||
|
required: |
||||||
|
- metadata |
||||||
|
- spec |
||||||
|
properties: |
||||||
|
apiVersion: |
||||||
|
description: |- |
||||||
|
APIVersion defines the versioned schema of this representation of an object. |
||||||
|
Servers should convert recognized schemas to the latest internal value, and |
||||||
|
may reject unrecognized values. |
||||||
|
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources |
||||||
|
type: string |
||||||
|
kind: |
||||||
|
description: |- |
||||||
|
Kind is a string value representing the REST resource this object represents. |
||||||
|
Servers may infer this from the endpoint the client submits requests to. |
||||||
|
Cannot be updated. |
||||||
|
In CamelCase. |
||||||
|
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds |
||||||
|
type: string |
||||||
|
metadata: |
||||||
|
type: object |
||||||
|
spec: |
||||||
|
description: |- |
||||||
|
Spec describes the desired state of the ProxyGroupPolicy. |
||||||
|
More info: |
||||||
|
https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status |
||||||
|
type: object |
||||||
|
properties: |
||||||
|
egress: |
||||||
|
description: |- |
||||||
|
Names of ProxyGroup resources that can be used by Service resources within this namespace. An empty list |
||||||
|
denotes that no egress via ProxyGroups is allowed within this namespace. |
||||||
|
type: array |
||||||
|
items: |
||||||
|
type: string |
||||||
|
ingress: |
||||||
|
description: |- |
||||||
|
Names of ProxyGroup resources that can be used by Ingress resources within this namespace. An empty list |
||||||
|
denotes that no ingress via ProxyGroups is allowed within this namespace. |
||||||
|
type: array |
||||||
|
items: |
||||||
|
type: string |
||||||
|
status: |
||||||
|
description: |- |
||||||
|
Status describes the status of the ProxyGroupPolicy. This is set |
||||||
|
and managed by the Tailscale operator. |
||||||
|
type: object |
||||||
|
properties: |
||||||
|
conditions: |
||||||
|
type: array |
||||||
|
items: |
||||||
|
description: Condition contains details for one aspect of the current state of this API Resource. |
||||||
|
type: object |
||||||
|
required: |
||||||
|
- lastTransitionTime |
||||||
|
- message |
||||||
|
- reason |
||||||
|
- status |
||||||
|
- type |
||||||
|
properties: |
||||||
|
lastTransitionTime: |
||||||
|
description: |- |
||||||
|
lastTransitionTime is the last time the condition transitioned from one status to another. |
||||||
|
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. |
||||||
|
type: string |
||||||
|
format: date-time |
||||||
|
message: |
||||||
|
description: |- |
||||||
|
message is a human readable message indicating details about the transition. |
||||||
|
This may be an empty string. |
||||||
|
type: string |
||||||
|
maxLength: 32768 |
||||||
|
observedGeneration: |
||||||
|
description: |- |
||||||
|
observedGeneration represents the .metadata.generation that the condition was set based upon. |
||||||
|
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date |
||||||
|
with respect to the current state of the instance. |
||||||
|
type: integer |
||||||
|
format: int64 |
||||||
|
minimum: 0 |
||||||
|
reason: |
||||||
|
description: |- |
||||||
|
reason contains a programmatic identifier indicating the reason for the condition's last transition. |
||||||
|
Producers of specific condition types may define expected values and meanings for this field, |
||||||
|
and whether the values are considered a guaranteed API. |
||||||
|
The value should be a CamelCase string. |
||||||
|
This field may not be empty. |
||||||
|
type: string |
||||||
|
maxLength: 1024 |
||||||
|
minLength: 1 |
||||||
|
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ |
||||||
|
status: |
||||||
|
description: status of the condition, one of True, False, Unknown. |
||||||
|
type: string |
||||||
|
enum: |
||||||
|
- "True" |
||||||
|
- "False" |
||||||
|
- Unknown |
||||||
|
type: |
||||||
|
description: type of condition in CamelCase or in foo.example.com/CamelCase. |
||||||
|
type: string |
||||||
|
maxLength: 316 |
||||||
|
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ |
||||||
|
x-kubernetes-list-map-keys: |
||||||
|
- type |
||||||
|
x-kubernetes-list-type: map |
||||||
|
served: true |
||||||
|
storage: true |
||||||
|
subresources: |
||||||
|
status: {} |
||||||
@ -0,0 +1,67 @@ |
|||||||
|
// Copyright (c) Tailscale Inc & contributors
|
||||||
|
// SPDX-License-Identifier: BSD-3-Clause
|
||||||
|
|
||||||
|
//go:build !plan9
|
||||||
|
|
||||||
|
package v1alpha1 |
||||||
|
|
||||||
|
import ( |
||||||
|
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" |
||||||
|
) |
||||||
|
|
||||||
|
// Code comments on these types should be treated as user facing documentation-
|
||||||
|
// they will appear on the ProxyGroupPolicy CRD i.e. if someone runs kubectl explain tailnet.
