Add NetworkPolicy type and controller

Makefile

@@ -112,7 +112,7 @@ ENVTEST_ASSETS_DIR=$(shell pwd)/testbin
 test-only: envtest ## Only run tests.
 	KUBEBUILDER_ASSETS="$(shell $(ENVTEST) use $(ENVTEST_K8S_VERSION) -p path)" go test ./... -coverprofile cover.out
 
-.PHONY: openapi-extractor
+.PHONY: extract-openapi
 extract-openapi: envtest openapi-extractor
 	KUBEBUILDER_ASSETS="$(shell $(ENVTEST) use $(ENVTEST_K8S_VERSION) -p path)" $(OPENAPI_EXTRACTOR) \
 		--apiserver-package="github.com/ironcore-dev/ironcore-net/cmd/apiserver" \

api/core/v1alpha1/common_types.go

@@ -3,6 +3,11 @@
 
 package v1alpha1
 
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+)
+
 const (
 	ReconcileRequestAnnotation = "reconcile.apinet.ironcore.dev/requestedAt"
 
@@ -28,3 +33,20 @@ func APINetletCommonName(name string) string {
 func MetalnetletCommonName(name string) string {
 	return MetalnetletUserNamePrefix + name
 }
+
+// ObjectSelector specifies how to select objects of a certain kind.
+type ObjectSelector struct {
+	// Kind is the kind of object to select.
+	Kind string `json:"kind"`
+	// LabelSelector is the label selector to select objects of the specified Kind by.
+	metav1.LabelSelector `json:",inline"`
+}
+
+// LocalUIDReference is a reference to another entity including its UID
+// +structType=atomic
+type LocalUIDReference struct {
+	// Name is the name of the referenced entity.
+	Name string `json:"name"`
+	// UID is the UID of the referenced entity.
+	UID types.UID `json:"uid"`
+}

api/core/v1alpha1/networkpolicy_types.go

@@ -0,0 +1,118 @@
+// SPDX-FileCopyrightText: 2024 SAP SE or an SAP affiliate company and IronCore contributors
+// SPDX-License-Identifier: Apache-2.0
+
+package v1alpha1
+
+import (
+	"github.com/ironcore-dev/ironcore-net/apimachinery/api/net"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+type NetworkPolicySpec struct {
+	// NetworkRef is the network to regulate using this policy.
+	NetworkRef corev1.LocalObjectReference `json:"networkRef"`
+	// NetworkInterfaceSelector selects the network interfaces that are subject to this policy.
+	NetworkInterfaceSelector metav1.LabelSelector `json:"networkInterfaceSelector"`
+	// Priority is an optional field that specifies the order in which the policy is applied.
+	// Policies with higher "order" are applied after those with lower
+	// order.  If the order is omitted, it may be considered to be "infinite" - i.e. the
+	// policy will be applied last.  Policies with identical order will be applied in
+	// alphanumerical order based on the Policy "Name".
+	Priority *int32 `json:"priority,omitempty"`
+	// Ingress specifies rules for ingress traffic.
+	Ingress []NetworkPolicyIngressRule `json:"ingress,omitempty"`
+	// Egress specifies rules for egress traffic.
+	Egress []NetworkPolicyEgressRule `json:"egress,omitempty"`
+	// PolicyTypes specifies the types of policies this network policy contains.
+	PolicyTypes []PolicyType `json:"policyTypes,omitempty"`
+}
+
+// NetworkPolicyPort describes a port to allow traffic on
+type NetworkPolicyPort struct {
+	// Protocol (TCP, UDP, or SCTP) which traffic must match. If not specified, this
+	// field defaults to TCP.
+	Protocol *corev1.Protocol `json:"protocol,omitempty"`
+
+	// The port on the given protocol. If this field is not provided, this matches
+	// all port names and numbers.
+	// If present, only traffic on the specified protocol AND port will be matched.
+	Port int32 `json:"port,omitempty"`
+
+	// EndPort indicates that the range of ports from Port to EndPort, inclusive,
+	// should be allowed by the policy. This field cannot be defined if the port field
+	// is not defined. The endPort must be equal or greater than port.
+	EndPort *int32 `json:"endPort,omitempty" protobuf:"bytes,3,opt,name=endPort"`
+}
+
+// IPBlock specifies an ip block with optional exceptions.
+type IPBlock struct {
+	// CIDR is a string representing the ip block.
+	CIDR net.IPPrefix `json:"cidr"`
+	// Except is a slice of CIDRs that should not be included within the specified CIDR.
+	// Values will be rejected if they are outside CIDR.
+	Except []net.IPPrefix `json:"except,omitempty"`
+}
+
+// NetworkPolicyPeer describes a peer to allow traffic to / from.
+type NetworkPolicyPeer struct {
+	// ObjectSelector selects peers with the given kind matching the label selector.
+	// Exclusive with other peer specifiers.
+	ObjectSelector *ObjectSelector `json:"objectSelector,omitempty"`
+	// IPBlock specifies the ip block from or to which network traffic may come.
+	IPBlock *IPBlock `json:"ipBlock,omitempty"`
+}
+
+// NetworkPolicyIngressRule describes a rule to regulate ingress traffic with.
+type NetworkPolicyIngressRule struct {
+	// From specifies the list of sources which should be able to send traffic to the
+	// selected network interfaces. Fields are combined using a logical OR. Empty matches all sources.
+	// As soon as a single item is present, only these peers are allowed.
+	From []NetworkPolicyPeer `json:"from,omitempty"`
+	// Ports specifies the list of ports which should be made accessible for
+	// this rule. Each item in this list is combined using a logical OR. Empty matches all ports.
+	// As soon as a single item is present, only these ports are allowed.
+	Ports []NetworkPolicyPort `json:"ports,omitempty"`
+}
+
+// NetworkPolicyEgressRule describes a rule to regulate egress traffic with.
+type NetworkPolicyEgressRule struct {
+	// Ports specifies the list of destination ports that can be called with
+	// this rule. Each item in this list is combined using a logical OR. Empty matches all ports.
+	// As soon as a single item is present, only these ports are allowed.
+	Ports []NetworkPolicyPort `json:"ports,omitempty"`
+	// To specifies the list of destinations which the selected network interfaces should be
+	// able to send traffic to. Fields are combined using a logical OR. Empty matches all destinations.
+	// As soon as a single item is present, only these peers are allowed.
+	To []NetworkPolicyPeer `json:"to,omitempty"`
+}
+
+// PolicyType is a type of policy.
+type PolicyType string
+
+const (
+	// PolicyTypeIngress is a policy that describes ingress traffic.
+	PolicyTypeIngress PolicyType = "Ingress"
+	// PolicyTypeEgress is a policy that describes egress traffic.
+	PolicyTypeEgress PolicyType = "Egress"
+)
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+// +genclient
+
+// NetworkPolicy is the Schema for the networkpolicies API.
+type NetworkPolicy struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	Spec NetworkPolicySpec `json:"spec,omitempty"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// NetworkPolicyList contains a list of NetworkPolicy.
+type NetworkPolicyList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []NetworkPolicy `json:"items"`
+}

api/core/v1alpha1/networkpolicyrule_types.go

@@ -0,0 +1,64 @@
+// SPDX-FileCopyrightText: 2024 SAP SE or an SAP affiliate company and IronCore contributors
+// SPDX-License-Identifier: Apache-2.0
+
+package v1alpha1
+
+import (
+	"github.com/ironcore-dev/ironcore-net/apimachinery/api/net"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+// +genclient
+
+// NetworkPolicyRule is the schema for the networkpolicyrules API.
+type NetworkPolicyRule struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	// NetworkRef is the network the load balancer is assigned to.
+	NetworkRef LocalUIDReference `json:"networkRef"`
+	// Targets are the targets of the network policy.
+	Targets []TargetNetworkInterface `json:"targets,omitempty"`
+	// Priority is an optional field that specifies the order in which the policy is applied.
+	Priority *int32 `json:"priority,omitempty"`
+	// IngressRules are the ingress rules.
+	IngressRules []Rule `json:"ingressRule,omitempty"`
+	// EgressRules are the egress rules.
+	EgressRules []Rule `json:"egressRule,omitempty"`
+}
+
+// TargetNetworkInterface is the target of the network policy.
+type TargetNetworkInterface struct {
+	// IP is the IP address of the target network interface.
+	IP net.IP `json:"ip"`
+	// TargetRef is the target providing the destination.
+	TargetRef *LocalUIDReference `json:"targetRef,omitempty"`
+}
+
+type Rule struct {
+	// CIDRBlock specifies the CIDR block from which network traffic may come or go.
+	CIDRBlock []IPBlock `json:"ipBlock,omitempty"`
+	// ObjectIPs are the object IPs the rule applies to.
+	ObjectIPs []ObjectIP `json:"ips,omitempty"`
+	// NetworkPolicyPorts are the protocol type and ports.
+	NetworkPolicyPorts []NetworkPolicyPort `json:"networkPolicyPorts,omitempty"`
+}
+
+type ObjectIP struct {
+	// IPFamily is the IPFamily of the prefix.
+	// If unset but Prefix is set, this can be inferred.
+	IPFamily corev1.IPFamily `json:"ipFamily,omitempty"`
+	// Prefix is the prefix of the IP.
+	Prefix net.IPPrefix `json:"prefix,omitempty"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// NetworkPolicyRulesList contains a list of NetworkPolicyRule.
+type NetworkPolicyRuleList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []NetworkPolicyRule `json:"items"`
+}

api/core/v1alpha1/register.go

@@ -55,6 +55,10 @@ func addKnownTypes(scheme *runtime.Scheme) error {
 		&NetworkIDList{},
 		&NetworkInterface{},
 		&NetworkInterfaceList{},
+		&NetworkPolicy{},
+		&NetworkPolicyList{},
+		&NetworkPolicyRule{},
+		&NetworkPolicyRuleList{},
 		&Node{},
 		&NodeList{},
 	)