Enhance L7 NetworkPolicy to support TLS protocol

Signed-off-by: Hongliang Liu <[email protected]>
antrea-io · Jul 19, 2023 · fc32b93 · fc32b93
1 parent ae6f269
commit fc32b93
Show file tree

Hide file tree

Showing 27 changed files with 1,031 additions and 182 deletions.
diff --git a/build/charts/antrea/crds/clusternetworkpolicy.yaml b/build/charts/antrea/crds/clusternetworkpolicy.yaml
@@ -267,6 +267,7 @@ spec:
                           type: object
                           oneOf:
                             - required: [http]
+                            - required: [tls]
                           properties:
                             http:
                               type: object
@@ -278,6 +279,11 @@ spec:
                                   enum: ['GET', 'POST', 'PUT', 'HEAD', 'DELETE', 'TRACE', 'OPTIONS', 'CONNECT', 'PATCH']
                                 path:
                                   type: string
+                            tls:
+                              type: object
+                              properties:
+                                sni:
+                                  type: string
                       from:
                         type: array
                         items:
@@ -522,6 +528,7 @@ spec:
                           type: object
                           oneOf:
                             - required: [http]
+                            - required: [tls]
                           properties:
                             http:
                               type: object
@@ -533,6 +540,11 @@ spec:
                                   enum: ['GET', 'POST', 'PUT', 'HEAD', 'DELETE', 'TRACE', 'OPTIONS', 'CONNECT', 'PATCH']
                                 path:
                                   type: string
+                            tls:
+                              type: object
+                              properties:
+                                sni:
+                                  type: string
                       to:
                         type: array
                         items:

diff --git a/build/charts/antrea/crds/networkpolicy.yaml b/build/charts/antrea/crds/networkpolicy.yaml
@@ -203,6 +203,7 @@ spec:
                           type: object
                           oneOf:
                             - required: [http]
+                            - required: [tls]
                           properties:
                             http:
                               type: object
@@ -214,6 +215,11 @@ spec:
                                   enum: ['GET', 'POST', 'PUT', 'HEAD', 'DELETE', 'TRACE', 'OPTIONS', 'CONNECT', 'PATCH']
                                 path:
                                   type: string
+                            tls:
+                              type: object
+                              properties:
+                                sni:
+                                  type: string
                       from:
                         type: array
                         items:
@@ -431,6 +437,7 @@ spec:
                           type: object
                           oneOf:
                             - required: [http]
+                            - required: [tls]
                           properties:
                             http:
                               type: object
@@ -442,6 +449,11 @@ spec:
                                   enum: ['GET', 'POST', 'PUT', 'HEAD', 'DELETE', 'TRACE', 'OPTIONS', 'CONNECT', 'PATCH']
                                 path:
                                   type: string
+                            tls:
+                              type: object
+                              properties:
+                                sni:
+                                  type: string
                       to:
                         type: array
                         items:

diff --git a/build/yamls/antrea-aks.yml b/build/yamls/antrea-aks.yml
@@ -646,6 +646,7 @@ spec:
                           type: object
                           oneOf:
                             - required: [http]
+                            - required: [tls]
                           properties:
                             http:
                               type: object
@@ -657,6 +658,11 @@ spec:
                                   enum: ['GET', 'POST', 'PUT', 'HEAD', 'DELETE', 'TRACE', 'OPTIONS', 'CONNECT', 'PATCH']
                                 path:
                                   type: string
+                            tls:
+                              type: object
+                              properties:
+                                sni:
+                                  type: string
                       from:
                         type: array
                         items:
@@ -901,6 +907,7 @@ spec:
                           type: object
                           oneOf:
                             - required: [http]
+                            - required: [tls]
                           properties:
                             http:
                               type: object
@@ -912,6 +919,11 @@ spec:
                                   enum: ['GET', 'POST', 'PUT', 'HEAD', 'DELETE', 'TRACE', 'OPTIONS', 'CONNECT', 'PATCH']
                                 path:
                                   type: string
+                            tls:
+                              type: object
+                              properties:
+                                sni:
+                                  type: string
                       to:
                         type: array
                         items:
@@ -1858,6 +1870,7 @@ spec:
                           type: object
                           oneOf:
                             - required: [http]
+                            - required: [tls]
                           properties:
                             http:
                               type: object
@@ -1869,6 +1882,11 @@ spec:
                                   enum: ['GET', 'POST', 'PUT', 'HEAD', 'DELETE', 'TRACE', 'OPTIONS', 'CONNECT', 'PATCH']
                                 path:
                                   type: string
+                            tls:
+                              type: object
+                              properties:
+                                sni:
+                                  type: string
                       from:
                         type: array
                         items:
@@ -2086,6 +2104,7 @@ spec:
                           type: object
                           oneOf:
                             - required: [http]
+                            - required: [tls]
                           properties:
                             http:
                               type: object
@@ -2097,6 +2116,11 @@ spec:
                                   enum: ['GET', 'POST', 'PUT', 'HEAD', 'DELETE', 'TRACE', 'OPTIONS', 'CONNECT', 'PATCH']
                                 path:
                                   type: string
+                            tls:
+                              type: object
+                              properties:
+                                sni:
+                                  type: string
                       to:
                         type: array
                         items:

diff --git a/build/yamls/antrea-crds.yml b/build/yamls/antrea-crds.yml
@@ -639,6 +639,7 @@ spec:
                           type: object
                           oneOf:
                             - required: [http]
+                            - required: [tls]
                           properties:
                             http:
                               type: object
@@ -650,6 +651,11 @@ spec:
                                   enum: ['GET', 'POST', 'PUT', 'HEAD', 'DELETE', 'TRACE', 'OPTIONS', 'CONNECT', 'PATCH']
                                 path:
                                   type: string
+                            tls:
+                              type: object
+                              properties:
+                                sni:
+                                  type: string
                       from:
                         type: array
                         items:
@@ -894,6 +900,7 @@ spec:
                           type: object
                           oneOf:
                             - required: [http]
+                            - required: [tls]
                           properties:
                             http:
                               type: object
@@ -905,6 +912,11 @@ spec:
                                   enum: ['GET', 'POST', 'PUT', 'HEAD', 'DELETE', 'TRACE', 'OPTIONS', 'CONNECT', 'PATCH']
                                 path:
                                   type: string
+                            tls:
+                              type: object
+                              properties:
+                                sni:
+                                  type: string
                       to:
                         type: array
                         items:
@@ -1839,6 +1851,7 @@ spec:
                           type: object
                           oneOf:
                             - required: [http]
+                            - required: [tls]
                           properties:
                             http:
                               type: object
@@ -1850,6 +1863,11 @@ spec:
                                   enum: ['GET', 'POST', 'PUT', 'HEAD', 'DELETE', 'TRACE', 'OPTIONS', 'CONNECT', 'PATCH']
                                 path:
                                   type: string
+                            tls:
+                              type: object
+                              properties:
+                                sni:
+                                  type: string
                       from:
                         type: array
                         items:
@@ -2067,6 +2085,7 @@ spec:
                           type: object
                           oneOf:
                             - required: [http]
+                            - required: [tls]
                           properties:
                             http:
                               type: object
@@ -2078,6 +2097,11 @@ spec:
                                   enum: ['GET', 'POST', 'PUT', 'HEAD', 'DELETE', 'TRACE', 'OPTIONS', 'CONNECT', 'PATCH']
                                 path:
                                   type: string
+                            tls:
+                              type: object
+                              properties:
+                                sni:
+                                  type: string
                       to:
                         type: array
                         items:

diff --git a/build/yamls/antrea-eks.yml b/build/yamls/antrea-eks.yml
@@ -646,6 +646,7 @@ spec:
                           type: object
                           oneOf:
                             - required: [http]
+                            - required: [tls]
                           properties:
                             http:
                               type: object
@@ -657,6 +658,11 @@ spec:
                                   enum: ['GET', 'POST', 'PUT', 'HEAD', 'DELETE', 'TRACE', 'OPTIONS', 'CONNECT', 'PATCH']
                                 path:
                                   type: string
+                            tls:
+                              type: object
+                              properties:
+                                sni:
+                                  type: string
                       from:
                         type: array
                         items:
@@ -901,6 +907,7 @@ spec:
                           type: object
                           oneOf:
                             - required: [http]
+                            - required: [tls]
                           properties:
                             http:
                               type: object
@@ -912,6 +919,11 @@ spec:
                                   enum: ['GET', 'POST', 'PUT', 'HEAD', 'DELETE', 'TRACE', 'OPTIONS', 'CONNECT', 'PATCH']
                                 path:
                                   type: string
+                            tls:
+                              type: object
+                              properties:
+                                sni:
+                                  type: string
                       to:
                         type: array
                         items:
@@ -1858,6 +1870,7 @@ spec:
                           type: object
                           oneOf:
                             - required: [http]
+                            - required: [tls]
                           properties:
                             http:
                               type: object
@@ -1869,6 +1882,11 @@ spec:
                                   enum: ['GET', 'POST', 'PUT', 'HEAD', 'DELETE', 'TRACE', 'OPTIONS', 'CONNECT', 'PATCH']
                                 path:
                                   type: string
+                            tls:
+                              type: object
+                              properties:
+                                sni:
+                                  type: string
                       from:
                         type: array
                         items:
@@ -2086,6 +2104,7 @@ spec:
                           type: object
                           oneOf:
                             - required: [http]
+                            - required: [tls]
                           properties:
                             http:
                               type: object
@@ -2097,6 +2116,11 @@ spec:
                                   enum: ['GET', 'POST', 'PUT', 'HEAD', 'DELETE', 'TRACE', 'OPTIONS', 'CONNECT', 'PATCH']
                                 path:
                                   type: string
+                            tls:
+                              type: object
+                              properties:
+                                sni:
+                                  type: string
                       to:
                         type: array
                         items:

diff --git a/build/yamls/antrea-gke.yml b/build/yamls/antrea-gke.yml
@@ -646,6 +646,7 @@ spec:
                           type: object
                           oneOf:
                             - required: [http]
+                            - required: [tls]
                           properties:
                             http:
                               type: object
@@ -657,6 +658,11 @@ spec:
                                   enum: ['GET', 'POST', 'PUT', 'HEAD', 'DELETE', 'TRACE', 'OPTIONS', 'CONNECT', 'PATCH']
                                 path:
                                   type: string
+                            tls:
+                              type: object
+                              properties:
+                                sni:
+                                  type: string
                       from:
                         type: array
                         items:
@@ -901,6 +907,7 @@ spec:
                           type: object
                           oneOf:
                             - required: [http]
+                            - required: [tls]
                           properties:
                             http:
                               type: object
@@ -912,6 +919,11 @@ spec:
                                   enum: ['GET', 'POST', 'PUT', 'HEAD', 'DELETE', 'TRACE', 'OPTIONS', 'CONNECT', 'PATCH']
                                 path:
                                   type: string
+                            tls:
+                              type: object
+                              properties:
+                                sni:
+                                  type: string
                       to:
                         type: array
                         items:
@@ -1858,6 +1870,7 @@ spec:
                           type: object
                           oneOf:
                             - required: [http]
+                            - required: [tls]
                           properties:
                             http:
                               type: object
@@ -1869,6 +1882,11 @@ spec:
                                   enum: ['GET', 'POST', 'PUT', 'HEAD', 'DELETE', 'TRACE', 'OPTIONS', 'CONNECT', 'PATCH']
                                 path:
                                   type: string
+                            tls:
+                              type: object
+                              properties:
+                                sni:
+                                  type: string
                       from:
                         type: array
                         items:
@@ -2086,6 +2104,7 @@ spec:
                           type: object
                           oneOf:
                             - required: [http]
+                            - required: [tls]
                           properties:
                             http:
                               type: object
@@ -2097,6 +2116,11 @@ spec:
                                   enum: ['GET', 'POST', 'PUT', 'HEAD', 'DELETE', 'TRACE', 'OPTIONS', 'CONNECT', 'PATCH']
                                 path:
                                   type: string
+                            tls:
+                              type: object
+                              properties:
+                                sni:
+                                  type: string
                       to:
                         type: array
                         items: