Skip to content

Commit 18af989

Browse files
youngnickyoungnick
committed
Add BackendTLSPolicy implementation and make generate
Signed-off-by: Nick Young <[email protected]>
1 parent f938efd commit 18af989

25 files changed

+1484
-33
lines changed

‎apis/v1alpha2/backendtlspolicy_types.go

Lines changed: 147 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,147 @@
1+
/*
2+
Copyright 2023 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package v1alpha2
18+
19+
import (
20+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
21+
"sigs.k8s.io/gateway-api/apis/v1beta1"
22+
)
23+
24+
// +genclient
25+
// +kubebuilder:object:root=true
26+
// +kubebuilder:subresource:status
27+
// +kubebuilder:storageversion
28+
// +kubebuilder:resource:categories=gateway-api,shortName=btlspolicy
29+
// +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp`
30+
31+
// BackendTLSPolicy provides a way to configure how a Gateway
32+
// connects to a Backend via TLS.
33+
type BackendTLSPolicy struct {
34+
metav1.TypeMeta `json:",inline"`
35+
metav1.ObjectMeta `json:"metadata,omitempty"`
36+
37+
// Spec defines the desired state of BackendTLSPolicy.
38+
Spec BackendTLSPolicySpec `json:"spec"`
39+
40+
// Status defines the current state of BackendTLSPolicy.
41+
Status PolicyStatus `json:"status,omitempty"`
42+
}
43+
44+
// +kubebuilder:object:root=true
45+
// BackendTLSPolicyList contains a list of BackendTLSPolicies
46+
type BackendTLSPolicyList struct {
47+
metav1.TypeMeta `json:",inline"`
48+
metav1.ListMeta `json:"metadata,omitempty"`
49+
Items []BackendTLSPolicy `json:"items"`
50+
}
51+
52+
// BackendTLSPolicySpec defines the desired state of
53+
// BackendTLSPolicy.
54+
// Note: BackendTLSPolicy is a Direct Attached Policy only.
55+
//
56+
// Support: Extended
57+
type BackendTLSPolicySpec struct {
58+
// TargetRef identifies an API object to apply the policy to.
59+
// Only Services have Extended support. Implementations MAY support
60+
// additional objects, with Implementation Specific support.
61+
// Note that this config applies to the entire referenced resource
62+
// by default, but this default may change in the future to provide
63+
// a more granular application of the policy.
64+
//
65+
// Support: Extended for Kubernetes Service
66+
//
67+
// Support: Implementation-specific for any other resource
68+
//
69+
TargetRef PolicyTargetReferenceWithSectionName `json:"targetRef"`
70+
71+
// TLS contains backend TLS policy configuration.
72+
TLS *BackendTLSPolicyConfig `json:"tls"`
73+
}
74+
75+
// BackendTLSPolicyConfig contains backend TLS policy configuration.
76+
// +kubebuilder:validation:XValidation:message="must not contain both CertRefs and StandardCerts",rule="(has(self.certRefs) && size(self.certRefs) > 0 && has(self.standardCerts) && self.standardCerts != \"\")"
77+
// +kubebuilder:validation:XValidation:message="must specify either CertRefs or StandardCerts",rule="!(has(self.certRefs) && size(self.certRefs) > 0 || has(self.standardCerts) && self.standardCerts != \"\")"
78+
type BackendTLSPolicyConfig struct {
79+
// CertRefs contains one or more references to
80+
// Kubernetes objects that contain PEM-encoded TLS certificates,
81+
// which are used to establish a TLS handshake between the Gateway
82+
// and backend Pod.
83+
//
84+
// If CertRefs is empty or unspecified, then StandardCerts must
85+
// be specified. Only one of CertRefs or StandardCerts may be
86+
// specified, not both.
87+
//
88+
// If CertRefs is empty or unspecified, then system trusted
89+
// certificates should be used. If there are none, or the
90+
// implementation doesn't define system trusted certificates,
91+
// then a TLS connection must fail.
92+
//
93+
// References to a resource in a different namespace are
94+
// invalid.
95+
//
96+
// A single CertRef to a Kubernetes ConfigMap kind has "Core"
97+
// support. Implementations MAY choose to support attaching
98+
// multiple certificates to a backend, but this behavior is
99+
// implementation-specific.
100+
//
101+
// Support: Core - An optional single reference to a Kubernetes
102+
// ConfigMap, with the CA certificate in a key named `ca.crt`.
103+
//
104+
// Support: Implementation-specific (More than one reference, or other kinds
105+
// of resources).
106+
//
107+
// +kubebuilder:validation:MaxItems=8
108+
// +optional
109+
CertRefs []v1beta1.ConfigMapObjectReference `json:"certRefs,omitempty"`
110+
111+
// StandardCerts specifies whether system CA certificates may
112+
// be used in the TLS handshake between the gateway and
113+
// backend pod.
114+
//
115+
// If StandardCerts is unspecified or set to "", then CertRefs must
116+
// be specified with at least one entry for a valid configuration.
117+
// Only one of CertRefs or StandardCerts may be specified, not both.
118+
//
119+
// StandardCerts must be set to "System" when CertRefs is unspecified.
120+
//
121+
//
122+
// Support: Core for "System"
123+
//
124+
//
125+
// +optional
126+
StandardCerts *StandardCertType `json:"standardCerts,omitempty"`
127+
128+
// Hostname is used for two purposes in the connection between Gateways and
129+
// backends:
130+
//
131+
// 1. Hostname MUST be used as the SNI to connect to the backend (RFC 3546).
132+
// 2. Hostname MUST be used for authentication and MUST be in the certificate
133+
// served by the matching backend.
134+
//
135+
// Support: Core
136+
Hostname v1beta1.PreciseHostname `json:"hostname"`
137+
}
138+
139+
// StandardCertType is the type of CA certificate that will be used when
140+
// the TLS.certRefs is unspecified.
141+
// +kubebuilder:validation:Enum=System
142+
type StandardCertType string
143+
144+
const (
145+
// Indicates that standard system CA certificates should be used.
146+
StandardCertSystem StandardCertType = "System"
147+
)

