github
/
k3s
mirror of https://github.com/k3s-io/k3s
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Merge pull request #25638 from caseydavenport/cd-network-policy-api 

Automatic merge from submit-queue

Add NetworkPolicy API Resource

API implementation of https://github.com/kubernetes/kubernetes/pull/24154

Still to do:
- [x] Get it working (See comments)
- [x] Make sure user-facing comments are correct.
- [x] Update naming in response to #24154
- [x] kubectl / client support
- [x] Release note.

```release-note
Implement NetworkPolicy v1beta1 API object / client support.
```

Next Steps:
- UTs in separate PR.
- e2e test in separate PR.
- make `Ports` + `From` pointers to slices (TODOs in code - to be done when auto-gen is fixed)

CC @thockin 

[![Analytics](https://kubernetes-site.appspot.com/UA-36037335-10/GitHub/.github/PULL_REQUEST_TEMPLATE.md?pixel)]()
pull/6/head
k8s-merge-robot 2016-05-21 08:51:28 -07:00
parent c05c1d24ae 47248f3698
commit d06fe0caf7
26 changed files with 6768 additions and 45 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
contrib/completions/bash/kubectl
View File

@ -416,6 +416,7 @@ _kubectl_get()
must_have_one_noun+=("job")
must_have_one_noun+=("limitrange")
must_have_one_noun+=("namespace")
must_have_one_noun+=("networkpolicy")
must_have_one_noun+=("node")
must_have_one_noun+=("persistentvolume")
must_have_one_noun+=("persistentvolumeclaim")
@ -451,6 +452,7 @@ _kubectl_get()
noun_aliases+=("limitranges")
noun_aliases+=("limits")
noun_aliases+=("namespaces")
noun_aliases+=("networkpolicies")
noun_aliases+=("no")
noun_aliases+=("nodes")
noun_aliases+=("ns")
@ -652,6 +654,7 @@ _kubectl_describe()
must_have_one_noun+=("job")
must_have_one_noun+=("limitrange")
must_have_one_noun+=("namespace")
must_have_one_noun+=("networkpolicy")
must_have_one_noun+=("node")
must_have_one_noun+=("persistentvolume")
must_have_one_noun+=("persistentvolumeclaim")
@ -680,6 +683,7 @@ _kubectl_describe()
noun_aliases+=("limitranges")
noun_aliases+=("limits")
noun_aliases+=("namespaces")
noun_aliases+=("networkpolicies")
noun_aliases+=("no")
noun_aliases+=("nodes")
noun_aliases+=("ns")
@ -1268,6 +1272,7 @@ _kubectl_patch()
must_have_one_noun+=("job")
must_have_one_noun+=("limitrange")
must_have_one_noun+=("namespace")
must_have_one_noun+=("networkpolicy")
must_have_one_noun+=("node")
must_have_one_noun+=("persistentvolume")
must_have_one_noun+=("persistentvolumeclaim")
@ -1303,6 +1308,7 @@ _kubectl_patch()
noun_aliases+=("limitranges")
noun_aliases+=("limits")
noun_aliases+=("namespaces")
noun_aliases+=("networkpolicies")
noun_aliases+=("no")
noun_aliases+=("nodes")
noun_aliases+=("ns")
@ -1401,6 +1407,7 @@ _kubectl_delete()
must_have_one_noun+=("job")
must_have_one_noun+=("limitrange")
must_have_one_noun+=("namespace")
must_have_one_noun+=("networkpolicy")
must_have_one_noun+=("node")
must_have_one_noun+=("persistentvolume")
must_have_one_noun+=("persistentvolumeclaim")
@ -1436,6 +1443,7 @@ _kubectl_delete()
noun_aliases+=("limitranges")
noun_aliases+=("limits")
noun_aliases+=("namespaces")
noun_aliases+=("networkpolicies")
noun_aliases+=("no")
noun_aliases+=("nodes")
noun_aliases+=("ns")
@ -1530,6 +1538,7 @@ _kubectl_edit()
must_have_one_noun+=("job")
must_have_one_noun+=("limitrange")
must_have_one_noun+=("namespace")
must_have_one_noun+=("networkpolicy")
must_have_one_noun+=("node")
must_have_one_noun+=("persistentvolume")
must_have_one_noun+=("persistentvolumeclaim")
@ -1565,6 +1574,7 @@ _kubectl_edit()
noun_aliases+=("limitranges")
noun_aliases+=("limits")
noun_aliases+=("namespaces")
noun_aliases+=("networkpolicies")
noun_aliases+=("no")
noun_aliases+=("nodes")
noun_aliases+=("ns")
@ -2857,6 +2867,7 @@ _kubectl_label()
must_have_one_noun+=("job")
must_have_one_noun+=("limitrange")
must_have_one_noun+=("namespace")
must_have_one_noun+=("networkpolicy")
must_have_one_noun+=("node")
must_have_one_noun+=("persistentvolume")
must_have_one_noun+=("persistentvolumeclaim")
@ -2892,6 +2903,7 @@ _kubectl_label()
noun_aliases+=("limitranges")
noun_aliases+=("limits")
noun_aliases+=("namespaces")
noun_aliases+=("networkpolicies")
noun_aliases+=("no")
noun_aliases+=("nodes")
noun_aliases+=("ns")
@ -3095,6 +3107,7 @@ _kubectl_taint()
must_have_one_noun+=("job")
must_have_one_noun+=("limitrange")
must_have_one_noun+=("namespace")
must_have_one_noun+=("networkpolicy")
must_have_one_noun+=("node")
must_have_one_noun+=("persistentvolume")
must_have_one_noun+=("persistentvolumeclaim")

130
pkg/apis/extensions/deep_copy_generated.go
View File

@ -58,6 +58,12 @@ func init() {
DeepCopy_extensions_IngressSpec,
DeepCopy_extensions_IngressStatus,
DeepCopy_extensions_IngressTLS,
DeepCopy_extensions_NetworkPolicy,
DeepCopy_extensions_NetworkPolicyIngressRule,
DeepCopy_extensions_NetworkPolicyList,
DeepCopy_extensions_NetworkPolicyPeer,
DeepCopy_extensions_NetworkPolicyPort,
DeepCopy_extensions_NetworkPolicySpec,
DeepCopy_extensions_PodSecurityPolicy,
DeepCopy_extensions_PodSecurityPolicyList,
DeepCopy_extensions_PodSecurityPolicySpec,
@ -484,6 +490,130 @@ func DeepCopy_extensions_IngressTLS(in IngressTLS, out *IngressTLS, c *conversio
return nil
}
func DeepCopy_extensions_NetworkPolicy(in NetworkPolicy, out *NetworkPolicy, c *conversion.Cloner) error {
if err := unversioned.DeepCopy_unversioned_TypeMeta(in.TypeMeta, &out.TypeMeta, c); err != nil {
return err
}
if err := api.DeepCopy_api_ObjectMeta(in.ObjectMeta, &out.ObjectMeta, c); err != nil {
return err
}
if err := DeepCopy_extensions_NetworkPolicySpec(in.Spec, &out.Spec, c); err != nil {
return err
}
return nil
}
func DeepCopy_extensions_NetworkPolicyIngressRule(in NetworkPolicyIngressRule, out *NetworkPolicyIngressRule, c *conversion.Cloner) error {
if in.Ports != nil {
in, out := in.Ports, &out.Ports
*out = make([]NetworkPolicyPort, len(in))
for i := range in {
if err := DeepCopy_extensions_NetworkPolicyPort(in[i], &(*out)[i], c); err != nil {
return err
}
}
} else {
out.Ports = nil
}
if in.From != nil {
in, out := in.From, &out.From
*out = make([]NetworkPolicyPeer, len(in))
for i := range in {
if err := DeepCopy_extensions_NetworkPolicyPeer(in[i], &(*out)[i], c); err != nil {
return err
}
}
} else {
out.From = nil
}
return nil
}
func DeepCopy_extensions_NetworkPolicyList(in NetworkPolicyList, out *NetworkPolicyList, c *conversion.Cloner) error {
if err := unversioned.DeepCopy_unversioned_TypeMeta(in.TypeMeta, &out.TypeMeta, c); err != nil {
return err
}
if err := unversioned.DeepCopy_unversioned_ListMeta(in.ListMeta, &out.ListMeta, c); err != nil {
return err
}
if in.Items != nil {
in, out := in.Items, &out.Items
*out = make([]NetworkPolicy, len(in))
for i := range in {
if err := DeepCopy_extensions_NetworkPolicy(in[i], &(*out)[i], c); err != nil {
return err
}
}
} else {
out.Items = nil
}
return nil
}
func DeepCopy_extensions_NetworkPolicyPeer(in NetworkPolicyPeer, out *NetworkPolicyPeer, c *conversion.Cloner) error {
if in.PodSelector != nil {
in, out := in.PodSelector, &out.PodSelector
*out = new(unversioned.LabelSelector)
if err := unversioned.DeepCopy_unversioned_LabelSelector(*in, *out, c); err != nil {
return err
}
} else {
out.PodSelector = nil
}
if in.NamespaceSelector != nil {
in, out := in.NamespaceSelector, &out.NamespaceSelector
*out = new(unversioned.LabelSelector)
if err := unversioned.DeepCopy_unversioned_LabelSelector(*in, *out, c); err != nil {
return err
}
} else {
out.NamespaceSelector = nil
}
return nil
}
func DeepCopy_extensions_NetworkPolicyPort(in NetworkPolicyPort, out *NetworkPolicyPort, c *conversion.Cloner) error {
if in.Protocol != nil {
in, out := in.Protocol, &out.Protocol
*out = new(api.Protocol)
if newVal, err := c.DeepCopy(*in); err != nil {
return err
} else {
**out = newVal.(api.Protocol)
}
} else {
out.Protocol = nil
}
if in.Port != nil {
in, out := in.Port, &out.Port
*out = new(intstr.IntOrString)
if err := intstr.DeepCopy_intstr_IntOrString(*in, *out, c); err != nil {
return err
}
} else {
out.Port = nil
}
return nil
}
func DeepCopy_extensions_NetworkPolicySpec(in NetworkPolicySpec, out *NetworkPolicySpec, c *conversion.Cloner) error {
if err := unversioned.DeepCopy_unversioned_LabelSelector(in.PodSelector, &out.PodSelector, c); err != nil {
return err
}
if in.Ingress != nil {
in, out := in.Ingress, &out.Ingress
*out = make([]NetworkPolicyIngressRule, len(in))
for i := range in {
if err := DeepCopy_extensions_NetworkPolicyIngressRule(in[i], &(*out)[i], c); err != nil {
return err
}
}
} else {
out.Ingress = nil
}
return nil
}
func DeepCopy_extensions_PodSecurityPolicy(in PodSecurityPolicy, out *PodSecurityPolicy, c *conversion.Cloner) error {
if err := unversioned.DeepCopy_unversioned_TypeMeta(in.TypeMeta, &out.TypeMeta, c); err != nil {
return err

