Skip to content

Commit

Permalink
Add ClusterSet scope for toServices field of Antrea-native policies (#…
Browse files Browse the repository at this point in the history 
…4397)

Adds a scope field for toServices feature in Antrea-native policy
egress rules. When scope is set to ClusterSet, users can simply
provide the name and Namespace of the exported Service, and
Antrea will match rule with egress traffic intended for backends of
the exported Service across all clusters in the ClusterSet.
It is equivalent to putting the imported Service name (antrea-mc-
[svcName]) in toServices field without setting scope.

Signed-off-by: Dyanngg <dingyang@vmware.com>
  • Loading branch information
@Dyanngg
Dyanngg committed Dec 20, 2022
1 parent 656a1f9 commit 76ee297
Show file tree
Hide file tree
Showing 26 changed files with 327 additions and 104 deletions.
2 changes: 2 additions & 0 deletions build/charts/antrea/crds/clusternetworkpolicy.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -638,6 +638,8 @@ spec:
type: string
namespace:
type: string
scope:
type: string
name:
type: string
enableLogging:
Expand Down
2 changes: 2 additions & 0 deletions build/charts/antrea/crds/networkpolicy.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -553,6 +553,8 @@ spec:
type: string
namespace:
type: string
scope:
type: string
name:
type: string
enableLogging:
Expand Down
4 changes: 4 additions & 0 deletions build/yamls/antrea-aks.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1016,6 +1016,8 @@ spec:
type: string
namespace:
type: string
scope:
type: string
name:
type: string
enableLogging:
Expand Down Expand Up @@ -2081,6 +2083,8 @@ spec:
type: string
namespace:
type: string
scope:
type: string
name:
type: string
enableLogging:
Expand Down
4 changes: 4 additions & 0 deletions build/yamls/antrea-crds.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1009,6 +1009,8 @@ spec:
type: string
namespace:
type: string
scope:
type: string
name:
type: string
enableLogging:
Expand Down Expand Up @@ -2062,6 +2064,8 @@ spec:
type: string
namespace:
type: string
scope:
type: string
name:
type: string
enableLogging:
Expand Down
4 changes: 4 additions & 0 deletions build/yamls/antrea-eks.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1016,6 +1016,8 @@ spec:
type: string
namespace:
type: string
scope:
type: string
name:
type: string
enableLogging:
Expand Down Expand Up @@ -2081,6 +2083,8 @@ spec:
type: string
namespace:
type: string
scope:
type: string
name:
type: string
enableLogging:
Expand Down
4 changes: 4 additions & 0 deletions build/yamls/antrea-gke.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1016,6 +1016,8 @@ spec:
type: string
namespace:
type: string
scope:
type: string
name:
type: string
enableLogging:
Expand Down Expand Up @@ -2081,6 +2083,8 @@ spec:
type: string
namespace:
type: string
scope:
type: string
name:
type: string
enableLogging:
Expand Down
4 changes: 4 additions & 0 deletions build/yamls/antrea-ipsec.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1016,6 +1016,8 @@ spec:
type: string
namespace:
type: string
scope:
type: string
name:
type: string
enableLogging:
Expand Down Expand Up @@ -2081,6 +2083,8 @@ spec:
type: string
namespace:
type: string
scope:
type: string
name:
type: string
enableLogging:
Expand Down
4 changes: 4 additions & 0 deletions build/yamls/antrea.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1016,6 +1016,8 @@ spec:
type: string
namespace:
type: string
scope:
type: string
name:
type: string
enableLogging:
Expand Down Expand Up @@ -2081,6 +2083,8 @@ spec:
type: string
namespace:
type: string
scope:
type: string
name:
type: string
enableLogging:
Expand Down
80 changes: 52 additions & 28 deletions multicluster/build/yamls/antrea-multicluster-leader-global.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1438,19 +1438,25 @@ spec:
type: array
toServices:
description: Rule is matched if traffic is intended for
a Service listed in this field. Currently only ClusterIP
types Services are supported in this field. This field
can only be used when AntreaProxy is enabled. This field
can't be used with To or Ports. If this field and To are
both empty or missing, this rule matches all destinations.
a Service listed in this field. Currently, only ClusterIP
types Services are supported in this field. When scope
is set to ClusterSet, it matches traffic intended for
a multi-cluster Service listed in this field. Service
name and Namespace provided should match the original
exported Service. This field can only be used when AntreaProxy
is enabled. This field can't be used with To or Ports.
If this field and To are both empty or missing, this rule
matches all destinations.
items:
description: NamespacedName refers to a Namespace scoped
resource. All fields must be used together.
description: PeerService refers to a Service, which can
be a in-cluster Service or imported multi-cluster service.
properties:
name:
type: string
namespace:
type: string
scope:
type: string
type: object
type: array
required:
Expand Down Expand Up @@ -2320,19 +2326,25 @@ spec:
type: array
toServices:
description: Rule is matched if traffic is intended for
a Service listed in this field. Currently only ClusterIP
types Services are supported in this field. This field
can only be used when AntreaProxy is enabled. This field
can't be used with To or Ports. If this field and To are
both empty or missing, this rule matches all destinations.
a Service listed in this field. Currently, only ClusterIP
types Services are supported in this field. When scope
is set to ClusterSet, it matches traffic intended for
a multi-cluster Service listed in this field. Service
name and Namespace provided should match the original
exported Service. This field can only be used when AntreaProxy
is enabled. This field can't be used with To or Ports.
If this field and To are both empty or missing, this rule
matches all destinations.
items:
description: NamespacedName refers to a Namespace scoped
resource. All fields must be used together.
description: PeerService refers to a Service, which can
be a in-cluster Service or imported multi-cluster service.
properties:
name:
type: string
namespace:
type: string
scope:
type: string
type: object
type: array
required:
Expand Down Expand Up @@ -4118,19 +4130,25 @@ spec:
type: array
toServices:
description: Rule is matched if traffic is intended for
a Service listed in this field. Currently only ClusterIP
types Services are supported in this field. This field
can only be used when AntreaProxy is enabled. This field
can't be used with To or Ports. If this field and To are
both empty or missing, this rule matches all destinations.
a Service listed in this field. Currently, only ClusterIP
types Services are supported in this field. When scope
is set to ClusterSet, it matches traffic intended for
a multi-cluster Service listed in this field. Service
name and Namespace provided should match the original
exported Service. This field can only be used when AntreaProxy
is enabled. This field can't be used with To or Ports.
If this field and To are both empty or missing, this rule
matches all destinations.
items:
description: NamespacedName refers to a Namespace scoped
resource. All fields must be used together.
description: PeerService refers to a Service, which can
be a in-cluster Service or imported multi-cluster service.
properties:
name:
type: string
namespace:
type: string
scope:
type: string
type: object
type: array
required:
Expand Down Expand Up @@ -5000,19 +5018,25 @@ spec:
type: array
toServices:
description: Rule is matched if traffic is intended for
a Service listed in this field. Currently only ClusterIP
types Services are supported in this field. This field
can only be used when AntreaProxy is enabled. This field
can't be used with To or Ports. If this field and To are
both empty or missing, this rule matches all destinations.
a Service listed in this field. Currently, only ClusterIP
types Services are supported in this field. When scope
is set to ClusterSet, it matches traffic intended for
a multi-cluster Service listed in this field. Service
name and Namespace provided should match the original
exported Service. This field can only be used when AntreaProxy
is enabled. This field can't be used with To or Ports.
If this field and To are both empty or missing, this rule
matches all destinations.
items:
description: NamespacedName refers to a Namespace scoped
resource. All fields must be used together.
description: PeerService refers to a Service, which can
be a in-cluster Service or imported multi-cluster service.
properties:
name:
type: string
namespace:
type: string
scope:
type: string
type: object
type: array
required:
Expand Down
40 changes: 26 additions & 14 deletions multicluster/config/crd/bases/multicluster.crd.antrea.io_resourceexports.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1133,19 +1133,25 @@ spec:
type: array
toServices:
description: Rule is matched if traffic is intended for
a Service listed in this field. Currently only ClusterIP
types Services are supported in this field. This field
can only be used when AntreaProxy is enabled. This field
can't be used with To or Ports. If this field and To are
both empty or missing, this rule matches all destinations.
a Service listed in this field. Currently, only ClusterIP
types Services are supported in this field. When scope
is set to ClusterSet, it matches traffic intended for
a multi-cluster Service listed in this field. Service
name and Namespace provided should match the original
exported Service. This field can only be used when AntreaProxy
is enabled. This field can't be used with To or Ports.
If this field and To are both empty or missing, this rule
matches all destinations.
items:
description: NamespacedName refers to a Namespace scoped
resource. All fields must be used together.
description: PeerService refers to a Service, which can
be a in-cluster Service or imported multi-cluster service.
properties:
name:
type: string
namespace:
type: string
scope:
type: string
type: object
type: array
required:
Expand Down Expand Up @@ -2015,19 +2021,25 @@ spec:
type: array
toServices:
description: Rule is matched if traffic is intended for
a Service listed in this field. Currently only ClusterIP
types Services are supported in this field. This field
can only be used when AntreaProxy is enabled. This field
can't be used with To or Ports. If this field and To are
both empty or missing, this rule matches all destinations.
a Service listed in this field. Currently, only ClusterIP
types Services are supported in this field. When scope
is set to ClusterSet, it matches traffic intended for
a multi-cluster Service listed in this field. Service
name and Namespace provided should match the original
exported Service. This field can only be used when AntreaProxy
is enabled. This field can't be used with To or Ports.
If this field and To are both empty or missing, this rule
matches all destinations.
items:
description: NamespacedName refers to a Namespace scoped
resource. All fields must be used together.
description: PeerService refers to a Service, which can
be a in-cluster Service or imported multi-cluster service.
properties:
name:
type: string
namespace:
type: string
scope:
type: string
type: object
type: array
required:
Expand Down
Loading

0 comments on commit 76ee297

Please sign in to comment.