Skip to content

api: cross-namespace policy target selectors #5145

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
guydc wants to merge 4 commits into
base: main
Choose a base branch
from
Open

api: cross-namespace policy target selectors #5145

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
97753a8
api: cross-namespace policy target selectors
guydc Jan 24, 2025
d28eb68
use gw-api style for namespace selector
guydc Jan 29, 2025
e672802
fix json tag
guydc Jan 29, 2025
ba7b099
Merge branch 'main' into cross-ns-attachment
guydc Feb 5, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 23 additions & 0 deletions api/v1alpha1/policy_helpers.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,29 @@ type TargetSelector struct {

// MatchLabels are the set of label selectors for identifying the targeted resource
MatchLabels map[string]string `json:"matchLabels"`

// Namespaces determines if the resource from all namespaces or the current namespace
// are considered when matching by label selectors specified in MatchLabels.
// Note: when referencing targets in a different namespace, appropriate ReferenceGrants must be
// configured to allow the selection.
// +optional
// +notImplementedHide
Namespaces *TargetSelectorNamespaces `json:"namespaces,omitempty"`
}

type FromNamespaces string

const (
// FromNamespacesAll indicates that the target selector should apply to targets from all namespaces
FromNamespacesAll FromNamespaces = "All"
Copy link
Copy Markdown
Member

@zhaohuabing zhaohuabing Apr 8, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we have an enum member Same defined here?

)

// TargetSelectorNamespaces determines which namespaces are used when selecting policy targets.
type TargetSelectorNamespaces struct {
// Indicates where targets would be selected for the Policy's TargetSelector.
// +kubebuilder:validation:Enum=All
// +kubebuilder:validation:Required
FromNamespaces FromNamespaces `json:"from,omitempty"`
}

func (p PolicyTargetReferences) GetTargetRefs() []gwapiv1a2.LocalPolicyTargetReferenceWithSectionName {
Expand Down
20 changes: 20 additions & 0 deletions api/v1alpha1/zz_generated.deepcopy.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

16 changes: 16 additions & 0 deletions charts/gateway-helm/crds/generated/gateway.envoyproxy.io_backendtrafficpolicies.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1514,6 +1514,22 @@ spec:
description: MatchLabels are the set of label selectors for
identifying the targeted resource
type: object
namespaces:
description: |-
Namespaces determines if the resource from all namespaces or the current namespace
are considered when matching by label selectors specified in MatchLabels.
Note: when referencing targets in a different namespace, appropriate ReferenceGrants must be
configured to allow the selection.
properties:
from:
description: Indicates where targets would be selected for
the Policy's TargetSelector.
enum:
- All
type: string
required:
- from
type: object
required:
- kind
- matchLabels
Expand Down
16 changes: 16 additions & 0 deletions charts/gateway-helm/crds/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -614,6 +614,22 @@ spec:
description: MatchLabels are the set of label selectors for
identifying the targeted resource
type: object
namespaces:
description: |-
Namespaces determines if the resource from all namespaces or the current namespace
are considered when matching by label selectors specified in MatchLabels.
Note: when referencing targets in a different namespace, appropriate ReferenceGrants must be
configured to allow the selection.
properties:
from:
description: Indicates where targets would be selected for
the Policy's TargetSelector.
enum:
- All
type: string
required:
- from
type: object
required:
- kind
- matchLabels
Expand Down
16 changes: 16 additions & 0 deletions charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyextensionpolicies.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1207,6 +1207,22 @@ spec:
description: MatchLabels are the set of label selectors for
identifying the targeted resource
type: object
namespaces:
description: |-
Namespaces determines if the resource from all namespaces or the current namespace
are considered when matching by label selectors specified in MatchLabels.
Note: when referencing targets in a different namespace, appropriate ReferenceGrants must be
configured to allow the selection.
properties:
from:
description: Indicates where targets would be selected for
the Policy's TargetSelector.
enum:
- All
type: string
required:
- from
type: object
required:
- kind
- matchLabels
Expand Down
16 changes: 16 additions & 0 deletions charts/gateway-helm/crds/generated/gateway.envoyproxy.io_securitypolicies.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4453,6 +4453,22 @@ spec:
description: MatchLabels are the set of label selectors for
identifying the targeted resource
type: object
namespaces:
description: |-
Namespaces determines if the resource from all namespaces or the current namespace
are considered when matching by label selectors specified in MatchLabels.
Note: when referencing targets in a different namespace, appropriate ReferenceGrants must be
configured to allow the selection.
properties:
from:
description: Indicates where targets would be selected for
the Policy's TargetSelector.
enum:
- All
type: string
required:
- from
type: object
required:
- kind
- matchLabels
Expand Down
28 changes: 28 additions & 0 deletions site/content/en/latest/api/extension_types.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1801,6 +1801,20 @@ _Appears in:_
| `after` | _[EnvoyFilter](#envoyfilter)_ | true | | After defines the filter that should come after the filter.<br />Only one of Before or After must be set. |


#### FromNamespaces

_Underlying type:_ _string_



_Appears in:_
- [TargetSelectorNamespaces](#targetselectornamespaces)

| Value | Description |
| ----- | ----------- |
| `All` | FromNamespacesAll indicates that the target selector should apply to targets from all namespaces<br /> |


#### GRPCActiveHealthChecker


Expand Down Expand Up @@ -4299,6 +4313,20 @@ _Appears in:_
| `matchLabels` | _object (keys:string, values:string)_ | true | | MatchLabels are the set of label selectors for identifying the targeted resource |


#### TargetSelectorNamespaces



TargetSelectorNamespaces determines which namespaces are used when selecting policy targets.

_Appears in:_
- [TargetSelector](#targetselector)

| Field | Type | Required | Default | Description |
| --- | --- | --- | --- | --- |
| `from` | _[FromNamespaces](#fromnamespaces)_ | true | | Indicates where targets would be selected for the Policy's TargetSelector. |


#### Timeout


Expand Down
28 changes: 28 additions & 0 deletions site/content/zh/latest/api/extension_types.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1801,6 +1801,20 @@ _Appears in:_
| `after` | _[EnvoyFilter](#envoyfilter)_ | true | | After defines the filter that should come after the filter.<br />Only one of Before or After must be set. |


#### FromNamespaces

_Underlying type:_ _string_



_Appears in:_
- [TargetSelectorNamespaces](#targetselectornamespaces)

| Value | Description |
| ----- | ----------- |
| `All` | FromNamespacesAll indicates that the target selector should apply to targets from all namespaces<br /> |


#### GRPCActiveHealthChecker


Expand Down Expand Up @@ -4299,6 +4313,20 @@ _Appears in:_
| `matchLabels` | _object (keys:string, values:string)_ | true | | MatchLabels are the set of label selectors for identifying the targeted resource |


#### TargetSelectorNamespaces



TargetSelectorNamespaces determines which namespaces are used when selecting policy targets.

_Appears in:_
- [TargetSelector](#targetselector)

| Field | Type | Required | Default | Description |
| --- | --- | --- | --- | --- |
| `from` | _[FromNamespaces](#fromnamespaces)_ | true | | Indicates where targets would be selected for the Policy's TargetSelector. |


#### Timeout


Expand Down