Add support for BaselineAdminNetworkPolicy. - Githubissues

projectcalico / calico

Cloud native networking and network security

https://docs.tigera.io/calico/latest/about/

Apache License 2.0

6.04k stars 1.35k forks source link

Add support for BaselineAdminNetworkPolicy. #9464

Open fasaxc opened 1 week ago

fasaxc commented 1 week ago

Description

Add support for sig-network-policy-api's BaselineAdminNetworkPolicy.

Map the single BANP to a policy (with order=1000) in a new dedicated Tier with order=10,000,000.
Convert the policy as per AdminNetworkPolicy. Due to different datatypes, the logic has to be copied (I didn't fancy using reflection).
Add RBAC to allow Typha and Node to access the resources.

Related issues/PRs

CORE-10800

Builds on ANP work:

Tier support: https://github.com/projectcalico/calico/pull/9085 Default action in tiers: https://github.com/projectcalico/calico/pull/9232 AdminNetworkPolicy: #9206 AdminNetworkPolicy egress networks: https://github.com/projectcalico/calico/pull/9276 AdminNetworkPolicy named port: https://github.com/projectcalico/calico/pull/9254

Todos

[ ] Tests
[ ] Documentation
[ ] Release note

Release Note

Add support for BaselineAdminNetworkPolicy.

Reminder for the reviewer

Make sure that this PR has the correct labels and milestone set.

Every PR needs one docs-* label.

docs-pr-required: This change requires a change to the documentation that has not been completed yet.
docs-completed: This change has all necessary documentation completed.
docs-not-required: This change has no user-facing impact and requires no docs.

Every PR needs one release-note-* label.

release-note-required: This PR has user-facing changes. Most PRs should have this label.
release-note-not-required: This PR has no user-facing changes.

Other optional labels:

cherry-pick-candidate: This PR should be cherry-picked to an earlier release. For bug fixes only.
needs-operator-pr: This PR is related to install and requires a corresponding change to the operator.