v1alpha1

package
v0.0.0-...-10c8642 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Apr 22, 2024 License: Apache-2.0 Imports: 5 Imported by: 0

Documentation

Overview

Package v1alpha1 contains API Schema definitions for the ingress-nodefw v1alpha1 API group +kubebuilder:object:generate=true +groupName=ingressnodefirewall.openshift.io

Index

Constants

This section is empty.

Variables

View Source
var (
	// GroupVersion is group version used to register these objects
	GroupVersion = schema.GroupVersion{Group: "ingressnodefirewall.openshift.io", Version: "v1alpha1"}

	// SchemeBuilder is used to add go types to the GroupVersionKind scheme
	SchemeBuilder = &scheme.Builder{GroupVersion: GroupVersion}

	// AddToScheme adds the types in this group-version to the given scheme.
	AddToScheme = SchemeBuilder.AddToScheme
)

Functions

This section is empty.

Types

type IngressNodeFirewall

type IngressNodeFirewall struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   IngressNodeFirewallSpec   `json:"spec,omitempty"`
	Status IngressNodeFirewallStatus `json:"status,omitempty"`
}

IngressNodeFirewall is the Schema for the ingressnodefirewalls API.

func (*IngressNodeFirewall) DeepCopy

func (in *IngressNodeFirewall) DeepCopy() *IngressNodeFirewall

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IngressNodeFirewall.

func (*IngressNodeFirewall) DeepCopyInto

func (in *IngressNodeFirewall) DeepCopyInto(out *IngressNodeFirewall)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*IngressNodeFirewall) DeepCopyObject

func (in *IngressNodeFirewall) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

type IngressNodeFirewallActionType

type IngressNodeFirewallActionType string

IngressNodeFirewallActionType indicates whether an IngressNodeFirewallRule allows or denies traffic. +kubebuilder:validation:Enum="Allow";"Deny"

const (
	IngressNodeFirewallAllow IngressNodeFirewallActionType = "Allow"
	IngressNodeFirewallDeny  IngressNodeFirewallActionType = "Deny"
)

type IngressNodeFirewallConfig

type IngressNodeFirewallConfig struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   IngressNodeFirewallConfigSpec   `json:"spec,omitempty"`
	Status IngressNodeFirewallConfigStatus `json:"status,omitempty"`
}

IngressNodeFirewallConfig is the Schema for the ingressnodefirewallconfigs API.

func (*IngressNodeFirewallConfig) DeepCopy

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IngressNodeFirewallConfig.

func (*IngressNodeFirewallConfig) DeepCopyInto

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*IngressNodeFirewallConfig) DeepCopyObject

func (in *IngressNodeFirewallConfig) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

type IngressNodeFirewallConfigList

type IngressNodeFirewallConfigList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []IngressNodeFirewallConfig `json:"items"`
}

IngressNodeFirewallConfigList contains a list of IngressNodeFirewallConfig.

func (*IngressNodeFirewallConfigList) DeepCopy

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IngressNodeFirewallConfigList.

func (*IngressNodeFirewallConfigList) DeepCopyInto

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*IngressNodeFirewallConfigList) DeepCopyObject

func (in *IngressNodeFirewallConfigList) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

type IngressNodeFirewallConfigSpec

type IngressNodeFirewallConfigSpec struct {
	// nodeSelector is used to select which Nodes the ingress node firewall DaemonSet will be run on.
	// + This field is using map[string]string instead of metav1.LabelSelector because it matches the daemonset NodeSelector template. Thus one cannot benefit from additional match criteria that metav1.LabelSelector provides.
	// +optional
	NodeSelector map[string]string `json:"nodeSelector,omitempty"`

	// Debug enable debug mode for ingress node firewall ebpf XDP lookup
	//+kubebuilder:default:=false
	// +optional
	Debug *bool `json:"debug,omitempty"`
}

IngressNodeFirewallConfigSpec defines the desired state of IngressNodeFirewallConfig.

func (*IngressNodeFirewallConfigSpec) DeepCopy

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IngressNodeFirewallConfigSpec.

func (*IngressNodeFirewallConfigSpec) DeepCopyInto

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type IngressNodeFirewallConfigStatus

type IngressNodeFirewallConfigStatus struct {
	// Conditions show the current state of the Ingress Node Firewall Config resource
	Conditions []metav1.Condition `json:"conditions,omitempty"`
}

IngressNodeFirewallConfigStatus defines the observed state of IngressNodeFirewallConfig.

func (*IngressNodeFirewallConfigStatus) DeepCopy

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IngressNodeFirewallConfigStatus.

func (*IngressNodeFirewallConfigStatus) DeepCopyInto

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type IngressNodeFirewallICMPRule

type IngressNodeFirewallICMPRule struct {
	// imcpType defines ICMP Type Numbers (RFC 792).
	// if configured, this field matches against the ICMP/ICMPv6 header otherwise its ignored.
	// +optional
	// +kubebuilder:validation:Maximum:=255
	// +kubebuilder:validation:Minimum:=0
	ICMPType uint8 `json:"icmpType,omitempty"`

	// icmpCode defines ICMP Code ID (RFC 792).
	// if configured, this field matches against the ICMP/ICMPv6 header otherwise its ignored.
	// +optional
	// +kubebuilder:validation:Maximum:=255
	// +kubebuilder:validation:Minimum:=0
	ICMPCode uint8 `json:"icmpCode,omitempty"`
}

IngressNodeFirewallICMPRule define ingress node firewall rule for ICMP and ICMPv6 protocols

func (*IngressNodeFirewallICMPRule) DeepCopy

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IngressNodeFirewallICMPRule.

func (*IngressNodeFirewallICMPRule) DeepCopyInto

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type IngressNodeFirewallList

type IngressNodeFirewallList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []IngressNodeFirewall `json:"items"`
}

IngressNodeFirewallList contains a list of IngressNodeFirewall.

func (*IngressNodeFirewallList) DeepCopy

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IngressNodeFirewallList.

func (*IngressNodeFirewallList) DeepCopyInto

func (in *IngressNodeFirewallList) DeepCopyInto(out *IngressNodeFirewallList)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*IngressNodeFirewallList) DeepCopyObject

func (in *IngressNodeFirewallList) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

type IngressNodeFirewallNodeState

type IngressNodeFirewallNodeState struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   IngressNodeFirewallNodeStateSpec   `json:"spec,omitempty"`
	Status IngressNodeFirewallNodeStateStatus `json:"status,omitempty"`
}

IngressNodeFirewallNodeState is the Schema for the ingressnodefirewallnodestates API.

func (*IngressNodeFirewallNodeState) DeepCopy

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IngressNodeFirewallNodeState.

func (*IngressNodeFirewallNodeState) DeepCopyInto

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*IngressNodeFirewallNodeState) DeepCopyObject

func (in *IngressNodeFirewallNodeState) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

type IngressNodeFirewallNodeStateList

type IngressNodeFirewallNodeStateList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []IngressNodeFirewallNodeState `json:"items"`
}

IngressNodeFirewallNodeStateList contains a list of IngressNodeFirewallNodeState.

func (*IngressNodeFirewallNodeStateList) DeepCopy

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IngressNodeFirewallNodeStateList.

func (*IngressNodeFirewallNodeStateList) DeepCopyInto

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*IngressNodeFirewallNodeStateList) DeepCopyObject

func (in *IngressNodeFirewallNodeStateList) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

type IngressNodeFirewallNodeStateSpec

type IngressNodeFirewallNodeStateSpec struct {
	// interfaceIngressRules is a map that matches interface names to ingress firewall policy rules that shall be
	// applied on the given interface.
	// An empty map indicates no ingress firewall rules shall be applied, i.e allow all incoming traffic.
	// +kubebuilder:validation:Required
	InterfaceIngressRules map[string][]IngressNodeFirewallRules `json:"interfaceIngressRules"`
}

IngressNodeFirewallNodeStateSpec defines the desired state of IngressNodeFirewallNodeState.

func (*IngressNodeFirewallNodeStateSpec) DeepCopy

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IngressNodeFirewallNodeStateSpec.

func (*IngressNodeFirewallNodeStateSpec) DeepCopyInto

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type IngressNodeFirewallNodeStateStatus

type IngressNodeFirewallNodeStateStatus struct {
	// syncStatus indicates if this IngressNodeFirewallNodeState object could be successfully generated
	// from the input IngressNodeFirewall objects or if any issues occurred during this object's generation.
	SyncStatus IngressNodeFirewallNodeStateSyncStatus `json:"syncStatus,omitempty"`
	// syncErrorMessage contains further information about the encountered synchronization error.
	SyncErrorMessage string `json:"syncErrorMessage,omitempty"`
}

IngressNodeFirewallNodeStateStatus defines the observed state of IngressNodeFirewallNodeState.

func (*IngressNodeFirewallNodeStateStatus) DeepCopy

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IngressNodeFirewallNodeStateStatus.