4
pkg/apis/extensions/register.go
View File

@ -73,6 +73,8 @@ func addKnownTypes(scheme *runtime.Scheme) {
&api.ExportOptions{},
&PodSecurityPolicy{},
&PodSecurityPolicyList{},
&NetworkPolicy{},
&NetworkPolicyList{},
)
}
@ -93,3 +95,5 @@ func (obj *ReplicaSet) GetObjectKind() unversioned.ObjectKind {
func (obj *ReplicaSetList) GetObjectKind() unversioned.ObjectKind { return &obj.TypeMeta }
func (obj *PodSecurityPolicy) GetObjectKind() unversioned.ObjectKind { return &obj.TypeMeta }
func (obj *PodSecurityPolicyList) GetObjectKind() unversioned.ObjectKind { return &obj.TypeMeta }
func (obj *NetworkPolicy) GetObjectKind() unversioned.ObjectKind { return &obj.TypeMeta }
func (obj *NetworkPolicyList) GetObjectKind() unversioned.ObjectKind { return &obj.TypeMeta }

2176
pkg/apis/extensions/types.generated.go
View File

File diff suppressed because it is too large Load Diff

86
pkg/apis/extensions/types.go
View File

@ -809,3 +809,89 @@ type PodSecurityPolicyList struct {
Items []PodSecurityPolicy `json:"items"`
}
type NetworkPolicy struct {
unversioned.TypeMeta `json:",inline"`
api.ObjectMeta `json:"metadata,omitempty"`
// Specification of the desired behavior for this NetworkPolicy.
Spec NetworkPolicySpec `json:"spec,omitempty"`
}
type NetworkPolicySpec struct {
// Selects the pods to which this NetworkPolicy object applies. The array of ingress rules
// is applied to any pods selected by this field. Multiple network policies can select the
// same set of pods. In this case, the ingress rules for each are combined additively.
// This field is NOT optional and follows standard label selector semantics.
// An empty podSelector matches all pods in this namespace.
PodSelector unversioned.LabelSelector `json:"podSelector"`
// List of ingress rules to be applied to the selected pods.
// Traffic is allowed to a pod if namespace.networkPolicy.ingress.isolation is undefined and cluster policy allows it,
// OR if the traffic source is the pod's local node,
// OR if the traffic matches at least one ingress rule across all of the NetworkPolicy
// objects whose podSelector matches the pod.
// If this field is empty then this NetworkPolicy does not affect ingress isolation.
// If this field is present and contains at least one rule, this policy allows any traffic
// which matches at least one of the ingress rules in this list.
Ingress []NetworkPolicyIngressRule `json:"ingress,omitempty"`
}
// This NetworkPolicyIngressRule matches traffic if and only if the traffic matches both ports AND from.
type NetworkPolicyIngressRule struct {
// List of ports which should be made accessible on the pods selected for this rule.
// Each item in this list is combined using a logical OR.
// If this field is not provided, this rule matches all ports (traffic not restricted by port).
// If this field is empty, this rule matches no ports (no traffic matches).
// If this field is present and contains at least one item, then this rule allows traffic
// only if the traffic matches at least one port in the list.
// TODO: Update this to be a pointer to slice as soon as auto-generation supports it.
Ports []NetworkPolicyPort `json:"ports,omitempty"`
// List of sources which should be able to access the pods selected for this rule.
// Items in this list are combined using a logical OR operation.
// If this field is not provided, this rule matches all sources (traffic not restricted by source).
// If this field is empty, this rule matches no sources (no traffic matches).
// If this field is present and contains at least on item, this rule allows traffic only if the
// traffic matches at least one item in the from list.
// TODO: Update this to be a pointer to slice as soon as auto-generation supports it.
From []NetworkPolicyPeer `json:"from,omitempty"`
}
type NetworkPolicyPort struct {
// Optional. The protocol (TCP or UDP) which traffic must match.
// If not specified, this field defaults to TCP.
Protocol *api.Protocol `json:"protocol,omitempty"`
// If specified, the port on the given protocol. This can
// either be a numerical or named port on a pod. If this field is not provided,
// this matches all port names and numbers.
// If present, only traffic on the specified protocol AND port
// will be matched.
Port *intstr.IntOrString `json:"port,omitempty"`
}
type NetworkPolicyPeer struct {
// Exactly one of the following must be specified.
// This is a label selector which selects Pods in this namespace.
// This field follows standard label selector semantics.
// If not provided, this selector selects no pods.
// If present but empty, this selector selects all pods in this namespace.
PodSelector *unversioned.LabelSelector `json:"podSelector,omitempty"`
// Selects Namespaces using cluster scoped-labels. This
// matches all pods in all namespaces selected by this label selector.
// This field follows standard label selector semantics.
// If omited, this selector selects no namespaces.
// If present but empty, this selector selects all namespaces.
NamespaceSelector *unversioned.LabelSelector `json:"namespaceSelector,omitempty"`
}
// NetworkPolicyList is a list of NetworkPolicy objects.
type NetworkPolicyList struct {
unversioned.TypeMeta `json:",inline"`
unversioned.ListMeta `json:"metadata,omitempty"`
Items []NetworkPolicy `json:"items"`
}

