Skip to content

Commit b246624

Browse files
AshleyDumaineAshleyDumaine
authored
[feat][improvement][docs] implement FirewallRule CRD and support in firewall controller, remove finalizers on AddressSets (#588)
* create new FirewallRule CRD * rip out finalizers on dependent resources
1 parent 3792726 commit b246624

26 files changed

+947
-226
lines changed

‎PROJECT

+8
Original file line numberDiff line numberDiff line change
@@ -121,4 +121,12 @@ resources:
121121
kind: AddressSet
122122
path: github.com/linode/cluster-api-provider-linode/api/v1alpha2
123123
version: v1alpha2
124+
- api:
125+
crdVersion: v1
126+
namespaced: true
127+
domain: cluster.x-k8s.io
128+
group: infrastructure
129+
kind: FirewallRule
130+
path: github.com/linode/cluster-api-provider-linode/api/v1alpha2
131+
version: v1alpha2
124132
version: "3"

‎Tiltfile

+1
Original file line numberDiff line numberDiff line change
@@ -100,6 +100,7 @@ if os.getenv("INSTALL_RKE2_PROVIDER", "false") == "true":
100100
capl_resources = [
101101
"capl-system:namespace",
102102
"addresssets.infrastructure.cluster.x-k8s.io:customresourcedefinition",
103+
"firewallrules.infrastructure.cluster.x-k8s.io:customresourcedefinition",
103104
"linodeclusters.infrastructure.cluster.x-k8s.io:customresourcedefinition",
104105
"linodemachines.infrastructure.cluster.x-k8s.io:customresourcedefinition",
105106
"linodeclustertemplates.infrastructure.cluster.x-k8s.io:customresourcedefinition",

‎api/v1alpha2/firewallrule_types.go

+83
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
/*
2+
Copyright 2023 Akamai Technologies, Inc.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package v1alpha2
18+
19+
import (
20+
"github.com/linode/linodego"
21+
corev1 "k8s.io/api/core/v1"
22+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
23+
)
24+
25+
// EDIT THIS FILE! THIS IS SCAFFOLDING FOR YOU TO OWN!
26+
// NOTE: json tags are required. Any new fields you add must have json tags for the fields to be serialized.
27+
28+
// FirewallRuleSpec defines the desired state of FirewallRule
29+
type FirewallRuleSpec struct {
30+
// INSERT ADDITIONAL SPEC FIELDS - desired state of cluster
31+
// Important: Run "make" to regenerate code after modifying this file
32+
Action string `json:"action"`
33+
Label string `json:"label"`
34+
Description string `json:"description,omitempty"`
35+
Ports string `json:"ports,omitempty"`
36+
// +kubebuilder:validation:Enum=TCP;UDP;ICMP;IPENCAP
37+
Protocol linodego.NetworkProtocol `json:"protocol"`
38+
Addresses *NetworkAddresses `json:"addresses,omitempty"`
39+
// AddressSetRefs is a list of references to AddressSets as an alternative to
40+
// using Addresses but can be used in conjunction with it
41+
AddressSetRefs []*corev1.ObjectReference `json:"addressSetRefs,omitempty"`
42+
}
43+
44+
// NetworkAddresses holds a list of IPv4 and IPv6 addresses
45+
// We don't use linodego here since kubebuilder can't generate DeepCopyInto
46+
// for linodego.NetworkAddresses
47+
type NetworkAddresses struct {
48+
IPv4 *[]string `json:"ipv4,omitempty"`
49+
IPv6 *[]string `json:"ipv6,omitempty"`
50+
}
51+
52+
// FirewallRuleStatus defines the observed state of FirewallRule
53+
type FirewallRuleStatus struct {
54+
// INSERT ADDITIONAL STATUS FIELD - define observed state of cluster
55+
// Important: Run "make" to regenerate code after modifying this file
56+
}
57+
58+
//+kubebuilder:object:root=true
59+
//+kubebuilder:resource:path=firewallrules,scope=Namespaced,categories=cluster-api,shortName=fwr
60+
//+kubebuilder:subresource:status
61+
// +kubebuilder:metadata:labels="clusterctl.cluster.x-k8s.io/move-hierarchy=true"
62+
63+
// FirewallRule is the Schema for the firewallrules API
64+
type FirewallRule struct {
65+
metav1.TypeMeta `json:",inline"`
66+
metav1.ObjectMeta `json:"metadata,omitempty"`
67+
68+
Spec FirewallRuleSpec `json:"spec,omitempty"`
69+
Status FirewallRuleStatus `json:"status,omitempty"`
70+
}
71+
72+
//+kubebuilder:object:root=true
73+
74+
// FirewallRuleList contains a list of FirewallRule
75+
type FirewallRuleList struct {
76+
metav1.TypeMeta `json:",inline"`
77+
metav1.ListMeta `json:"metadata,omitempty"`
78+
Items []FirewallRule `json:"items"`
79+
}
80+
81+
func init() {
82+
SchemeBuilder.Register(&FirewallRule{}, &FirewallRuleList{})
83+
}

‎api/v1alpha2/linodefirewall_types.go

+12-24
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,6 @@ limitations under the License.
1717
package v1alpha2
1818

1919
import (
20-
"github.com/linode/linodego"
2120
corev1 "k8s.io/api/core/v1"
2221
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
2322
clusterv1 "sigs.k8s.io/cluster-api/api/v1beta1"
@@ -39,7 +38,12 @@ type LinodeFirewallSpec struct {
3938
Enabled bool `json:"enabled,omitempty"`
4039

4140
// +optional
42-
InboundRules []FirewallRule `json:"inboundRules,omitempty"`
41+
InboundRules []FirewallRuleSpec `json:"inboundRules,omitempty"`
42+
43+
// InboundRuleRefs is a list of references to FirewallRules as an alternative to
44+
// using InboundRules but can be used in conjunction with it
45+
// +optional
46+
InboundRuleRefs []*corev1.ObjectReference `json:"inboundRuleRefs,omitempty"`
4347

4448
// InboundPolicy determines if traffic by default should be ACCEPTed or DROPped. Defaults to ACCEPT if not defined.
4549
// +kubebuilder:validation:Enum=ACCEPT;DROP
@@ -48,7 +52,12 @@ type LinodeFirewallSpec struct {
4852
InboundPolicy string `json:"inboundPolicy,omitempty"`
4953

5054
// +optional
51-
OutboundRules []FirewallRule `json:"outboundRules,omitempty"`
55+
OutboundRules []FirewallRuleSpec `json:"outboundRules,omitempty"`
56+
57+
// OutboundRuleRefs is a list of references to FirewallRules as an alternative to
58+
// using OutboundRules but can be used in conjunction with it
59+
// +optional
60+
OutboundRuleRefs []*corev1.ObjectReference `json:"outboundRuleRefs,omitempty"`
5261

5362
// OutboundPolicy determines if traffic by default should be ACCEPTed or DROPped. Defaults to ACCEPT if not defined.
5463
// +kubebuilder:validation:Enum=ACCEPT;DROP
@@ -62,27 +71,6 @@ type LinodeFirewallSpec struct {
6271
CredentialsRef *corev1.SecretReference `json:"credentialsRef,omitempty"`
6372
}
6473

65-
type FirewallRule struct {
66-
Action string `json:"action"`
67-
Label string `json:"label"`
68-
Description string `json:"description,omitempty"`
69-
Ports string `json:"ports,omitempty"`
70-
// +kubebuilder:validation:Enum=TCP;UDP;ICMP;IPENCAP
71-
Protocol linodego.NetworkProtocol `json:"protocol"`
72-
Addresses *NetworkAddresses `json:"addresses,omitempty"`
73-
// AddressSetRefs is a list of references to AddressSets as an alternative to
74-
// using Addresses but can be used in conjunction with it
75-
AddressSetRefs []*corev1.ObjectReference `json:"addressSetRefs,omitempty"`
76-
}
77-
78-
// NetworkAddresses holds a list of IPv4 and IPv6 addresses
79-
// We don't use linodego here since kubebuilder can't generate DeepCopyInto
80-
// for linodego.NetworkAddresses
81-
type NetworkAddresses struct {
82-
IPv4 *[]string `json:"ipv4,omitempty"`
83-
IPv6 *[]string `json:"ipv6,omitempty"`
84-
}
85-
8674
// LinodeFirewallStatus defines the observed state of LinodeFirewall
8775
type LinodeFirewallStatus struct {
8876
// Ready is true when the provider resource is ready.

‎api/v1alpha2/zz_generated.deepcopy.go

+101-5
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)