|
||||||
|
|
||||||
|
var ProxyGroupPolicyKind = "ProxyGroupPolicy" |
||||||
|
|
||||||
|
// +kubebuilder:object:root=true
|
||||||
|
// +kubebuilder:subresource:status
|
||||||
|
// +kubebuilder:resource:scope=Namespaced,shortName=pgp
|
||||||
|
// +kubebuilder:printcolumn:name="Age",type="date",JSONPath=".metadata.creationTimestamp"
|
||||||
|
// +kubebuilder:printcolumn:name="Status",type="string",JSONPath=`.status.conditions[?(@.type == "ProxyGroupPolicyReady")].reason`,description="Status of the deployed ProxyGroupPolicy resources."
|
||||||
|
|
||||||
|
type ProxyGroupPolicy struct { |
||||||
|
metav1.TypeMeta `json:",inline"` |
||||||
|
metav1.ObjectMeta `json:"metadata,omitzero"` |
||||||
|
|
||||||
|
// Spec describes the desired state of the ProxyGroupPolicy.
|
||||||
|
// More info:
|
||||||
|
// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
|
||||||
|
Spec ProxyGroupPolicySpec `json:"spec"` |
||||||
|
|
||||||
|
// Status describes the status of the ProxyGroupPolicy. This is set
|
||||||
|
// and managed by the Tailscale operator.
|
||||||
|
// +optional
|
||||||
|
Status ProxyGroupPolicyStatus `json:"status"` |
||||||
|
} |
||||||
|
|
||||||
|
// +kubebuilder:object:root=true
|
||||||
|
|
||||||
|
type ProxyGroupPolicyList struct { |
||||||
|
metav1.TypeMeta `json:",inline"` |
||||||
|
metav1.ListMeta `json:"metadata"` |
||||||
|
|
||||||
|
Items []ProxyGroupPolicy `json:"items"` |
||||||
|
} |
||||||
|
|
||||||
|
type ProxyGroupPolicySpec struct { |
||||||
|
// Names of ProxyGroup resources that can be used by Ingress resources within this namespace. An empty list
|
||||||
|
// denotes that no ingress via ProxyGroups is allowed within this namespace.
|
||||||
|
// +optional
|
||||||
|
Ingress []string `json:"ingress,omitempty"` |
||||||
|
|
||||||
|
// Names of ProxyGroup resources that can be used by Service resources within this namespace. An empty list
|
||||||
|
// denotes that no egress via ProxyGroups is allowed within this namespace.
|
||||||
|
// +optional
|
||||||
|
Egress []string `json:"egress,omitempty"` |
||||||
|
} |
||||||
|
|
||||||
|
type ProxyGroupPolicyStatus struct { |
||||||
|
// +listType=map
|
||||||
|
// +listMapKey=type
|
||||||
|
// +optional
|
||||||
|
Conditions []metav1.Condition `json:"conditions"` |
||||||
|
} |
||||||
|
|
||||||
|
// ProxyGroupPolicyReady is set to True if the ProxyGroupPolicy is available for use by operator workloads.
|
||||||
|
const ProxyGroupPolicyReady ConditionType = "ProxyGroupPolicyReady" |
||||||
Loading…
Reference in new issue