304
pkg/apis/extensions/v1beta1/conversion_generated.go
View File

@ -28,6 +28,7 @@ import (
batch "k8s.io/kubernetes/pkg/apis/batch"
extensions "k8s.io/kubernetes/pkg/apis/extensions"
conversion "k8s.io/kubernetes/pkg/conversion"
intstr "k8s.io/kubernetes/pkg/util/intstr"
)
func init() {
@ -110,6 +111,18 @@ func init() {
Convert_unversioned_LabelSelector_To_v1beta1_LabelSelector,
Convert_v1beta1_LabelSelectorRequirement_To_unversioned_LabelSelectorRequirement,
Convert_unversioned_LabelSelectorRequirement_To_v1beta1_LabelSelectorRequirement,
Convert_v1beta1_NetworkPolicy_To_extensions_NetworkPolicy,
Convert_extensions_NetworkPolicy_To_v1beta1_NetworkPolicy,
Convert_v1beta1_NetworkPolicyIngressRule_To_extensions_NetworkPolicyIngressRule,
Convert_extensions_NetworkPolicyIngressRule_To_v1beta1_NetworkPolicyIngressRule,
Convert_v1beta1_NetworkPolicyList_To_extensions_NetworkPolicyList,
Convert_extensions_NetworkPolicyList_To_v1beta1_NetworkPolicyList,
Convert_v1beta1_NetworkPolicyPeer_To_extensions_NetworkPolicyPeer,
Convert_extensions_NetworkPolicyPeer_To_v1beta1_NetworkPolicyPeer,
Convert_v1beta1_NetworkPolicyPort_To_extensions_NetworkPolicyPort,
Convert_extensions_NetworkPolicyPort_To_v1beta1_NetworkPolicyPort,
Convert_v1beta1_NetworkPolicySpec_To_extensions_NetworkPolicySpec,
Convert_extensions_NetworkPolicySpec_To_v1beta1_NetworkPolicySpec,
Convert_v1beta1_PodSecurityPolicy_To_extensions_PodSecurityPolicy,
Convert_extensions_PodSecurityPolicy_To_v1beta1_PodSecurityPolicy,
Convert_v1beta1_PodSecurityPolicyList_To_extensions_PodSecurityPolicyList,
@ -1556,6 +1569,297 @@ func Convert_unversioned_LabelSelectorRequirement_To_v1beta1_LabelSelectorRequir
return autoConvert_unversioned_LabelSelectorRequirement_To_v1beta1_LabelSelectorRequirement(in, out, s)
}
func autoConvert_v1beta1_NetworkPolicy_To_extensions_NetworkPolicy(in *NetworkPolicy, out *extensions.NetworkPolicy, s conversion.Scope) error {
SetDefaults_NetworkPolicy(in)
if err := api.Convert_unversioned_TypeMeta_To_unversioned_TypeMeta(&in.TypeMeta, &out.TypeMeta, s); err != nil {
return err
}
// TODO: Inefficient conversion - can we improve it?
if err := s.Convert(&in.ObjectMeta, &out.ObjectMeta, 0); err != nil {
return err
}
if err := Convert_v1beta1_NetworkPolicySpec_To_extensions_NetworkPolicySpec(&in.Spec, &out.Spec, s); err != nil {
return err
}
return nil
}
func Convert_v1beta1_NetworkPolicy_To_extensions_NetworkPolicy(in *NetworkPolicy, out *extensions.NetworkPolicy, s conversion.Scope) error {
return autoConvert_v1beta1_NetworkPolicy_To_extensions_NetworkPolicy(in, out, s)
}
func autoConvert_extensions_NetworkPolicy_To_v1beta1_NetworkPolicy(in *extensions.NetworkPolicy, out *NetworkPolicy, s conversion.Scope) error {
if err := api.Convert_unversioned_TypeMeta_To_unversioned_TypeMeta(&in.TypeMeta, &out.TypeMeta, s); err != nil {
return err
}
// TODO: Inefficient conversion - can we improve it?
if err := s.Convert(&in.ObjectMeta, &out.ObjectMeta, 0); err != nil {
return err
}
if err := Convert_extensions_NetworkPolicySpec_To_v1beta1_NetworkPolicySpec(&in.Spec, &out.Spec, s); err != nil {
return err
}
return nil
}
func Convert_extensions_NetworkPolicy_To_v1beta1_NetworkPolicy(in *extensions.NetworkPolicy, out *NetworkPolicy, s conversion.Scope) error {
return autoConvert_extensions_NetworkPolicy_To_v1beta1_NetworkPolicy(in, out, s)
}
func autoConvert_v1beta1_NetworkPolicyIngressRule_To_extensions_NetworkPolicyIngressRule(in *NetworkPolicyIngressRule, out *extensions.NetworkPolicyIngressRule, s conversion.Scope) error {
if in.Ports != nil {
in, out := &in.Ports, &out.Ports
*out = make([]extensions.NetworkPolicyPort, len(*in))
for i := range *in {
if err := Convert_v1beta1_NetworkPolicyPort_To_extensions_NetworkPolicyPort(&(*in)[i], &(*out)[i], s); err != nil {
return err
}
}
} else {
out.Ports = nil
}
if in.From != nil {
in, out := &in.From, &out.From
*out = make([]extensions.NetworkPolicyPeer, len(*in))
for i := range *in {
if err := Convert_v1beta1_NetworkPolicyPeer_To_extensions_NetworkPolicyPeer(&(*in)[i], &(*out)[i], s); err != nil {
return err
}
}
} else {
out.From = nil
}
return nil
}
func Convert_v1beta1_NetworkPolicyIngressRule_To_extensions_NetworkPolicyIngressRule(in *NetworkPolicyIngressRule, out *extensions.NetworkPolicyIngressRule, s conversion.Scope) error {
return autoConvert_v1beta1_NetworkPolicyIngressRule_To_extensions_NetworkPolicyIngressRule(in, out, s)
}
func autoConvert_extensions_NetworkPolicyIngressRule_To_v1beta1_NetworkPolicyIngressRule(in *extensions.NetworkPolicyIngressRule, out *NetworkPolicyIngressRule, s conversion.Scope) error {
if in.Ports != nil {
in, out := &in.Ports, &out.Ports
*out = make([]NetworkPolicyPort, len(*in))
for i := range *in {
if err := Convert_extensions_NetworkPolicyPort_To_v1beta1_NetworkPolicyPort(&(*in)[i], &(*out)[i], s); err != nil {
return err
}
}
} else {
out.Ports = nil
}
if in.From != nil {
in, out := &in.From, &out.From
*out = make([]NetworkPolicyPeer, len(*in))
for i := range *in {
if err := Convert_extensions_NetworkPolicyPeer_To_v1beta1_NetworkPolicyPeer(&(*in)[i], &(*out)[i], s); err != nil {
return err
}
}
} else {
out.From = nil
}
return nil
}
func Convert_extensions_NetworkPolicyIngressRule_To_v1beta1_NetworkPolicyIngressRule(in *extensions.NetworkPolicyIngressRule, out *NetworkPolicyIngressRule, s conversion.Scope) error {
return autoConvert_extensions_NetworkPolicyIngressRule_To_v1beta1_NetworkPolicyIngressRule(in, out, s)
}
func autoConvert_v1beta1_NetworkPolicyList_To_extensions_NetworkPolicyList(in *NetworkPolicyList, out *extensions.NetworkPolicyList, s conversion.Scope) error {
if err := api.Convert_unversioned_TypeMeta_To_unversioned_TypeMeta(&in.TypeMeta, &out.TypeMeta, s); err != nil {
return err
}
if err := api.Convert_unversioned_ListMeta_To_unversioned_ListMeta(&in.ListMeta, &out.ListMeta, s); err != nil {
return err
}
if in.Items != nil {
in, out := &in.Items, &out.Items
*out = make([]extensions.NetworkPolicy, len(*in))
for i := range *in {
if err := Convert_v1beta1_NetworkPolicy_To_extensions_NetworkPolicy(&(*in)[i], &(*out)[i], s); err != nil {
return err
}
}
} else {
out.Items = nil
}
return nil
}
func Convert_v1beta1_NetworkPolicyList_To_extensions_NetworkPolicyList(in *NetworkPolicyList, out *extensions.NetworkPolicyList, s conversion.Scope) error {
return autoConvert_v1beta1_NetworkPolicyList_To_extensions_NetworkPolicyList(in, out, s)
}
func autoConvert_extensions_NetworkPolicyList_To_v1beta1_NetworkPolicyList(in *extensions.NetworkPolicyList, out *NetworkPolicyList, s conversion.Scope) error {
if err := api.Convert_unversioned_TypeMeta_To_unversioned_TypeMeta(&in.TypeMeta, &out.TypeMeta, s); err != nil {
return err
}
if err := api.Convert_unversioned_ListMeta_To_unversioned_ListMeta(&in.ListMeta, &out.ListMeta, s); err != nil {
return err
}
if in.Items != nil {
in, out := &in.Items, &out.Items
*out = make([]NetworkPolicy, len(*in))
for i := range *in {
if err := Convert_extensions_NetworkPolicy_To_v1beta1_NetworkPolicy(&(*in)[i], &(*out)[i], s); err != nil {
return err
}
}
} else {
out.Items = nil
}
return nil
}
func Convert_extensions_NetworkPolicyList_To_v1beta1_NetworkPolicyList(in *extensions.NetworkPolicyList, out *NetworkPolicyList, s conversion.Scope) error {
return autoConvert_extensions_NetworkPolicyList_To_v1beta1_NetworkPolicyList(in, out, s)
}
func autoConvert_v1beta1_NetworkPolicyPeer_To_extensions_NetworkPolicyPeer(in *NetworkPolicyPeer, out *extensions.NetworkPolicyPeer, s conversion.Scope) error {
if in.PodSelector != nil {
in, out := &in.PodSelector, &out.PodSelector
*out = new(unversioned.LabelSelector)
if err := Convert_v1beta1_LabelSelector_To_unversioned_LabelSelector(*in, *out, s); err != nil {
return err
}
} else {
out.PodSelector = nil
}
if in.NamespaceSelector != nil {
in, out := &in.NamespaceSelector, &out.NamespaceSelector
*out = new(unversioned.LabelSelector)
if err := Convert_v1beta1_LabelSelector_To_unversioned_LabelSelector(*in, *out, s); err != nil {
return err
}
} else {
out.NamespaceSelector = nil
}
return nil
}
func Convert_v1beta1_NetworkPolicyPeer_To_extensions_NetworkPolicyPeer(in *NetworkPolicyPeer, out *extensions.NetworkPolicyPeer, s conversion.Scope) error {
return autoConvert_v1beta1_NetworkPolicyPeer_To_extensions_NetworkPolicyPeer(in, out, s)
}
func autoConvert_extensions_NetworkPolicyPeer_To_v1beta1_NetworkPolicyPeer(in *extensions.NetworkPolicyPeer, out *NetworkPolicyPeer, s conversion.Scope) error {
if in.PodSelector != nil {
in, out := &in.PodSelector, &out.PodSelector
*out = new(LabelSelector)
if err := Convert_unversioned_LabelSelector_To_v1beta1_LabelSelector(*in, *out, s); err != nil {
return err
}
} else {
out.PodSelector = nil
}
if in.NamespaceSelector != nil {
in, out := &in.NamespaceSelector, &out.NamespaceSelector
*out = new(LabelSelector)
if err := Convert_unversioned_LabelSelector_To_v1beta1_LabelSelector(*in, *out, s); err != nil {
return err
}
} else {
out.NamespaceSelector = nil
}
return nil
}
func Convert_extensions_NetworkPolicyPeer_To_v1beta1_NetworkPolicyPeer(in *extensions.NetworkPolicyPeer, out *NetworkPolicyPeer, s conversion.Scope) error {
return autoConvert_extensions_NetworkPolicyPeer_To_v1beta1_NetworkPolicyPeer(in, out, s)
}
func autoConvert_v1beta1_NetworkPolicyPort_To_extensions_NetworkPolicyPort(in *NetworkPolicyPort, out *extensions.NetworkPolicyPort, s conversion.Scope) error {
if in.Protocol != nil {
in, out := &in.Protocol, &out.Protocol
*out = new(api.Protocol)
**out = api.Protocol(**in)
} else {
out.Protocol = nil
}
if in.Port != nil {
in, out := &in.Port, &out.Port
*out = new(intstr.IntOrString)
if err := api.Convert_intstr_IntOrString_To_intstr_IntOrString(*in, *out, s); err != nil {
return err
}
} else {
out.Port = nil
}
return nil
}
func Convert_v1beta1_NetworkPolicyPort_To_extensions_NetworkPolicyPort(in *NetworkPolicyPort, out *extensions.NetworkPolicyPort, s conversion.Scope) error {
return autoConvert_v1beta1_NetworkPolicyPort_To_extensions_NetworkPolicyPort(in, out, s)
}
func autoConvert_extensions_NetworkPolicyPort_To_v1beta1_NetworkPolicyPort(in *extensions.NetworkPolicyPort, out *NetworkPolicyPort, s conversion.Scope) error {
if in.Protocol != nil {
in, out := &in.Protocol, &out.Protocol
*out = new(v1.Protocol)
**out = v1.Protocol(**in)
} else {
out.Protocol = nil
}
if in.Port != nil {
in, out := &in.Port, &out.Port
*out = new(intstr.IntOrString)
if err := api.Convert_intstr_IntOrString_To_intstr_IntOrString(*in, *out, s); err != nil {
return err
}
} else {
out.Port = nil
}
return nil
}
func Convert_extensions_NetworkPolicyPort_To_v1beta1_NetworkPolicyPort(in *extensions.NetworkPolicyPort, out *NetworkPolicyPort, s conversion.Scope) error {
return autoConvert_extensions_NetworkPolicyPort_To_v1beta1_NetworkPolicyPort(in, out, s)
}
func autoConvert_v1beta1_NetworkPolicySpec_To_extensions_NetworkPolicySpec(in *NetworkPolicySpec, out *extensions.NetworkPolicySpec, s conversion.Scope) error {
if err := Convert_v1beta1_LabelSelector_To_unversioned_LabelSelector(&in.PodSelector, &out.PodSelector, s); err != nil {
return err
}
if in.Ingress != nil {
in, out := &in.Ingress, &out.Ingress
*out = make([]extensions.NetworkPolicyIngressRule, len(*in))
for i := range *in {
if err := Convert_v1beta1_NetworkPolicyIngressRule_To_extensions_NetworkPolicyIngressRule(&(*in)[i], &(*out)[i], s); err != nil {
return err
}
}
} else {
out.Ingress = nil
}
return nil
}
func Convert_v1beta1_NetworkPolicySpec_To_extensions_NetworkPolicySpec(in *NetworkPolicySpec, out *extensions.NetworkPolicySpec, s conversion.Scope) error {
return autoConvert_v1beta1_NetworkPolicySpec_To_extensions_NetworkPolicySpec(in, out, s)
}
func autoConvert_extensions_NetworkPolicySpec_To_v1beta1_NetworkPolicySpec(in *extensions.NetworkPolicySpec, out *NetworkPolicySpec, s conversion.Scope) error {
if err := Convert_unversioned_LabelSelector_To_v1beta1_LabelSelector(&in.PodSelector, &out.PodSelector, s); err != nil {
return err
}
if in.Ingress != nil {
in, out := &in.Ingress, &out.Ingress
*out = make([]NetworkPolicyIngressRule, len(*in))
for i := range *in {
if err := Convert_extensions_NetworkPolicyIngressRule_To_v1beta1_NetworkPolicyIngressRule(&(*in)[i], &(*out)[i], s); err != nil {
return err
}
}
} else {
out.Ingress = nil
}
return nil
}
func Convert_extensions_NetworkPolicySpec_To_v1beta1_NetworkPolicySpec(in *extensions.NetworkPolicySpec, out *NetworkPolicySpec, s conversion.Scope) error {
return autoConvert_extensions_NetworkPolicySpec_To_v1beta1_NetworkPolicySpec(in, out, s)
}
func autoConvert_v1beta1_PodSecurityPolicy_To_extensions_PodSecurityPolicy(in *PodSecurityPolicy, out *extensions.PodSecurityPolicy, s conversion.Scope) error {
if err := api.Convert_unversioned_TypeMeta_To_unversioned_TypeMeta(&in.TypeMeta, &out.TypeMeta, s); err != nil {
return err

