mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-09 22:13:18 +09:00
Aleksei SviridkinandTimofei Larkin
bfe6b78fa2
The aggregated API server translates each SecurityGroup into a single CiliumNetworkPolicy in the same namespace and back. Policies owned by the SecurityGroup API are marked with the sdn.cozystack.io/securitygroup label, which the storage always re-asserts on every write and hides from the SecurityGroup view, so it only ever surfaces or mutates its own policies, leaves platform-managed policies untouched, and cannot be orphaned by a tenant overwriting the marker through spec labels. Mutating verbs run the genericapiserver admission hooks, and updates replace labels/annotations rather than merging them, matching Kubernetes PUT semantics. To avoid importing the full Cilium module — which pins a Kubernetes version incompatible with this project's apimachinery fork — the backing object is a minimal in-tree CiliumNetworkPolicy mirror that reuses SecurityGroupSpec as its spec body, making the projection a near-identity translation in both directions. Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Aleksei Sviridkin <f@lex.la> Co-authored-by: Timofei Larkin <lllamnyp@gmail.com>