Skip to content

Commit 18aaa21

Browse files
zhaohuabingzhaohuabing
committed
update api
Signed-off-by: Huabing (Robin) Zhao <[email protected]>
1 parent b56a4b1 commit 18aaa21

13 files changed

+676
-1161
lines changed

‎api/v1alpha1/authorization_types.go‎

Lines changed: 41 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,7 @@ type Operation struct {
7272
// or any other identity that can be extracted from a custom header.
7373
// If there are multiple principal types, all principals must match for the rule to match.
7474
//
75-
// +kubebuilder:validation:XValidation:rule="(has(self.clientCIDRs) || has(self.jwt) || has(self.headers))",message="at least one of clientCIDRs, jwt, or headers must be specified"
75+
// +kubebuilder:validation:XValidation:rule="(has(self.clientCIDRs) || has(self.jwt) || has(self.headers) || has(self.geoLocation))",message="at least one of clientCIDRs, jwt, headers, or geoLocation must be specified"
7676
type Principal struct {
7777
// ClientCIDRs are the IP CIDR ranges of the client.
7878
// Valid examples are "192.168.1.0/24" or "2001:db8::/64"
@@ -110,6 +110,46 @@ type Principal struct {
110110
// +kubebuilder:validation:MinItems=1
111111
// +kubebuilder:validation:MaxItems=256
112112
Headers []AuthorizationHeaderMatch `json:"headers,omitempty"`
113+
114+
// GeoLocation authorizes the request based on geolocation metadata derived from the client IP.
115+
//
116+
// +optional
117+
// +notImplementedHide
118+
GeoLocation *GeoLocationPrincipal `json:"geoLocation,omitempty"`
119+
}
120+
121+
// GeoLocationPrincipal specifies geolocation-based match criteria for authorization.
122+
//
123+
// +kubebuilder:validation:XValidation:rule="(has(self.countries) || has(self.regions) || has(self.cities) || has(self.asns) || has(self.anonymous))",message="at least one of countries, regions, cities, asns, or anonymous must be specified"
124+
type GeoLocationPrincipal struct {
125+
// Countries is a list of ISO 3166-1 alpha-2 country codes.
126+
//
127+
// +optional
128+
// +kubebuilder:validation:MinItems=1
129+
Countries []string `json:"countries,omitempty"`
130+
131+
// Regions refines matching to ISO 3166-2 subdivisions.
132+
//
133+
// +optional
134+
// +kubebuilder:validation:MinItems=1
135+
Regions []GeoIPRegion `json:"regions,omitempty"`
136+
137+
// Cities refines matching to specific city names.
138+
//
139+
// +optional
140+
// +kubebuilder:validation:MinItems=1
141+
Cities []GeoIPCity `json:"cities,omitempty"`
142+
143+
// ASNs matches the autonomous system numbers associated with the client IP.
144+
//
145+
// +optional
146+
// +kubebuilder:validation:MinItems=1
147+
ASNs []uint32 `json:"asns,omitempty"`
148+
149+
// Anonymous matches anonymous network detection signals.
150+
//
151+
// +optional
152+
Anonymous *GeoIPAnonymousMatch `json:"anonymous,omitempty"`
113153
}
114154

115155
// AuthorizationHeaderMatch specifies how to match against the value of an HTTP header within a authorization rule.

‎api/v1alpha1/envoyproxy_types.go‎

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -77,6 +77,11 @@ type EnvoyProxySpec struct {
7777
// +optional
7878
RoutingType *RoutingType `json:"routingType,omitempty"`
7979

80+
// GeoIP defines shared GeoIP provider configuration for this EnvoyProxy fleet.
81+
//
82+
// +optional
83+
GeoIP *EnvoyProxyGeoIP `json:"geoIP,omitempty"`
84+
8085
// ExtraArgs defines additional command line options that are provided to Envoy.
8186
// More info: https://www.envoyproxy.io/docs/envoy/latest/operations/cli#command-line-options
8287
// Note: some command line options are used internally(e.g. --log-level) so they cannot be provided here.
@@ -182,6 +187,12 @@ type EnvoyProxySpec struct {
182187
LuaValidation *LuaValidation `json:"luaValidation,omitempty"`
183188
}
184189

190+
// EnvoyProxyGeoIP defines shared GeoIP provider settings for EnvoyProxy.
191+
type EnvoyProxyGeoIP struct {
192+
// Provider defines the GeoIP provider configuration used by GeoIP filter instances.
193+
Provider GeoIPProvider `json:"provider"`
194+
}
195+
185196
// +kubebuilder:validation:Enum=Strict;InsecureSyntax;Disabled
186197
type LuaValidation string
187198

