Enhance L7 NetworkPolicy to support TLS protocol (#4932)

Signed-off-by: Hongliang Liu <[email protected]>
antrea-io · Jul 21, 2023 · 9c09f7c · 9c09f7c
1 parent 33878a8
commit 9c09f7c
Show file tree

Hide file tree

Showing 27 changed files with 1,015 additions and 187 deletions.
diff --git a/build/charts/antrea/crds/clusternetworkpolicy.yaml b/build/charts/antrea/crds/clusternetworkpolicy.yaml
@@ -267,6 +267,7 @@ spec:
                           type: object
                           oneOf:
                             - required: [http]
+                            - required: [tls]
                           properties:
                             http:
                               type: object
@@ -278,6 +279,11 @@ spec:
                                   enum: ['GET', 'POST', 'PUT', 'HEAD', 'DELETE', 'TRACE', 'OPTIONS', 'CONNECT', 'PATCH']
                                 path:
                                   type: string
+                            tls:
+                              type: object
+                              properties:
+                                sni:
+                                  type: string
                       from:
                         type: array
                         items:
@@ -522,6 +528,7 @@ spec:
                           type: object
                           oneOf:
                             - required: [http]
+                            - required: [tls]
                           properties:
                             http:
                               type: object
@@ -533,6 +540,11 @@ spec:
                                   enum: ['GET', 'POST', 'PUT', 'HEAD', 'DELETE', 'TRACE', 'OPTIONS', 'CONNECT', 'PATCH']
                                 path:
                                   type: string
+                            tls:
+                              type: object
+                              properties:
+                                sni:
+                                  type: string
                       to:
                         type: array
                         items:

diff --git a/build/charts/antrea/crds/networkpolicy.yaml b/build/charts/antrea/crds/networkpolicy.yaml
@@ -203,6 +203,7 @@ spec:
                           type: object
                           oneOf:
                             - required: [http]
+                            - required: [tls]
                           properties:
                             http:
                               type: object
@@ -214,6 +215,11 @@ spec:
                                   enum: ['GET', 'POST', 'PUT', 'HEAD', 'DELETE', 'TRACE', 'OPTIONS', 'CONNECT', 'PATCH']
                                 path:
                                   type: string
+                            tls:
+                              type: object
+                              properties:
+                                sni:
+                                  type: string
                       from:
                         type: array
                         items:
@@ -431,6 +437,7 @@ spec:
                           type: object
                           oneOf:
                             - required: [http]
+                            - required: [tls]
                           properties:
                             http:
                               type: object
@@ -442,6 +449,11 @@ spec:
                                   enum: ['GET', 'POST', 'PUT', 'HEAD', 'DELETE', 'TRACE', 'OPTIONS', 'CONNECT', 'PATCH']
                                 path:
                                   type: string
+                            tls:
+                              type: object
+                              properties:
+                                sni:
+                                  type: string
                       to:
                         type: array
                         items:

diff --git a/build/yamls/antrea-aks.yml b/build/yamls/antrea-aks.yml
@@ -646,6 +646,7 @@ spec:
                           type: object
                           oneOf:
                             - required: [http]
+                            - required: [tls]
                           properties:
                             http:
                               type: object
@@ -657,6 +658,11 @@ spec:
                                   enum: ['GET', 'POST', 'PUT', 'HEAD', 'DELETE', 'TRACE', 'OPTIONS', 'CONNECT', 'PATCH']
                                 path:
                                   type: string
+                            tls:
+                              type: object
+                              properties:
+                                sni:
+                                  type: string
                       from:
                         type: array
                         items:
@@ -901,6 +907,7 @@ spec:
                           type: object
                           oneOf:
                             - required: [http]
+                            - required: [tls]
                           properties:
                             http:
                               type: object
@@ -912,6 +919,11 @@ spec:
                                   enum: ['GET', 'POST', 'PUT', 'HEAD', 'DELETE', 'TRACE', 'OPTIONS', 'CONNECT', 'PATCH']
                                 path:
                                   type: string
+                            tls:
+                              type: object
+                              properties:
+                                sni:
+                                  type: string
                       to:
                         type: array
                         items:
@@ -1859,6 +1871,7 @@ spec:
                           type: object
                           oneOf:
                             - required: [http]
+                            - required: [tls]
                           properties:
                             http:
                               type: object
@@ -1870,6 +1883,11 @@ spec:
                                   enum: ['GET', 'POST', 'PUT', 'HEAD', 'DELETE', 'TRACE', 'OPTIONS', 'CONNECT', 'PATCH']
                                 path:
                                   type: string
+                            tls:
+                              type: object
+                              properties:
+                                sni:
+                                  type: string
                       from:
                         type: array
                         items:
@@ -2087,6 +2105,7 @@ spec:
                           type: object
                           oneOf:
                             - required: [http]
+                            - required: [tls]
                           properties:
                             http:
                               type: object
@@ -2098,6 +2117,11 @@ spec:
                                   enum: ['GET', 'POST', 'PUT', 'HEAD', 'DELETE', 'TRACE', 'OPTIONS', 'CONNECT', 'PATCH']
                                 path:
                                   type: string
+                            tls:
+                              type: object
+                              properties:
+                                sni:
+                                  type: string
                       to:
                         type: array
                         items:

diff --git a/build/yamls/antrea-crds.yml b/build/yamls/antrea-crds.yml
@@ -639,6 +639,7 @@ spec:
                           type: object
                           oneOf:
                             - required: [http]
+                            - required: [tls]
                           properties:
                             http:
                               type: object
@@ -650,6 +651,11 @@ spec:
                                   enum: ['GET', 'POST', 'PUT', 'HEAD', 'DELETE', 'TRACE', 'OPTIONS', 'CONNECT', 'PATCH']
                                 path:
                                   type: string
+                            tls:
+                              type: object
+                              properties:
+                                sni:
+                                  type: string
                       from:
                         type: array
                         items:
@@ -894,6 +900,7 @@ spec:
                           type: object
                           oneOf:
                             - required: [http]
+                            - required: [tls]
                           properties:
                             http:
                               type: object
@@ -905,6 +912,11 @@ spec:
                                   enum: ['GET', 'POST', 'PUT', 'HEAD', 'DELETE', 'TRACE', 'OPTIONS', 'CONNECT', 'PATCH']
                                 path:
                                   type: string
+                            tls:
+                              type: object
+                              properties:
+                                sni:
+                                  type: string
                       to:
                         type: array
                         items:
@@ -1840,6 +1852,7 @@ spec:
                           type: object
                           oneOf:
                             - required: [http]
+                            - required: [tls]
                           properties:
                             http:
                               type: object
@@ -1851,6 +1864,11 @@ spec:
                                   enum: ['GET', 'POST', 'PUT', 'HEAD', 'DELETE', 'TRACE', 'OPTIONS', 'CONNECT', 'PATCH']
                                 path:
                                   type: string
+                            tls:
+                              type: object
+                              properties:
+                                sni:
+                                  type: string
                       from:
                         type: array
                         items:
@@ -2068,6 +2086,7 @@ spec:
                           type: object
                           oneOf:
                             - required: [http]
+                            - required: [tls]
                           properties:
                             http:
                               type: object
@@ -2079,6 +2098,11 @@ spec:
                                   enum: ['GET', 'POST', 'PUT', 'HEAD', 'DELETE', 'TRACE', 'OPTIONS', 'CONNECT', 'PATCH']
                                 path:
                                   type: string
+                            tls:
+                              type: object
+                              properties:
+                                sni:
+                                  type: string
                       to:
                         type: array
                         items:

diff --git a/build/yamls/antrea-eks.yml b/build/yamls/antrea-eks.yml
@@ -646,6 +646,7 @@ spec:
                           type: object
                           oneOf:
                             - required: [http]
+                            - required: [tls]
                           properties:
                             http:
                               type: object
@@ -657,6 +658,11 @@ spec:
                                   enum: ['GET', 'POST', 'PUT', 'HEAD', 'DELETE', 'TRACE', 'OPTIONS', 'CONNECT', 'PATCH']
                                 path:
                                   type: string
+                            tls:
+                              type: object
+                              properties:
+                                sni:
+                                  type: string
                       from:
                         type: array
                         items:
@@ -901,6 +907,7 @@ spec:
                           type: object
                           oneOf:
                             - required: [http]
+                            - required: [tls]
                           properties:
                             http:
                               type: object
@@ -912,6 +919,11 @@ spec:
                                   enum: ['GET', 'POST', 'PUT', 'HEAD', 'DELETE', 'TRACE', 'OPTIONS', 'CONNECT', 'PATCH']
                                 path:
                                   type: string
+                            tls:
+                              type: object
+                              properties:
+                                sni:
+                                  type: string
                       to:
                         type: array
                         items:
@@ -1859,6 +1871,7 @@ spec:
                           type: object
                           oneOf:
                             - required: [http]
+                            - required: [tls]
                           properties:
                             http:
                               type: object
@@ -1870,6 +1883,11 @@ spec:
                                   enum: ['GET', 'POST', 'PUT', 'HEAD', 'DELETE', 'TRACE', 'OPTIONS', 'CONNECT', 'PATCH']
                                 path:
                                   type: string
+                            tls:
+                              type: object
+                              properties:
+                                sni:
+                                  type: string
                       from:
                         type: array
                         items:
@@ -2087,6 +2105,7 @@ spec:
                           type: object
                           oneOf:
                             - required: [http]
+                            - required: [tls]
                           properties:
                             http:
                               type: object
@@ -2098,6 +2117,11 @@ spec:
                                   enum: ['GET', 'POST', 'PUT', 'HEAD', 'DELETE', 'TRACE', 'OPTIONS', 'CONNECT', 'PATCH']
                                 path:
                                   type: string
+                            tls:
+                              type: object
+                              properties:
+                                sni:
+                                  type: string
                       to:
                         type: array
                         items:

diff --git a/build/yamls/antrea-gke.yml b/build/yamls/antrea-gke.yml
@@ -646,6 +646,7 @@ spec:
                           type: object
                           oneOf:
                             - required: [http]
+                            - required: [tls]
                           properties:
                             http:
                               type: object
@@ -657,6 +658,11 @@ spec:
                                   enum: ['GET', 'POST', 'PUT', 'HEAD', 'DELETE', 'TRACE', 'OPTIONS', 'CONNECT', 'PATCH']
                                 path:
                                   type: string
+                            tls:
+                              type: object
+                              properties:
+                                sni:
+                                  type: string
                       from:
                         type: array
                         items:
@@ -901,6 +907,7 @@ spec:
                           type: object
                           oneOf:
                             - required: [http]
+                            - required: [tls]
                           properties:
                             http:
                               type: object
@@ -912,6 +919,11 @@ spec:
                                   enum: ['GET', 'POST', 'PUT', 'HEAD', 'DELETE', 'TRACE', 'OPTIONS', 'CONNECT', 'PATCH']
                                 path:
                                   type: string
+                            tls:
+                              type: object
+                              properties:
+                                sni:
+                                  type: string
                       to:
                         type: array
                         items:
@@ -1859,6 +1871,7 @@ spec:
                           type: object
                           oneOf:
                             - required: [http]
+                            - required: [tls]
                           properties:
                             http:
                               type: object
@@ -1870,6 +1883,11 @@ spec:
                                   enum: ['GET', 'POST', 'PUT', 'HEAD', 'DELETE', 'TRACE', 'OPTIONS', 'CONNECT', 'PATCH']
                                 path:
                                   type: string
+                            tls:
+                              type: object
+                              properties:
+                                sni:
+                                  type: string
                       from:
                         type: array
                         items:
@@ -2087,6 +2105,7 @@ spec:
                           type: object
                           oneOf:
                             - required: [http]
+                            - required: [tls]
                           properties:
                             http:
                               type: object
@@ -2098,6 +2117,11 @@ spec:
                                   enum: ['GET', 'POST', 'PUT', 'HEAD', 'DELETE', 'TRACE', 'OPTIONS', 'CONNECT', 'PATCH']
                                 path:
                                   type: string
+                            tls:
+                              type: object
+                              properties:
+                                sni:
+                                  type: string
                       to:
                         type: array
                         items: