github/capsule
1
0
Fork 0
mirror of https://github.com/projectcapsule/capsule.git synced 2026-09-08 16:27:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: add externalip to rules api (#2099)

Browse Source 
Signed-off-by: Oliver Baehler <oliver@sudo-i.net>
This commit is contained in:
Oliver Bähler
2026-08-24 08:37:50 +02:00
committed by GitHub
parent 7f56e957d6
commit 7b146871d6
10 changed files with 789 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/ruleengine/validate.go
+14
View File
@@ -415,6 +415,20 @@ func validateServiceRules(
}
}
if services.ExternalIPs != nil {
for j, cidr := range services.ExternalIPs.CIDRs {
if err := validateCIDR(cidr); err != nil {
return fmt.Errorf(
"rules[%d].enforce.services.externalIPs.cidrs[%d] %q is invalid: %w",
ruleIndex,
j,
cidr,
err,
)
}
}
}
if services.ExternalNames != nil {
for j, hostname := range services.ExternalNames.Hostnames {
if err := validateExpressionMatch(
pkg/ruleengine/validate_test.go
+72
View File
@@ -647,6 +647,78 @@ func TestValidateRuleStatusBody(t *testing.T) {
},
wantErr: `rules[0].enforce.services.loadBalancers.cidrs[0] "" is invalid: CIDR is empty`,
},
{
name: "invalid external IP CIDR",
mapper: mapper,
bodies: []*rules.NamespaceRuleBodyNamespace{
{
Enforce: &rules.NamespaceRuleEnforceBody{
Services: rules.NamespaceRuleEnforceServicesBody{
ExternalIPs: &rules.ServiceExternalIPRule{
CIDRs: []string{
"10.20.0.0/33",
},
},
},
},
},
},
wantErr: `rules[0].enforce.services.externalIPs.cidrs[0] "10.20.0.0/33" is invalid`,
},
{
name: "empty external IP CIDR entry",
mapper: mapper,
bodies: []*rules.NamespaceRuleBodyNamespace{
{
Enforce: &rules.NamespaceRuleEnforceBody{
Services: rules.NamespaceRuleEnforceServicesBody{
ExternalIPs: &rules.ServiceExternalIPRule{
CIDRs: []string{
"",
},
},
},
},
},
},
wantErr: `rules[0].enforce.services.externalIPs.cidrs[0] "" is invalid: CIDR is empty`,
},
{
name: "external IP CIDRs are valid",
mapper: mapper,
bodies: []*rules.NamespaceRuleBodyNamespace{
{
Enforce: &rules.NamespaceRuleEnforceBody{
Action: rules.ActionTypeAllow,
Services: rules.NamespaceRuleEnforceServicesBody{
ExternalIPs: &rules.ServiceExternalIPRule{
CIDRs: []string{
"10.20.0.0/16",
"192.168.1.2",
"2001:db8::/32",
},
},
},
},
},
},
},
{
name: "empty external IP CIDR deny rule is valid",
mapper: mapper,
bodies: []*rules.NamespaceRuleBodyNamespace{
{
Enforce: &rules.NamespaceRuleEnforceBody{
Action: rules.ActionTypeDeny,
Services: rules.NamespaceRuleEnforceServicesBody{
ExternalIPs: &rules.ServiceExternalIPRule{
CIDRs: []string{},
},
},
},
},
},
},
{
name: "invalid externalName hostname regex",
mapper: mapper,