Skip to content

Commit 207ac9c

Browse files
zhaohuabingzhaohuabing
committed
update api
Signed-off-by: Huabing (Robin) Zhao <[email protected]>
1 parent 4ecbfe9 commit 207ac9c

5 files changed

Lines changed: 186 additions & 294 deletions

File tree

‎api/v1alpha1/authorization_types.go‎

Lines changed: 21 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,7 @@ type Operation struct {
7272
// or any other identity that can be extracted from a custom header.
7373
// If there are multiple principal types, all principals must match for the rule to match.
7474
//
75-
// +kubebuilder:validation:XValidation:rule="(has(self.clientCIDRs) || has(self.jwt) || has(self.headers) || has(self.geoLocation))",message="at least one of clientCIDRs, jwt, headers, or geoLocation must be specified"
75+
// +kubebuilder:validation:XValidation:rule="(has(self.clientCIDRs) || has(self.jwt) || has(self.headers) || has(self.geoLocations))",message="at least one of clientCIDRs, jwt, headers, or geoLocations must be specified"
7676
type Principal struct {
7777
// ClientCIDRs are the IP CIDR ranges of the client.
7878
// Valid examples are "192.168.1.0/24" or "2001:db8::/64"
@@ -129,40 +129,43 @@ type Principal struct {
129129
// +notImplementedHide
130130
SourceCIDRs []CIDR `json:"sourceCIDRs,omitempty"`
131131

132-
// GeoLocation authorizes the request based on geolocation metadata derived from the client IP.
132+
// GeoLocations authorizes the request based on geolocation metadata derived from the client IP.
133+
// If multiple entries are specified, one of the GeoLocation entries must match for the rule to match.
133134
//
134135
// +optional
136+
// +kubebuilder:validation:MinItems=1
135137
// +notImplementedHide
136-
GeoLocation *GeoLocationPrincipal `json:"geoLocation,omitempty"`
138+
GeoLocations []GeoLocation `json:"geoLocations,omitempty"`
137139
}
138140

139-
// GeoLocationPrincipal specifies geolocation-based match criteria for authorization.
141+
// GeoLocation specifies geolocation-based match criteria for authorization.
140142
//
141-
// +kubebuilder:validation:XValidation:rule="(has(self.countries) || has(self.regions) || has(self.cities) || has(self.asns) || has(self.anonymous))",message="at least one of countries, regions, cities, asns, or anonymous must be specified"
142-
type GeoLocationPrincipal struct {
143-
// Countries is a list of ISO 3166-1 alpha-2 country codes.
143+
// +kubebuilder:validation:XValidation:rule="(has(self.country) ? 1 : 0) + (has(self.region) ? 1 : 0) + (has(self.city) ? 1 : 0) + (has(self.asn) ? 1 : 0) + (has(self.isp) ? 1 : 0) + (has(self.anonymous) ? 1 : 0) == 1",message="exactly one of country, region, city, asn, isp, or anonymous must be specified"
144+
type GeoLocation struct {
145+
// Country is the country associated with the client IP.
144146
//
145147
// +optional
146-
// +kubebuilder:validation:MinItems=1
147-
Countries []string `json:"countries,omitempty"`
148+
Country *string `json:"country,omitempty"`
148149

149-
// Regions refines matching to ISO 3166-2 subdivisions.
150+
// Region is the region associated with the client IP.
150151
//
151152
// +optional
152-
// +kubebuilder:validation:MinItems=1
153-
Regions []GeoIPRegion `json:"regions,omitempty"`
153+
Region *string `json:"region,omitempty"`
154154

155-
// Cities refines matching to specific city names.
155+
// City is the city associated with the client IP.
156156
//
157157
// +optional
158-
// +kubebuilder:validation:MinItems=1
159-
Cities []GeoIPCity `json:"cities,omitempty"`
158+
City *string `json:"city,omitempty"`
160159

161-
// ASNs matches the autonomous system numbers associated with the client IP.
160+
// ASN is the autonomous system number associated with the client IP.
162161
//
163162
// +optional
164-
// +kubebuilder:validation:MinItems=1
165-
ASNs []uint32 `json:"asns,omitempty"`
163+
ASN *uint32 `json:"asn,omitempty"`
164+
165+
// ISP is the internet service provider associated with the client IP.
166+
//
167+
// +optional
168+
ISP *string `json:"isp,omitempty"`
166169

167170
// Anonymous matches anonymous network detection signals.
168171
//

‎api/v1alpha1/zz_generated.deepcopy.go‎

Lines changed: 31 additions & 26 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_securitypolicies.yaml‎

