Skip to content

Commit fe6a88d

Browse files
youngnickyoungnick
committed
Add BackendTLSPolicy implementation and make generate
Signed-off-by: Nick Young <[email protected]>
1 parent fa5cafb commit fe6a88d

25 files changed

+1501
-61
lines changed

‎apis/v1alpha2/backendtlspolicy_types.go

Lines changed: 148 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,148 @@
1+
/*
2+
Copyright 2023 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package v1alpha2
18+
19+
import (
20+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
21+
22+
"sigs.k8s.io/gateway-api/apis/v1beta1"
23+
)
24+
25+
// +genclient
26+
// +kubebuilder:object:root=true
27+
// +kubebuilder:subresource:status
28+
// +kubebuilder:storageversion
29+
// +kubebuilder:resource:categories=gateway-api,shortName=btlspolicy
30+
// +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp`
31+
32+
// BackendTLSPolicy provides a way to configure how a Gateway
33+
// connects to a Backend via TLS.
34+
type BackendTLSPolicy struct {
35+
metav1.TypeMeta `json:",inline"`
36+
metav1.ObjectMeta `json:"metadata,omitempty"`
37+
38+
// Spec defines the desired state of BackendTLSPolicy.
39+
Spec BackendTLSPolicySpec `json:"spec"`
40+
41+
// Status defines the current state of BackendTLSPolicy.
42+
Status PolicyStatus `json:"status,omitempty"`
43+
}
44+
45+
// +kubebuilder:object:root=true
46+
// BackendTLSPolicyList contains a list of BackendTLSPolicies
47+
type BackendTLSPolicyList struct {
48+
metav1.TypeMeta `json:",inline"`
49+
metav1.ListMeta `json:"metadata,omitempty"`
50+
Items []BackendTLSPolicy `json:"items"`
51+
}
52+
53+
// BackendTLSPolicySpec defines the desired state of
54+
// BackendTLSPolicy.
55+
// Note: BackendTLSPolicy is a Direct Attached Policy only.
56+
//
57+
// Support: Extended
58+
type BackendTLSPolicySpec struct {
59+
// TargetRef identifies an API object to apply the policy to.
60+
// Only Services have Extended support. Implementations MAY support
61+
// additional objects, with Implementation Specific support.
62+
// Note that this config applies to the entire referenced resource
63+
// by default, but this default may change in the future to provide
64+
// a more granular application of the policy.
65+
//
66+
// Support: Extended for Kubernetes Service
67+
//
68+
// Support: Implementation-specific for any other resource
69+
//
70+
TargetRef PolicyTargetReferenceWithSectionName `json:"targetRef"`
71+
72+
// TLS contains backend TLS policy configuration.
73+
TLS BackendTLSPolicyConfig `json:"tls"`
74+
}
75+
76+
// BackendTLSPolicyConfig contains backend TLS policy configuration.
77+
// +kubebuilder:validation:XValidation:message="must not contain both CertRefs and StandardCerts",rule="(has(self.caCertRefs) && size(self.caCertRefs) > 0 && has(self.wellKnownCACerts) && self.wellKnownCACerts != \"\")"
78+
// +kubebuilder:validation:XValidation:message="must specify either CertRefs or StandardCerts",rule="!(has(self.caCertRefs) && size(self.caCertRefs) > 0 || has(self.wellKnownCACerts) && self.wellKnownCACerts != \"\")"
79+
type BackendTLSPolicyConfig struct {
80+
// CACertRefs contains one or more references to Kubernetes objects that
81+
// contain a PEM-encoded TLS CA certificate bundle, which is used to
82+
// validate a TLS handshake between the Gateway and backend Pod.
83+
//
84+
// If CACertRefs is empty or unspecified, then StandardCerts must
85+
// be specified. Only one of CACertRefs or StandardCerts may be
86+
// specified, not both.
87+
//
88+
// If CACertRefs is empty or unspecified, then system trusted
89+
// certificates should be used. If there are none, or the
90+
// implementation doesn't define system trusted certificates,
91+
// then a TLS connection must fail.
92+
//
93+
// References to a resource in a different namespace are
94+
// invalid for the moment, although we will revisit this
95+
// in the future.
96+
//
97+
// A single CACertRef to a Kubernetes ConfigMap kind has "Core"
98+
// support. Implementations MAY choose to support attaching
99+
// multiple certificates to a backend, but this behavior is
100+
// implementation-specific.
101+
//
102+
// Support: Core - An optional single reference to a Kubernetes
103+
// ConfigMap, with the CA certificate in a key named `ca.crt`.
104+
//
105+
// Support: Implementation-specific (More than one reference, or other kinds
106+
// of resources).
107+
//
108+
// +kubebuilder:validation:MaxItems=8
109+
// +optional
110+
CACertRefs []v1beta1.ObjectReference `json:"caCertRefs,omitempty"`
111+
112+
// WellKnownCACerts specifies whether system CA certificates may
113+
// be used in the TLS handshake between the gateway and
114+
// backend pod.
115+
//
116+
// If WellKnownCACerts is unspecified or set to "", then CACertRefs must
117+
// be specified with at least one entry for a valid configuration.
118+
// Only one of CACertRefs or WellKnownCACerts may be specified, not both.
119+
//
120+
// WellKnownCACerts must be set to "System" when CACertRefs is unspecified.
121+
//
122+
//
123+
// Support: Core for "System"
124+
//
125+
//
126+
// +optional
127+
WellKnownCACerts *WellKnownCACertType `json:"wellKnownCACerts,omitempty"`
128+
129+
// Hostname is used for two purposes in the connection between Gateways and
130+
// backends:
131+
//
132+
// 1. Hostname MUST be used as the SNI to connect to the backend (RFC 6066).
133+
// 2. Hostname MUST be used for authentication and MUST match the certificate
134+
// served by the matching backend.
135+
//
136+
// Support: Core
137+
Hostname v1beta1.PreciseHostname `json:"hostname"`
138+
}
139+
140+
// WellKnownCACertType is the type of CA certificate that will be used when
141+
// the TLS.caCertRefs is unspecified.
142+
// +kubebuilder:validation:Enum=System
143+
type WellKnownCACertType string
144+
145+
const (
146+
// Indicates that standard system CA certificates should be used.
147+
WellKnownCACertSystem WellKnownCACertType = "System"
148+
)