130
pkg/apis/extensions/v1beta1/deep_copy_generated.go
View File

@ -73,6 +73,12 @@ func init() {
DeepCopy_v1beta1_LabelSelector,
DeepCopy_v1beta1_LabelSelectorRequirement,
DeepCopy_v1beta1_ListOptions,
DeepCopy_v1beta1_NetworkPolicy,
DeepCopy_v1beta1_NetworkPolicyIngressRule,
DeepCopy_v1beta1_NetworkPolicyList,
DeepCopy_v1beta1_NetworkPolicyPeer,
DeepCopy_v1beta1_NetworkPolicyPort,
DeepCopy_v1beta1_NetworkPolicySpec,
DeepCopy_v1beta1_PodSecurityPolicy,
DeepCopy_v1beta1_PodSecurityPolicyList,
DeepCopy_v1beta1_PodSecurityPolicySpec,
@ -796,6 +802,130 @@ func DeepCopy_v1beta1_ListOptions(in ListOptions, out *ListOptions, c *conversio
return nil
}
func DeepCopy_v1beta1_NetworkPolicy(in NetworkPolicy, out *NetworkPolicy, c *conversion.Cloner) error {
if err := unversioned.DeepCopy_unversioned_TypeMeta(in.TypeMeta, &out.TypeMeta, c); err != nil {
return err
}
if err := v1.DeepCopy_v1_ObjectMeta(in.ObjectMeta, &out.ObjectMeta, c); err != nil {
return err
}
if err := DeepCopy_v1beta1_NetworkPolicySpec(in.Spec, &out.Spec, c); err != nil {
return err
}
return nil
}
func DeepCopy_v1beta1_NetworkPolicyIngressRule(in NetworkPolicyIngressRule, out *NetworkPolicyIngressRule, c *conversion.Cloner) error {
if in.Ports != nil {
in, out := in.Ports, &out.Ports
*out = make([]NetworkPolicyPort, len(in))
for i := range in {
if err := DeepCopy_v1beta1_NetworkPolicyPort(in[i], &(*out)[i], c); err != nil {
return err
}
}
} else {
out.Ports = nil
}
if in.From != nil {
in, out := in.From, &out.From
*out = make([]NetworkPolicyPeer, len(in))
for i := range in {
if err := DeepCopy_v1beta1_NetworkPolicyPeer(in[i], &(*out)[i], c); err != nil {
return err
}
}
} else {
out.From = nil
}
return nil
}
func DeepCopy_v1beta1_NetworkPolicyList(in NetworkPolicyList, out *NetworkPolicyList, c *conversion.Cloner) error {
if err := unversioned.DeepCopy_unversioned_TypeMeta(in.TypeMeta, &out.TypeMeta, c); err != nil {
return err
}
if err := unversioned.DeepCopy_unversioned_ListMeta(in.ListMeta, &out.ListMeta, c); err != nil {
return err
}
if in.Items != nil {
in, out := in.Items, &out.Items
*out = make([]NetworkPolicy, len(in))
for i := range in {
if err := DeepCopy_v1beta1_NetworkPolicy(in[i], &(*out)[i], c); err != nil {
return err
}
}
} else {
out.Items = nil
}
return nil
}
func DeepCopy_v1beta1_NetworkPolicyPeer(in NetworkPolicyPeer, out *NetworkPolicyPeer, c *conversion.Cloner) error {
if in.PodSelector != nil {
in, out := in.PodSelector, &out.PodSelector
*out = new(LabelSelector)
if err := DeepCopy_v1beta1_LabelSelector(*in, *out, c); err != nil {
return err
}
} else {
out.PodSelector = nil
}
if in.NamespaceSelector != nil {
in, out := in.NamespaceSelector, &out.NamespaceSelector
*out = new(LabelSelector)
if err := DeepCopy_v1beta1_LabelSelector(*in, *out, c); err != nil {
return err
}
} else {
out.NamespaceSelector = nil
}
return nil
}
func DeepCopy_v1beta1_NetworkPolicyPort(in NetworkPolicyPort, out *NetworkPolicyPort, c *conversion.Cloner) error {
if in.Protocol != nil {
in, out := in.Protocol, &out.Protocol
*out = new(v1.Protocol)
if newVal, err := c.DeepCopy(*in); err != nil {
return err
} else {
**out = newVal.(v1.Protocol)
}
} else {
out.Protocol = nil
}
if in.Port != nil {
in, out := in.Port, &out.Port
*out = new(intstr.IntOrString)
if err := intstr.DeepCopy_intstr_IntOrString(*in, *out, c); err != nil {
return err
}
} else {
out.Port = nil
}
return nil
}
func DeepCopy_v1beta1_NetworkPolicySpec(in NetworkPolicySpec, out *NetworkPolicySpec, c *conversion.Cloner) error {
if err := DeepCopy_v1beta1_LabelSelector(in.PodSelector, &out.PodSelector, c); err != nil {
return err
}
if in.Ingress != nil {
in, out := in.Ingress, &out.Ingress
*out = make([]NetworkPolicyIngressRule, len(in))
for i := range in {
if err := DeepCopy_v1beta1_NetworkPolicyIngressRule(in[i], &(*out)[i], c); err != nil {
return err
}
}
} else {
out.Ingress = nil
}
return nil
}
func DeepCopy_v1beta1_PodSecurityPolicy(in PodSecurityPolicy, out *PodSecurityPolicy, c *conversion.Cloner) error {
if err := unversioned.DeepCopy_unversioned_TypeMeta(in.TypeMeta, &out.TypeMeta, c); err != nil {
return err

15
pkg/apis/extensions/v1beta1/defaults.go
View File

@ -17,6 +17,7 @@ limitations under the License.
package v1beta1
import (
"k8s.io/kubernetes/pkg/api/v1"
"k8s.io/kubernetes/pkg/runtime"
"k8s.io/kubernetes/pkg/util/intstr"
)
@ -28,6 +29,7 @@ func addDefaultingFuncs(scheme *runtime.Scheme) {
SetDefaults_Job,
SetDefaults_HorizontalPodAutoscaler,
SetDefaults_ReplicaSet,
SetDefaults_NetworkPolicy,
)
}
@ -150,3 +152,16 @@ func SetDefaults_ReplicaSet(obj *ReplicaSet) {
*obj.Spec.Replicas = 1
}
}
func SetDefaults_NetworkPolicy(obj *NetworkPolicy) {
// Default any undefined Protocol fields to TCP.
for _, i := range obj.Spec.Ingress {
// TODO: Update Ports to be a pointer to slice as soon as auto-generation supports it.
for _, p := range i.Ports {
if p.Protocol == nil {
proto := v1.ProtocolTCP
p.Protocol = &proto
}
}
}
}

