feat: add externalip to rules api (#2099)

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

pkg/api/rules/enforce_services_types.go

@@ -23,6 +23,10 @@ type NamespaceRuleEnforceServicesBody struct {
 	// +optional
 	LoadBalancers *ServiceLoadBalancerRule `json:"loadBalancers,omitempty"`
 
+	// ExternalIPs defines constraints for spec.externalIPs.
+	// +optional
+	ExternalIPs *ServiceExternalIPRule `json:"externalIPs,omitempty"`
+
 	// ExternalNames defines additional constraints for Services of type ExternalName.
 	// +optional
 	ExternalNames *ServiceExternalNameRule `json:"externalNames,omitempty"`
@@ -50,6 +54,16 @@ type ServiceLoadBalancerRule struct {
 	CIDRs []string `json:"cidrs,omitempty"`
 }
 
+// +kubebuilder:object:generate=true
+type ServiceExternalIPRule struct {
+	// CIDRs restricts spec.externalIPs. Individual IP addresses are treated as
+	// host CIDRs (/32 for IPv4 and /128 for IPv6).
+	// For deny rules, empty means all external IPs are denied. For allow and
+	// audit rules, empty means no external IP restriction.
+	// +optional
+	CIDRs []string `json:"cidrs,omitempty"`
+}
+
 // +kubebuilder:object:generate=true
 type ServiceExternalNameRule struct {
 	// Hostnames restricts spec.externalName.

pkg/api/rules/zz_generated.deepcopy.go

@@ -214,6 +214,11 @@ func (in *NamespaceRuleEnforceServicesBody) DeepCopyInto(out *NamespaceRuleEnfor
 		*out = new(ServiceLoadBalancerRule)
 		(*in).DeepCopyInto(*out)
 	}
+	if in.ExternalIPs != nil {
+		in, out := &in.ExternalIPs, &out.ExternalIPs
+		*out = new(ServiceExternalIPRule)
+		(*in).DeepCopyInto(*out)
+	}
 	if in.ExternalNames != nil {
 		in, out := &in.ExternalNames, &out.ExternalNames
 		*out = new(ServiceExternalNameRule)
@@ -375,6 +380,26 @@ func (in *ResourceQuotaRule) DeepCopy() *ResourceQuotaRule {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ServiceExternalIPRule) DeepCopyInto(out *ServiceExternalIPRule) {
+	*out = *in
+	if in.CIDRs != nil {
+		in, out := &in.CIDRs, &out.CIDRs
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ServiceExternalIPRule.
+func (in *ServiceExternalIPRule) DeepCopy() *ServiceExternalIPRule {
+	if in == nil {
+		return nil
+	}
+	out := new(ServiceExternalIPRule)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *ServiceExternalNameRule) DeepCopyInto(out *ServiceExternalNameRule) {
 	*out = *in

pkg/ruleengine/validate.go

@@ -415,6 +415,20 @@ func validateServiceRules(
 		}
 	}
 
+	if services.ExternalIPs != nil {
+		for j, cidr := range services.ExternalIPs.CIDRs {
+			if err := validateCIDR(cidr); err != nil {
+				return fmt.Errorf(
+					"rules[%d].enforce.services.externalIPs.cidrs[%d] %q is invalid: %w",
+					ruleIndex,
+					j,
+					cidr,
+					err,
+				)
+			}
+		}
+	}
+
 	if services.ExternalNames != nil {
 		for j, hostname := range services.ExternalNames.Hostnames {
 			if err := validateExpressionMatch(

pkg/ruleengine/validate_test.go

@@ -647,6 +647,78 @@ func TestValidateRuleStatusBody(t *testing.T) {
 			},
 			wantErr: `rules[0].enforce.services.loadBalancers.cidrs[0] "" is invalid: CIDR is empty`,
 		},
+		{
+			name:   "invalid external IP CIDR",
+			mapper: mapper,
+			bodies: []*rules.NamespaceRuleBodyNamespace{
+				{
+					Enforce: &rules.NamespaceRuleEnforceBody{
+						Services: rules.NamespaceRuleEnforceServicesBody{
+							ExternalIPs: &rules.ServiceExternalIPRule{
+								CIDRs: []string{
+									"10.20.0.0/33",
+								},
+							},
+						},
+					},
+				},
+			},
+			wantErr: `rules[0].enforce.services.externalIPs.cidrs[0] "10.20.0.0/33" is invalid`,
+		},
+		{
+			name:   "empty external IP CIDR entry",
+			mapper: mapper,
+			bodies: []*rules.NamespaceRuleBodyNamespace{
+				{
+					Enforce: &rules.NamespaceRuleEnforceBody{
+						Services: rules.NamespaceRuleEnforceServicesBody{
+							ExternalIPs: &rules.ServiceExternalIPRule{
+								CIDRs: []string{
+									"",
+								},
+							},
+						},
+					},
+				},
+			},
+			wantErr: `rules[0].enforce.services.externalIPs.cidrs[0] "" is invalid: CIDR is empty`,
+		},
+		{
+			name:   "external IP CIDRs are valid",
+			mapper: mapper,
+			bodies: []*rules.NamespaceRuleBodyNamespace{
+				{
+					Enforce: &rules.NamespaceRuleEnforceBody{
+						Action: rules.ActionTypeAllow,
+						Services: rules.NamespaceRuleEnforceServicesBody{
+							ExternalIPs: &rules.ServiceExternalIPRule{
+								CIDRs: []string{
+									"10.20.0.0/16",
+									"192.168.1.2",
+									"2001:db8::/32",
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+		{
+			name:   "empty external IP CIDR deny rule is valid",
+			mapper: mapper,
+			bodies: []*rules.NamespaceRuleBodyNamespace{
+				{
+					Enforce: &rules.NamespaceRuleEnforceBody{
+						Action: rules.ActionTypeDeny,
+						Services: rules.NamespaceRuleEnforceServicesBody{
+							ExternalIPs: &rules.ServiceExternalIPRule{
+								CIDRs: []string{},
+							},
+						},
+					},
+				},
+			},
+		},
 		{
 			name:   "invalid externalName hostname regex",
 			mapper: mapper,