Network policies and policy communities. #572
Draft
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
- Still needs community and policy assigment endpoints. - Hard to fix in host create view and serializer due to the same issues we've seen before. - Will make specialized endpoints.
pederhan
reviewed
Jan 27, 2025
pederhan
reviewed
Jan 27, 2025
Co-authored-by: Peder Hovdan Andresen <107681714+pederhan@users.noreply.github.com>
- Fix it so policy-ID isn't required in POST for creating communities (it comes from THE URL). - ruff format on the files created for this PR only. - Update `pyproject.toml` to use the `tool.ruff.lint` namespace for selected rules.
… case insensitive.
- Duplcated names now gives 409 instead of 400. Sadly, the default returned from Django on duplicated entries in the database is 400, and we want 409. - The NetworkPolicyAttribute 'isolated' is now persistent, created during migration, and may not be renamed, deleted, or otherwise removed. One can however change its description.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Add support for networks to have policies and communities.
This PR allows for networks to have policies applied to them. Network policies consists of two things:
Legal attributes are defined by adding or removing entries to networkattributes.
Purpose
Say you want to create an isolated network, but within this network you want a set of communities that can talk together. You can do this creating a network attribute (
isolated), and then create a network policy that includes that attribute. You then apply that policy to the network in question. Listing the network will now (hopefully) show the attribute.Now, within this policy, you may create two communities,
fooandbar. You can then add hosts to these communities. Note that to add a host to a community, at least one of the IPs of the host has to be in the network that the policy the community belongs to.Changes
When creating a host, one may add a
network_communityattribute to the JSON, which takes the parameter of a network community ID that the host is to be assigned to. Note that this requires the host to be created with a network or an IP as a host cannot be a member of a network community that belongs to a network policy that again belongs to a network to which the host has no IPs.Removing / changing policies
Since hosts may belong to communities that belong to policies, trying to change IPs on a host now requires a check to see if the new IP can belong to the community of the host. If that isn't the case, we return a 409.
(This description is currently incomplete.)