267 lines
11 KiB
YAML
267 lines
11 KiB
YAML
---
|
|
apiVersion: apiextensions.k8s.io/v1
|
|
kind: CustomResourceDefinition
|
|
metadata:
|
|
name: serverauthorizations.policy.linkerd.io
|
|
annotations:
|
|
{{ include "partials.annotations.created-by" . }}
|
|
labels:
|
|
helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
|
|
linkerd.io/control-plane-ns: {{.Release.Namespace}}
|
|
spec:
|
|
group: policy.linkerd.io
|
|
scope: Namespaced
|
|
names:
|
|
kind: ServerAuthorization
|
|
plural: serverauthorizations
|
|
singular: serverauthorization
|
|
shortNames: [saz, serverauthz, srvauthz]
|
|
versions:
|
|
- name: v1alpha1
|
|
served: true
|
|
storage: false
|
|
deprecated: true
|
|
deprecationWarning: "policy.linkerd.io/v1alpha1 ServerAuthorization is deprecated; use policy.linkerd.io/v1beta1 ServerAuthorization"
|
|
schema:
|
|
openAPIV3Schema:
|
|
type: object
|
|
required: [spec]
|
|
properties:
|
|
spec:
|
|
description: >-
|
|
Authorizes clients to communicate with Linkerd-proxied servers.
|
|
type: object
|
|
required: [server, client]
|
|
properties:
|
|
server:
|
|
description: >-
|
|
Identifies servers in the same namespace for which this
|
|
authorization applies.
|
|
|
|
Only one of `name` or `selector` may be specified.
|
|
type: object
|
|
oneOf:
|
|
- required: [name]
|
|
- required: [selector]
|
|
properties:
|
|
name:
|
|
description: References a `Server` instance by name
|
|
type: string
|
|
pattern: '^[a-z0-9]([-a-z0-9]*[a-z0-9])?$'
|
|
selector:
|
|
description: >-
|
|
A label query over servers on which this authorization applies.
|
|
type: object
|
|
properties:
|
|
matchLabels:
|
|
type: object
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
matchExpressions:
|
|
type: array
|
|
items:
|
|
type: object
|
|
required: [key, operator]
|
|
properties:
|
|
key:
|
|
type: string
|
|
operator:
|
|
type: string
|
|
enum: [In, NotIn, Exists, DoesNotExist]
|
|
values:
|
|
type: array
|
|
items:
|
|
type: string
|
|
client:
|
|
description: Describes clients authorized to access a server.
|
|
type: object
|
|
properties:
|
|
networks:
|
|
description: >-
|
|
Limits the client IP addresses to which this
|
|
authorization applies. If unset, the server chooses a
|
|
default (typically, all IPs or the cluster's pod
|
|
network).
|
|
type: array
|
|
items:
|
|
type: object
|
|
required: [cidr]
|
|
properties:
|
|
cidr:
|
|
type: string
|
|
except:
|
|
type: array
|
|
items:
|
|
type: string
|
|
unauthenticated:
|
|
description: >-
|
|
Authorizes unauthenticated clients to access a server.
|
|
type: boolean
|
|
meshTLS:
|
|
type: object
|
|
properties:
|
|
unauthenticatedTLS:
|
|
type: boolean
|
|
description: >-
|
|
Indicates that no client identity is required for
|
|
communication.
|
|
|
|
This is mostly important for the identity
|
|
controller, which must terminate TLS connections
|
|
from clients that do not yet have a certificate.
|
|
identities:
|
|
description: >-
|
|
Authorizes clients with the provided proxy identity
|
|
strings (as provided via MTLS)
|
|
|
|
The `*` prefix can be used to match all identities in
|
|
a domain. An identity string of `*` indicates that
|
|
all authentication clients are authorized.
|
|
type: array
|
|
items:
|
|
type: string
|
|
pattern: '^(\*|[a-z0-9]([-a-z0-9]*[a-z0-9])?)(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$'
|
|
serviceAccounts:
|
|
description: >-
|
|
Authorizes clients with the provided proxy identity
|
|
service accounts (as provided via MTLS)
|
|
type: array
|
|
items:
|
|
type: object
|
|
required: [name]
|
|
properties:
|
|
name:
|
|
description: The ServiceAccount's name.