@@ -246,7 +257,7 @@ type FilterPosition struct {
246257
}
247258

248259
// EnvoyFilter defines the type of Envoy HTTP filter.
249-
// +kubebuilder:validation:Enum=envoy.filters.http.health_check;envoy.filters.http.fault;envoy.filters.http.cors;envoy.filters.http.ext_authz;envoy.filters.http.api_key_auth;envoy.filters.http.basic_auth;envoy.filters.http.oauth2;envoy.filters.http.jwt_authn;envoy.filters.http.stateful_session;envoy.filters.http.buffer;envoy.filters.http.lua;envoy.filters.http.ext_proc;envoy.filters.http.wasm;envoy.filters.http.rbac;envoy.filters.http.local_ratelimit;envoy.filters.http.ratelimit;envoy.filters.http.grpc_web;envoy.filters.http.grpc_stats;envoy.filters.http.custom_response;envoy.filters.http.credential_injector;envoy.filters.http.compressor;envoy.filters.http.dynamic_forward_proxy
260+
// +kubebuilder:validation:Enum=envoy.filters.http.health_check;envoy.filters.http.fault;envoy.filters.http.cors;envoy.filters.http.ext_authz;envoy.filters.http.api_key_auth;envoy.filters.http.basic_auth;envoy.filters.http.oauth2;envoy.filters.http.jwt_authn;envoy.filters.http.stateful_session;envoy.filters.http.buffer;envoy.filters.http.lua;envoy.filters.http.ext_proc;envoy.filters.http.wasm;envoy.filters.http.geoip;envoy.filters.http.rbac;envoy.filters.http.local_ratelimit;envoy.filters.http.ratelimit;envoy.filters.http.grpc_web;envoy.filters.http.grpc_stats;envoy.filters.http.custom_response;envoy.filters.http.credential_injector;envoy.filters.http.compressor;envoy.filters.http.dynamic_forward_proxy
250261
type EnvoyFilter string
251262

252263
const (
@@ -284,6 +295,9 @@ const (
284295
// EnvoyFilterWasm defines the Envoy HTTP WebAssembly filter.
285296
EnvoyFilterWasm EnvoyFilter = "envoy.filters.http.wasm"
286297

298+
// EnvoyFilterGeoIP defines the Envoy HTTP GeoIP filter.
299+
EnvoyFilterGeoIP EnvoyFilter = "envoy.filters.http.geoip"
300+
287301
// EnvoyFilterLua defines the Envoy HTTP Lua filter.
288302
EnvoyFilterLua EnvoyFilter = "envoy.filters.http.lua"
289303

‎api/v1alpha1/geoip_types.go‎

Lines changed: 28 additions & 98 deletions
Original file line numberDiff line numberDiff line change
@@ -5,68 +5,6 @@
55

66
package v1alpha1
77

8-
// GeoIP defines GeoIP enrichment and access control configuration.
9-
type GeoIP struct {
10-
// Source configures how the client IP is extracted before being passed to the provider.
11-
// If unset, Envoy falls back to using the immediate downstream connection address.
12-
//
13-
// +optional
14-
Source *GeoIPSource `json:"source,omitempty"`
15-
16-
// Provider defines the GeoIP provider configuration.
17-
Provider GeoIPProvider `json:"provider"`
18-
19-
// Access defines the GeoIP based access control configuration.
20-
//
21-
// +optional
22-
Access *GeoIPAccessControl `json:"access,omitempty"`
23-
}
24-
25-
// GeoIPSource configures how Envoy determines the client IP address that is passed to the provider.
26-
// +kubebuilder:validation:XValidation:rule="self.type == 'XFF' ? has(self.xff) && !has(self.header) : self.type == 'Header' ? has(self.header) && !has(self.xff) : true",message="When type is XFF, xff must be set (and header unset). When type is Header, header must be set (and xff unset)."
27-
type GeoIPSource struct {
28-
// +kubebuilder:validation:Enum=XFF;Header
29-
// +kubebuilder:validation:Required
30-
Type GeoIPSourceType `json:"type"`
31-
32-
// XFF configures extraction based on the X-Forwarded-For header chain.
33-
//
34-
// +optional
35-
XFF *GeoIPXFFSource `json:"xff,omitempty"`
36-
37-
// Header configures extraction from a custom header.
38-
//
39-
// +optional
40-
Header *GeoIPHeaderSource `json:"header,omitempty"`
41-
}
42-
43-
// GeoIPSourceType enumerates supported client IP sources.
44-
type GeoIPSourceType string
45-
46-
const (
47-
// GeoIPSourceTypeXFF instructs Envoy to honor the X-Forwarded-For header count.
48-
GeoIPSourceTypeXFF GeoIPSourceType = "XFF"
49-
// GeoIPSourceTypeHeader instructs Envoy to read a custom request header.
50-
GeoIPSourceTypeHeader GeoIPSourceType = "Header"
51-
)
52-
53-
// GeoIPXFFSource configures trusted hop count for XFF parsing.
54-
type GeoIPXFFSource struct {
55-
// TrustedHops defines the number of trusted hops from the right side of XFF.
56-
// Defaults to 0 when unset.
57-
//
58-
// +optional
59-
TrustedHops *uint32 `json:"trustedHops,omitempty"`
60-
}
61-
62-
// GeoIPHeaderSource configures extraction from a custom header.
63-
type GeoIPHeaderSource struct {
64-
// HeaderName is the HTTP header that carries the client IP.
65-
//
66-
// +kubebuilder:validation:MinLength=1
67-
HeaderName string `json:"headerName"`
68-
}
69-
708
// GeoIPProvider defines provider-specific settings.
719
// +kubebuilder:validation:XValidation:rule="self.type == 'MaxMind' ? has(self.MaxMind) : true",message="MaxMind must be set when type is MaxMind"
7210
type GeoIPProvider struct {
@@ -123,42 +61,6 @@ type GeoIPMaxMind struct {
12361
AnonymousIPDBPath *string `json:"anonymousIpDbPath,omitempty"`
12462
}
12563

