Skip to content

Commit 283cc40

Browse files
jaelliojaellio
authored
Define targetRef proto (#2888)
* Define protobuf for PolicyTargetReference Signed-off-by: Jackie Elliott <jaellio@microsoft.com> * Add targetRef to AuthorizationPolicy, Telemetry, WasmPlugin, ProxyConfig, and RequestAuthentication. Need more examples. Signed-off-by: Jackie Elliott <jaellio@microsoft.com> * Add examples Signed-off-by: Jackie Elliott <jaellio@microsoft.com> * Moved targetRef def to selector.proto. Removed kubebuilder comments. Added release note for targetRef. Signed-off-by: Jackie Elliott <jaellio@microsoft.com> * Add oneof to CRD protos. Add clarifying comments about intended use of taretRef. Signed-off-by: Jackie Elliott <jaellio@microsoft.com> * Remove targetRef from ProxyConfig Signed-off-by: Jackie Elliott <jaellio@microsoft.com> * Removed root namespace references and ingress gateway targetRef examples. Signed-off-by: Jackie Elliott <jaellio@microsoft.com> * Hide API changes from docs and remove examples until impl is complete Signed-off-by: Jackie Elliott <jaellio@microsoft.com> * Remove telemtry example until impl complete Signed-off-by: Jackie Elliott <jaellio@microsoft.com> * add clarification resource must be in same ns as policy and add oneof to wasm plugin. Signed-off-by: Jackie Elliott <jaellio@microsoft.com> * Remove oneof in to avoid go changes. Signed-off-by: Jackie Elliott <jaellio@microsoft.com> * update release note to clarify scope is limited to waypoints Signed-off-by: Jackie Elliott <jaellio@microsoft.com> * Update authorizationPolicy selector comment Signed-off-by: Jackie Elliott <jaellio@microsoft.com> * clarify in targetRef description only waypoint is supported as a targeted resource Signed-off-by: Jackie Elliott <jaellio@microsoft.com> * add k8s gateway references Signed-off-by: Jackie Elliott <jaellio@microsoft.com> * Respond to PR feedback and add selector example. Signed-off-by: Jackie Elliott <jaellio@microsoft.com> * Address nits Signed-off-by: Jackie Elliott <jaellio@microsoft.com> --------- Signed-off-by: Jackie Elliott <jaellio@microsoft.com>
1 parent 56a12e0 commit 283cc40

23 files changed

+1225
-605
lines changed

‎extensions/v1alpha1/wasm.pb.go‎

Lines changed: 143 additions & 116 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎extensions/v1alpha1/wasm.pb.html‎

Lines changed: 1 addition & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎extensions/v1alpha1/wasm.proto‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -240,8 +240,22 @@ message WasmPlugin {
240240
// namespace. If the `WasmPlugin` is present in the config root
241241
// namespace, it will be applied to all applicable workloads in any
242242
// namespace.
243+
//
244+
// At most one of the selector and targetRef can be set.
243245
istio.type.v1beta1.WorkloadSelector selector = 1;
244246

247+
// $hide_from_docs
248+
// Optional. The targetRef specifies the gateway the policy should be
249+
// applied to. The targeted resource specified will determine which
250+
// workloads the WasmPlugin applies to. The targeted resource must be
251+
// a `Gateway` in the group `gateway.networking.k8s.io`. The gateway
252+
// must be in the same namespace as the policy.
253+
//
254+
// If the `targetRef` is not set, the policy is applied as defined by the selector.
255+
// At most one of the selector and targetRef can be set.
256+
// Waypoint proxies will not respect selectors even if they match.
257+
istio.type.v1beta1.PolicyTargetReference targetRef = 15;
258+
245259
// URL of a Wasm module or OCI container. If no scheme is present,
246260
// defaults to `oci://`, referencing an OCI image. Other valid schemes
247261
// are `file://` for referencing .wasm module files present locally

‎kubernetes/customresourcedefinitions.gen.yaml‎

Lines changed: 90 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎proto.lock‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36539,6 +36539,11 @@
3653936539
"name": "selector",
3654036540
"type": "istio.type.v1beta1.WorkloadSelector"
3654136541
},
36542+
{
36543+
"id": 15,
36544+
"name": "targetRef",
36545+
"type": "istio.type.v1beta1.PolicyTargetReference"
36546+
},
3654236547
{
3654336548
"id": 2,
3654436549
"name": "url",
@@ -46818,6 +46823,11 @@
4681846823
"name": "selector",
4681946824
"type": "istio.type.v1beta1.WorkloadSelector"
4682046825
},
46826+
{
46827+
"id": 5,
46828+
"name": "targetRef",
46829+
"type": "istio.type.v1beta1.PolicyTargetReference"
46830+
},
4682146831
{
4682246832
"id": 2,
4682346833
"name": "rules",
@@ -47188,6 +47198,11 @@
4718847198
"name": "selector",
4718947199
"type": "istio.type.v1beta1.WorkloadSelector"
4719047200
},
47201+
{
47202+
"id": 3,
47203+
"name": "targetRef",
47204+
"type": "istio.type.v1beta1.PolicyTargetReference"
47205+
},
4719147206
{
4719247207
"id": 2,
4719347208
"name": "jwt_rules",
@@ -47314,6 +47329,11 @@
4731447329
"name": "selector",
4731547330
"type": "istio.type.v1beta1.WorkloadSelector"
4731647331
},
47332+
{
47333+
"id": 5,
47334+
"name": "targetRef",
47335+
"type": "istio.type.v1beta1.PolicyTargetReference"
47336+
},
4731747337
{
4731847338
"id": 2,
4731947339
"name": "rules",
@@ -47764,6 +47784,11 @@
4776447784
"name": "selector",
4776547785
"type": "istio.type.v1beta1.WorkloadSelector"
4776647786
},
47787+
{
47788+
"id": 3,
47789+
"name": "targetRef",
47790+
"type": "istio.type.v1beta1.PolicyTargetReference"
47791+
},
4776747792
{
4776847793
"id": 2,
4776947794
"name": "jwt_rules",
@@ -47918,6 +47943,11 @@
4791847943
"name": "selector",
4791947944
"type": "istio.type.v1beta1.WorkloadSelector"
4792047945
},
47946+
{
47947+
"id": 5,
47948+
"name": "targetRef",
47949+
"type": "istio.type.v1beta1.PolicyTargetReference"
47950+
},
4792147951
{
4792247952
"id": 2,
4792347953
"name": "tracing",
@@ -48279,6 +48309,31 @@
4827948309
"type": "uint32"
4828048310
}
4828148311
]
48312+
},
48313+
{
48314+
"name": "PolicyTargetReference",
48315+
"fields": [
48316+
{
48317+
"id": 1,
48318+
"name": "group",
48319+
"type": "string"
48320+
},
48321+
{
48322+
"id": 2,
48323+
"name": "kind",
48324+
"type": "string"
48325+
},
48326+
{
48327+
"id": 3,
48328+
"name": "name",
48329+
"type": "string"
48330+
},
48331+
{
48332+
"id": 4,
48333+
"name": "namespace",
48334+
"type": "string"
48335+
}
48336+
]
4828248337
}
4828348338
],
4828448339
"imports": [

‎releasenotes/notes/target-ref.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
apiVersion: release-notes/v2
2+
kind: feature
3+
area: traffic-management
4+
issue:
5+
- https://github.com/istio/api/issues/2885
6+
7+
releaseNotes:
8+
- |
9+
**Added** PolicyTargetReference definition to be used in the RequestAuthentication, AuthorizationPolicy, Telemetry, and WasmPlugin CRDs to target k8s gateways.
10+
11+
docs:
12+
- https://docs.google.com/document/d/1MaMdyIQdOwq7mGCVMYW56FED9HrkJa93Nd0S0zBwws4/edit?usp=sharing

0 commit comments

Comments
 (0)