github.com/zhyoulun/cilium@v1.6.12/pkg/policy/api/rule.go (about)

     1  // Copyright 2016-2019 Authors of Cilium
     2  //
     3  // Licensed under the Apache License, Version 2.0 (the "License");
     4  // you may not use this file except in compliance with the License.
     5  // You may obtain a copy of the License at
     6  //
     7  //     http://www.apache.org/licenses/LICENSE-2.0
     8  //
     9  // Unless required by applicable law or agreed to in writing, software
    10  // distributed under the License is distributed on an "AS IS" BASIS,
    11  // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    12  // See the License for the specific language governing permissions and
    13  // limitations under the License.
    14  
    15  package api
    16  
    17  import (
    18  	"github.com/cilium/cilium/pkg/labels"
    19  )
    20  
    21  // Rule is a policy rule which must be applied to all endpoints which match the
    22  // labels contained in the endpointSelector
    23  //
    24  // Each rule is split into an ingress section which contains all rules
    25  // applicable at ingress, and an egress section applicable at egress. For rule
    26  // types such as `L4Rule` and `CIDR` which can be applied at both ingress and
    27  // egress, both ingress and egress side have to either specifically allow the
    28  // connection or one side has to be omitted.
    29  //
    30  // Either ingress, egress, or both can be provided. If both ingress and egress
    31  // are omitted, the rule has no effect.
    32  type Rule struct {
    33  	// EndpointSelector selects all endpoints which should be subject to
    34  	// this rule. Cannot be empty.
    35  	EndpointSelector EndpointSelector `json:"endpointSelector"`
    36  
    37  	// Ingress is a list of IngressRule which are enforced at ingress.
    38  	// If omitted or empty, this rule does not apply at ingress.
    39  	//
    40  	// +optional
    41  	Ingress []IngressRule `json:"ingress,omitempty"`
    42  
    43  	// Egress is a list of EgressRule which are enforced at egress.
    44  	// If omitted or empty, this rule does not apply at egress.
    45  	//
    46  	// +optional
    47  	Egress []EgressRule `json:"egress,omitempty"`
    48  
    49  	// Labels is a list of optional strings which can be used to
    50  	// re-identify the rule or to store metadata. It is possible to lookup
    51  	// or delete strings based on labels. Labels are not required to be
    52  	// unique, multiple rules can have overlapping or identical labels.
    53  	//
    54  	// +optional
    55  	Labels labels.LabelArray `json:"labels,omitempty"`
    56  
    57  	// Description is a free form string, it can be used by the creator of
    58  	// the rule to store human readable explanation of the purpose of this
    59  	// rule. Rules cannot be identified by comment.
    60  	//
    61  	// +optional
    62  	Description string `json:"description,omitempty"`
    63  }
    64  
    65  // NewRule builds a new rule with no selector and no policy.
    66  func NewRule() *Rule {
    67  	return &Rule{}
    68  }
    69  
    70  // WithEndpointSelector configures the Rule with the specified selector.
    71  func (r *Rule) WithEndpointSelector(es EndpointSelector) *Rule {
    72  	r.EndpointSelector = es
    73  	return r
    74  }
    75  
    76  // WithIngressRules configures the Rule with the specified rules.
    77  func (r *Rule) WithIngressRules(rules []IngressRule) *Rule {
    78  	r.Ingress = rules
    79  	return r
    80  }
    81  
    82  // WithEgressRules configures the Rule with the specified rules.
    83  func (r *Rule) WithEgressRules(rules []EgressRule) *Rule {
    84  	r.Egress = rules
    85  	return r
    86  }
    87  
    88  // WithLabels configures the Rule with the specified labels metadata.
    89  func (r *Rule) WithLabels(labels labels.LabelArray) *Rule {
    90  	r.Labels = labels
    91  	return r
    92  }
    93  
    94  // WithDescription configures the Rule with the specified description metadata.
    95  func (r *Rule) WithDescription(desc string) *Rule {
    96  	r.Description = desc
    97  	return r
    98  }
    99  
   100  // RequiresDerivative it return true if the rule has a derivative rule.
   101  func (r *Rule) RequiresDerivative() bool {
   102  	for _, rule := range r.Egress {
   103  		if rule.RequiresDerivative() {
   104  			return true
   105  		}
   106  	}
   107  	return false
   108  }
   109  
   110  // CreateDerivative will return a new Rule with the new data based gather
   111  // by the rules that autogenerated new Rule
   112  func (r *Rule) CreateDerivative() (*Rule, error) {
   113  	newRule := r.DeepCopy()
   114  	newRule.Egress = []EgressRule{}
   115  
   116  	for _, egressRule := range r.Egress {
   117  		derivativeEgressRule, err := egressRule.CreateDerivative()
   118  		if err != nil {
   119  			return newRule, err
   120  		}
   121  		newRule.Egress = append(newRule.Egress, *derivativeEgressRule)
   122  	}
   123  	return newRule, nil
   124  }