|
| 1 | +/* |
| 2 | +Copyright 2024. |
| 3 | +
|
| 4 | +Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | +you may not use this file except in compliance with the License. |
| 6 | +You may obtain a copy of the License at |
| 7 | +
|
| 8 | + http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | +
|
| 10 | +Unless required by applicable law or agreed to in writing, software |
| 11 | +distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | +See the License for the specific language governing permissions and |
| 14 | +limitations under the License. |
| 15 | +*/ |
| 16 | + |
| 17 | +package v1alpha1 |
| 18 | + |
| 19 | +import ( |
| 20 | + corev1 "k8s.io/api/core/v1" |
| 21 | + networkingv1 "k8s.io/api/networking/v1" |
| 22 | + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" |
| 23 | +) |
| 24 | + |
| 25 | +// +genclient |
| 26 | +// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object |
| 27 | +// +kubebuilder:resource:path=networkqoses |
| 28 | +// +kubebuilder::singular=networkqos |
| 29 | +// +kubebuilder:object:root=true |
| 30 | +// +kubebuilder:printcolumn:name="Status",type=string,JSONPath=".status.status" |
| 31 | +// +kubebuilder:subresource:status |
| 32 | +// NetworkQoS is a CRD that allows the user to define a DSCP marking and metering |
| 33 | +// for pods ingress/egress traffic on its namespace to specified CIDRs, |
| 34 | +// protocol and port. Traffic belong these pods will be checked against |
| 35 | +// each Rule in the namespace's NetworkQoS, and if there is a match the traffic |
| 36 | +// is marked with relevant DSCP value and enforcing specified policing |
| 37 | +// parameters. |
| 38 | +type NetworkQoS struct { |
| 39 | + metav1.TypeMeta `json:",inline"` |
| 40 | + metav1.ObjectMeta `json:"metadata,omitempty"` |
| 41 | + |
| 42 | + Spec Spec `json:"spec,omitempty"` |
| 43 | + Status Status `json:"status,omitempty"` |
| 44 | +} |
| 45 | + |
| 46 | +// Spec defines the desired state of NetworkQoS |
| 47 | +type Spec struct { |
| 48 | + // netAttachRefs points to a list of objects which could be either NAD, UDN, or Cluster UDN. |
| 49 | + // In the case of NAD, the network type could be of type Layer-3, Layer-2, or Localnet. |
| 50 | + // If not specified, then the primary network of the selected Pods will be chosen. |
| 51 | + // +optional |
| 52 | + // +kubebuilder:validation:XValidation:rule="self == oldSelf", message="netAttachRefs is immutable" |
| 53 | + NetworkAttachmentRefs []corev1.ObjectReference `json:"netAttachRefs,omitempty"` |
| 54 | + |
| 55 | + // podSelector applies the NetworkQoS rule only to the pods in the namespace whose label |
| 56 | + // matches this definition. This field is optional, and in case it is not set |
| 57 | + // results in the rule being applied to all pods in the namespace. |
| 58 | + // +optional |
| 59 | + PodSelector metav1.LabelSelector `json:"podSelector,omitempty"` |
| 60 | + |
| 61 | + // priority is a value from 0 to 100 and represents the NetworkQoS' priority. |
| 62 | + // QoSes with numerically higher priority takes precedence over those with lower. |
| 63 | + // +kubebuilder:validation:Maximum:=100 |
| 64 | + // +kubebuilder:validation:Minimum:=0 |
| 65 | + Priority int `json:"priority"` |
| 66 | + |
| 67 | + // egress a collection of Egress NetworkQoS rule objects. A total of 20 rules will |
| 68 | + // be allowed in each NetworkQoS instance. The relative precedence of egress rules |
| 69 | + // within a single NetworkQos object (all of which share the priority) will be |
| 70 | + // determined by the order in which the rule is written. Thus, a rule that appears |
| 71 | + // first in the list of egress rules would take the lower precedence. |
| 72 | + Egress []Rule `json:"egress"` |
| 73 | +} |
| 74 | + |
| 75 | +type Rule struct { |
| 76 | + // dscp marking value for matching pods' traffic. |
| 77 | + // +kubebuilder:validation:Maximum:=63 |
| 78 | + // +kubebuilder:validation:Minimum:=0 |
| 79 | + DSCP int `json:"dscp"` |
| 80 | + |
| 81 | + // classifier The classifier on which packets should match |
| 82 | + // to apply the NetworkQoS Rule. |
| 83 | + // This field is optional, and in case it is not set the rule is applied |
| 84 | + // to all egress traffic regardless of the destination. |
| 85 | + // +optional |
| 86 | + Classifier Classifier `json:"classifier"` |
| 87 | + |
| 88 | + // +optional |
| 89 | + Bandwidth Bandwidth `json:"bandwidth"` |
| 90 | +} |
| 91 | + |
| 92 | +type Classifier struct { |
| 93 | + // +optional |
| 94 | + To []Destination `json:"to"` |