Lines changed: 63 additions & 108 deletions
Original file line numberDiff line numberDiff line change
@@ -272,115 +272,70 @@ spec:
272272
type: string
273273
minItems: 1
274274
type: array
275-
geoLocation:
276-
description: GeoLocation authorizes the request based
277-
on geolocation metadata derived from the client IP.
278-
properties:
279-
anonymous:
280-
description: Anonymous matches anonymous network
281-
detection signals.
282-
properties:
283-
isAnonymous:
284-
description: IsAnonymous matches whether the
285-
client IP is considered anonymous.
286-
type: boolean
287-
isHosting:
288-
description: IsHosting matches whether the client
289-
IP belongs to a hosting provider.
290-
type: boolean
291-
isProxy:
292-
description: IsProxy matches whether the client
293-
IP belongs to a public proxy.
294-
type: boolean
295-
isTor:
296-
description: IsTor matches whether the client
297-
IP belongs to a Tor exit node.
298-
type: boolean
299-
isVPN:
300-
description: IsVPN matches whether the client
301-
IP is detected as VPN.
302-
type: boolean
303-
type: object
304-
asns:
305-
description: ASNs matches the autonomous system
306-
numbers associated with the client IP.
307-
items:
308-
format: int32
309-
type: integer
310-
minItems: 1
311-
type: array
312-
cities:
313-
description: Cities refines matching to specific
314-
city names.
315-
items:
316-
description: GeoIPCity selects a city, optionally
317-
scoped to a region.
275+
geoLocations:
276+
description: |-
277+
GeoLocations authorizes the request based on geolocation metadata derived from the client IP.
278+
If multiple entries are specified, one of the GeoLocation entries must match for the rule to match.
279+
items:
280+
description: GeoLocation specifies geolocation-based
281+
match criteria for authorization.
282+
properties:
283+
anonymous:
284+
description: Anonymous matches anonymous network
285+
detection signals.
318286
properties:
319-
cityName:
320-
description: CityName is the city name.
321-
minLength: 1
322-
type: string
323-
countryCode:
324-
description: CountryCode is the ISO 3166-1
325-
alpha-2 country code.
326-
pattern: ^[A-Z]{2}$
327-
type: string
328-
regionCode:
329-
description: RegionCode optionally scopes
330-
the city to a subdivision (ISO 3166-2 without
331-
country prefix).
332-
maxLength: 32
333-
type: string
334-
required:
335-
- cityName
336-
- countryCode
287+
isAnonymous:
288+
description: IsAnonymous matches whether the
289+
client IP is considered anonymous.
290+
type: boolean
291+
isHosting:
292+
description: IsHosting matches whether the
293+
client IP belongs to a hosting provider.
294+
type: boolean
295+
isProxy:
296+
description: IsProxy matches whether the client
297+
IP belongs to a public proxy.
298+
type: boolean
299+
isTor:
300+
description: IsTor matches whether the client
301+
IP belongs to a Tor exit node.
302+
type: boolean
303+
isVPN:
304+
description: IsVPN matches whether the client
305+
IP is detected as VPN.
306+
type: boolean
337307
type: object
338-
x-kubernetes-validations:
339-
- message: countryCode and cityName must be set
340-
rule: has(self.countryCode) && has(self.cityName)
341-
minItems: 1
342-
type: array
343-
countries:
344-
description: Countries is a list of ISO 3166-1 alpha-2
345-
country codes.
346-
items:
308+
asn:
309+
description: ASN is the autonomous system number
310+
associated with the client IP.
311+
format: int32
312+
type: integer
313+
city:
314+
description: City is the city associated with
315+
the client IP.
347316
type: string
348-
minItems: 1
349-
type: array
350-
regions:
351-
description: Regions refines matching to ISO 3166-2
352-
subdivisions.
353-
items:
354-
description: GeoIPRegion selects a region within
355-
a country.
356-
properties:
357-
countryCode:
358-
description: CountryCode is the ISO 3166-1
359-
alpha-2 country code.
360-
pattern: ^[A-Z]{2}$
361-
type: string
362-
regionCode:
363-
description: RegionCode is the ISO 3166-2
364-
subdivision code (without country prefix).
365-
maxLength: 32
366-
minLength: 1
367-
type: string
368-
required:
369-
- countryCode
370-
- regionCode
371-
type: object
372-
x-kubernetes-validations:
373-
- message: countryCode and regionCode must both
374-
be set
375-
rule: has(self.countryCode) && has(self.regionCode)
376-
minItems: 1
377-
type: array
378-
type: object
379-
x-kubernetes-validations:
380-
- message: at least one of countries, regions, cities,
381-
asns, or anonymous must be specified
382-
rule: (has(self.countries) || has(self.regions) ||
383-
has(self.cities) || has(self.asns) || has(self.anonymous))
317+
country:
318+
description: Country is the country associated
319+
with the client IP.
320+
type: string
321+
isp:
322+
description: ISP is the internet service provider
323+
associated with the client IP.
324+
type: string
325+
region:
326+
description: Region is the region associated with
327+
the client IP.
328+
type: string
329+
type: object
330+
x-kubernetes-validations:
331+
- message: exactly one of country, region, city, asn,
332+
isp, or anonymous must be specified
333+
rule: '(has(self.country) ? 1 : 0) + (has(self.region)
334+
? 1 : 0) + (has(self.city) ? 1 : 0) + (has(self.asn)
335+
? 1 : 0) + (has(self.isp) ? 1 : 0) + (has(self.anonymous)
336+
? 1 : 0) == 1'
337+
minItems: 1
338+
type: array
384339
headers:
385340
description: |-
386341
Headers authorize the request based on user identity extracted from custom headers.
@@ -524,9 +479,9 @@ spec:
524479
type: object
525480
x-kubernetes-validations:
526481
- message: at least one of clientCIDRs, jwt, headers, or
527-
geoLocation must be specified
482+
geoLocations must be specified
528483
rule: (has(self.clientCIDRs) || has(self.jwt) || has(self.headers)
529-
|| has(self.geoLocation))
484+
|| has(self.geoLocations))
530485
required:
531486
- action
532487
- principal

0 commit comments

Comments
 (0)