Design Proposal for New Type `NetworkPolicyTargets` to Explicitly Define Targets for `NetworkPolicy`

[afritzler]

Objective

To design and introduce a new type within our network configuration API named NetworkPolicyTargets. This type will be utilized to specifically define NetworkInterfaces as the targets of a NetworkPolicy, aiming to enhance granularity and control over network traffic rules.

Background

While our existing NetworkPolicy implementation offers the capability to set broad network traffic rules, there's a need for more granular control. Specifically, there's a requirement to precisely target NetworkInterfaces with these policies. The introduction of the NetworkPolicyTargets type aims to address this need, enabling users to specify NetworkInterfaces directly as policy targets.

Requirements

1. Explicit Targeting of NetworkInterfaces: The NetworkPolicyTargets type should allow for the explicit specification of NetworkInterfaces as targets of a network policy.
2. Compatibility and Integration: Ensure that NetworkPolicyTargets is fully compatible with the current NetworkPolicy structure, enhancing functionality without disrupting existing definitions.
3. Simplicity and Usability: The design of NetworkPolicyTargets should prioritize ease of use, allowing for intuitive specification of network interface targets in network policies.

Proposed API Changes

1. Introduction of NetworkPolicyTargets Type:

   • This new type should include fields that allow users to specify a list of NetworkInterfaces as targets. Each target can be defined by attributes such as UID andName.

2. Specification Example:

   • Provide examples and guidelines on how to utilize the NetworkPolicyTargets type within network policies, emphasizing the targeting of NetworkInterfaces.

Next Steps

1. Define the API design based on feedback, ensuring that it meets the needs for precise targeting.
2. Develop a detailed implementation plan, including testing strategies and migration guidelines for existing network policies.

[balpert89]

some questions from top of my head:

• is this meant to be used in conjunction / complementary to the LabelSelector section in a NetworkPolicy?
• what is the benefit compared to just using the LabelSelector section?
• why not introducing an extension in the NetworkPolicy API? It seems cumbersome to have logic to union the list of NetworkInterfaces chosen by LabelSelector and NetworkPolicyTargets

[afritzler]

Closing in favor of https://github.com/ironcore-dev/ironcore-net/issues/275