| 95 | + |
| 96 | + // +optional |
| 97 | + Port Port `json:"port"` |
| 98 | +} |
| 99 | + |
| 100 | +// Bandwidth controls the maximum of rate traffic that can be sent |
| 101 | +// or received on the matching packets. |
| 102 | +type Bandwidth struct { |
| 103 | + // rate The value of rate limit in kbps. Traffic over the limit |
| 104 | + // will be dropped. |
| 105 | + // +kubebuilder:validation:Minimum:=1 |
| 106 | + // +kubebuilder:validation:Maximum:=4294967295 |
| 107 | + // +optional |
| 108 | + Rate uint32 `json:"rate"` |
| 109 | + |
| 110 | + // burst The value of burst rate limit in kilobits. |
| 111 | + // This also needs rate to be specified. |
| 112 | + // +kubebuilder:validation:Minimum:=1 |
| 113 | + // +kubebuilder:validation:Maximum:=4294967295 |
| 114 | + // +optional |
| 115 | + Burst uint32 `json:"burst"` |
| 116 | +} |
| 117 | + |
| 118 | +// Port specifies destination protocol and port on which NetworkQoS |
| 119 | +// rule is applied |
| 120 | +type Port struct { |
| 121 | + // protocol (tcp, udp, sctp) that the traffic must match. |
| 122 | + // +kubebuilder:validation:Pattern=^TCP|UDP|SCTP$ |
| 123 | + // +optional |
| 124 | + Protocol string `json:"protocol"` |
| 125 | + |
| 126 | + // port that the traffic must match |
| 127 | + // +kubebuilder:validation:Minimum:=1 |
| 128 | + // +kubebuilder:validation:Maximum:=65535 |
| 129 | + // +optional |
| 130 | + Port int32 `json:"port"` |
| 131 | +} |
| 132 | + |
| 133 | +// Destination describes a peer to apply NetworkQoS configuration for the outgoing traffic. |
| 134 | +// Only certain combinations of fields are allowed. |
| 135 | +// +kubebuilder:validation:XValidation:rule="!(has(self.ipBlock) && (has(self.podSelector) || has(self.namespaceSelector)))",message="Can't specify both podSelector/namespaceSelector and ipBlock" |
| 136 | +type Destination struct { |
| 137 | + // podSelector is a label selector which selects pods. This field follows standard label |
| 138 | + // selector semantics; if present but empty, it selects all pods. |
| 139 | + // |
| 140 | + // If namespaceSelector is also set, then the NetworkQoS as a whole selects |
| 141 | + // the pods matching podSelector in the Namespaces selected by NamespaceSelector. |
| 142 | + // Otherwise it selects the pods matching podSelector in the NetworkQoS's own namespace. |
| 143 | + // +optional |
| 144 | + PodSelector *metav1.LabelSelector `json:"podSelector,omitempty" protobuf:"bytes,1,opt,name=podSelector"` |
| 145 | + |
| 146 | + // namespaceSelector selects namespaces using cluster-scoped labels. This field follows |
| 147 | + // standard label selector semantics; if present but empty, it selects all namespaces. |
| 148 | + // |
| 149 | + // If podSelector is also set, then the NetworkQoS as a whole selects |
| 150 | + // the pods matching podSelector in the namespaces selected by namespaceSelector. |
| 151 | + // Otherwise it selects all pods in the namespaces selected by namespaceSelector. |
| 152 | + // +optional |
| 153 | + NamespaceSelector *metav1.LabelSelector `json:"namespaceSelector,omitempty" protobuf:"bytes,2,opt,name=namespaceSelector"` |
| 154 | + |
| 155 | + // ipBlock defines policy on a particular IPBlock. If this field is set then |
| 156 | + // neither of the other fields can be. |
| 157 | + // +optional |
| 158 | + IPBlock *networkingv1.IPBlock `json:"ipBlock,omitempty" protobuf:"bytes,3,rep,name=ipBlock"` |
| 159 | +} |
| 160 | + |
| 161 | +// Status defines the observed state of NetworkQoS |
| 162 | +type Status struct { |
| 163 | + // A concise indication of whether the NetworkQoS resource is applied with success. |
| 164 | + // +optional |
| 165 | + Status string `json:"status,omitempty"` |
| 166 | + |
| 167 | + // An array of condition objects indicating details about status of NetworkQoS object. |
| 168 | + // +optional |
| 169 | + // +patchMergeKey=type |
| 170 | + // +patchStrategy=merge |
| 171 | + // +listType=map |
| 172 | + // +listMapKey=type |
| 173 | + Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"` |
| 174 | +} |
| 175 | + |
| 176 | +// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object |
| 177 | +// +kubebuilder:resource:path=networkqoses |
| 178 | +// +kubebuilder::singular=networkqos |
| 179 | +// NetworkQoSList contains a list of NetworkQoS |
| 180 | +type NetworkQoSList struct { |
| 181 | + metav1.TypeMeta `json:",inline"` |
| 182 | + metav1.ListMeta `json:"metadata,omitempty"` |
| 183 | + Items []NetworkQoS `json:"items"` |
| 184 | +} |
0 commit comments