‎apis/v1alpha2/policy_types.go

Lines changed: 34 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -31,8 +31,6 @@ const (
3131
PolicyLabelKey = "gateway.networking.k8s.io/policy"
3232
)
3333

34-
35-
3634
// PolicyTargetReference identifies an API object to apply a direct or
3735
// inherited policy to. This should be used as part of Policy resources
3836
// that can target Gateway API resources. For more information on how this
@@ -128,12 +126,22 @@ const (
128126
// PolicyAncestorStatus describes the status of a route with respect to an
129127
// associated Ancestor.
130128
//
131-
// The object that a Policy attaches to (the object in its TargetRef) is its
132-
// _parent_, and any other objects above it in an object hierarchy are its
133-
// _ancestors_.
134-
//
135-
// For some Policies, particularly Direct Attached Policies, the relevant object
136-
// that distinguishes its status is not necessarily the parent object.
129+
// Ancestors refer to objects that are either the Target of a policy or above it
130+
// in terms of object hierarchy. For example, if a policy targets a Service, the
131+
// Policy's Ancestors are, in order, the Service, the HTTPRoute, the Gateway, and
132+
// the GatewayClass. Almost always, in this hierarchy, the Gateway will be the most
133+
// useful object to place Policy status on, so we recommend that implementations
134+
// SHOULD use Gateway as the PolicyAncestorStatus object unless the designers
135+
// have a _very_ good reason otherwise.
136+
//
137+
// In the context of policy attachment, the Ancestor is used to distinguish which
138+
// resource results in a distinct application of this policy. For example, if a policy
139+
// targets a Service, it may have a distinct result per attached Gateway.
140+
//
141+
// Policies targeting the same resource may have different effects depending on the
142+
// ancestors of those resources. For example, different Gateways targeting the same
143+
// Service may have different capabilities, especially if they have different underlying
144+
// implementations.
137145
//
138146
// For example, in BackendTLSPolicy, the Policy attaches to a Service that is
139147
// used as a backend in a HTTPRoute that is itself attached to a Gateway.
@@ -142,9 +150,12 @@ const (
142150
//
143151
// Note that a parent is also an ancestor, so for objects where the parent is the
144152
// relevant object for status, this struct SHOULD still be used.
153+
//
154+
// This struct is intended to be used in a slice that's effectively a map,
155+
// with a composite key made up of the AncestorRef and the ControllerName.
145156
type PolicyAncestorStatus struct {
146157
// AncestorRef corresponds with a ParentRef in the spec that this
147-
// RouteParentStatus struct describes the status of.
158+
// PolicyAncestorStatus struct describes the status of.
148159
AncestorRef ParentReference `json:"ancestorRef"`
149160

150161
// ControllerName is a domain/path string that indicates the name of the
@@ -175,24 +186,28 @@ type PolicyAncestorStatus struct {
175186
// their status.
176187
type PolicyStatus struct {
177188
// Ancestors is a list of ancestor resources (usually Gateways) that are
178-
// associated with the route, and the status of the route with respect to
179-
// each ancestor. When this route attaches to a parent, the controller that
189+
// associated with the policy, and the status of the policy with respect to
190+
// each ancestor. When this policy attaches to a parent, the controller that
180191
// manages the parent and the ancestors MUST add an entry to this list when
181-
// the controller first sees the route and SHOULD update the entry as
192+
// the controller first sees the policy and SHOULD update the entry as
182193
// appropriate when the relevant ancestor is modified.
183194
//
184195
// Note that choosing the relevant ancestor is left to the Policy designers;
185196
// an important part of Policy design is designing the right object level at
186197
// which to namespace this status.
187198
//
188-
// Note also that parent references that cannot be resolved by an implementation
189-
// of this API will not be added to this list. Implementations of this API
190-
// can only populate ancestor status for the parent resources they are
191-
// responsible for.
199+
// Note also that implementations MUST ONLY populate ancestor status for
200+
// the Ancestor resources they are responsible for. Implementations MUST
201+
// use the ControllerName field to uniquely identify the entries in this list
202+
// that they are responsible for.
203+
//
204+
// Note that to achieve this, the list of PolicyAncestorStatus structs
205+
// MUST be treated as a map with a composite key, made up of the AncestorRef
206+
// and ControllerName fields combined.
192207
//
193-
// A maximum of 32 ancestors will be represented in this list. An empty list
208+
// A maximum of 8 ancestors will be represented in this list. An empty list
194209
// means the Policy is not relevant for any ancestors.
195210
//
196-
// +kubebuilder:validation:MaxItems=32
211+
// +kubebuilder:validation:MaxItems=8
197212
Ancestors []PolicyAncestorStatus `json:"ancestors"`
198-
}
213+
}

0 commit comments

Comments
 (0)