feat(rules): add service enforcement rules (#1982)

* fix(controller): decode old object for delete requests Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * chore: modernize golang Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * chore: modernize golang Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * chore: modernize golang Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * fix: preserve ca-bundles injected from external providers Signed-off-by: Oliver Baehler <oliver@sudo-i.net> * feat(rules): add service enforcement rules Signed-off-by: Oliver Baehler <oliver@sudo-i.net> * feat(rules): add service enforcement rules Signed-off-by: Oliver Baehler <oliver@sudo-i.net> * feat(rules): add service enforcement rules Signed-off-by: Oliver Baehler <oliver@sudo-i.net> * feat(rules): add service enforcement rules Signed-off-by: Oliver Baehler <oliver@sudo-i.net> * feat(rules): add service enforcement rules Signed-off-by: Oliver Baehler <oliver@sudo-i.net> --------- Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> Signed-off-by: Oliver Baehler <oliver@sudo-i.net>
2026-08-25 16:07:24 +00:00 · 2026-06-24 11:20:23 +02:00
parent 7669abf063
commit 755cef54bf
63 changed files with 10168 additions and 1435 deletions
@@ -91,10 +91,20 @@ spec:
  rules:
  - enforce:
      action: "allow"
-      workloads:
-        schedulers:
-        - exact:
-            - "{{ .tenant.metadata.name }}-scheduler"
+      services:
+        types: ["ClusterIP", "NodePort", "LoadBalancer", "ExternalName"]
+        loadBalancers:
+          cidrs:
+            - 10.0.0.2/32
+        externalNames:
+          hostnames:
+            - exp: ".*\\.example\\.com"
+              exact:
+                - "internal.git.com"
+        nodePorts:
+          ports:
+            - from: 30000
+              to: 32767
 ---
 apiVersion: capsule.clastix.io/v1beta2
 kind: Tenant