‎apis/v1alpha2/policy_types.go

Lines changed: 17 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -31,8 +31,6 @@ const (
3131
PolicyLabelKey = "gateway.networking.k8s.io/policy"
3232
)
3333

34-
35-
3634
// PolicyTargetReference identifies an API object to apply a direct or
3735
// inherited policy to. This should be used as part of Policy resources
3836
// that can target Gateway API resources. For more information on how this
@@ -128,12 +126,18 @@ const (
128126
// PolicyAncestorStatus describes the status of a route with respect to an
129127
// associated Ancestor.
130128
//
131-
// The object that a Policy attaches to (the object in its TargetRef) is its
132-
// _parent_, and any other objects above it in an object hierarchy are its
133-
// _ancestors_.
134-
//
135-
// For some Policies, particularly Direct Attached Policies, the relevant object
136-
// that distinguishes its status is not necessarily the parent object.
129+
// Ancestors refer to objects that are either the Target of a policy or above it in terms
130+
// of object hierarchy. For example, if a policy targets a Service, an Ancestor could be
131+
// a Route or a Gateway.
132+
//
133+
// In the context of policy attachment, the Ancestor is used to distinguish which
134+
// resource results in a distinct application of this policy. For example, if a policy
135+
// targets a Service, it may have a distinct result per attached Gateway.
136+
//
137+
// Policies targeting the same resource may have different effects depending on the
138+
// ancestors of those resources. For example, different Gateways targeting the same
139+
// Service may have different capabilities, especially if they have different underlying
140+
// implementations.
137141
//
138142
// For example, in BackendTLSPolicy, the Policy attaches to a Service that is
139143
// used as a backend in a HTTPRoute that is itself attached to a Gateway.
@@ -185,14 +189,14 @@ type PolicyStatus struct {
185189
// an important part of Policy design is designing the right object level at
186190
// which to namespace this status.
187191
//
188-
// Note also that parent references that cannot be resolved by an implementation
189-
// of this API will not be added to this list. Implementations of this API
190-
// can only populate ancestor status for the parent resources they are
191-
// responsible for.
192+
// Note also that implementations MUST ONLY populate ancestor status for
193+
// the Ancestor resources they are responsible for. Implementations MUST
194+
// use the ControllerName field to uniquely identify the entries in this list
195+
// that they are responsible for.
192196
//
193197
// A maximum of 32 ancestors will be represented in this list. An empty list
194198
// means the Policy is not relevant for any ancestors.
195199
//
196200
// +kubebuilder:validation:MaxItems=32
197201
Ancestors []PolicyAncestorStatus `json:"ancestors"`
198-
}
202+
}

‎apis/v1alpha2/zz_generated.deepcopy.go

Lines changed: 153 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎apis/v1alpha2/zz_generated.register.go

Lines changed: 2 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)