func (*IngressNodeFirewallNodeStateStatus) DeepCopyInto

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type IngressNodeFirewallNodeStateSyncStatus

type IngressNodeFirewallNodeStateSyncStatus string

IngressNodeFirewallNodeStateSyncStatus defines the various valid synchronization states for IngressNodeFirewallNodeState.

var (
	// SyncError indicates that the last synchronization attempt failed.
	SyncError IngressNodeFirewallNodeStateSyncStatus = "Error"
	// SyncOK indicates that the last synchronization attempt was a success.
	SyncOK IngressNodeFirewallNodeStateSyncStatus = "Synchronized"
)

type IngressNodeFirewallProtoRule

type IngressNodeFirewallProtoRule struct {
	// ports defines either a single port or a range of ports to apply a protocol rule too.
	// To filter a single port, set a single port as an integer value. For example ports: 80.
	// To filter a range of ports, use a "start-end" range, string format. For example ports: "80-100".
	// +optional
	Ports intstr.IntOrString `json:"ports,omitempty"`
}

IngressNodeFirewallProtoRule define ingress node firewall rule for TCP, UDP and SCTP protocols

func (*IngressNodeFirewallProtoRule) DeepCopy

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IngressNodeFirewallProtoRule.

func (*IngressNodeFirewallProtoRule) DeepCopyInto

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type IngressNodeFirewallProtocolRule

type IngressNodeFirewallProtocolRule struct {
	// order defines the order of execution of ingress firewall rules.
	// The minimum order value is 1 and the values must be unique.
	// + index 0 is used internally as catch all for unclassified packets matching the same sourceCIDR.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Minimum:=1
	Order uint32 `json:"order"`

	// protocolConfig is a discriminated union of a protocol's specific configuration for TCP, UDP, SCTP, ICMP and ICMPv6.
	// If not specified, packet matching will be based on the protocol value and protocol configuration, such as dstPort/type/code, will be ignored
	// +optional
	ProtocolConfig IngressNodeProtocolConfig `json:"protocolConfig"`

	// action can be Allow or Deny, default action is Allow.
	// +optional
	Action IngressNodeFirewallActionType `json:"action,omitempty"`
}

IngressNodeFirewallProtocolRule defines an ingress node firewall rule per protocol.

func (*IngressNodeFirewallProtocolRule) DeepCopy

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IngressNodeFirewallProtocolRule.

func (*IngressNodeFirewallProtocolRule) DeepCopyInto

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type IngressNodeFirewallRuleProtocolType

type IngressNodeFirewallRuleProtocolType string

ProtocolType defines the protocol types that are supported

const (
	// ProtocolTypeICMP refers to the ICMP protocol.
	ProtocolTypeICMP IngressNodeFirewallRuleProtocolType = "ICMP"

	// ProtocolTypeICMP6 refers to the ICMPv6 protocol.
	ProtocolTypeICMP6 IngressNodeFirewallRuleProtocolType = "ICMPv6"

	// ProtocolTypeTCP refers to the TCP protocol, for either IPv4 or IPv6.
	ProtocolTypeTCP IngressNodeFirewallRuleProtocolType = "TCP"

	// ProtocolTypeUDP refers to the UDP protocol, for either IPv4 or IPv6.
	ProtocolTypeUDP IngressNodeFirewallRuleProtocolType = "UDP"

	// ProtocolTypeSCTP refers to the SCTP protocol, for either IPv4 or IPv6.
	ProtocolTypeSCTP IngressNodeFirewallRuleProtocolType = "SCTP"
)

type IngressNodeFirewallRules

type IngressNodeFirewallRules struct {
	// sourceCIDRs defines the origin of packets that FirewallProtocolRules will be applied to.
	// +kubebuilder:validation:MinItems:=1
	SourceCIDRs []string `json:"sourceCIDRs"`
	// rules is a list of per protocol ingress node firewall rules.
	// +listType:=map
	// +listMapKey:=order
	FirewallProtocolRules []IngressNodeFirewallProtocolRule `json:"rules,omitempty"`
}

IngressNodeFirewallRules define ingress node firewall rule.

func (*IngressNodeFirewallRules) DeepCopy

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IngressNodeFirewallRules.

func (*IngressNodeFirewallRules) DeepCopyInto

func (in *IngressNodeFirewallRules) DeepCopyInto(out *IngressNodeFirewallRules)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type IngressNodeFirewallSpec

type IngressNodeFirewallSpec struct {
	// nodeSelector Selects node(s) where ingress firewall rules will be applied to.
	// +optional
	NodeSelector metav1.LabelSelector `json:"nodeSelector,omitempty"`

