网络策略

// NetworkPolicy describes what network traffic is allowed for a set of Pods
type NetworkPolicy struct {
    metav1.TypeMeta `json:",inline"`
    // Standard object's metadata.
    // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    // +optional
    metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`

    // Specification of the desired behavior for this NetworkPolicy.
    // +optional
    Spec NetworkPolicySpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"`

    // Status is the current state of the NetworkPolicy.
    // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
    // +optional
    Status NetworkPolicyStatus `json:"status,omitempty" protobuf:"bytes,3,opt,name=status"`
}

// NetworkPolicySpec provides the specification of a NetworkPolicy
type NetworkPolicySpec struct {
    // Selects the pods to which this NetworkPolicy object applies. The array of
    // ingress rules is applied to any pods selected by this field. Multiple network
    // policies can select the same set of pods. In this case, the ingress rules for
    // each are combined additively. This field is NOT optional and follows standard
    // label selector semantics. An empty podSelector matches all pods in this
    // namespace.
    // 选择这个网络策略应用到哪些 Pod 上
    // 空的 podSelector 选择名字空间下的所有 Pod
    PodSelector metav1.LabelSelector `json:"podSelector" protobuf:"bytes,1,opt,name=podSelector"`

    // List of ingress rules to be applied to the selected pods. Traffic is allowed to
    // a pod if there are no NetworkPolicies selecting the pod
    // (and cluster policy otherwise allows the traffic), OR if the traffic source is
    // the pod's local node, OR if the traffic matches at least one ingress rule
    // across all of the NetworkPolicy objects whose podSelector matches the pod. If
    // this field is empty then this NetworkPolicy does not allow any traffic (and serves
    // solely to ensure that the pods it selects are isolated by default)
    // +optional
    // 白名单模式，入口网络流量隔离规则
    Ingress []NetworkPolicyIngressRule `json:"ingress,omitempty" protobuf:"bytes,2,rep,name=ingress"`

    // List of egress rules to be applied to the selected pods. Outgoing traffic is
    // allowed if there are no NetworkPolicies selecting the pod (and cluster policy
    // otherwise allows the traffic), OR if the traffic matches at least one egress rule
    // across all of the NetworkPolicy objects whose podSelector matches the pod. If
    // this field is empty then this NetworkPolicy limits all outgoing traffic (and serves
    // solely to ensure that the pods it selects are isolated by default).
    // This field is beta-level in 1.8
    // +optional
    // 白名单模式，出口网络流量隔离规则
    Egress []NetworkPolicyEgressRule `json:"egress,omitempty" protobuf:"bytes,3,rep,name=egress"`

    // List of rule types that the NetworkPolicy relates to.
    // Valid options are ["Ingress"], ["Egress"], or ["Ingress", "Egress"].
    // If this field is not specified, it will default based on the existence of Ingress or Egress rules;
    // policies that contain an Egress section are assumed to affect Egress, and all policies
    // (whether or not they contain an Ingress section) are assumed to affect Ingress.
    // If you want to write an egress-only policy, you must explicitly specify policyTypes [ "Egress" ].
    // Likewise, if you want to write a policy that specifies that no egress is allowed,
    // you must specify a policyTypes value that include "Egress" (since such a policy would not include
    // an Egress section and would otherwise default to just [ "Ingress" ]).
    // This field is beta-level in 1.8
    // +optional
    // 哪种隔离规则生效，仅可组合为以下三种模式：
    // ["Ingress"] 应用于进入所选 Pod 的入站流量
    // ["Egress"]  应用与所选 Pod 的出站流量
    // ["Ingress", "Egress"] 同时应用与 Pod 的进出流量
    PolicyTypes []PolicyType `json:"policyTypes,omitempty" protobuf:"bytes,4,rep,name=policyTypes,casttype=PolicyType"`
}

// NetworkPolicyIngressRule describes a particular set of traffic that is allowed to the pods
// matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and from.
// 规则中 "ports" 与 "from" 必须同时匹配
type NetworkPolicyIngressRule struct {
    // List of ports which should be made accessible on the pods selected for this
    // rule. Each item in this list is combined using a logical OR. If this field is
    // empty or missing, this rule matches all ports (traffic not restricted by port).
    // If this field is present and contains at least one item, then this rule allows
    // traffic only if the traffic matches at least one port in the list.
    // +optional
    Ports []NetworkPolicyPort `json:"ports,omitempty" protobuf:"bytes,1,rep,name=ports"`

    // List of sources which should be able to access the pods selected for this rule.
    // Items in this list are combined using a logical OR operation. If this field is
    // empty or missing, this rule matches all sources (traffic not restricted by
    // source). If this field is present and contains at least one item, this rule
    // allows traffic only if the traffic matches at least one item in the from list.
    // +optional
    From []NetworkPolicyPeer `json:"from,omitempty" protobuf:"bytes,2,rep,name=from"`
}

// NetworkPolicyEgressRule describes a particular set of traffic that is allowed out of pods
// matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and to.
// This type is beta-level in 1.8
// 规则中 "ports" 与 "to" 必须同时匹配
type NetworkPolicyEgressRule struct {
    // List of destination ports for outgoing traffic.
    // Each item in this list is combined using a logical OR. If this field is
    // empty or missing, this rule matches all ports (traffic not restricted by port).
    // If this field is present and contains at least one item, then this rule allows
    // traffic only if the traffic matches at least one port in the list.
    // +optional
    Ports []NetworkPolicyPort `json:"ports,omitempty" protobuf:"bytes,1,rep,name=ports"`

    // List of destinations for outgoing traffic of pods selected for this rule.
    // Items in this list are combined using a logical OR operation. If this field is
    // empty or missing, this rule matches all destinations (traffic not restricted by
    // destination). If this field is present and contains at least one item, this rule
    // allows traffic only if the traffic matches at least one item in the to list.
    // +optional
    To []NetworkPolicyPeer `json:"to,omitempty" protobuf:"bytes,2,rep,name=to"`
}

// PolicyType string describes the NetworkPolicy type
// This type is beta-level in 1.8
// +enum
type PolicyType string

const (
    // PolicyTypeIngress is a NetworkPolicy that affects ingress traffic on selected pods
    PolicyTypeIngress PolicyType = "Ingress"
    // PolicyTypeEgress is a NetworkPolicy that affects egress traffic on selected pods
    PolicyTypeEgress PolicyType = "Egress"
)

// NetworkPolicyPort describes a port to allow traffic on
type NetworkPolicyPort struct {
    // The protocol (TCP, UDP, or SCTP) which traffic must match. If not specified, this
    // field defaults to TCP.
    // +optional
    Protocol *v1.Protocol `json:"protocol,omitempty" protobuf:"bytes,1,opt,name=protocol,casttype=k8s.io/api/core/v1.Protocol"`

    // The port on the given protocol. This can either be a numerical or named
    // port on a pod. If this field is not provided, this matches all port names and
    // numbers.
    // If present, only traffic on the specified protocol AND port will be matched.
    // +optional
    Port *intstr.IntOrString `json:"port,omitempty" protobuf:"bytes,2,opt,name=port"`

    // If set, indicates that the range of ports from port to endPort, inclusive,
    // should be allowed by the policy. This field cannot be defined if the port field
    // is not defined or if the port field is defined as a named (string) port.
    // The endPort must be equal or greater than port.
    // +optional
    EndPort *int32 `json:"endPort,omitempty" protobuf:"bytes,3,opt,name=endPort"`
}

// NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of
// fields are allowed
// 描述匹配的对端目标，应用在 "to" 或 "from" 方向，仅支持四种组合，见以下说明
type NetworkPolicyPeer struct {
    // This is a label selector which selects Pods. This field follows standard label
    // selector semantics; if present but empty, it selects all pods.
    //
    // If NamespaceSelector is also set, then the NetworkPolicyPeer as a whole selects
    // the Pods matching PodSelector in the Namespaces selected by NamespaceSelector.
    // Otherwise it selects the Pods matching PodSelector in the policy's own Namespace.
    // +optional
    PodSelector *metav1.LabelSelector `json:"podSelector,omitempty" protobuf:"bytes,1,opt,name=podSelector"`

    // Selects Namespaces using cluster-scoped labels. This field follows standard label
    // selector semantics; if present but empty, it selects all namespaces.
    //
    // If PodSelector is also set, then the NetworkPolicyPeer as a whole selects
    // the Pods matching PodSelector in the Namespaces selected by NamespaceSelector.
    // Otherwise it selects all Pods in the Namespaces selected by NamespaceSelector.
    // +optional
    NamespaceSelector *metav1.LabelSelector `json:"namespaceSelector,omitempty" protobuf:"bytes,2,opt,name=namespaceSelector"`

    // IPBlock defines policy on a particular IPBlock. If this field is set then
    // neither of the other fields can be.
    // +optional
    IPBlock *IPBlock `json:"ipBlock,omitempty" protobuf:"bytes,3,rep,name=ipBlock"`
}

// IPBlock describes a particular CIDR (Ex. "192.168.1.0/24","2001:db8::/64") that is allowed
// to the pods matched by a NetworkPolicySpec's podSelector. The except entry describes CIDRs
// that should not be included within this rule.
type IPBlock struct {
    // CIDR is a string representing the IP Block
    // Valid examples are "192.168.1.0/24" or "2001:db8::/64"
    CIDR string `json:"cidr" protobuf:"bytes,1,name=cidr"`
    // Except is a slice of CIDRs that should not be included within an IP Block
    // Valid examples are "192.168.1.0/24" or "2001:db8::/64"
    // Except values will be rejected if they are outside the CIDR range
    // +optional
    Except []string `json:"except,omitempty" protobuf:"bytes,2,rep,name=except"`
}

// NetworkPolicyStatus describe the current state of the NetworkPolicy.
type NetworkPolicyStatus struct {
    // Conditions holds an array of metav1.Condition that describe the state of the NetworkPolicy.
    // Current service state
    // +optional
    // +patchMergeKey=type
    // +patchStrategy=merge
    // +listType=map
    // +listMapKey=type
    Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,1,rep,name=conditions"`
}