Examples with NetworkPolicyPeer io.fabric8.kubernetes.api.model.networking.v1.NetworkPolicyPeer used on opensource projects

Example 16 with NetworkPolicyPeer

use of io.fabric8.kubernetes.api.model.networking.v1.NetworkPolicyPeer in project strimzi by strimzi.

the class ModelUtils method setClusterOperatorNetworkPolicyNamespaceSelector.

/**
 * Decides whether the Cluster Operator needs namespaceSelector to be configured in the network policies in order
 * to talk with the operands. This follows the following rules:
 *     - If it runs in the same namespace as the operand, do not set namespace selector
 *     - If it runs in a different namespace, but user provided selector labels, use the labels
 *     - If it runs in a different namespace, and user didn't provided selector labels, open it to COs in all namespaces
 *
 * @param peer                      Network policy peer where the namespace selector should be set
 * @param operandNamespace          Namespace of the operand
 * @param operatorNamespace         Namespace of the Strimzi CO
 * @param operatorNamespaceLabels   Namespace labels provided by the user
 */
public static void setClusterOperatorNetworkPolicyNamespaceSelector(NetworkPolicyPeer peer, String operandNamespace, String operatorNamespace, Labels operatorNamespaceLabels) {
    if (!operandNamespace.equals(operatorNamespace)) {
        if (operatorNamespaceLabels != null && !operatorNamespaceLabels.toMap().isEmpty()) {
            // If user specified the namespace labels, we can use them to make the network policy as tight as possible
            LabelSelector nsLabelSelector = new LabelSelector();
            nsLabelSelector.setMatchLabels(operatorNamespaceLabels.toMap());
            peer.setNamespaceSelector(nsLabelSelector);
        } else {
            // If no namespace labels were specified, we open the network policy to COs in all namespaces
            peer.setNamespaceSelector(new LabelSelector());
        }
    }
}

Example 17 with NetworkPolicyPeer

use of io.fabric8.kubernetes.api.model.networking.v1.NetworkPolicyPeer in project strimzi by strimzi.

the class CruiseControlTest method testRestApiPortNetworkPolicyInTheSameNamespace.

@ParallelTest
public void testRestApiPortNetworkPolicyInTheSameNamespace() {
    NetworkPolicyPeer clusterOperatorPeer = new NetworkPolicyPeerBuilder().withNewPodSelector().withMatchLabels(Collections.singletonMap(Labels.STRIMZI_KIND_LABEL, "cluster-operator")).endPodSelector().build();
    NetworkPolicy np = cc.generateNetworkPolicy(namespace, null);
    assertThat(np.getSpec().getIngress().stream().filter(ing -> ing.getPorts().get(0).getPort().equals(new IntOrString(CruiseControl.REST_API_PORT))).findFirst().orElse(null), is(notNullValue()));
    List<NetworkPolicyPeer> rules = np.getSpec().getIngress().stream().filter(ing -> ing.getPorts().get(0).getPort().equals(new IntOrString(CruiseControl.REST_API_PORT))).map(NetworkPolicyIngressRule::getFrom).findFirst().orElse(null);
    assertThat(rules.size(), is(1));
    assertThat(rules.contains(clusterOperatorPeer), is(true));
}

Example 18 with NetworkPolicyPeer

use of io.fabric8.kubernetes.api.model.networking.v1.NetworkPolicyPeer in project strimzi by strimzi.

the class CruiseControlTest method testRestApiPortNetworkPolicy.