1105
pkg/apis/extensions/v1beta1/generated.pb.go
View File

File diff suppressed because it is too large Load Diff

87
pkg/apis/extensions/v1beta1/generated.proto
View File

@ -625,6 +625,93 @@ message ListOptions {
optional int64 timeoutSeconds = 5;
}
message NetworkPolicy {
// Standard object's metadata.
// More info: http://releases.k8s.io/HEAD/docs/devel/api-conventions.md#metadata
optional k8s.io.kubernetes.pkg.api.v1.ObjectMeta metadata = 1;
// Specification of the desired behavior for this NetworkPolicy.
optional NetworkPolicySpec spec = 2;
}
// This NetworkPolicyIngressRule matches traffic if and only if the traffic matches both ports AND from.
message NetworkPolicyIngressRule {
// List of ports which should be made accessible on the pods selected for this rule.
// Each item in this list is combined using a logical OR.
// If this field is not provided, this rule matches all ports (traffic not restricted by port).
// If this field is empty, this rule matches no ports (no traffic matches).
// If this field is present and contains at least one item, then this rule allows traffic
// only if the traffic matches at least one port in the list.
// TODO: Update this to be a pointer to slice as soon as auto-generation supports it.
repeated NetworkPolicyPort ports = 1;
// List of sources which should be able to access the pods selected for this rule.
// Items in this list are combined using a logical OR operation.
// If this field is not provided, this rule matches all sources (traffic not restricted by source).
// If this field is empty, this rule matches no sources (no traffic matches).
// If this field is present and contains at least on item, this rule allows traffic only if the
// traffic matches at least one item in the from list.
// TODO: Update this to be a pointer to slice as soon as auto-generation supports it.
repeated NetworkPolicyPeer from = 2;
}
// Network Policy List is a list of NetworkPolicy objects.
message NetworkPolicyList {
// Standard list metadata.
// More info: http://releases.k8s.io/HEAD/docs/devel/api-conventions.md#metadata
optional k8s.io.kubernetes.pkg.api.unversioned.ListMeta metadata = 1;
// Items is a list of schema objects.
repeated NetworkPolicy items = 2;
}
message NetworkPolicyPeer {
// This is a label selector which selects Pods in this namespace.
// This field follows standard label selector semantics.
// If not provided, this selector selects no pods.
// If present but empty, this selector selects all pods in this namespace.
optional LabelSelector podSelector = 1;
// Selects Namespaces using cluster scoped-labels. This
// matches all pods in all namespaces selected by this label selector.
// This field follows standard label selector semantics.
// If omited, this selector selects no namespaces.
// If present but empty, this selector selects all namespaces.
optional LabelSelector namespaceSelector = 2;
}
message NetworkPolicyPort {
// Optional. The protocol (TCP or UDP) which traffic must match.
// If not specified, this field defaults to TCP.
optional string protocol = 1;
// If specified, the port on the given protocol. This can
// either be a numerical or named port on a pod. If this field is not provided,
// this matches all port names and numbers.
// If present, only traffic on the specified protocol AND port
// will be matched.
optional k8s.io.kubernetes.pkg.util.intstr.IntOrString port = 2;
}
message NetworkPolicySpec {
// Selects the pods to which this NetworkPolicy object applies. The array of ingress rules
// is applied to any pods selected by this field. Multiple network policies can select the
// same set of pods. In this case, the ingress rules for each are combined additively.
// This field is NOT optional and follows standard label selector semantics.
// An empty podSelector matches all pods in this namespace.
optional LabelSelector podSelector = 1;
// List of ingress rules to be applied to the selected pods.
// Traffic is allowed to a pod if namespace.networkPolicy.ingress.isolation is undefined and cluster policy allows it,
// OR if the traffic source is the pod's local node,
// OR if the traffic matches at least one ingress rule across all of the NetworkPolicy
// objects whose podSelector matches the pod.
// If this field is empty then this NetworkPolicy does not affect ingress isolation.
// If this field is present and contains at least one rule, this policy allows any traffic
// which matches at least one of the ingress rules in this list.
repeated NetworkPolicyIngressRule ingress = 2;
}
// Pod Security Policy governs the ability to make requests that affect the Security Context
// that will be applied to a pod and container.
message PodSecurityPolicy {

4
pkg/apis/extensions/v1beta1/register.go
View File

@ -61,6 +61,8 @@ func addKnownTypes(scheme *runtime.Scheme) {
&ReplicaSetList{},
&PodSecurityPolicy{},
&PodSecurityPolicyList{},
&NetworkPolicy{},
&NetworkPolicyList{},
)
// Add the watch version that applies
versionedwatch.AddToGroupVersion(scheme, SchemeGroupVersion)
@ -88,3 +90,5 @@ func (obj *ReplicaSet) GetObjectKind() unversioned.ObjectKind {
func (obj *ReplicaSetList) GetObjectKind() unversioned.ObjectKind { return &obj.TypeMeta }
func (obj *PodSecurityPolicy) GetObjectKind() unversioned.ObjectKind { return &obj.TypeMeta }
func (obj *PodSecurityPolicyList) GetObjectKind() unversioned.ObjectKind { return &obj.TypeMeta }
func (obj *NetworkPolicy) GetObjectKind() unversioned.ObjectKind { return &obj.TypeMeta }
func (obj *NetworkPolicyList) GetObjectKind() unversioned.ObjectKind { return &obj.TypeMeta }

2104
pkg/apis/extensions/v1beta1/types.generated.go
View File

File diff suppressed because it is too large Load Diff

91
pkg/apis/extensions/v1beta1/types.go
View File

@ -1102,3 +1102,94 @@ type PodSecurityPolicyList struct {
// Items is a list of schema objects.
Items []PodSecurityPolicy `json:"items" protobuf:"bytes,2,rep,name=items"`
}
type NetworkPolicy struct {
unversioned.TypeMeta `json:",inline"`
// Standard object's metadata.
// More info: http://releases.k8s.io/HEAD/docs/devel/api-conventions.md#metadata
v1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
// Specification of the desired behavior for this NetworkPolicy.
Spec NetworkPolicySpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"`
}
type NetworkPolicySpec struct {
// Selects the pods to which this NetworkPolicy object applies. The array of ingress rules
// is applied to any pods selected by this field. Multiple network policies can select the
// same set of pods. In this case, the ingress rules for each are combined additively.
// This field is NOT optional and follows standard label selector semantics.
// An empty podSelector matches all pods in this namespace.
PodSelector LabelSelector `json:"podSelector" protobuf:"bytes,1,opt,name=podSelector"`
// List of ingress rules to be applied to the selected pods.
// Traffic is allowed to a pod if namespace.networkPolicy.ingress.isolation is undefined and cluster policy allows it,
// OR if the traffic source is the pod's local node,
// OR if the traffic matches at least one ingress rule across all of the NetworkPolicy
// objects whose podSelector matches the pod.
// If this field is empty then this NetworkPolicy does not affect ingress isolation.
// If this field is present and contains at least one rule, this policy allows any traffic
// which matches at least one of the ingress rules in this list.
Ingress []NetworkPolicyIngressRule `json:"ingress,omitempty" protobuf:"bytes,2,rep,name=ingress"`
}
// This NetworkPolicyIngressRule matches traffic if and only if the traffic matches both ports AND from.
type NetworkPolicyIngressRule struct {
// List of ports which should be made accessible on the pods selected for this rule.
// Each item in this list is combined using a logical OR.
// If this field is not provided, this rule matches all ports (traffic not restricted by port).
// If this field is empty, this rule matches no ports (no traffic matches).
// If this field is present and contains at least one item, then this rule allows traffic
// only if the traffic matches at least one port in the list.
// TODO: Update this to be a pointer to slice as soon as auto-generation supports it.
Ports []NetworkPolicyPort `json:"ports,omitempty" protobuf:"bytes,1,rep,name=ports"`
// List of sources which should be able to access the pods selected for this rule.
// Items in this list are combined using a logical OR operation.
// If this field is not provided, this rule matches all sources (traffic not restricted by source).
// If this field is empty, this rule matches no sources (no traffic matches).
// If this field is present and contains at least on item, this rule allows traffic only if the
// traffic matches at least one item in the from list.
// TODO: Update this to be a pointer to slice as soon as auto-generation supports it.
From []NetworkPolicyPeer `json:"from,omitempty" protobuf:"bytes,2,rep,name=from"`
}
type NetworkPolicyPort struct {
// Optional. The protocol (TCP or UDP) which traffic must match.
// If not specified, this field defaults to TCP.
Protocol *v1.Protocol `json:"protocol,omitempty" protobuf:"bytes,1,opt,name=protocol,casttype=k8s.io/kubernetes/pkg/api/v1.Protocol"`
// If specified, the port on the given protocol. This can
// either be a numerical or named port on a pod. If this field is not provided,
// this matches all port names and numbers.
// If present, only traffic on the specified protocol AND port
// will be matched.
Port *intstr.IntOrString `json:"port,omitempty" protobuf:"bytes,2,opt,name=port"`
}
type NetworkPolicyPeer struct {
// Exactly one of the following must be specified.
// This is a label selector which selects Pods in this namespace.
// This field follows standard label selector semantics.
// If not provided, this selector selects no pods.
// If present but empty, this selector selects all pods in this namespace.
PodSelector *LabelSelector `json:"podSelector,omitempty" protobuf:"bytes,1,opt,name=podSelector"`
// Selects Namespaces using cluster scoped-labels. This
// matches all pods in all namespaces selected by this label selector.
// This field follows standard label selector semantics.
// If omited, this selector selects no namespaces.
// If present but empty, this selector selects all namespaces.
NamespaceSelector *LabelSelector `json:"namespaceSelector,omitempty" protobuf:"bytes,2,opt,name=namespaceSelector"`
}
// Network Policy List is a list of NetworkPolicy objects.
type NetworkPolicyList struct {
unversioned.TypeMeta `json:",inline"`
// Standard list metadata.
// More info: http://releases.k8s.io/HEAD/docs/devel/api-conventions.md#metadata
unversioned.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
// Items is a list of schema objects.
Items []NetworkPolicy `json:"items" protobuf:"bytes,2,rep,name=items"`
}

56
pkg/apis/extensions/v1beta1/types_swagger_doc_generated.go
View File

@ -456,6 +456,62 @@ func (ListOptions) SwaggerDoc() map[string]string {
return map_ListOptions
}
var map_NetworkPolicy = map[string]string{
"metadata": "Standard object's metadata. More info: http://releases.k8s.io/HEAD/docs/devel/api-conventions.md#metadata",
"spec": "Specification of the desired behavior for this NetworkPolicy.",
}
func (NetworkPolicy) SwaggerDoc() map[string]string {
return map_NetworkPolicy
}
var map_NetworkPolicyIngressRule = map[string]string{
"": "This NetworkPolicyIngressRule matches traffic if and only if the traffic matches both ports AND from.",
"ports": "List of ports which should be made accessible on the pods selected for this rule. Each item in this list is combined using a logical OR. If this field is not provided, this rule matches all ports (traffic not restricted by port). If this field is empty, this rule matches no ports (no traffic matches). If this field is present and contains at least one item, then this rule allows traffic only if the traffic matches at least one port in the list.",
"from": "List of sources which should be able to access the pods selected for this rule. Items in this list are combined using a logical OR operation. If this field is not provided, this rule matches all sources (traffic not restricted by source). If this field is empty, this rule matches no sources (no traffic matches). If this field is present and contains at least on item, this rule allows traffic only if the traffic matches at least one item in the from list.",
}
func (NetworkPolicyIngressRule) SwaggerDoc() map[string]string {
return map_NetworkPolicyIngressRule
}
var map_NetworkPolicyList = map[string]string{
"": "Network Policy List is a list of NetworkPolicy objects.",
"metadata": "Standard list metadata. More info: http://releases.k8s.io/HEAD/docs/devel/api-conventions.md#metadata",
"items": "Items is a list of schema objects.",
}
func (NetworkPolicyList) SwaggerDoc() map[string]string {
return map_NetworkPolicyList
}
var map_NetworkPolicyPeer = map[string]string{
"podSelector": "This is a label selector which selects Pods in this namespace. This field follows standard label selector semantics. If not provided, this selector selects no pods. If present but empty, this selector selects all pods in this namespace.",
"namespaceSelector": "Selects Namespaces using cluster scoped-labels. This matches all pods in all namespaces selected by this label selector. This field follows standard label selector semantics. If omited, this selector selects no namespaces. If present but empty, this selector selects all namespaces.",
}
func (NetworkPolicyPeer) SwaggerDoc() map[string]string {
return map_NetworkPolicyPeer
}
var map_NetworkPolicyPort = map[string]string{
"protocol": "Optional. The protocol (TCP or UDP) which traffic must match. If not specified, this field defaults to TCP.",
"port": "If specified, the port on the given protocol. This can either be a numerical or named port on a pod. If this field is not provided, this matches all port names and numbers. If present, only traffic on the specified protocol AND port will be matched.",
}
func (NetworkPolicyPort) SwaggerDoc() map[string]string {
return map_NetworkPolicyPort
}
var map_NetworkPolicySpec = map[string]string{
"podSelector": "Selects the pods to which this NetworkPolicy object applies. The array of ingress rules is applied to any pods selected by this field. Multiple network policies can select the same set of pods. In this case, the ingress rules for each are combined additively. This field is NOT optional and follows standard label selector semantics. An empty podSelector matches all pods in this namespace.",
"ingress": "List of ingress rules to be applied to the selected pods. Traffic is allowed to a pod if namespace.networkPolicy.ingress.isolation is undefined and cluster policy allows it, OR if the traffic source is the pod's local node, OR if the traffic matches at least one ingress rule across all of the NetworkPolicy objects whose podSelector matches the pod. If this field is empty then this NetworkPolicy does not affect ingress isolation. If this field is present and contains at least one rule, this policy allows any traffic which matches at least one of the ingress rules in this list.",
}
func (NetworkPolicySpec) SwaggerDoc() map[string]string {
return map_NetworkPolicySpec
}
var map_PodSecurityPolicy = map[string]string{
"": "Pod Security Policy governs the ability to make requests that affect the Security Context that will be applied to a pod and container.",
"metadata": "Standard object's metadata. More info: http://releases.k8s.io/HEAD/docs/devel/api-conventions.md#metadata",

56
pkg/apis/extensions/validation/validation.go
View File

@ -19,6 +19,7 @@ package validation
import (
"fmt"
"net"
"reflect"
"regexp"
"strconv"
"strings"
@ -681,3 +682,58 @@ func ValidatePodSecurityPolicyUpdate(old *extensions.PodSecurityPolicy, new *ext
allErrs = append(allErrs, ValidatePodSecurityPolicySpec(&new.Spec, field.NewPath("spec"))...)
return allErrs
}
// ValidateNetworkPolicyName can be used to check whether the given networkpolicy
// name is valid.
func ValidateNetworkPolicyName(name string, prefix bool) []string {
return apivalidation.NameIsDNSSubdomain(name, prefix)
}
// ValidateNetworkPolicySpec tests if required fields in the networkpolicy spec are set.
func ValidateNetworkPolicySpec(spec *extensions.NetworkPolicySpec, fldPath *field.Path) field.ErrorList {
allErrs := field.ErrorList{}
allErrs = append(allErrs, unversionedvalidation.ValidateLabelSelector(&spec.PodSelector, fldPath.Child("podSelector"))...)
// Validate ingress rules.
for _, i := range spec.Ingress {
// TODO: Update From to be a pointer to slice as soon as auto-generation supports it.
for _, f := range i.From {
numFroms := 0
allErrs := field.ErrorList{}
if f.PodSelector != nil {
numFroms++
allErrs = append(allErrs, unversionedvalidation.ValidateLabelSelector(f.PodSelector, fldPath.Child("podSelector"))...)
}
if f.NamespaceSelector != nil {
if numFroms > 0 {
allErrs = append(allErrs, field.Forbidden(fldPath, "may not specify more than 1 from type"))
} else {
numFroms++
allErrs = append(allErrs, unversionedvalidation.ValidateLabelSelector(f.NamespaceSelector, fldPath.Child("namespaces"))...)
}
}
if numFroms == 0 {
// At least one of PodSelector and NamespaceSelector must be defined.
allErrs = append(allErrs, field.Required(fldPath, "must specify a from type"))
}
}
}
return allErrs
}
// ValidateNetworkPolicy validates a networkpolicy.
func ValidateNetworkPolicy(np *extensions.NetworkPolicy) field.ErrorList {
allErrs := apivalidation.ValidateObjectMeta(&np.ObjectMeta, true, ValidateNetworkPolicyName, field.NewPath("metadata"))
allErrs = append(allErrs, ValidateNetworkPolicySpec(&np.Spec, field.NewPath("spec"))...)
return allErrs
}
// ValidateNetworkPolicyUpdate tests if an update to a NetworkPolicy is valid.
func ValidateNetworkPolicyUpdate(np, oldNP *extensions.NetworkPolicy) field.ErrorList {
allErrs := field.ErrorList{}
if !reflect.DeepEqual(np, oldNP) {
allErrs = append(allErrs, field.Forbidden(field.NewPath("spec"), "updates to networkpolicy spec are forbidden."))
}
return allErrs
}

5
pkg/client/unversioned/extensions.go
View File

@ -33,6 +33,7 @@ type ExtensionsInterface interface {
DeploymentsNamespacer
JobsNamespacer
IngressNamespacer
NetworkPolicyNamespacer
ThirdPartyResourceNamespacer
ReplicaSetsNamespacer
PodSecurityPoliciesInterface
@ -69,6 +70,10 @@ func (c *ExtensionsClient) Ingress(namespace string) IngressInterface {
return newIngress(c, namespace)
}
func (c *ExtensionsClient) NetworkPolicies(namespace string) NetworkPolicyInterface {
return newNetworkPolicies(c, namespace)
}
func (c *ExtensionsClient) ThirdPartyResources() ThirdPartyResourceInterface {
return newThirdPartyResources(c)
}

92
pkg/client/unversioned/network_policys.go Normal file
View File

@ -0,0 +1,92 @@
/*
Copyright 2015 The Kubernetes Authors All rights reserved.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
package unversioned
import (
"k8s.io/kubernetes/pkg/api"
"k8s.io/kubernetes/pkg/apis/extensions"
"k8s.io/kubernetes/pkg/watch"
)
// NetworkPolicyNamespacer has methods to work with NetworkPolicy resources in a namespace
type NetworkPolicyNamespacer interface {
NetworkPolicies(namespace string) NetworkPolicyInterface
}
// NetworkPolicyInterface exposes methods to work on NetworkPolicy resources.
type NetworkPolicyInterface interface {
List(opts api.ListOptions) (*extensions.NetworkPolicyList, error)
Get(name string) (*extensions.NetworkPolicy, error)
Create(networkPolicy *extensions.NetworkPolicy) (*extensions.NetworkPolicy, error)
Update(networkPolicy *extensions.NetworkPolicy) (*extensions.NetworkPolicy, error)
Delete(name string, options *api.DeleteOptions) error
Watch(opts api.ListOptions) (watch.Interface, error)
}
// NetworkPolicies implements NetworkPolicyNamespacer interface
type NetworkPolicies struct {
r *ExtensionsClient
ns string
}
// newNetworkPolicies returns a NetworkPolicies
func newNetworkPolicies(c *ExtensionsClient, namespace string) *NetworkPolicies {
return &NetworkPolicies{c, namespace}
}
// List returns a list of networkPolicy that match the label and field selectors.
func (c *NetworkPolicies) List(opts api.ListOptions) (result *extensions.NetworkPolicyList, err error) {
result = &extensions.NetworkPolicyList{}
err = c.r.Get().Namespace(c.ns).Resource("networkpolicies").VersionedParams(&opts, api.ParameterCodec).Do().Into(result)
return
}
// Get returns information about a particular networkPolicy.
func (c *NetworkPolicies) Get(name string) (result *extensions.NetworkPolicy, err error) {
result = &extensions.NetworkPolicy{}
err = c.r.Get().Namespace(c.ns).Resource("networkpolicies").Name(name).Do().Into(result)
return
}
// Create creates a new networkPolicy.
func (c *NetworkPolicies) Create(networkPolicy *extensions.NetworkPolicy) (result *extensions.NetworkPolicy, err error) {
result = &extensions.NetworkPolicy{}
err = c.r.Post().Namespace(c.ns).Resource("networkpolicies").Body(networkPolicy).Do().Into(result)
return
}
// Update updates an existing networkPolicy.
func (c *NetworkPolicies) Update(networkPolicy *extensions.NetworkPolicy) (result *extensions.NetworkPolicy, err error) {
result = &extensions.NetworkPolicy{}
err = c.r.Put().Namespace(c.ns).Resource("networkpolicies").Name(networkPolicy.Name).Body(networkPolicy).Do().Into(result)
return
}
// Delete deletes a networkPolicy, returns error if one occurs.
func (c *NetworkPolicies) Delete(name string, options *api.DeleteOptions) (err error) {
return c.r.Delete().Namespace(c.ns).Resource("networkpolicies").Name(name).Body(options).Do().Error()
}
// Watch returns a watch.Interface that watches the requested networkPolicy.
func (c *NetworkPolicies) Watch(opts api.ListOptions) (watch.Interface, error) {
return c.r.Get().
Prefix("watch").
Namespace(c.ns).
Resource("networkpolicies").
VersionedParams(&opts, api.ParameterCodec).
Watch()
}

75
pkg/client/unversioned/testclient/fake_network_policies.go Normal file
View File

@ -0,0 +1,75 @@
/*
Copyright 2015 The Kubernetes Authors All rights reserved.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
package testclient
import (
"k8s.io/kubernetes/pkg/api"
"k8s.io/kubernetes/pkg/apis/extensions"
kclientlib "k8s.io/kubernetes/pkg/client/unversioned"
"k8s.io/kubernetes/pkg/watch"
)
// FakeNetworkPolicies implements NetworkPolicyInterface. Meant to be embedded into a struct to get a default
// implementation. This makes faking out just the method you want to test easier.
type FakeNetworkPolicies struct {
Fake *FakeExperimental
Namespace string
}
// Ensure statically that FakeNetworkPolicies implements NetworkPolicyInterface.
var _ kclientlib.NetworkPolicyInterface = &FakeNetworkPolicies{}
func (c *FakeNetworkPolicies) Get(name string) (*extensions.NetworkPolicy, error) {
obj, err := c.Fake.Invokes(NewGetAction("networkpolicies", c.Namespace, name), &extensions.NetworkPolicy{})
if obj == nil {
return nil, err
}
return obj.(*extensions.NetworkPolicy), err
}
func (c *FakeNetworkPolicies) List(opts api.ListOptions) (*extensions.NetworkPolicyList, error) {
obj, err := c.Fake.Invokes(NewListAction("networkpolicies", c.Namespace, opts), &extensions.NetworkPolicyList{})
if obj == nil {
return nil, err
}
return obj.(*extensions.NetworkPolicyList), err
}
func (c *FakeNetworkPolicies) Create(np *extensions.NetworkPolicy) (*extensions.NetworkPolicy, error) {
obj, err := c.Fake.Invokes(NewCreateAction("networkpolicies", c.Namespace, np), &extensions.NetworkPolicy{})
if obj == nil {
return nil, err
}
return obj.(*extensions.NetworkPolicy), err
}
func (c *FakeNetworkPolicies) Update(np *extensions.NetworkPolicy) (*extensions.NetworkPolicy, error) {
obj, err := c.Fake.Invokes(NewUpdateAction("networkpolicies", c.Namespace, np), &extensions.NetworkPolicy{})
if obj == nil {
return nil, err
}
return obj.(*extensions.NetworkPolicy), err
}
func (c *FakeNetworkPolicies) Delete(name string, options *api.DeleteOptions) error {
_, err := c.Fake.Invokes(NewDeleteAction("networkpolicies", c.Namespace, name), &extensions.NetworkPolicy{})
return err
}
func (c *FakeNetworkPolicies) Watch(opts api.ListOptions) (watch.Interface, error) {
return c.Fake.InvokesWatch(NewWatchAction("networkpolicies", c.Namespace, opts))
}

4
pkg/client/unversioned/testclient/testclient.go
View File

@ -378,6 +378,10 @@ func (c *FakeExperimental) ReplicaSets(namespace string) client.ReplicaSetInterf
return &FakeReplicaSets{Fake: c, Namespace: namespace}
}
func (c *FakeExperimental) NetworkPolicies(namespace string) client.NetworkPolicyInterface {
return &FakeNetworkPolicies{Fake: c, Namespace: namespace}
}
type FakeDiscovery struct {
*Fake
}

27
pkg/kubectl/describe.go
View File

@ -103,6 +103,7 @@ func describerMap(c *client.Client) map[unversioned.GroupKind]Describer {
extensions.Kind("ReplicaSet"): &ReplicaSetDescriber{c},
extensions.Kind("HorizontalPodAutoscaler"): &HorizontalPodAutoscalerDescriber{c},
extensions.Kind("NetworkPolicy"): &NetworkPolicyDescriber{c},
autoscaling.Kind("HorizontalPodAutoscaler"): &HorizontalPodAutoscalerDescriber{c},
extensions.Kind("DaemonSet"): &DaemonSetDescriber{c},
extensions.Kind("Deployment"): &DeploymentDescriber{adapter.FromUnversionedClient(c)},
@ -2089,6 +2090,32 @@ func describeCluster(cluster *federation.Cluster) (string, error) {
fmt.Fprintf(out, " %s:\t%s\n", resource, value.String())
}
}
return nil
})
}
// NetworkPolicyDescriber generates information about a NetworkPolicy
type NetworkPolicyDescriber struct {
client.Interface
}
func (d *NetworkPolicyDescriber) Describe(namespace, name string, describerSettings DescriberSettings) (string, error) {
c := d.Extensions().NetworkPolicies(namespace)
networkPolicy, err := c.Get(name)
if err != nil {
return "", err
}
return describeNetworkPolicy(networkPolicy)
}
func describeNetworkPolicy(networkPolicy *extensions.NetworkPolicy) (string, error) {
return tabbedString(func(out io.Writer) error {
fmt.Fprintf(out, "Name:\t%s\n", networkPolicy.Name)
fmt.Fprintf(out, "Namespace:\t%s\n", networkPolicy.Namespace)
printLabelsMultiline(out, "Labels", networkPolicy.Labels)
printLabelsMultiline(out, "Annotations", networkPolicy.Annotations)
return nil
})

31
pkg/kubectl/resource_printer.go
View File

@ -444,6 +444,7 @@ var deploymentColumns = []string{"NAME", "DESIRED", "CURRENT", "UP-TO-DATE", "AV
var configMapColumns = []string{"NAME", "DATA", "AGE"}
var podSecurityPolicyColumns = []string{"NAME", "PRIV", "CAPS", "VOLUMEPLUGINS", "SELINUX", "RUNASUSER"}
var clusterColumns = []string{"NAME", "STATUS", "VERSION", "AGE"}
var networkPolicyColumns = []string{"NAME", "POD-SELECTOR", "AGE"}
// addDefaultHandlers adds print handlers for default Kubernetes types.
func (h *HumanReadablePrinter) addDefaultHandlers() {
@ -501,6 +502,8 @@ func (h *HumanReadablePrinter) addDefaultHandlers() {
h.Handler(thirdPartyResourceDataColumns, printThirdPartyResourceDataList)
h.Handler(clusterColumns, printCluster)
h.Handler(clusterColumns, printClusterList)
h.Handler(networkPolicyColumns, printNetworkPolicy)
h.Handler(networkPolicyColumns, printNetworkPolicyList)
}
func (h *HumanReadablePrinter) unknown(data []byte, w io.Writer) error {
@ -1775,6 +1778,34 @@ func printPodSecurityPolicyList(list *extensions.PodSecurityPolicyList, w io.Wri
return nil
}
func printNetworkPolicy(networkPolicy *extensions.NetworkPolicy, w io.Writer, options PrintOptions) error {
name := networkPolicy.Name
namespace := networkPolicy.Namespace
if options.WithNamespace {
if _, err := fmt.Fprintf(w, "%s\t", namespace); err != nil {
return err
}
}
if _, err := fmt.Fprintf(w, "%s\t%v\t%s", name, unversioned.FormatLabelSelector(&networkPolicy.Spec.PodSelector), translateTimestamp(networkPolicy.CreationTimestamp)); err != nil {
return err
}
if _, err := fmt.Fprint(w, appendLabels(networkPolicy.Labels, options.ColumnLabels)); err != nil {
return err
}
_, err := fmt.Fprint(w, appendAllLabels(options.ShowLabels, networkPolicy.Labels))
return err
}
func printNetworkPolicyList(list *extensions.NetworkPolicyList, w io.Writer, options PrintOptions) error {
for i := range list.Items {
if err := printNetworkPolicy(&list.Items[i], w, options); err != nil {
return err
}
}
return nil
}
func appendLabels(itemLabels map[string]string, columnLabels []string) string {
var buffer bytes.Buffer