|
|
type: string
|
|
pattern: '^[a-z0-9]([-a-z0-9]*[a-z0-9])?$'
|
|
namespace:
|
|
description: >-
|
|
The ServiceAccount's namespace. If unset, the
|
|
authorization's namespace is used.
|
|
type: string
|
|
pattern: '^[a-z0-9]([-a-z0-9]*[a-z0-9])?$'
|
|
- name: v1beta1
|
|
served: true
|
|
storage: true
|
|
schema:
|
|
openAPIV3Schema:
|
|
type: object
|
|
required: [spec]
|
|
properties:
|
|
spec:
|
|
description: >-
|
|
Authorizes clients to communicate with Linkerd-proxied servers.
|
|
type: object
|
|
required: [server, client]
|
|
properties:
|
|
server:
|
|
description: >-
|
|
Identifies servers in the same namespace for which this
|
|
authorization applies.
|
|
|
|
Only one of `name` or `selector` may be specified.
|
|
type: object
|
|
oneOf:
|
|
- required: [name]
|
|
- required: [selector]
|
|
properties:
|
|
name:
|
|
description: References a `Server` instance by name
|
|
type: string
|
|
pattern: '^[a-z0-9]([-a-z0-9]*[a-z0-9])?$'
|
|
selector:
|
|
description: >-
|
|
A label query over servers on which this authorization applies.
|
|
type: object
|
|
properties:
|
|
matchLabels:
|
|
type: object
|
|
x-kubernetes-preserve-unknown-fields: true
|
|
matchExpressions:
|
|
type: array
|
|
items:
|
|
type: object
|
|
required: [key, operator]
|
|
properties:
|
|
key:
|
|
type: string
|
|
operator:
|
|
type: string
|
|
enum: [In, NotIn, Exists, DoesNotExist]
|
|
values:
|
|
type: array
|
|
items:
|
|
type: string
|
|
client:
|
|
description: Describes clients authorized to access a server.
|
|
type: object
|
|
properties:
|
|
networks:
|
|
description: >-
|
|
Limits the client IP addresses to which this
|
|
authorization applies. If unset, the server chooses a
|
|
default (typically, all IPs or the cluster's pod
|
|
network).
|
|
type: array
|
|
items:
|
|
type: object
|
|
required: [cidr]
|
|
properties:
|
|
cidr:
|
|
type: string
|
|
except:
|
|
type: array
|
|
items:
|
|
type: string
|
|
unauthenticated:
|
|
description: >-
|
|
Authorizes unauthenticated clients to access a server.
|
|
type: boolean
|
|
meshTLS:
|
|
type: object
|
|
properties:
|
|
unauthenticatedTLS:
|
|
type: boolean
|
|
description: >-
|
|
Indicates that no client identity is required for
|
|
communication.
|
|
|
|
This is mostly important for the identity
|
|
controller, which must terminate TLS connections
|
|
from clients that do not yet have a certificate.
|
|
identities:
|
|
description: >-
|
|
Authorizes clients with the provided proxy identity
|
|
strings (as provided via MTLS)
|
|
|
|
The `*` prefix can be used to match all identities in
|
|
a domain. An identity string of `*` indicates that
|
|
all authentication clients are authorized.
|
|
type: array
|
|
items:
|
|
type: string
|
|
pattern: '^(\*|[a-z0-9]([-a-z0-9]*[a-z0-9])?)(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$'
|
|
serviceAccounts:
|
|
description: >-
|
|
Authorizes clients with the provided proxy identity
|
|
service accounts (as provided via MTLS)
|
|
type: array
|
|
items:
|
|
type: object
|
|
required: [name]
|
|
properties:
|
|
name:
|
|
description: The ServiceAccount's name.
|
|
type: string
|
|
pattern: '^[a-z0-9]([-a-z0-9]*[a-z0-9])?$'
|
|
namespace:
|
|
description: >-
|
|
The ServiceAccount's namespace. If unset, the
|
|
authorization's namespace is used.
|
|
type: string
|
|
pattern: '^[a-z0-9]([-a-z0-9]*[a-z0-9])?$'
|
|
additionalPrinterColumns:
|
|
- name: Server
|
|
type: string
|
|
description: The server that this grants access to
|
|
jsonPath: .spec.server.name
|