@ParallelTest
public void testRestApiPortNetworkPolicy() {
    NetworkPolicyPeer clusterOperatorPeer = new NetworkPolicyPeerBuilder().withNewPodSelector().withMatchLabels(Collections.singletonMap(Labels.STRIMZI_KIND_LABEL, "cluster-operator")).endPodSelector().withNewNamespaceSelector().endNamespaceSelector().build();
    NetworkPolicy np = cc.generateNetworkPolicy("operator-namespace", null);
    assertThat(np.getSpec().getIngress().stream().filter(ing -> ing.getPorts().get(0).getPort().equals(new IntOrString(CruiseControl.REST_API_PORT))).findFirst().orElse(null), is(notNullValue()));
    List<NetworkPolicyPeer> rules = np.getSpec().getIngress().stream().filter(ing -> ing.getPorts().get(0).getPort().equals(new IntOrString(CruiseControl.REST_API_PORT))).map(NetworkPolicyIngressRule::getFrom).findFirst().orElse(null);
    assertThat(rules.size(), is(1));
    assertThat(rules.contains(clusterOperatorPeer), is(true));
}

Example 19 with NetworkPolicyPeer

use of io.fabric8.kubernetes.api.model.networking.v1.NetworkPolicyPeer in project strimzi by strimzi.

the class ModelUtilsTest method testCONetworkPolicyPeerNamespaceSelectorDifferentNSWithLabels.

@ParallelTest
public void testCONetworkPolicyPeerNamespaceSelectorDifferentNSWithLabels() {
    NetworkPolicyPeer peer = new NetworkPolicyPeer();
    Labels nsLabels = Labels.fromMap(singletonMap("labelKey", "labelValue"));
    ModelUtils.setClusterOperatorNetworkPolicyNamespaceSelector(peer, "my-ns", "my-operator-ns", nsLabels);
    assertThat(peer.getNamespaceSelector().getMatchLabels(), is(nsLabels.toMap()));
}

Example 20 with NetworkPolicyPeer

use of io.fabric8.kubernetes.api.model.networking.v1.NetworkPolicyPeer in project strimzi by strimzi.

the class CruiseControl method generateNetworkPolicy.

/**
 * Generates the NetworkPolicies relevant for Cruise Control
 *
 * @param operatorNamespace                             Namespace where the Strimzi Cluster Operator runs. Null if not configured.
 * @param operatorNamespaceLabels                       Labels of the namespace where the Strimzi Cluster Operator runs. Null if not configured.
 *
 * @return The network policy.
 */
public NetworkPolicy generateNetworkPolicy(String operatorNamespace, Labels operatorNamespaceLabels) {
    List<NetworkPolicyIngressRule> rules = new ArrayList<>(1);
    // CO can access the REST API
    NetworkPolicyIngressRule restApiRule = new NetworkPolicyIngressRuleBuilder().addNewPort().withNewPort(REST_API_PORT).withProtocol("TCP").endPort().build();
    NetworkPolicyPeer clusterOperatorPeer = new NetworkPolicyPeerBuilder().withNewPodSelector().addToMatchLabels(Labels.STRIMZI_KIND_LABEL, "cluster-operator").endPodSelector().build();
    ModelUtils.setClusterOperatorNetworkPolicyNamespaceSelector(clusterOperatorPeer, namespace, operatorNamespace, operatorNamespaceLabels);
    restApiRule.setFrom(Collections.singletonList(clusterOperatorPeer));
    rules.add(restApiRule);
    if (isMetricsEnabled) {
        NetworkPolicyIngressRule metricsRule = new NetworkPolicyIngressRuleBuilder().addNewPort().withNewPort(METRICS_PORT).withProtocol("TCP").endPort().withFrom().build();
        rules.add(metricsRule);
    }
    NetworkPolicy networkPolicy = new NetworkPolicyBuilder().withNewMetadata().withName(CruiseControlResources.networkPolicyName(cluster)).withNamespace(namespace).withLabels(labels.toMap()).withOwnerReferences(createOwnerReference()).endMetadata().withNewSpec().withNewPodSelector().addToMatchLabels(Labels.STRIMZI_NAME_LABEL, CruiseControlResources.deploymentName(cluster)).endPodSelector().withIngress(rules).endSpec().build();
    LOGGER.traceCr(reconciliation, "Created network policy {}", networkPolicy);
    return networkPolicy;
}