-
Notifications
You must be signed in to change notification settings - Fork 1.3k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Issue #7709 proposes new Custom Resource types to support generalized authorization policies: - `AuthorizationPolicy` - `MeshTLSAuthentication` - `NetworkAuthentication` This change introduces these CRDs to the default linkerd installation (via the `linkerd-crds` chart) and updates the policy controller's admission webhook to validate these resource types. This change does NOT update the policy controller to actually honor these resources when serving policy configuration to proxies. This change adds policy-controller integration tests to exercise the admission controller & CRD validation logic. These tests are implemented in the `policy-test` crate. Signed-off-by: Oliver Gould <ver@buoyant.io>
- Loading branch information
Showing
46 changed files
with
4,865 additions
and
97 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
101 changes: 101 additions & 0 deletions
101
charts/linkerd-crds/templates/policy/authorizationpolicy.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,101 @@ | ||
|
|
||
| --- | ||
| apiVersion: apiextensions.k8s.io/v1 | ||
| kind: CustomResourceDefinition | ||
| metadata: | ||
| name: authorizationpolicies.policy.linkerd.io | ||
| annotations: | ||
| {{ include "partials.annotations.created-by" . }} | ||
| labels: | ||
| helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version }} | ||
| linkerd.io/control-plane-ns: {{.Release.Namespace}} | ||
| spec: | ||
| group: policy.linkerd.io | ||
| scope: Namespaced | ||
| names: | ||
| kind: AuthorizationPolicy | ||
| plural: authorizationpolicies | ||
| singular: authorizationpolicy | ||
| shortNames: [] | ||
| versions: | ||
| - name: v1alpha1 | ||
| served: true | ||
| storage: true | ||
| schema: | ||
| openAPIV3Schema: | ||
| type: object | ||
| required: [spec] | ||
| properties: | ||
| spec: | ||
| description: >- | ||
| Authorizes clients to communicate with Linkerd-proxied servers. | ||
| type: object | ||
| required: [targetRef, requiredAuthenticationRefs] | ||
| properties: | ||
| targetRef: | ||
| description: >- | ||
| TODO ... | ||
| type: object | ||
| # Modified from the gateway API. | ||
| # Copyright 2020 The Kubernetes Authors | ||
| properties: | ||
| group: | ||
| description: >- | ||
| Group is the group of the referent. When empty, the Kubernetes core API | ||
| group is inferred. | ||
| maxLength: 253 | ||
| pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ | ||
| type: string | ||
| kind: | ||
| description: >- | ||
| Kind is the kind of the referent. | ||
| maxLength: 63 | ||
| minLength: 1 | ||
| pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ | ||
| type: string | ||
| name: | ||
| description: Name is the name of the referent. | ||
| maxLength: 253 | ||
| minLength: 1 | ||
| type: string | ||
| required: | ||
| - kind | ||
| - name | ||
| requiredAuthenticationRefs: | ||
| description: >- | ||
| RequiredAuthenticationRefs enumerates a set of required authentications | ||
| type: array | ||
| items: | ||
| type: object | ||
| properties: | ||
| group: | ||
| description: >- | ||
| Group is the group of the referent. When empty, the Kubernetes core API | ||
| group is inferred." | ||
| maxLength: 253 | ||
| pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ | ||
| type: string | ||
| kind: | ||
| description: >- | ||
| Kind is the kind of the referent. | ||
| maxLength: 63 | ||
| minLength: 1 | ||
| pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ | ||
| type: string | ||
| name: | ||
| description: >- | ||
| Name is the name of the referent. When unspecified, this authentication | ||
| refers to all resources of the specified Group and Kind in the specified | ||
| namespace. | ||
| maxLength: 253 | ||
| minLength: 1 | ||
| type: string | ||
| namespace: | ||
| description: >- | ||
| Name is the name of the referent. When unspecified, this authentication | ||
| refers to the local namespace. | ||
| maxLength: 253 | ||
| type: string | ||
| required: | ||
| - kind | ||
| - name |
Oops, something went wrong.