Skip to content

Commit

Permalink
add sameness group to source intention
Browse files Browse the repository at this point in the history
  • Loading branch information
Maliz committed Apr 28, 2023
1 parent f8eb931 commit 69c0323
Show file tree
Hide file tree
Showing 9 changed files with 161 additions and 31 deletions.
3 changes: 2 additions & 1 deletion charts/consul/templates/crd-exportedservices.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -76,7 +76,8 @@ spec:
the service to.
type: string
peer:
description: Peer is the name of the peer to export the service to.
description: Peer is the name of the peer to export the
service to.
type: string
samenessGroup:
description: SamenessGroup is the name of the sameness
Expand Down
4 changes: 4 additions & 0 deletions charts/consul/templates/crd-serviceintentions.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -185,6 +185,10 @@ spec:
type: object
type: object
type: array
samenessGroup:
description: SamenessGroup is the name of the sameness group,
if applicable.
type: string
type: object
type: array
type: object
Expand Down
75 changes: 52 additions & 23 deletions control-plane/api/v1alpha1/serviceintentions_types.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@ package v1alpha1

import (
"encoding/json"
"fmt"
"net/http"
"strings"

Expand Down Expand Up @@ -85,6 +86,8 @@ type SourceIntention struct {
Peer string `json:"peer,omitempty"`
// Partition is the Admin Partition for the Name parameter.
Partition string `json:"partition,omitempty"`
// SamenessGroup is the name of the sameness group, if applicable.
SamenessGroup string `json:"samenessGroup,omitempty"`
// Action is required for an L4 intention, and should be set to one of
// "allow" or "deny" for the action that should be taken if this intention matches a request.
Action IntentionAction `json:"action,omitempty"`
Expand Down Expand Up @@ -272,10 +275,10 @@ func (in *ServiceIntentions) Validate(consulMeta common.ConsulMeta) error {
} else {
errs = append(errs, source.Permissions.validate(path.Child("sources").Index(i))...)
}
errs = append(errs, source.validate(path.Child("sources").Index(i), consulMeta.PartitionsEnabled)...)
}

errs = append(errs, in.validateNamespaces(consulMeta.NamespacesEnabled)...)
errs = append(errs, in.validateSourcePeerAndPartitions(consulMeta.PartitionsEnabled)...)

if len(errs) > 0 {
return apierrors.NewInvalid(
Expand All @@ -285,6 +288,46 @@ func (in *ServiceIntentions) Validate(consulMeta common.ConsulMeta) error {
return nil
}

func (in *SourceIntention) validate(path *field.Path, partitionsEnabled bool) field.ErrorList {
var errs field.ErrorList

if in.Name == "" {
errs = append(errs, field.Required(path.Child("name"), "name is required."))
}

if strings.Contains(in.Partition, WildcardSpecifier) {
errs = append(errs, field.Invalid(path.Child("partition"), in.Partition, "partition cannot use or contain wildcard '*'"))
}
if strings.Contains(in.Peer, WildcardSpecifier) {
errs = append(errs, field.Invalid(path.Child("peer"), in.Peer, "peer cannot use or contain wildcard '*'"))
}
if strings.Contains(in.SamenessGroup, WildcardSpecifier) {
errs = append(errs, field.Invalid(path.Child("samenessgroup"), in.SamenessGroup, "samenessgroup cannot use or contain wildcard '*'"))
}

if in.Partition != "" && !partitionsEnabled {
errs = append(errs, field.Invalid(path.Child("partition"), in.Partition, `Consul Enterprise Admin Partitions must be enabled to set source.partition`))
}

if in.Peer != "" && in.Partition != "" {
errs = append(errs, field.Invalid(path, *in, "cannot set peer and partition at the same time."))
}

if in.SamenessGroup != "" && in.Partition != "" {
errs = append(errs, field.Invalid(path, *in, "cannot set samenessgroup and partition at the same time."))
}

if in.SamenessGroup != "" && in.Peer != "" {
errs = append(errs, field.Invalid(path, *in, "cannot set samenessgroup and peer at the same time."))
}

if len(in.Description) > metaValueMaxLength {
errs = append(errs, field.Invalid(path, "", fmt.Sprintf("description exceeds maximum length %d", metaValueMaxLength)))
}

return errs
}

// DefaultNamespaceFields sets the namespace field on spec.destination to their default values if namespaces are enabled.
func (in *ServiceIntentions) DefaultNamespaceFields(consulMeta common.ConsulMeta) {
// If namespaces are enabled we want to set the destination namespace field to it's
Expand Down Expand Up @@ -313,13 +356,14 @@ func (in *SourceIntention) toConsul() *capi.SourceIntention {
return nil
}
return &capi.SourceIntention{
Name: in.Name,
Namespace: in.Namespace,
Partition: in.Partition,
Peer: in.Peer,
Action: in.Action.toConsul(),
Permissions: in.Permissions.toConsul(),
Description: in.Description,
Name: in.Name,
Namespace: in.Namespace,
Partition: in.Partition,
Peer: in.Peer,
SamenessGroup: in.SamenessGroup,
Action: in.Action.toConsul(),
Permissions: in.Permissions.toConsul(),
Description: in.Description,
}
}