7
pkg/master/master.go
View File

@ -63,6 +63,7 @@ import (
limitrangeetcd "k8s.io/kubernetes/pkg/registry/limitrange/etcd"
"k8s.io/kubernetes/pkg/registry/namespace"
namespaceetcd "k8s.io/kubernetes/pkg/registry/namespace/etcd"
networkpolicyetcd "k8s.io/kubernetes/pkg/registry/networkpolicy/etcd"
"k8s.io/kubernetes/pkg/registry/node"
nodeetcd "k8s.io/kubernetes/pkg/registry/node/etcd"
pvetcd "k8s.io/kubernetes/pkg/registry/persistentvolume/etcd"
@ -845,6 +846,10 @@ func (m *Master) getExtensionResources(c *Config) map[string]rest.Storage {
storage["replicasets/status"] = replicaSetStorage.Status
storage["replicasets/scale"] = replicaSetStorage.Scale
}
networkPolicyStorage := networkpolicyetcd.NewREST(restOptions("networkpolicies"))
if c.APIResourceConfigSource.ResourceEnabled(version.WithResource("networkpolicies")) {
storage["networkpolicies"] = networkPolicyStorage
}
return storage
}
@ -888,7 +893,7 @@ func (m *Master) getPolicyResources(c *Config) map[string]rest.Storage {
return storage
}
// getPetSetResources returns the resources for apps api
// getAppsResources returns the resources for apps api
func (m *Master) getAppsResources(c *Config) map[string]rest.Storage {
// TODO update when we support more than one version of this group
version := appsapi.SchemeGroupVersion

2
pkg/registry/cachesize/cachesize.go
View File

@ -39,6 +39,7 @@ const (
Jobs Resource = "jobs"
LimitRanges Resource = "limitranges"
Namespaces Resource = "namespaces"
NetworkPolicys Resource = "networkpolicies"
Nodes Resource = "nodes"
PersistentVolumes Resource = "persistentvolumes"
PersistentVolumeClaims Resource = "persistentvolumeclaims"
@ -66,6 +67,7 @@ func init() {
watchCacheSizes[Jobs] = 100
watchCacheSizes[LimitRanges] = 100
watchCacheSizes[Namespaces] = 100
watchCacheSizes[NetworkPolicys] = 100
watchCacheSizes[Nodes] = 1000
watchCacheSizes[PersistentVolumes] = 100
watchCacheSizes[PersistentVolumeClaims] = 100

17
pkg/registry/networkpolicy/doc.go Normal file
View File

@ -0,0 +1,17 @@
/*
Copyright 2015 The Kubernetes Authors All rights reserved.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
package networkpolicy

80
pkg/registry/networkpolicy/etcd/etcd.go Normal file
View File

@ -0,0 +1,80 @@
/*
Copyright 2015 The Kubernetes Authors All rights reserved.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
package etcd
import (
"k8s.io/kubernetes/pkg/api"
extensionsapi "k8s.io/kubernetes/pkg/apis/extensions"
"k8s.io/kubernetes/pkg/fields"
"k8s.io/kubernetes/pkg/labels"
"k8s.io/kubernetes/pkg/registry/cachesize"
"k8s.io/kubernetes/pkg/registry/generic"
"k8s.io/kubernetes/pkg/registry/generic/registry"
"k8s.io/kubernetes/pkg/registry/networkpolicy"
"k8s.io/kubernetes/pkg/runtime"
)
// rest implements a RESTStorage for network policies against etcd
type REST struct {
*registry.Store
}
// NewREST returns a RESTStorage object that will work against network policies.
func NewREST(opts generic.RESTOptions) *REST {
prefix := "/networkpolicies"
newListFunc := func() runtime.Object { return &extensionsapi.NetworkPolicyList{} }
storageInterface := opts.Decorator(
opts.Storage, cachesize.GetWatchCacheSizeByResource(cachesize.NetworkPolicys), &extensionsapi.NetworkPolicy{}, prefix, networkpolicy.Strategy, newListFunc)
store := &registry.Store{
NewFunc: func() runtime.Object { return &extensionsapi.NetworkPolicy{} },
// NewListFunc returns an object capable of storing results of an etcd list.
NewListFunc: newListFunc,
// Produces a NetworkPolicy that etcd understands, to the root of the resource
// by combining the namespace in the context with the given prefix
KeyRootFunc: func(ctx api.Context) string {
return registry.NamespaceKeyRootFunc(ctx, prefix)
},
// Produces a NetworkPolicy that etcd understands, to the resource by combining
// the namespace in the context with the given prefix
KeyFunc: func(ctx api.Context, name string) (string, error) {
return registry.NamespaceKeyFunc(ctx, prefix, name)
},
// Retrieve the name field of a network policy
ObjectNameFunc: func(obj runtime.Object) (string, error) {
return obj.(*extensionsapi.NetworkPolicy).Name, nil
},
// Used to match objects based on labels/fields for list and watch
PredicateFunc: func(label labels.Selector, field fields.Selector) generic.Matcher {
return networkpolicy.MatchNetworkPolicy(label, field)
},
QualifiedResource: extensionsapi.Resource("networkpolicies"),
DeleteCollectionWorkers: opts.DeleteCollectionWorkers,
// Used to validate controller creation
CreateStrategy: networkpolicy.Strategy,
// Used to validate controller updates
UpdateStrategy: networkpolicy.Strategy,
DeleteStrategy: networkpolicy.Strategy,
Storage: storageInterface,
}
return &REST{store}
}

112
pkg/registry/networkpolicy/strategy.go Normal file
View File

@ -0,0 +1,112 @@
/*
Copyright 2014 The Kubernetes Authors All rights reserved.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
package networkpolicy
import (
"fmt"
"reflect"
"k8s.io/kubernetes/pkg/api"
"k8s.io/kubernetes/pkg/apis/extensions"
"k8s.io/kubernetes/pkg/apis/extensions/validation"
"k8s.io/kubernetes/pkg/fields"
"k8s.io/kubernetes/pkg/labels"
"k8s.io/kubernetes/pkg/registry/generic"
"k8s.io/kubernetes/pkg/runtime"
"k8s.io/kubernetes/pkg/util/validation/field"
)
// networkPolicyStrategy implements verification logic for NetworkPolicys.
type networkPolicyStrategy struct {
runtime.ObjectTyper
api.NameGenerator
}
// Strategy is the default logic that applies when creating and updating NetworkPolicy objects.
var Strategy = networkPolicyStrategy{api.Scheme, api.SimpleNameGenerator}
// NamespaceScoped returns true because all NetworkPolicys need to be within a namespace.
func (networkPolicyStrategy) NamespaceScoped() bool {
return true
}
// PrepareForCreate clears the status of an NetworkPolicy before creation.
func (networkPolicyStrategy) PrepareForCreate(obj runtime.Object) {
networkPolicy := obj.(*extensions.NetworkPolicy)
networkPolicy.Generation = 1
}
// PrepareForUpdate clears fields that are not allowed to be set by end users on update.
func (networkPolicyStrategy) PrepareForUpdate(obj, old runtime.Object) {
newNetworkPolicy := obj.(*extensions.NetworkPolicy)
oldNetworkPolicy := old.(*extensions.NetworkPolicy)
// Any changes to the spec increment the generation number, any changes to the
// status should reflect the generation number of the corresponding object.
// See api.ObjectMeta description for more information on Generation.
if !reflect.DeepEqual(oldNetworkPolicy.Spec, newNetworkPolicy.Spec) {
newNetworkPolicy.Generation = oldNetworkPolicy.Generation + 1
}
}
// Validate validates a new NetworkPolicy.
func (networkPolicyStrategy) Validate(ctx api.Context, obj runtime.Object) field.ErrorList {
networkPolicy := obj.(*extensions.NetworkPolicy)
return validation.ValidateNetworkPolicy(networkPolicy)
}
// Canonicalize normalizes the object after validation.
func (networkPolicyStrategy) Canonicalize(obj runtime.Object) {
}
// AllowCreateOnUpdate is false for NetworkPolicy; this means you may not create one with a PUT request.
func (networkPolicyStrategy) AllowCreateOnUpdate() bool {
return false
}
// ValidateUpdate is the default update validation for an end user.
func (networkPolicyStrategy) ValidateUpdate(ctx api.Context, obj, old runtime.Object) field.ErrorList {
validationErrorList := validation.ValidateNetworkPolicy(obj.(*extensions.NetworkPolicy))
updateErrorList := validation.ValidateNetworkPolicyUpdate(obj.(*extensions.NetworkPolicy), old.(*extensions.NetworkPolicy))
return append(validationErrorList, updateErrorList...)
}
// AllowUnconditionalUpdate is the default update policy for NetworkPolicy objects.
func (networkPolicyStrategy) AllowUnconditionalUpdate() bool {
return true
}
// NetworkPolicyToSelectableFields returns a field set that represents the object.
func NetworkPolicyToSelectableFields(networkPolicy *extensions.NetworkPolicy) fields.Set {
return generic.ObjectMetaFieldsSet(networkPolicy.ObjectMeta, true)
}
// MatchNetworkPolicy is the filter used by the generic etcd backend to watch events
// from etcd to clients of the apiserver only interested in specific labels/fields.
func MatchNetworkPolicy(label labels.Selector, field fields.Selector) generic.Matcher {
return &generic.SelectionPredicate{
Label: label,
Field: field,
GetAttrs: func(obj runtime.Object) (labels.Set, fields.Set, error) {
networkPolicy, ok := obj.(*extensions.NetworkPolicy)
if !ok {
return nil, nil, fmt.Errorf("given object is not a NetworkPolicy.")
}
return labels.Set(networkPolicy.ObjectMeta.Labels), NetworkPolicyToSelectableFields(networkPolicy), nil
},
}
}