policy: Validate ServerAuthorization resources (#8076)

`ServerAuthorization` resources are not validated by the admission
controller.

This change enables validation for `ServerAuthorization` resources,
based on changes to the admission controller proposed as a part of
#8007. This admission controller is generalized to
support arbitrary resource types. The `ServerAuthoriation` validation
currently only ensures that network blocks are valid CIDRs and that they
are coherent. We use the new _schemars_ feature of `ipnet` v2.4.0 to
support using IpNet data structures directly in the custom resource
type bindings.

This change also adds an integration test to validate that the admission
controller behaves as expected.

Signed-off-by: Oliver Gould <ver@buoyant.io>
(cherry picked from commit c445c72)
Signed-off-by: Oliver Gould <ver@buoyant.io>

Cargo.lock

@@ -612,6 +612,10 @@ name = "ipnet"
 version = "2.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "35e70ee094dc02fd9c13fdad4940090f22dbd6ac7c9e7094a46cf0232a50bc7c"
+dependencies = [
+ "schemars",
+ "serde",
+]
 
 [[package]]
 name = "itertools"
@@ -852,10 +856,12 @@ name = "linkerd-policy-controller"
 version = "0.1.0"
 dependencies = [
  "anyhow",
+ "async-trait",
  "clap",
  "drain",
  "futures",
  "hyper",
+ "ipnet",
  "jemallocator",
  "k8s-openapi",
  "kube",
@@ -865,6 +871,7 @@ dependencies = [
  "linkerd-policy-controller-k8s-api",
  "linkerd-policy-controller-k8s-index",
  "parking_lot 0.12.0",
+ "serde",
  "serde_json",
  "thiserror",
  "tokio",
@@ -901,6 +908,7 @@ dependencies = [
 name = "linkerd-policy-controller-k8s-api"
 version = "0.1.0"
 dependencies = [
+ "ipnet",
  "k8s-openapi",
  "kube",
  "schemars",
@@ -939,7 +947,9 @@ dependencies = [
  "kube",
  "linkerd-policy-controller-k8s-api",
  "rand",
+ "schemars",
  "serde",
+ "serde_json",
  "tokio",
  "tokio-test",
  "tracing",

charts/linkerd2/templates/destination-rbac.yaml

@@ -150,7 +150,9 @@ webhooks:
   - operations: ["CREATE", "UPDATE"]
     apiGroups: ["policy.linkerd.io"]
     apiVersions: ["v1alpha1", "v1beta1"]
-    resources: ["servers"]
+    resources:
+    - serverauthorizations
+    - servers
   sideEffects: None
 ---
 apiVersion: rbac.authorization.k8s.io/v1

policy-controller/Cargo.toml

@@ -12,16 +12,19 @@ rustls-tls = ["kube/rustls-tls"]
 
 [dependencies]
 anyhow = "1"
+async-trait = "0.1"
 clap = { version = "3", default-features = false, features = ["derive", "env", "std"] }
 drain = "0.1"
 futures = { version = "0.3", default-features = false }
 k8s-openapi = { version = "0.14", features = ["v1_20"] }
 hyper = { version = "0.14", features = ["http1", "http2", "runtime", "server"] }
+ipnet = { version = "2", default-features = false }
 linkerd-policy-controller-core = { path = "./core" }
 linkerd-policy-controller-grpc = { path = "./grpc" }
 linkerd-policy-controller-k8s-index = { path = "./k8s/index" }
 linkerd-policy-controller-k8s-api = { path = "./k8s/api" }
 parking_lot = "0.12"
+serde = "1"
 serde_json = "1"
 thiserror = "1"
 tracing = "0.1"

policy-controller/k8s/api/Cargo.toml

@@ -8,6 +8,7 @@ publish = false
 [dependencies]
 k8s-openapi = { version = "0.14", default-features = false, features = ["v1_16"] }
 kube = { version = "0.69", default-features = false, features = ["client", "derive", "runtime"] }
+ipnet = { version = "2.4", features = ["json"] }
 schemars = "0.8"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"

policy-controller/k8s/api/src/policy/server_authorization.rs

@@ -1,4 +1,5 @@
 use super::super::labels;
+use ipnet::IpNet;
 use kube::CustomResource;
 use schemars::JsonSchema;
 use serde::{Deserialize, Serialize};
@@ -56,8 +57,8 @@ pub struct MeshTls {
 
 #[derive(Deserialize, Serialize, Clone, Debug, JsonSchema)]
 pub struct Network {
-    pub cidr: String,
-    pub except: Option<Vec<String>>,
+    pub cidr: IpNet,
+    pub except: Option<Vec<IpNet>>,
 }
 
 /// References a Kubernetes `ServiceAccount` instance.

policy-controller/k8s/index/src/server_authorization.rs

@@ -3,7 +3,7 @@ use ahash::{AHashMap as HashMap, AHashSet as HashSet};
 use anyhow::{anyhow, bail, Result};
 use futures::prelude::*;
 use linkerd_policy_controller_core::{
-    ClientAuthentication, ClientAuthorization, IdentityMatch, IpNet, NetworkMatch,
+    ClientAuthentication, ClientAuthorization, IdentityMatch, NetworkMatch,
 };
 use linkerd_policy_controller_k8s_api::{
     self as k8s,
@@ -189,15 +189,12 @@ fn mk_server_authz(
 
     let networks = if let Some(nets) = spec.client.networks {
         nets.into_iter()
-            .map(|policy::server_authorization::Network { cidr, except }| {
-                let net = cidr.parse::<IpNet>()?;
-                debug!(%net, "Unauthenticated");
-                let except = except
-                    .into_iter()
-                    .flatten()
-                    .map(|cidr| cidr.parse().map_err(Into::into))
-                    .collect::<Result<Vec<IpNet>>>()?;
-                Ok(NetworkMatch { net, except })
+            .map(|net| {
+                debug!(net = %net.cidr, "Unauthenticated");
+                Ok(NetworkMatch {
+                    net: net.cidr,
+                    except: net.except.unwrap_or_default(),
+                })
             })
             .collect::<Result<Vec<NetworkMatch>>>()?
     } else {