126-
// GeoIPAccessControl defines GeoIP-based allow/deny lists.
127-
type GeoIPAccessControl struct {
128-
// DefaultAction defines how to handle requests that do not match any rule or lack GeoIP data.
129-
// Defaults to Allow when unset.
130-
//
131-
// +optional
132-
DefaultAction *AuthorizationAction `json:"defaultAction,omitempty"`
133-
134-
// Rules evaluated in order. The first matching rule's action applies.
135-
//
136-
// +optional
137-
Rules []GeoIPRule `json:"rules,omitempty"`
138-
}
139-
140-
// GeoIPRule defines a single GeoIP allow/deny rule.
141-
// +kubebuilder:validation:XValidation:rule="has(self.countries) || has(self.regions) || has(self.cities)",message="At least one of countries, regions, or cities must be specified"
142-
type GeoIPRule struct {
143-
// Action is reused from Authorization rules (Allow or Deny).
144-
Action AuthorizationAction `json:"action"`
145-
146-
// Countries is a list of ISO 3166-1 alpha-2 country codes.
147-
//
148-
// +optional
149-
Countries []string `json:"countries,omitempty"`
150-
151-
// Regions refines matching to ISO 3166-2 subdivisions.
152-
//
153-
// +optional
154-
Regions []GeoIPRegion `json:"regions,omitempty"`
155-
156-
// Cities refines matching to specific city names.
157-
//
158-
// +optional
159-
Cities []GeoIPCity `json:"cities,omitempty"`
160-
}
161-
16264
// GeoIPRegion selects a region within a country.
16365
// +kubebuilder:validation:XValidation:rule="has(self.countryCode) && has(self.regionCode)",message="countryCode and regionCode must both be set"
16466
type GeoIPRegion struct {
@@ -193,3 +95,31 @@ type GeoIPCity struct {
19395
// +kubebuilder:validation:MinLength=1
19496
CityName string `json:"cityName"`
19597
}
98+
99+
// GeoIPAnonymousMatch matches anonymous network signals emitted by the GeoIP provider.
100+
type GeoIPAnonymousMatch struct {
101+
// IsAnonymous matches whether the client IP is considered anonymous.
102+
//
103+
// +optional
104+
IsAnonymous *bool `json:"isAnonymous,omitempty"`
105+
106+
// IsVPN matches whether the client IP is detected as VPN.
107+
//
108+
// +optional
109+
IsVPN *bool `json:"isVPN,omitempty"`
110+
111+
// IsHosting matches whether the client IP belongs to a hosting provider.
112+
//
113+
// +optional
114+
IsHosting *bool `json:"isHosting,omitempty"`
115+
116+
// IsTor matches whether the client IP belongs to a Tor exit node.
117+
//
118+
// +optional
119+
IsTor *bool `json:"isTor,omitempty"`
120+
121+
// IsProxy matches whether the client IP belongs to a public proxy.
122+
//
123+
// +optional
124+
IsProxy *bool `json:"isProxy,omitempty"`
125+
}

‎api/v1alpha1/securitypolicy_types.go‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -82,12 +82,6 @@ type SecurityPolicySpec struct {
8282
// +optional
8383
ExtAuth *ExtAuth `json:"extAuth,omitempty"`
8484

85-
// GeoIP defines the configuration for GeoIP based request enrichment and access control.
86-
//
87-
// +optional
88-
// +notImplementedHide
89-
GeoIP *GeoIP `json:"geoip,omitempty"`
90-
9185
// Authorization defines the authorization configuration.
9286
//
9387
// +optional

0 commit comments

Comments
 (0)