Expand Down Expand Up @@ -461,21 +505,6 @@ func (in *ServiceIntentions) validateNamespaces(namespacesEnabled bool) field.Er
return errs
}

func (in *ServiceIntentions) validateSourcePeerAndPartitions(partitionsEnabled bool) field.ErrorList {
var errs field.ErrorList
path := field.NewPath("spec")
for i, source := range in.Spec.Sources {
if source.Partition != "" && !partitionsEnabled {
errs = append(errs, field.Invalid(path.Child("sources").Index(i).Child("partition"), source.Partition, `Consul Enterprise Admin Partitions must be enabled to set source.partition`))
}

if source.Peer != "" && source.Partition != "" {
errs = append(errs, field.Invalid(path.Child("sources").Index(i), source, `Both source.peer and source.partition cannot be set.`))
}
}
return errs
}

func (in IntentionAction) validate(path *field.Path) *field.Error {
actions := []string{"allow", "deny"}
if !sliceContains(actions, string(in)) {
Expand Down
84 changes: 81 additions & 3 deletions control-plane/api/v1alpha1/serviceintentions_types_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -269,6 +269,13 @@ func TestServiceIntentions_ToConsul(t *testing.T) {
Action: "deny",
Description: "disallow access from namespace not-test",
},
{
Name: "*",
Namespace: "ns1",
SamenessGroup: "sg2",
Action: "deny",
Description: "disallow access from namespace ns1",
},
{
Name: "svc-2",
Namespace: "bar",
Expand Down Expand Up @@ -322,6 +329,13 @@ func TestServiceIntentions_ToConsul(t *testing.T) {
Action: "deny",
Description: "disallow access from namespace not-test",
},
{
Name: "*",
Namespace: "ns1",
SamenessGroup: "sg2",
Action: "deny",
Description: "disallow access from namespace ns1",
},
{
Name: "svc-2",
Namespace: "bar",
Expand Down Expand Up @@ -1343,7 +1357,71 @@ func TestServiceIntentions_Validate(t *testing.T) {
namespacesEnabled: true,
partitionsEnabled: true,
expectedErrMsgs: []string{
`spec.sources[0]: Invalid value: v1alpha1.SourceIntention{Name:"web", Namespace:"namespace-b", Peer:"peer-other", Partition:"partition-other", Action:"allow", Permissions:v1alpha1.IntentionPermissions(nil), Description:""}: Both source.peer and source.partition cannot be set.`,
`cannot set peer and partition at the same time.`,
},
},
"single source samenessgroup and partition specified": {
input: &ServiceIntentions{
ObjectMeta: metav1.ObjectMeta{
Name: "does-not-matter",
},
Spec: ServiceIntentionsSpec{
Destination: IntentionDestination{
Name: "dest-service",
Namespace: "namespace-a",
},
Sources: SourceIntentions{
{
Name: "web",
Action: "allow",
Namespace: "namespace-b",
Partition: "partition-other",
SamenessGroup: "sg2",
},
{
Name: "db",
Action: "deny",
Namespace: "namespace-c",
},
},
},
},
namespacesEnabled: true,
partitionsEnabled: true,
expectedErrMsgs: []string{
`cannot set samenessgroup and partition at the same time.`,
},
},
"single source samenessgroup and peer specified": {
input: &ServiceIntentions{
ObjectMeta: metav1.ObjectMeta{
Name: "does-not-matter",
},
Spec: ServiceIntentionsSpec{
Destination: IntentionDestination{
Name: "dest-service",
Namespace: "namespace-a",
},
Sources: SourceIntentions{
{
Name: "web",
Action: "allow",
Namespace: "namespace-b",
Peer: "p2",
SamenessGroup: "sg2",
},
{
Name: "db",
Action: "deny",
Namespace: "namespace-c",
},
},
},
},
namespacesEnabled: true,
partitionsEnabled: true,
expectedErrMsgs: []string{
`cannot set samenessgroup and peer at the same time.`,
},
},
"multiple source peer and partition specified": {
Expand Down Expand Up @@ -1377,8 +1455,8 @@ func TestServiceIntentions_Validate(t *testing.T) {
namespacesEnabled: true,
partitionsEnabled: true,
expectedErrMsgs: []string{
`spec.sources[0]: Invalid value: v1alpha1.SourceIntention{Name:"web", Namespace:"namespace-b", Peer:"peer-other", Partition:"partition-other", Action:"allow", Permissions:v1alpha1.IntentionPermissions(nil), Description:""}: Both source.peer and source.partition cannot be set.`,
`spec.sources[1]: Invalid value: v1alpha1.SourceIntention{Name:"db", Namespace:"namespace-c", Peer:"peer-2", Partition:"partition-2", Action:"deny", Permissions:v1alpha1.IntentionPermissions(nil), Description:""}: Both source.peer and source.partition cannot be set.`,
`spec.sources[0]: Invalid value: v1alpha1.SourceIntention{Name:"web", Namespace:"namespace-b", Peer:"peer-other", Partition:"partition-other", SamenessGroup:"", Action:"allow", Permissions:v1alpha1.IntentionPermissions(nil), Description:""}: cannot set peer and partition at the same time.`,
`spec.sources[1]: Invalid value: v1alpha1.SourceIntention{Name:"db", Namespace:"namespace-c", Peer:"peer-2", Partition:"partition-2", SamenessGroup:"", Action:"deny", Permissions:v1alpha1.IntentionPermissions(nil), Description:""}: cannot set peer and partition at the same time.`,
},
},
}
Expand Down
2 changes: 2 additions & 0 deletions control-plane/api/v1alpha1/shared_types.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,8 @@ import (

// This file contains structs that are shared between multiple config entries.

const metaValueMaxLength = 512

type MeshGatewayMode string

// Expose describes HTTP paths to expose through Envoy outside of Connect.
Expand Down
3 changes: 2 additions & 1 deletion control-plane/config/crd/bases/consul.hashicorp.com_exportedservices.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -72,7 +72,8 @@ spec:
the service to.
type: string
peer:
description: Peer is the name of the peer to export the service to.
description: Peer is the name of the peer to export the
service to.
type: string
samenessGroup:
description: SamenessGroup is the name of the sameness
Expand Down
4 changes: 4 additions & 0 deletions control-plane/config/crd/bases/consul.hashicorp.com_serviceintentions.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -181,6 +181,10 @@ spec:
type: object
type: object
type: array
samenessGroup:
description: SamenessGroup is the name of the sameness group,
if applicable.
type: string
type: object
type: array
type: object
Expand Down
7 changes: 4 additions & 3 deletions control-plane/go.mod
View file
Original file line number Diff line number Diff line change
Expand Up @@ -6,11 +6,11 @@ require (
github.com/deckarep/golang-set v1.7.1
github.com/fsnotify/fsnotify v1.5.4
github.com/go-logr/logr v0.4.0
github.com/google/go-cmp v0.5.7
github.com/google/go-cmp v0.5.8
github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510
github.com/hashicorp/consul-k8s/control-plane/cni v0.0.0-20220831174802-b8af65262de8
github.com/hashicorp/consul-server-connection-manager v0.1.0
github.com/hashicorp/consul/api v1.10.1-0.20230418163148-eb9f671eafae
github.com/hashicorp/consul/api v1.10.1-0.20230427155444-391ed069c461
github.com/hashicorp/consul/sdk v0.13.1
github.com/hashicorp/go-discover v0.0.0-20200812215701-c4b85f6ed31f
github.com/hashicorp/go-hclog v1.2.2
Expand Down Expand Up @@ -130,10 +130,11 @@ require (
go.uber.org/atomic v1.9.0 // indirect
go.uber.org/multierr v1.6.0 // indirect
golang.org/x/crypto v0.0.0-20220411220226-7b82a4e95df4 // indirect
golang.org/x/exp v0.0.0-20230321023759-10a507213a29 // indirect
golang.org/x/net v0.0.0-20220127200216-cd36cc0744dd // indirect
golang.org/x/oauth2 v0.0.0-20211104180415-d3ed0bb246c8 // indirect
golang.org/x/sync v0.0.0-20210220032951-036812b2e83c // indirect
golang.org/x/sys v0.0.0-20220728004956-3c1f35247d10 // indirect
golang.org/x/sys v0.1.0 // indirect
golang.org/x/term v0.0.0-20220526004731-065cf7ba2467 // indirect
golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 // indirect
google.golang.org/api v0.43.0 // indirect
Expand Down
10 changes: 10 additions & 0 deletions control-plane/go.sum
View file
Original file line number Diff line number Diff line change
Expand Up @@ -301,6 +301,8 @@ github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
github.com/google/go-cmp v0.5.7 h1:81/ik6ipDQS2aGcBfIN5dHDB36BwrStyeAQquSYCV4o=
github.com/google/go-cmp v0.5.7/go.mod h1:n+brtR0CgQNWTVd5ZUFpTBC8YFBDLK/h/bpaJ8/DtOE=
github.com/google/go-cmp v0.5.8 h1:e6P7q2lk1O+qJJb4BtCQXlK8vWEO8V1ZeuEdJNOqZyg=
github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
github.com/google/go-querystring v0.0.0-20170111101155-53e6ce116135/go.mod h1:odCYkC5MyYFN7vkCjXpyrEuKhc/BUO6wN/zVPAxq5ck=
github.com/google/go-querystring v1.0.0 h1:Xkwi/a1rcvNg1PPYe5vI8GbeBY/jrVuDX5ASuANWTrk=
github.com/google/go-querystring v1.0.0/go.mod h1:odCYkC5MyYFN7vkCjXpyrEuKhc/BUO6wN/zVPAxq5ck=
Expand Down Expand Up @@ -355,6 +357,10 @@ github.com/hashicorp/consul-server-connection-manager v0.1.0/go.mod h1:XVVlO+Yk7
github.com/hashicorp/consul/api v1.1.0/go.mod h1:VmuI/Lkw1nC05EYQWNKwWGbkg+FbDBtguAZLlVdkD9Q=
github.com/hashicorp/consul/api v1.10.1-0.20230418163148-eb9f671eafae h1:lYnO52QxlfATRZ1Vo8tQV+lFns7rZ4iAbbi3JN4ZAQw=
github.com/hashicorp/consul/api v1.10.1-0.20230418163148-eb9f671eafae/go.mod h1:f8zVJwBcLdr1IQnfdfszjUM0xzp31Zl3bpws3pL9uFM=
github.com/hashicorp/consul/api v1.10.1-0.20230426225948-5eaeb7b8e563 h1:C34qTESgxbiqkhK9ydoRmC+5CcaP6eW5wS9at+Jw5X0=
github.com/hashicorp/consul/api v1.10.1-0.20230426225948-5eaeb7b8e563/go.mod h1:tXfrC6o0yFTgAW46xd5Ic8STHc9oIBcRVBcwhX5KNCQ=
github.com/hashicorp/consul/api v1.10.1-0.20230427155444-391ed069c461 h1:cbsTR88ShbvcRMqLU8K0atm4GmRr8UH4x4jX4e12RYE=
github.com/hashicorp/consul/api v1.10.1-0.20230427155444-391ed069c461/go.mod h1:tXfrC6o0yFTgAW46xd5Ic8STHc9oIBcRVBcwhX5KNCQ=
github.com/hashicorp/consul/proto-public v0.1.0 h1:O0LSmCqydZi363hsqc6n2v5sMz3usQMXZF6ziK3SzXU=
github.com/hashicorp/consul/proto-public v0.1.0/go.mod h1:vs2KkuWwtjkIgA5ezp4YKPzQp4GitV+q/+PvksrA92k=
github.com/hashicorp/consul/sdk v0.1.1/go.mod h1:VKf9jXwCTEY1QZP2MOLRhb5i/I/ssyNV1vwHyQBF0x8=
Expand Down Expand Up @@ -765,6 +771,8 @@ golang.org/x/exp v0.0.0-20191227195350-da58074b4299/go.mod h1:2RIsYlXP63K8oxa1u0
golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
golang.org/x/exp v0.0.0-20230321023759-10a507213a29 h1:ooxPy7fPvB4kwsA2h+iBNHkAbp/4JxTSwCmvdjEYmug=
golang.org/x/exp v0.0.0-20230321023759-10a507213a29/go.mod h1:CxIveKay+FTh1D0yPZemJVgC/95VzuuOLq5Qi4xnoYc=
golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
Expand Down Expand Up @@ -945,6 +953,8 @@ golang.org/x/sys v0.0.0-20220412211240-33da011f77ad/go.mod h1:oPkhp1MJrh7nUepCBc
golang.org/x/sys v0.0.0-20220503163025-988cb79eb6c6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.0.0-20220728004956-3c1f35247d10 h1:WIoqL4EROvwiPdUtaip4VcDdpZ4kha7wBWZrbVKCIZg=
golang.org/x/sys v0.0.0-20220728004956-3c1f35247d10/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.1.0 h1:kunALQeHf1/185U1i0GOB/fy1IPRDDpuoOOqRReG57U=
golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
golang.org/x/term v0.0.0-20210220032956-6a3ed077a48d/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
Expand Down

0 comments on commit 69c0323

Please sign in to comment.