Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func MakeComponentPolicies ¶
func MakeComponentPolicies(params ComponentPolicyParams) []map[string]any
MakeComponentPolicies returns a policy for a component with ingress rules based on declared endpoint visibility. Egress is unrestricted. When Provider is ProviderCilium a CiliumNetworkPolicy is returned with L7 HTTP rules for HTTP-proxied endpoints; otherwise a standard Kubernetes NetworkPolicy is returned.
Types ¶
type ComponentPolicyParams ¶
type ComponentPolicyParams struct {
Namespace string // data plane namespace name
CPNamespace string // control plane namespace name
Environment string // environment name (e.g., "development")
ComponentName string // for naming the policy
PodSelectors map[string]string // platform pod selectors
Endpoints map[string]openchoreov1alpha1.WorkloadEndpoint // from workload spec
Provider Provider // network policy provider
}
ComponentPolicyParams holds parameters for generating per-component NetworkPolicies with ingress rules based on endpoint visibility.
type Provider ¶ added in v1.1.0
type Provider string
Provider selects which network policy API to use when generating component policies.
const ( // ProviderKubernetes generates standard Kubernetes NetworkPolicy objects (default). ProviderKubernetes Provider = "kubernetes" // ProviderCilium generates CiliumNetworkPolicy objects with L7 HTTP rules for // HTTP-proxied endpoints, enabling Hubble flow metrics via Envoy. ProviderCilium Provider = "cilium" // KubernetesNamespaceKey is the key for Kubernetes namespace // used in CiliumNetworkPolicy to allow rules based on namespace. KubernetesNamespaceKey = "k8s:io.kubernetes.pod.namespace" )
Source Files
Click to show internal directories.
Click to hide internal directories.