mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-03 10:37:21 +09:00
Aleksei Sviridkin
2b25163a8f
Give each SecurityGroup its own membership label (securitygroup.sdn.cozystack.io/<name>) and select it from the backing CiliumNetworkPolicy, instead of deriving the endpointSelector from a single app's lineage labels. spec.targetRef becomes spec.attachments, so one SecurityGroup can apply to several applications at once. Peers move from free-form fromEndpoints/toEndpoints selectors to fromApp/toApp (resolved to lineage labels) and fromSG/toSG (resolved to another group's membership label, a reference the Cilium dataplane resolves live). Attachments are persisted in a storage-owned CiliumNetworkPolicy annotation, round-tripped and hidden from the SecurityGroup view like the marker label. Validation now covers attachments and app/SG peers and rejects names that collide with reserved Cilium entities. The membership labels are maintained by a separate controller added in a follow-up commit; this change covers the API types and the aggregated-apiserver projection only. BREAKING CHANGE: SecurityGroup spec.targetRef is replaced by spec.attachments, and ingress/egress peers use fromApp/fromSG/toApp/toSG instead of fromEndpoints/toEndpoints. The feature is unreleased, so no migration is required. Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Aleksei Sviridkin <f@lex.la>
41 lines
4.3 KiB
Plaintext
41 lines
4.3 KiB
Plaintext
API rule violation: list_type_missing,github.com/cozystack/cozystack/pkg/apis/apps/v1alpha1,ApplicationStatus,Conditions
|
|
API rule violation: list_type_missing,github.com/cozystack/cozystack/pkg/apis/core/v1alpha1,OptionSpec,Items
|
|
API rule violation: list_type_missing,github.com/cozystack/cozystack/pkg/apis/core/v1alpha1,TenantModuleStatus,Conditions
|
|
API rule violation: list_type_missing,github.com/cozystack/cozystack/pkg/apis/sdn/v1alpha1,EgressRule,ToApp
|
|
API rule violation: list_type_missing,github.com/cozystack/cozystack/pkg/apis/sdn/v1alpha1,EgressRule,ToCIDR
|
|
API rule violation: list_type_missing,github.com/cozystack/cozystack/pkg/apis/sdn/v1alpha1,EgressRule,ToFQDNs
|
|
API rule violation: list_type_missing,github.com/cozystack/cozystack/pkg/apis/sdn/v1alpha1,EgressRule,ToPorts
|
|
API rule violation: list_type_missing,github.com/cozystack/cozystack/pkg/apis/sdn/v1alpha1,EgressRule,ToSG
|
|
API rule violation: list_type_missing,github.com/cozystack/cozystack/pkg/apis/sdn/v1alpha1,IngressRule,FromApp
|
|
API rule violation: list_type_missing,github.com/cozystack/cozystack/pkg/apis/sdn/v1alpha1,IngressRule,FromCIDR
|
|
API rule violation: list_type_missing,github.com/cozystack/cozystack/pkg/apis/sdn/v1alpha1,IngressRule,FromSG
|
|
API rule violation: list_type_missing,github.com/cozystack/cozystack/pkg/apis/sdn/v1alpha1,IngressRule,ToPorts
|
|
API rule violation: list_type_missing,github.com/cozystack/cozystack/pkg/apis/sdn/v1alpha1,PortRule,Ports
|
|
API rule violation: list_type_missing,github.com/cozystack/cozystack/pkg/apis/sdn/v1alpha1,SecurityGroupSpec,Attachments
|
|
API rule violation: list_type_missing,github.com/cozystack/cozystack/pkg/apis/sdn/v1alpha1,SecurityGroupSpec,Egress
|
|
API rule violation: list_type_missing,github.com/cozystack/cozystack/pkg/apis/sdn/v1alpha1,SecurityGroupSpec,Ingress
|
|
API rule violation: names_match,k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1,JSONSchemaProps,Ref
|
|
API rule violation: names_match,k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1,JSONSchemaProps,Schema
|
|
API rule violation: names_match,k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1,JSONSchemaProps,XEmbeddedResource
|
|
API rule violation: names_match,k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1,JSONSchemaProps,XIntOrString
|
|
API rule violation: names_match,k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1,JSONSchemaProps,XListMapKeys
|
|
API rule violation: names_match,k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1,JSONSchemaProps,XListType
|
|
API rule violation: names_match,k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1,JSONSchemaProps,XMapType
|
|
API rule violation: names_match,k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1,JSONSchemaProps,XPreserveUnknownFields
|
|
API rule violation: names_match,k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1,JSONSchemaProps,XValidations
|
|
API rule violation: names_match,k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1,JSONSchemaPropsOrArray,JSONSchemas
|
|
API rule violation: names_match,k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1,JSONSchemaPropsOrArray,Schema
|
|
API rule violation: names_match,k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1,JSONSchemaPropsOrBool,Allows
|
|
API rule violation: names_match,k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1,JSONSchemaPropsOrBool,Schema
|
|
API rule violation: names_match,k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1,JSONSchemaPropsOrStringArray,Property
|
|
API rule violation: names_match,k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1,JSONSchemaPropsOrStringArray,Schema
|
|
API rule violation: names_match,k8s.io/apimachinery/pkg/apis/meta/v1,APIResourceList,APIResources
|
|
API rule violation: names_match,k8s.io/apimachinery/pkg/apis/meta/v1,Duration,Duration
|
|
API rule violation: names_match,k8s.io/apimachinery/pkg/apis/meta/v1,InternalEvent,Object
|
|
API rule violation: names_match,k8s.io/apimachinery/pkg/apis/meta/v1,InternalEvent,Type
|
|
API rule violation: names_match,k8s.io/apimachinery/pkg/apis/meta/v1,MicroTime,Time
|
|
API rule violation: names_match,k8s.io/apimachinery/pkg/apis/meta/v1,StatusCause,Type
|
|
API rule violation: names_match,k8s.io/apimachinery/pkg/apis/meta/v1,Time,Time
|
|
API rule violation: names_match,k8s.io/apimachinery/pkg/runtime,Unknown,ContentEncoding
|
|
API rule violation: names_match,k8s.io/apimachinery/pkg/runtime,Unknown,ContentType
|