Skip to content

Commit b22773a

Browse files
youngnickyoungnick
committed
Add BackendTLSPolicy implementation and make generate
Signed-off-by: Nick Young <[email protected]>
1 parent f938efd commit b22773a

File tree

17 files changed

+1409
-2
lines changed

17 files changed

+1409
-2
lines changed

‎apis/v1alpha2/backendtlspolicy_types.go

Lines changed: 157 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,157 @@
1+
/*
2+
Copyright 2021 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package v1alpha2
18+
19+
import (
20+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
21+
"sigs.k8s.io/gateway-api/apis/v1beta1"
22+
)
23+
24+
// +genclient
25+
// +kubebuilder:object:root=true
26+
// +kubebuilder:subresource:status
27+
// +kubebuilder:storageversion
28+
// +kubebuilder:resource:categories=gateway-api,shortName=btlspolicy
29+
// +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp`
30+
31+
// BackendTLSPolicy provides a way to publish TLS configuration
32+
// that enables a gateway client to connect to a backend pod.
33+
type BackendTLSPolicy struct {
34+
metav1.TypeMeta `json:",inline"`
35+
metav1.ObjectMeta `json:"metadata,omitempty"`
36+
37+
// Spec defines the desired state of BackendTLSPolicy.
38+
Spec BackendTLSPolicySpec `json:"spec"`
39+
40+
// Status defines the current state of BackendTLSPolicy.
41+
Status PolicyStatus `json:"status,omitempty"`
42+
}
43+
44+
// +kubebuilder:object:root=true
45+
// BackendTLSPolicyList contains a list of TCPRoute
46+
type BackendTLSPolicyList struct {
47+
metav1.TypeMeta `json:",inline"`
48+
metav1.ListMeta `json:"metadata,omitempty"`
49+
Items []BackendTLSPolicy `json:"items"`
50+
}
51+
52+
// BackendTLSPolicySpec defines the desired state of
53+
// BackendTLSPolicy.
54+
// Note: there is no Override or Default policy configuration.
55+
//
56+
// Support: Extended
57+
type BackendTLSPolicySpec struct {
58+
// TargetRef identifies an API object to apply policy to.
59+
// Services are the only valid API target references.
60+
// Note that this config applies to the entire referenced resource
61+
// by default, but this default may change in the future to provide
62+
// a more granular application of the policy.
63+
TargetRef PolicyTargetReference `json:"targetRef"`
64+
65+
// TLS contains backend TLS policy configuration.
66+
TLS *BackendTLSPolicyConfig `json:"tls"`
67+
}
68+
69+
// BackendTLSPolicyConfig contains backend TLS policy configuration.
70+
// +kubebuilder:validation:XValidation:message="must not contain both CertRefs and StandardCerts",rule="(has(self.certRefs) && size(self.certRefs > 0) && has(self.standardCerts) && self.standardCerts != '')"
71+
// +kubebuilder:validation:XValidation:message="must specify either CertRefs or StandardCerts",rule="!(has(self.certRefs) && size(self.certRefs > 0) || has(self.standardCerts) && self.standardCerts != '')"
72+
type BackendTLSPolicyConfig struct {
73+
// CertRefs contains one or more references to
74+
// Kubernetes objects that contain PEM-encoded TLS certificates,
75+
// which are used to establish a TLS handshake between the gateway
76+
// and backend pod.
77+
//
78+
// If CertRefs is empty or unspecified, then StandardCerts must
79+
// be specified. Only one of CertRefs or StandardCerts may be
80+
// specified, not both.
81+
//
82+
// If CertRefs is empty or unspecified, then system trusted
83+
// certificates should be used. If there are none, or the
84+
// implementation doesn't define system trusted certificates,
85+
// then a TLS connection must fail.
86+
//
87+
// References to a resource in a different namespace are
88+
// invalid.
89+
//
90+
// A single CertRef to a Kubernetes ConfigMap kind has "Core"
91+
// support. Implementations MAY choose to support attaching
92+
// multiple certificates to a backend, but this behavior is
93+
// implementation-specific. Also implementation-specific is
94+
// a CertRef of other object kinds, e.g. Secret.
95+
//
96+
// Support: Core - An optional single reference to a Kubernetes
97+
// ConfigMap.
98+
//
99+
// Support: Implementation-specific (No reference, more than one
100+
// reference, or resource types other than ConfigMaps.
101+
// Service mesh may ignore.)
102+
//
103+
// +kubebuilder:validation:MaxItems=8
104+
// +optional
105+
CertRefs []v1beta1.ConfigMapObjectReference `json:"certRefs,omitempty"`
106+
107+
// StandardCerts specifies whether system CA certificates may
108+
// be used in the TLS handshake between the gateway and
109+
// backend pod.
110+
//
111+
// If StandardCerts is unspecified or set to "", then CertRefs must
112+
// be specified with at least one entry for a valid configuration.
113+
// If StandardCerts is unspecified or set to "", then CertRefs must
114+
// be specified. Only one of CertRefs or StandardCerts may be
115+
// specified, not both.
116+
//
117+
// StandardCerts must be set to "System" when CertRefs is unspecified.
118+
//
119+
// If StandardCerts is set to "System", then the system trusted
120+
// certificates should be used. If there are none, or the
121+
// implementation doesn't define system trusted certificates,
122+
// then a TLS connection must fail.
123+
//
124+
// Support: Core - An optional value to specify whether to use
125+
// system certificates or not.
126+
//
127+
// Support: Implementation-specific (In the absence of support
128+
// for usable system certs, may be ignored. Service mesh may ignore.)
129+
//
130+
// +optional
131+
StandardCerts *StandardCertType `json:"standardCerts,omitempty"`
132+
133+
// Hostname is the Server Name Indication that the Gateway uses to
134+
// connect to the backend. It represents the fully qualified domain
135+
// name of a network host, as defined by RFC1123 - except that numeric
136+
// IP addresses are not allowed. Each label of the FQDN must consist
137+
// of lower case alphanumeric characters or '-', and must start and
138+
// end with an alphanumeric character. No other punctuation is allowed.
139+
// Wildcard domain names are specifically disallowed.
140+
//
141+
// It specifies the hostname that may authenticate, and must be in the
142+
// certificate served by the matching backend.
143+
//
144+
// Support: Core - A required value used by the Gateway to connect to
145+
// the backend when a BackendTLSPolicy is specified.
146+
Hostname v1beta1.PreciseHostname `json:"hostname"`
147+
}
148+
149+
// StandardCertType is the type of CA certificate that will be used when
150+
// the TLS.certRefs is unspecified.
151+
// +kubebuilder:validation:Enum=System
152+
type StandardCertType string
153+
154+
const (
155+
StandardCertSystem StandardCertType = "System"
156+
)
157+

‎apis/v1alpha2/policy_types.go

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -31,8 +31,6 @@ const (
3131
PolicyLabelKey = "gateway.networking.k8s.io/policy"
3232
)
3333

34-
35-
3634
// PolicyTargetReference identifies an API object to apply a direct or
3735
// inherited policy to. This should be used as part of Policy resources
3836
// that can target Gateway API resources. For more information on how this

‎apis/v1alpha2/zz_generated.deepcopy.go

Lines changed: 153 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎apis/v1alpha2/zz_generated.register.go

Lines changed: 2 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎apis/v1beta1/object_reference_types.go

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -145,3 +145,44 @@ type BackendObjectReference struct {
145145
// +optional
146146
Port *PortNumber `json:"port,omitempty"`
147147
}
148+
149+
// ConfigMapObjectReference identifies an API object including its namespace,
150+
// defaulting to ConfigMap.
151+
//
152+
// The API object must be valid in the cluster; the Group and Kind must
153+
// be registered in the cluster for this reference to be valid.
154+
//
155+
// References to objects with invalid Group and Kind are not valid, and must
156+
// be rejected by the implementation, with appropriate Conditions set
157+
// on the containing object.
158+
type ConfigMapObjectReference struct {
159+
// Group is the group of the referent. For example, "gateway.networking.k8s.io".
160+
// When unspecified or empty string, core API group is inferred.
161+
//
162+
// +optional
163+
// +kubebuilder:default=""
164+
Group *Group `json:"group"`
165+
166+
// Kind is the kind of the referent. For example, "ConfigMap".
167+
//
168+
// +optional
169+
// +kubebuilder:default=ConfigMap
170+
Kind *Kind `json:"kind"`
171+
172+
// Name is the metadata.name of the referenced config map.
173+
// +kubebuilder:validation:Required
174+
Name ObjectName `json:"name"`
175+
176+
// Namespace is the namespace of the referenced object. When unspecified, the local
177+
// namespace is inferred.
178+
//
179+
// Note that when a namespace different than the local namespace is specified,
180+
// a ReferenceGrant object is required in the referent namespace to allow that
181+
// namespace's owner to accept the reference. See the ReferenceGrant
182+
// documentation for details.
183+
//
184+
// Support: Core
185+
//
186+
// +optional
187+
Namespace *Namespace `json:"namespace,omitempty"`
188+
}

0 commit comments

Comments
 (0)