	// ingress is a list of ingress firewall policy rules.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinItems:=1
	Ingress []IngressNodeFirewallRules `json:"ingress"`

	// interfaces is a list of interfaces where the ingress firewall policy will be applied on.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinItems:=1
	Interfaces []string `json:"interfaces"`
}

IngressNodeFirewallSpec defines the desired state of IngressNodeFirewall.

func (*IngressNodeFirewallSpec) DeepCopy

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IngressNodeFirewallSpec.

func (*IngressNodeFirewallSpec) DeepCopyInto

func (in *IngressNodeFirewallSpec) DeepCopyInto(out *IngressNodeFirewallSpec)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type IngressNodeFirewallStatus

type IngressNodeFirewallStatus struct {
	SyncStatus IngressNodeFirewallSyncStatus `json:"syncStatus,omitempty"`
}

IngressNodeFirewallStatus defines the observed state of IngressNodeFirewall.

func (*IngressNodeFirewallStatus) DeepCopy

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IngressNodeFirewallStatus.

func (*IngressNodeFirewallStatus) DeepCopyInto

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type IngressNodeFirewallSyncStatus

type IngressNodeFirewallSyncStatus string
var (
	// FirewallRulesSyncError indicates that one or more NodeState synchronization failed.
	FirewallRulesSyncError IngressNodeFirewallSyncStatus = "Error"
	// FirewallRulesSyncOK indicates that the last synchronization attempt to all nodes with matching label was a success.
	FirewallRulesSyncOK IngressNodeFirewallSyncStatus = "Synchronized"
)

type IngressNodeProtocolConfig

type IngressNodeProtocolConfig struct {
	// protocol can be ICMP, ICMPv6, TCP, SCTP or UDP.
	// +unionDiscriminator
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Enum="ICMP";"ICMPv6";"TCP";"UDP";"SCTP";""
	Protocol IngressNodeFirewallRuleProtocolType `json:"protocol"`

	// tcp defines an ingress node firewall rule for TCP protocol.
	// +unionMember
	// +optional
	TCP *IngressNodeFirewallProtoRule `json:"tcp,omitempty"`

	// udp defines an ingress node firewall rule for UDP protocol.
	// +unionMember
	// +optional
	UDP *IngressNodeFirewallProtoRule `json:"udp,omitempty"`

	// sctp defines an ingress node firewall rule for SCTP protocol.
	// +unionMember
	// +optional
	SCTP *IngressNodeFirewallProtoRule `json:"sctp,omitempty"`

	// icmp defines an ingress node firewall rule for ICMP protocol.
	// +unionMember
	// +optional
	ICMP *IngressNodeFirewallICMPRule `json:"icmp,omitempty"`

	// icmpv6 defines an ingress node firewall rule for ICMPv6 protocol.
	// +unionMember
	// +optional
	ICMPv6 *IngressNodeFirewallICMPRule `json:"icmpv6,omitempty"`
}

IngressNodeProtocolConfig is a discriminated union of protocol's specific configuration. +union +kubebuilder:validation:XValidation:rule="has(self.protocol) && self.protocol == 'TCP' ? has(self.tcp) : !has(self.tcp)",message="tcp is required when protocol is TCP, and forbidden otherwise" +kubebuilder:validation:XValidation:rule="has(self.protocol) && self.protocol == 'UDP' ? has(self.udp) : !has(self.udp)",message="udp is required when protocol is UDP, and forbidden otherwise" +kubebuilder:validation:XValidation:rule="has(self.protocol) && self.protocol == 'SCTP' ? has(self.sctp) : !has(self.sctp)",message="sctp is required when protocol is SCTP, and forbidden otherwise" +kubebuilder:validation:XValidation:rule="has(self.protocol) && self.protocol == 'ICMP' ? has(self.icmp) : !has(self.icmp)",message="icmp is required when protocol is ICMP, and forbidden otherwise" +kubebuilder:validation:XValidation:rule="has(self.protocol) && self.protocol == 'ICMPv6' ? has(self.icmpv6) : !has(self.icmpv6)",message="icmpv6 is required when protocol is ICMPv6, and forbidden otherwise"

func (*IngressNodeProtocolConfig) DeepCopy

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IngressNodeProtocolConfig.

func (*IngressNodeProtocolConfig) DeepCopyInto

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL