diff --git a/api/v1beta1/common_types.go b/api/v1beta1/common_types.go index b929e31..0a8eca9 100644 --- a/api/v1beta1/common_types.go +++ b/api/v1beta1/common_types.go @@ -4,17 +4,38 @@ package v1beta1 // NOTE: json tags are required. Any new fields you add must have json tags for the fields to be serialized. // FirewallRuleSpec defines the desired state of FirewallRule. -type ServiceSpec struct { +type NamedUnifiResource struct { + Name string `json:"name,omitempty"` + ID string `json:"id,omitempty"` +} + +type ServiceEntry struct { Namespace string `json:"namespace,omitempty"` Name string `json:"name,omitempty"` } +type FirewallGroupEntry struct { + Namespace string `json:"namespace,omitempty"` + Name string `json:"name,omitempty"` +} +type FirewallZoneEntry struct { + Namespace string `json:"namespace,omitempty"` + Name string `json:"name,omitempty"` +} +type FirewallRuleEntry struct { + Namespace string `json:"namespace,omitempty"` + Name string `json:"name,omitempty"` +} +type NetworkEntry struct { + Namespace string `json:"namespace,omitempty"` + Name string `json:"name,omitempty"` +} type FirewallSource struct { - Zones []string `json:"from_zones,omitempty"` - Networks []string `json:"from_networks,omitempty"` + FirewallZones []FirewallZoneEntry `json:"from_zones,omitempty"` + Networks []NetworkEntry `json:"from_networks,omitempty"` } type FirewallDestination struct { - FirewallGroups []string `json:"firewall_group,omitempty"` - Services []ServiceSpec `json:"service,omitempty"` + FirewallGroups []FirewallGroupEntry `json:"firewall_groups,omitempty"` + Services []ServiceEntry `json:"services,omitempty"` } diff --git a/api/v1beta1/firewallgroup_types.go b/api/v1beta1/firewallgroup_types.go index be83790..db1dec5 100644 --- a/api/v1beta1/firewallgroup_types.go +++ b/api/v1beta1/firewallgroup_types.go @@ -31,15 +31,17 @@ type FirewallGroupSpec struct { // Foo is an example field of FirewallGroup. Edit firewallgroup_types.go to remove/update // Description is a human-readable explanation for the object + ID string `json:"id,omitempty"` Name string `json:"name,omitempty"` MatchServicesInAllNamespaces bool `json:"matchServicesInAllNamespaces,omitempty"` // ManualAddresses is a list of manual IPs or CIDRs (IPv4 or IPv6) // +optional - ManualAddresses []string `json:"manualAddresses,omitempty"` - ManualPorts []string `json:"manualPorts,omitempty"` + ManualAddresses []string `json:"manualAddresses,omitempty"` + ManualPorts []string `json:"manualPorts,omitempty"` + ManualServices []ServiceEntry `json:"manual_services,omitempty"` - AutoCreatedFrom ServiceSpec `json:"auto_created_from,omitempty"` + AutoCreatedFrom FirewallRuleEntry `json:"auto_created_from,omitempty"` // AutoIncludeSelector defines which services to extract addresses from // +optional @@ -51,17 +53,29 @@ type FirewallGroupStatus struct { // INSERT ADDITIONAL STATUS FIELD - define observed state of cluster // Important: Run "make" to regenerate code after modifying this file - ResolvedAddresses []string `json:"resolvedAddresses,omitempty"` + ResolvedIPV4Addresses []string `json:"resolvedIPV4Addresses,omitempty"` + ResolvedIPV6Addresses []string `json:"resolvedIPV6Addresses,omitempty"` + ResolvedTCPPorts []string `json:"resolvedTCPorts,omitempty"` + ResolvedUDPPorts []string `json:"resolvedUDPorts,omitempty"` // SyncedWithUnifi indicates whether the addresses are successfully pushed // +optional SyncedWithUnifi bool `json:"syncedWithUnifi,omitempty"` + ResourcesManaged *FirewallGroupResourcesManaged `json:"resources_managed,omitempty"` + // LastSyncTime is the last time the object was synced // +optional LastSyncTime *metav1.Time `json:"lastSyncTime,omitempty"` } +type FirewallGroupResourcesManaged struct { + IPV4Object *NamedUnifiResource `json:"ipv4_object,omitempty"` + IPV6Object *NamedUnifiResource `json:"ipv6_object,omitempty"` + TCPPortsObject *NamedUnifiResource `json:"tcp_ports_object,omitempty"` + UDPPortsObject *NamedUnifiResource `json:"udp_ports_object,omitempty"` +} + // +kubebuilder:object:root=true // +kubebuilder:subresource:status diff --git a/api/v1beta1/firewallrule_types.go b/api/v1beta1/firewallrule_types.go index d77c8aa..9fb72c6 100644 --- a/api/v1beta1/firewallrule_types.go +++ b/api/v1beta1/firewallrule_types.go @@ -54,6 +54,19 @@ type FirewallRuleSpec struct { type FirewallRuleStatus struct { // INSERT ADDITIONAL STATUS FIELD - define observed state of cluster // Important: Run "make" to regenerate code after modifying this file + + ResourcesManaged *FirewallRuleResourcesManaged `json:"resources_managed,omitempty"` +} + +type FirewallRuleResourcesManaged struct { + UnifiFirewallRules []UnifiFirewallRuleEntry `json:"firewall_rules_managed,omitempty"` + FirewallGroups []FirewallGroupEntry `json:"firewall_groups_managed,omitempty"` +} + +type UnifiFirewallRuleEntry struct { + From string `json:"from"` + To string `json:"to"` + RuleID string `json:"rule_id"` } // +kubebuilder:object:root=true diff --git a/api/v1beta1/firewallzone_types.go b/api/v1beta1/firewallzone_types.go index 34dc4e7..f579e6a 100644 --- a/api/v1beta1/firewallzone_types.go +++ b/api/v1beta1/firewallzone_types.go @@ -39,6 +39,12 @@ type FirewallZoneSpec struct { type FirewallZoneStatus struct { // INSERT ADDITIONAL STATUS FIELD - define observed state of cluster // Important: Run "make" to regenerate code after modifying this file + + ResourcesManaged *FirewallZoneResourcesManaged `json:"resources_managed,omitempty"` +} + +type FirewallZoneResourcesManaged struct { + UnifiFirewallZones []NamedUnifiResource `json:"firewall_zones_managed,omitempty"` } // +kubebuilder:object:root=true diff --git a/api/v1beta1/networkconfiguration_types.go b/api/v1beta1/networkconfiguration_types.go index 4157159..c6fc793 100644 --- a/api/v1beta1/networkconfiguration_types.go +++ b/api/v1beta1/networkconfiguration_types.go @@ -58,11 +58,16 @@ type NetworkconfigurationStatus struct { // +optional SyncedWithUnifi bool `json:"syncedWithUnifi,omitempty"` + ResourcesManaged *NetworkconfigurationResourcesManaged `json:"resources_managed,omitempty"` // LastSyncTime is the last time the object was synced // +optional LastSyncTime *metav1.Time `json:"lastSyncTime,omitempty"` } +type NetworkconfigurationResourcesManaged struct { + UnifiNetworks []NamedUnifiResource `json:"networks_managed,omitempty"` +} + // +kubebuilder:object:root=true // +kubebuilder:subresource:status diff --git a/api/v1beta1/zz_generated.deepcopy.go b/api/v1beta1/zz_generated.deepcopy.go index e28d8c0..2c5bb7f 100644 --- a/api/v1beta1/zz_generated.deepcopy.go +++ b/api/v1beta1/zz_generated.deepcopy.go @@ -30,12 +30,12 @@ func (in *FirewallDestination) DeepCopyInto(out *FirewallDestination) { *out = *in if in.FirewallGroups != nil { in, out := &in.FirewallGroups, &out.FirewallGroups - *out = make([]string, len(*in)) + *out = make([]FirewallGroupEntry, len(*in)) copy(*out, *in) } if in.Services != nil { in, out := &in.Services, &out.Services - *out = make([]ServiceSpec, len(*in)) + *out = make([]ServiceEntry, len(*in)) copy(*out, *in) } } @@ -77,6 +77,21 @@ func (in *FirewallGroup) DeepCopyObject() runtime.Object { return nil } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *FirewallGroupEntry) DeepCopyInto(out *FirewallGroupEntry) { + *out = *in +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new FirewallGroupEntry. +func (in *FirewallGroupEntry) DeepCopy() *FirewallGroupEntry { + if in == nil { + return nil + } + out := new(FirewallGroupEntry) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *FirewallGroupList) DeepCopyInto(out *FirewallGroupList) { *out = *in @@ -109,6 +124,41 @@ func (in *FirewallGroupList) DeepCopyObject() runtime.Object { return nil } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *FirewallGroupResourcesManaged) DeepCopyInto(out *FirewallGroupResourcesManaged) { + *out = *in + if in.IPV4Object != nil { + in, out := &in.IPV4Object, &out.IPV4Object + *out = new(NamedUnifiResource) + **out = **in + } + if in.IPV6Object != nil { + in, out := &in.IPV6Object, &out.IPV6Object + *out = new(NamedUnifiResource) + **out = **in + } + if in.TCPPortsObject != nil { + in, out := &in.TCPPortsObject, &out.TCPPortsObject + *out = new(NamedUnifiResource) + **out = **in + } + if in.UDPPortsObject != nil { + in, out := &in.UDPPortsObject, &out.UDPPortsObject + *out = new(NamedUnifiResource) + **out = **in + } +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new FirewallGroupResourcesManaged. +func (in *FirewallGroupResourcesManaged) DeepCopy() *FirewallGroupResourcesManaged { + if in == nil { + return nil + } + out := new(FirewallGroupResourcesManaged) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *FirewallGroupSpec) DeepCopyInto(out *FirewallGroupSpec) { *out = *in @@ -122,6 +172,11 @@ func (in *FirewallGroupSpec) DeepCopyInto(out *FirewallGroupSpec) { *out = make([]string, len(*in)) copy(*out, *in) } + if in.ManualServices != nil { + in, out := &in.ManualServices, &out.ManualServices + *out = make([]ServiceEntry, len(*in)) + copy(*out, *in) + } out.AutoCreatedFrom = in.AutoCreatedFrom if in.AutoIncludeSelector != nil { in, out := &in.AutoIncludeSelector, &out.AutoIncludeSelector @@ -143,11 +198,31 @@ func (in *FirewallGroupSpec) DeepCopy() *FirewallGroupSpec { // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *FirewallGroupStatus) DeepCopyInto(out *FirewallGroupStatus) { *out = *in - if in.ResolvedAddresses != nil { - in, out := &in.ResolvedAddresses, &out.ResolvedAddresses + if in.ResolvedIPV4Addresses != nil { + in, out := &in.ResolvedIPV4Addresses, &out.ResolvedIPV4Addresses *out = make([]string, len(*in)) copy(*out, *in) } + if in.ResolvedIPV6Addresses != nil { + in, out := &in.ResolvedIPV6Addresses, &out.ResolvedIPV6Addresses + *out = make([]string, len(*in)) + copy(*out, *in) + } + if in.ResolvedTCPPorts != nil { + in, out := &in.ResolvedTCPPorts, &out.ResolvedTCPPorts + *out = make([]string, len(*in)) + copy(*out, *in) + } + if in.ResolvedUDPPorts != nil { + in, out := &in.ResolvedUDPPorts, &out.ResolvedUDPPorts + *out = make([]string, len(*in)) + copy(*out, *in) + } + if in.ResourcesManaged != nil { + in, out := &in.ResourcesManaged, &out.ResourcesManaged + *out = new(FirewallGroupResourcesManaged) + (*in).DeepCopyInto(*out) + } if in.LastSyncTime != nil { in, out := &in.LastSyncTime, &out.LastSyncTime *out = (*in).DeepCopy() @@ -170,7 +245,7 @@ func (in *FirewallRule) DeepCopyInto(out *FirewallRule) { out.TypeMeta = in.TypeMeta in.ObjectMeta.DeepCopyInto(&out.ObjectMeta) in.Spec.DeepCopyInto(&out.Spec) - out.Status = in.Status + in.Status.DeepCopyInto(&out.Status) } // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new FirewallRule. @@ -191,6 +266,21 @@ func (in *FirewallRule) DeepCopyObject() runtime.Object { return nil } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *FirewallRuleEntry) DeepCopyInto(out *FirewallRuleEntry) { + *out = *in +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new FirewallRuleEntry. +func (in *FirewallRuleEntry) DeepCopy() *FirewallRuleEntry { + if in == nil { + return nil + } + out := new(FirewallRuleEntry) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *FirewallRuleList) DeepCopyInto(out *FirewallRuleList) { *out = *in @@ -223,6 +313,31 @@ func (in *FirewallRuleList) DeepCopyObject() runtime.Object { return nil } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *FirewallRuleResourcesManaged) DeepCopyInto(out *FirewallRuleResourcesManaged) { + *out = *in + if in.UnifiFirewallRules != nil { + in, out := &in.UnifiFirewallRules, &out.UnifiFirewallRules + *out = make([]UnifiFirewallRuleEntry, len(*in)) + copy(*out, *in) + } + if in.FirewallGroups != nil { + in, out := &in.FirewallGroups, &out.FirewallGroups + *out = make([]FirewallGroupEntry, len(*in)) + copy(*out, *in) + } +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new FirewallRuleResourcesManaged. +func (in *FirewallRuleResourcesManaged) DeepCopy() *FirewallRuleResourcesManaged { + if in == nil { + return nil + } + out := new(FirewallRuleResourcesManaged) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *FirewallRuleSpec) DeepCopyInto(out *FirewallRuleSpec) { *out = *in @@ -243,6 +358,11 @@ func (in *FirewallRuleSpec) DeepCopy() *FirewallRuleSpec { // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *FirewallRuleStatus) DeepCopyInto(out *FirewallRuleStatus) { *out = *in + if in.ResourcesManaged != nil { + in, out := &in.ResourcesManaged, &out.ResourcesManaged + *out = new(FirewallRuleResourcesManaged) + (*in).DeepCopyInto(*out) + } } // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new FirewallRuleStatus. @@ -258,14 +378,14 @@ func (in *FirewallRuleStatus) DeepCopy() *FirewallRuleStatus { // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *FirewallSource) DeepCopyInto(out *FirewallSource) { *out = *in - if in.Zones != nil { - in, out := &in.Zones, &out.Zones - *out = make([]string, len(*in)) + if in.FirewallZones != nil { + in, out := &in.FirewallZones, &out.FirewallZones + *out = make([]FirewallZoneEntry, len(*in)) copy(*out, *in) } if in.Networks != nil { in, out := &in.Networks, &out.Networks - *out = make([]string, len(*in)) + *out = make([]NetworkEntry, len(*in)) copy(*out, *in) } } @@ -286,7 +406,7 @@ func (in *FirewallZone) DeepCopyInto(out *FirewallZone) { out.TypeMeta = in.TypeMeta in.ObjectMeta.DeepCopyInto(&out.ObjectMeta) in.Spec.DeepCopyInto(&out.Spec) - out.Status = in.Status + in.Status.DeepCopyInto(&out.Status) } // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new FirewallZone. @@ -307,6 +427,21 @@ func (in *FirewallZone) DeepCopyObject() runtime.Object { return nil } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *FirewallZoneEntry) DeepCopyInto(out *FirewallZoneEntry) { + *out = *in +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new FirewallZoneEntry. +func (in *FirewallZoneEntry) DeepCopy() *FirewallZoneEntry { + if in == nil { + return nil + } + out := new(FirewallZoneEntry) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *FirewallZoneList) DeepCopyInto(out *FirewallZoneList) { *out = *in @@ -339,6 +474,26 @@ func (in *FirewallZoneList) DeepCopyObject() runtime.Object { return nil } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *FirewallZoneResourcesManaged) DeepCopyInto(out *FirewallZoneResourcesManaged) { + *out = *in + if in.UnifiFirewallZones != nil { + in, out := &in.UnifiFirewallZones, &out.UnifiFirewallZones + *out = make([]NamedUnifiResource, len(*in)) + copy(*out, *in) + } +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new FirewallZoneResourcesManaged. +func (in *FirewallZoneResourcesManaged) DeepCopy() *FirewallZoneResourcesManaged { + if in == nil { + return nil + } + out := new(FirewallZoneResourcesManaged) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *FirewallZoneSpec) DeepCopyInto(out *FirewallZoneSpec) { *out = *in @@ -362,6 +517,11 @@ func (in *FirewallZoneSpec) DeepCopy() *FirewallZoneSpec { // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *FirewallZoneStatus) DeepCopyInto(out *FirewallZoneStatus) { *out = *in + if in.ResourcesManaged != nil { + in, out := &in.ResourcesManaged, &out.ResourcesManaged + *out = new(FirewallZoneResourcesManaged) + (*in).DeepCopyInto(*out) + } } // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new FirewallZoneStatus. @@ -374,6 +534,36 @@ func (in *FirewallZoneStatus) DeepCopy() *FirewallZoneStatus { return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *NamedUnifiResource) DeepCopyInto(out *NamedUnifiResource) { + *out = *in +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NamedUnifiResource. +func (in *NamedUnifiResource) DeepCopy() *NamedUnifiResource { + if in == nil { + return nil + } + out := new(NamedUnifiResource) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *NetworkEntry) DeepCopyInto(out *NetworkEntry) { + *out = *in +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NetworkEntry. +func (in *NetworkEntry) DeepCopy() *NetworkEntry { + if in == nil { + return nil + } + out := new(NetworkEntry) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *Networkconfiguration) DeepCopyInto(out *Networkconfiguration) { *out = *in @@ -433,6 +623,26 @@ func (in *NetworkconfigurationList) DeepCopyObject() runtime.Object { return nil } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *NetworkconfigurationResourcesManaged) DeepCopyInto(out *NetworkconfigurationResourcesManaged) { + *out = *in + if in.UnifiNetworks != nil { + in, out := &in.UnifiNetworks, &out.UnifiNetworks + *out = make([]NamedUnifiResource, len(*in)) + copy(*out, *in) + } +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NetworkconfigurationResourcesManaged. +func (in *NetworkconfigurationResourcesManaged) DeepCopy() *NetworkconfigurationResourcesManaged { + if in == nil { + return nil + } + out := new(NetworkconfigurationResourcesManaged) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *NetworkconfigurationSpec) DeepCopyInto(out *NetworkconfigurationSpec) { *out = *in @@ -451,6 +661,11 @@ func (in *NetworkconfigurationSpec) DeepCopy() *NetworkconfigurationSpec { // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *NetworkconfigurationStatus) DeepCopyInto(out *NetworkconfigurationStatus) { *out = *in + if in.ResourcesManaged != nil { + in, out := &in.ResourcesManaged, &out.ResourcesManaged + *out = new(NetworkconfigurationResourcesManaged) + (*in).DeepCopyInto(*out) + } if in.LastSyncTime != nil { in, out := &in.LastSyncTime, &out.LastSyncTime *out = (*in).DeepCopy() @@ -468,16 +683,31 @@ func (in *NetworkconfigurationStatus) DeepCopy() *NetworkconfigurationStatus { } // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *ServiceSpec) DeepCopyInto(out *ServiceSpec) { +func (in *ServiceEntry) DeepCopyInto(out *ServiceEntry) { *out = *in } -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ServiceSpec. -func (in *ServiceSpec) DeepCopy() *ServiceSpec { +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ServiceEntry. +func (in *ServiceEntry) DeepCopy() *ServiceEntry { if in == nil { return nil } - out := new(ServiceSpec) + out := new(ServiceEntry) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *UnifiFirewallRuleEntry) DeepCopyInto(out *UnifiFirewallRuleEntry) { + *out = *in +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new UnifiFirewallRuleEntry. +func (in *UnifiFirewallRuleEntry) DeepCopy() *UnifiFirewallRuleEntry { + if in == nil { + return nil + } + out := new(UnifiFirewallRuleEntry) in.DeepCopyInto(out) return out } diff --git a/config/crd/bases/unifi.engen.priv.no_firewallgroups.yaml b/config/crd/bases/unifi.engen.priv.no_firewallgroups.yaml index 54e7f4b..415a0b8 100644 --- a/config/crd/bases/unifi.engen.priv.no_firewallgroups.yaml +++ b/config/crd/bases/unifi.engen.priv.no_firewallgroups.yaml @@ -39,7 +39,6 @@ spec: spec: properties: auto_created_from: - description: FirewallRuleSpec defines the desired state of FirewallRule. properties: name: type: string @@ -93,6 +92,20 @@ spec: type: object type: object x-kubernetes-map-type: atomic + id: + description: |- + Foo is an example field of FirewallGroup. Edit firewallgroup_types.go to remove/update + Description is a human-readable explanation for the object + type: string + manual_services: + items: + properties: + name: + type: string + namespace: + type: string + type: object + type: array manualAddresses: description: ManualAddresses is a list of manual IPs or CIDRs (IPv4 or IPv6) @@ -106,9 +119,6 @@ spec: matchServicesInAllNamespaces: type: boolean name: - description: |- - Foo is an example field of FirewallGroup. Edit firewallgroup_types.go to remove/update - Description is a human-readable explanation for the object type: string type: object status: @@ -118,10 +128,57 @@ spec: description: LastSyncTime is the last time the object was synced format: date-time type: string - resolvedAddresses: + resolvedIPV4Addresses: items: type: string type: array + resolvedIPV6Addresses: + items: + type: string + type: array + resolvedTCPorts: + items: + type: string + type: array + resolvedUDPorts: + items: + type: string + type: array + resources_managed: + properties: + ipv4_object: + description: FirewallRuleSpec defines the desired state of FirewallRule. + properties: + id: + type: string + name: + type: string + type: object + ipv6_object: + description: FirewallRuleSpec defines the desired state of FirewallRule. + properties: + id: + type: string + name: + type: string + type: object + tcp_ports_object: + description: FirewallRuleSpec defines the desired state of FirewallRule. + properties: + id: + type: string + name: + type: string + type: object + udp_ports_object: + description: FirewallRuleSpec defines the desired state of FirewallRule. + properties: + id: + type: string + name: + type: string + type: object + type: object syncedWithUnifi: description: SyncedWithUnifi indicates whether the addresses are successfully pushed diff --git a/config/crd/bases/unifi.engen.priv.no_firewallrules.yaml b/config/crd/bases/unifi.engen.priv.no_firewallrules.yaml index 95e9212..ffb7612 100644 --- a/config/crd/bases/unifi.engen.priv.no_firewallrules.yaml +++ b/config/crd/bases/unifi.engen.priv.no_firewallrules.yaml @@ -40,13 +40,17 @@ spec: properties: destination: properties: - firewall_group: + firewall_groups: items: - type: string + properties: + name: + type: string + namespace: + type: string + type: object type: array - service: + services: items: - description: FirewallRuleSpec defines the desired state of FirewallRule. properties: name: type: string @@ -65,11 +69,21 @@ spec: properties: from_networks: items: - type: string + properties: + name: + type: string + namespace: + type: string + type: object type: array from_zones: items: - type: string + properties: + name: + type: string + namespace: + type: string + type: object type: array type: object required: @@ -79,6 +93,34 @@ spec: type: object status: description: FirewallRuleStatus defines the observed state of FirewallRule. + properties: + resources_managed: + properties: + firewall_groups_managed: + items: + properties: + name: + type: string + namespace: + type: string + type: object + type: array + firewall_rules_managed: + items: + properties: + from: + type: string + rule_id: + type: string + to: + type: string + required: + - from + - rule_id + - to + type: object + type: array + type: object type: object type: object served: true diff --git a/config/crd/bases/unifi.engen.priv.no_firewallzones.yaml b/config/crd/bases/unifi.engen.priv.no_firewallzones.yaml index cded5dc..22b296d 100644 --- a/config/crd/bases/unifi.engen.priv.no_firewallzones.yaml +++ b/config/crd/bases/unifi.engen.priv.no_firewallzones.yaml @@ -54,6 +54,20 @@ spec: type: object status: description: FirewallZoneStatus defines the observed state of FirewallZone. + properties: + resources_managed: + properties: + firewall_zones_managed: + items: + description: FirewallRuleSpec defines the desired state of FirewallRule. + properties: + id: + type: string + name: + type: string + type: object + type: array + type: object type: object type: object served: true diff --git a/config/crd/bases/unifi.engen.priv.no_networkconfigurations.yaml b/config/crd/bases/unifi.engen.priv.no_networkconfigurations.yaml index 4a680f7..cc0f436 100644 --- a/config/crd/bases/unifi.engen.priv.no_networkconfigurations.yaml +++ b/config/crd/bases/unifi.engen.priv.no_networkconfigurations.yaml @@ -93,6 +93,19 @@ spec: description: LastSyncTime is the last time the object was synced format: date-time type: string + resources_managed: + properties: + networks_managed: + items: + description: FirewallRuleSpec defines the desired state of FirewallRule. + properties: + id: + type: string + name: + type: string + type: object + type: array + type: object syncedWithUnifi: description: SyncedWithUnifi indicates whether the addresses are successfully pushed diff --git a/go.mod b/go.mod index a92bc87..4fae175 100644 --- a/go.mod +++ b/go.mod @@ -9,7 +9,7 @@ godebug default=go1.23 require ( github.com/onsi/ginkgo/v2 v2.23.4 github.com/onsi/gomega v1.37.0 - github.com/vegardengen/go-unifi v0.0.1-alpha9 + github.com/vegardengen/go-unifi v0.0.1-alpha25 k8s.io/api v0.32.1 k8s.io/apimachinery v0.32.1 k8s.io/client-go v0.32.1 diff --git a/go.sum b/go.sum index da6255a..4c844b1 100644 --- a/go.sum +++ b/go.sum @@ -1080,8 +1080,38 @@ github.com/vbatts/tar-split v0.11.5 h1:3bHCTIheBm1qFTcgh9oPu+nNBtX+XJIupG/vacinC github.com/vbatts/tar-split v0.11.5/go.mod h1:yZbwRsSeGjusneWgA781EKej9HF8vme8okylkAeNKLk= github.com/vegardengen/go-unifi v0.0.1-alpha1 h1:PF1Y4NH/bfk6A7PLGxiqAhQkrfPau0B1vSayfmqlbRM= github.com/vegardengen/go-unifi v0.0.1-alpha1/go.mod h1:iwGJACYaRNb8eElwajOM7uYtyZraV9+5171gv3Q1QSc= +github.com/vegardengen/go-unifi v0.0.1-alpha11 h1:+2eOU2jkJSji6YYVHUfQht/tjfGeLZCQlNGD2Oh7ndE= +github.com/vegardengen/go-unifi v0.0.1-alpha11/go.mod h1:iwGJACYaRNb8eElwajOM7uYtyZraV9+5171gv3Q1QSc= +github.com/vegardengen/go-unifi v0.0.1-alpha12 h1:1g0JGmB1FivG0nU9EvZVyZkX5i+HR3qRGto0jk4k8hU= +github.com/vegardengen/go-unifi v0.0.1-alpha12/go.mod h1:iwGJACYaRNb8eElwajOM7uYtyZraV9+5171gv3Q1QSc= +github.com/vegardengen/go-unifi v0.0.1-alpha13 h1:MEFYSlYGBmbSkxTAJ4i89iV2ji5wrvDsRgx4LmuCz3Y= +github.com/vegardengen/go-unifi v0.0.1-alpha13/go.mod h1:iwGJACYaRNb8eElwajOM7uYtyZraV9+5171gv3Q1QSc= +github.com/vegardengen/go-unifi v0.0.1-alpha14 h1:O5vrSemL/XbX+9aNmovYNE0xAtdurVa3TawN2wBaUbs= +github.com/vegardengen/go-unifi v0.0.1-alpha14/go.mod h1:iwGJACYaRNb8eElwajOM7uYtyZraV9+5171gv3Q1QSc= +github.com/vegardengen/go-unifi v0.0.1-alpha15 h1:qjmfOmxDBu8/pSKiWP7YQzh8qZEUUJ9S4vs93GjfeqM= +github.com/vegardengen/go-unifi v0.0.1-alpha15/go.mod h1:iwGJACYaRNb8eElwajOM7uYtyZraV9+5171gv3Q1QSc= +github.com/vegardengen/go-unifi v0.0.1-alpha16 h1:OVVaOjYO8dh32fF1BQxSrRoV878ZBLtB/KQx9jIe9Ak= +github.com/vegardengen/go-unifi v0.0.1-alpha16/go.mod h1:iwGJACYaRNb8eElwajOM7uYtyZraV9+5171gv3Q1QSc= +github.com/vegardengen/go-unifi v0.0.1-alpha17 h1:SoSStxP7CV+lxlKg2mqfadpXCQ2xhwRwM78sdxtPmKU= +github.com/vegardengen/go-unifi v0.0.1-alpha17/go.mod h1:iwGJACYaRNb8eElwajOM7uYtyZraV9+5171gv3Q1QSc= +github.com/vegardengen/go-unifi v0.0.1-alpha18 h1:vUaALQmoRzP1z764GCzfQLt1IjnlG/ODJvNxx0B84D4= +github.com/vegardengen/go-unifi v0.0.1-alpha18/go.mod h1:iwGJACYaRNb8eElwajOM7uYtyZraV9+5171gv3Q1QSc= +github.com/vegardengen/go-unifi v0.0.1-alpha19 h1:B1U2hXNT/6HHsw92oHElhwpuYvwIUCvCdQ5D/tOik4o= +github.com/vegardengen/go-unifi v0.0.1-alpha19/go.mod h1:iwGJACYaRNb8eElwajOM7uYtyZraV9+5171gv3Q1QSc= github.com/vegardengen/go-unifi v0.0.1-alpha2 h1:2aVWpzi+i1X4rVFLOphAp7ZoTvER/rySzvpdB5cul4I= github.com/vegardengen/go-unifi v0.0.1-alpha2/go.mod h1:iwGJACYaRNb8eElwajOM7uYtyZraV9+5171gv3Q1QSc= +github.com/vegardengen/go-unifi v0.0.1-alpha20 h1:kQ+QQ1IYGwvjLkoXYBEU4gSD2yQj+9FwHtMf7+GQlok= +github.com/vegardengen/go-unifi v0.0.1-alpha20/go.mod h1:iwGJACYaRNb8eElwajOM7uYtyZraV9+5171gv3Q1QSc= +github.com/vegardengen/go-unifi v0.0.1-alpha21 h1:a+yPTu97ETRdkhmKltMrJTo28qA0GPWctPFyICLCUZw= +github.com/vegardengen/go-unifi v0.0.1-alpha21/go.mod h1:iwGJACYaRNb8eElwajOM7uYtyZraV9+5171gv3Q1QSc= +github.com/vegardengen/go-unifi v0.0.1-alpha22 h1:2axPhv/S6bawsh7n3/ik4oBcRHNFjrTykOzgTRd+LnU= +github.com/vegardengen/go-unifi v0.0.1-alpha22/go.mod h1:iwGJACYaRNb8eElwajOM7uYtyZraV9+5171gv3Q1QSc= +github.com/vegardengen/go-unifi v0.0.1-alpha23 h1:PFKiAKy9u8s04a8cjSRIJa6N3BfPYQW8NmpEtXi+KJM= +github.com/vegardengen/go-unifi v0.0.1-alpha23/go.mod h1:iwGJACYaRNb8eElwajOM7uYtyZraV9+5171gv3Q1QSc= +github.com/vegardengen/go-unifi v0.0.1-alpha24 h1:0L5aRrQEdXBQAzO/AK/OaA/Gt2ymA8pzA8MoAk12aOc= +github.com/vegardengen/go-unifi v0.0.1-alpha24/go.mod h1:iwGJACYaRNb8eElwajOM7uYtyZraV9+5171gv3Q1QSc= +github.com/vegardengen/go-unifi v0.0.1-alpha25 h1:GAwtNpMslE6/0IfM80cWFaMqwqsn+NXlUVsvauN7v68= +github.com/vegardengen/go-unifi v0.0.1-alpha25/go.mod h1:iwGJACYaRNb8eElwajOM7uYtyZraV9+5171gv3Q1QSc= github.com/vegardengen/go-unifi v0.0.1-alpha3 h1:ppllnTPduJIRZWSVLh9oGNXjo4L2hVzpVzCxvRhLSpM= github.com/vegardengen/go-unifi v0.0.1-alpha3/go.mod h1:iwGJACYaRNb8eElwajOM7uYtyZraV9+5171gv3Q1QSc= github.com/vegardengen/go-unifi v0.0.1-alpha4 h1:ZqdkYf/DRBwc1O+TwNsEAuMiXEv4j82XWbhbcMqUDnU= diff --git a/internal/controller/firewallgroup_controller.go b/internal/controller/firewallgroup_controller.go index d05dd27..f02c06b 100644 --- a/internal/controller/firewallgroup_controller.go +++ b/internal/controller/firewallgroup_controller.go @@ -146,8 +146,18 @@ func (r *FirewallGroupReconciler) Reconcile(ctx context.Context, req reconcile.R return reconcile.Result{}, err } } + serviceNamespaceNames := make(map[string]struct{}) + for _, serviceEntry := range nwObj.Spec.ManualServices { + serviceNamespaceNames[serviceEntry.Namespace+"/"+serviceEntry.Name] = struct{}{} + } + log.Info(fmt.Sprintf("Manually specified: %+v", serviceNamespaceNames)) for _, service := range services.Items { - if val, found := service.Annotations["unifi.engen.priv.no/firewall-group"]; found && val == nwObj.Name && service.Status.LoadBalancer.Ingress != nil { + _, manually_specified := serviceNamespaceNames[service.Namespace+"/"+service.Name] + val, found := service.Annotations["unifi.engen.priv.no/firewall-group"] + log.Info(fmt.Sprintf("%s %sv %+v %+v", service.Name, val, manually_specified, found)) + + // if val, found := service.Annotations["unifi.engen.priv.no/firewall-group"]; (manually_specified || (found && val == nwObj.Name)) && service.Status.LoadBalancer.Ingress != nil { + if (manually_specified || (found && val == nwObj.Name)) && service.Status.LoadBalancer.Ingress != nil { for _, ingress := range service.Status.LoadBalancer.Ingress { if ingress.IP != "" { ip := ingress.IP @@ -176,12 +186,33 @@ func (r *FirewallGroupReconciler) Reconcile(ctx context.Context, req reconcile.R } } } - nwObj.Status.ResolvedAddresses = ipv4 - nwObj.Status.ResolvedAddresses = append(nwObj.Status.ResolvedAddresses, ipv6...) + nwObj.Status.ResolvedIPV4Addresses = ipv4 + nwObj.Status.ResolvedIPV6Addresses = ipv6 + nwObj.Status.ResolvedTCPPorts = tcpports + nwObj.Status.ResolvedUDPPorts = udpports currentTime := metav1.Now() nwObj.Status.LastSyncTime = ¤tTime nwObj.Status.SyncedWithUnifi = true - + if nwObj.Status.ResourcesManaged == nil { + nwObj.Status.ResourcesManaged = &unifiv1beta1.FirewallGroupResourcesManaged{ + IPV4Object: &unifiv1beta1.NamedUnifiResource{ + ID: "", + Name: "", + }, + IPV6Object: &unifiv1beta1.NamedUnifiResource{ + ID: "", + Name: "", + }, + TCPPortsObject: &unifiv1beta1.NamedUnifiResource{ + ID: "", + Name: "", + }, + UDPPortsObject: &unifiv1beta1.NamedUnifiResource{ + ID: "", + Name: "", + }, + } + } err = r.UnifiClient.Reauthenticate() if err != nil { return reconcile.Result{}, err @@ -216,10 +247,14 @@ func (r *FirewallGroupReconciler) Reconcile(ctx context.Context, req reconcile.R log.Error(updateerr, "Could neither delete or rename firewall group") return reconcile.Result{}, updateerr } + nwObj.Status.ResourcesManaged.IPV4Object.Name = firewall_group.Name } else { log.Error(err, "Could not delete firewall group") return reconcile.Result{}, err } + } else { + nwObj.Status.ResourcesManaged.IPV4Object.Name = "" + nwObj.Status.ResourcesManaged.IPV4Object.ID = "" } ipv4_done = true } else { @@ -251,10 +286,14 @@ func (r *FirewallGroupReconciler) Reconcile(ctx context.Context, req reconcile.R log.Error(updateerr, "Could neither delete or rename firewall group") return reconcile.Result{}, updateerr } + nwObj.Status.ResourcesManaged.IPV6Object.Name = firewall_group.Name } else { log.Error(err, "Could not delete firewall group") return reconcile.Result{}, err } + } else { + nwObj.Status.ResourcesManaged.IPV6Object.Name = "" + nwObj.Status.ResourcesManaged.IPV6Object.ID = "" } ipv6_done = true } else { @@ -279,17 +318,21 @@ func (r *FirewallGroupReconciler) Reconcile(ctx context.Context, req reconcile.R log.Info(msg) if strings.Contains(msg, "api.err.objectreferredby") { log.Info("Firewall group is in use. Invoking workaround...!") - firewall_group.GroupMembers = []string{"127.0.0.1"} + firewall_group.GroupMembers = []string{"0"} firewall_group.Name = firewall_group.Name + "-deleted" _, updateerr := r.UnifiClient.Client.UpdateFirewallGroup(context.Background(), r.UnifiClient.SiteID, &firewall_group) if updateerr != nil { log.Error(updateerr, "Could neither delete or rename firewall group") return reconcile.Result{}, updateerr } + nwObj.Status.ResourcesManaged.TCPPortsObject.Name = firewall_group.Name } else { log.Error(err, "Could not delete firewall group") return reconcile.Result{}, err } + } else { + nwObj.Status.ResourcesManaged.TCPPortsObject.Name = "" + nwObj.Status.ResourcesManaged.TCPPortsObject.ID = "" } tcpports_done = true } else { @@ -321,10 +364,14 @@ func (r *FirewallGroupReconciler) Reconcile(ctx context.Context, req reconcile.R log.Error(updateerr, "Could neither delete or rename firewall group") return reconcile.Result{}, updateerr } + nwObj.Status.ResourcesManaged.UDPPortsObject.Name = firewall_group.Name } else { log.Error(err, "Could not delete firewall group") return reconcile.Result{}, err } + } else { + nwObj.Status.ResourcesManaged.UDPPortsObject.Name = "" + nwObj.Status.ResourcesManaged.UDPPortsObject.ID = "" } udpports_done = true } else { @@ -349,6 +396,7 @@ func (r *FirewallGroupReconciler) Reconcile(ctx context.Context, req reconcile.R log.Error(err, "Could not update firewall group") return reconcile.Result{}, err } + nwObj.Status.ResourcesManaged.IPV4Object.Name = firewall_group.Name ipv4_done = true } if firewall_group.Name == ipv6_name+"-deleted" && len(ipv6) > 0 { @@ -360,6 +408,7 @@ func (r *FirewallGroupReconciler) Reconcile(ctx context.Context, req reconcile.R log.Error(err, "Could not update firewall group") return reconcile.Result{}, err } + nwObj.Status.ResourcesManaged.IPV4Object.Name = firewall_group.Name ipv6_done = true } if firewall_group.Name == tcpports_name+"-deleted" && len(tcpports) > 0 { @@ -371,6 +420,7 @@ func (r *FirewallGroupReconciler) Reconcile(ctx context.Context, req reconcile.R log.Error(err, "Could not update firewall group") return reconcile.Result{}, err } + nwObj.Status.ResourcesManaged.TCPPortsObject.Name = firewall_group.Name tcpports_done = true } if firewall_group.Name == udpports_name+"-deleted" && len(udpports) > 0 { @@ -382,6 +432,7 @@ func (r *FirewallGroupReconciler) Reconcile(ctx context.Context, req reconcile.R log.Error(err, "Could not update firewall group") return reconcile.Result{}, err } + nwObj.Status.ResourcesManaged.UDPPortsObject.Name = firewall_group.Name udpports_done = true } } @@ -392,11 +443,19 @@ func (r *FirewallGroupReconciler) Reconcile(ctx context.Context, req reconcile.R firewall_group.SiteID = r.UnifiClient.SiteID firewall_group.GroupMembers = ipv4 firewall_group.GroupType = "address-group" - _, err := r.UnifiClient.Client.CreateFirewallGroup(context.Background(), r.UnifiClient.SiteID, &firewall_group) + firewall_group_result, err := r.UnifiClient.Client.CreateFirewallGroup(context.Background(), r.UnifiClient.SiteID, &firewall_group) + log.Info(fmt.Sprintf("%+v", firewall_group_result)) if err != nil { log.Error(err, "Could not create firewall group") return reconcile.Result{}, err + } else { + firewall_group = *firewall_group_result } + + log.Info(fmt.Sprintf("ID and name: %s %s", firewall_group.ID, firewall_group.Name)) + log.Info(fmt.Sprintf("%+v", firewall_group)) + nwObj.Status.ResourcesManaged.IPV4Object.ID = firewall_group.ID + nwObj.Status.ResourcesManaged.IPV4Object.Name = firewall_group.Name } if len(ipv6) > 0 && !ipv6_done { log.Info(fmt.Sprintf("Creating %s", ipv6_name)) @@ -405,11 +464,17 @@ func (r *FirewallGroupReconciler) Reconcile(ctx context.Context, req reconcile.R firewall_group.SiteID = r.UnifiClient.SiteID firewall_group.GroupMembers = ipv6 firewall_group.GroupType = "ipv6-address-group" - _, err := r.UnifiClient.Client.CreateFirewallGroup(context.Background(), r.UnifiClient.SiteID, &firewall_group) + firewall_group_result, err := r.UnifiClient.Client.CreateFirewallGroup(context.Background(), r.UnifiClient.SiteID, &firewall_group) + log.Info(fmt.Sprintf("%+v", firewall_group_result)) if err != nil { log.Error(err, "Could not create firewall group") return reconcile.Result{}, err + } else { + firewall_group = *firewall_group_result } + nwObj.Status.ResourcesManaged.IPV6Object.ID = firewall_group.ID + nwObj.Status.ResourcesManaged.IPV6Object.Name = firewall_group.Name + } if len(tcpports) > 0 && !tcpports_done { log.Info(fmt.Sprintf("Creating %s", tcpports_name)) @@ -419,11 +484,15 @@ func (r *FirewallGroupReconciler) Reconcile(ctx context.Context, req reconcile.R firewall_group.GroupMembers = tcpports firewall_group.GroupType = "port-group" log.Info(fmt.Sprintf("Trying to apply: %+v", firewall_group)) - _, err := r.UnifiClient.Client.CreateFirewallGroup(context.Background(), r.UnifiClient.SiteID, &firewall_group) + firewall_group_result, err := r.UnifiClient.Client.CreateFirewallGroup(context.Background(), r.UnifiClient.SiteID, &firewall_group) if err != nil { log.Error(err, "Could not create firewall group") return reconcile.Result{}, err + } else { + firewall_group = *firewall_group_result } + nwObj.Status.ResourcesManaged.TCPPortsObject.ID = firewall_group.ID + nwObj.Status.ResourcesManaged.TCPPortsObject.Name = firewall_group.Name } if len(udpports) > 0 && !udpports_done { log.Info(fmt.Sprintf("Creating %s", udpports_name)) @@ -433,12 +502,18 @@ func (r *FirewallGroupReconciler) Reconcile(ctx context.Context, req reconcile.R firewall_group.GroupMembers = udpports firewall_group.GroupType = "port-group" log.Info(fmt.Sprintf("Trying to apply: %+v", firewall_group)) - _, err := r.UnifiClient.Client.CreateFirewallGroup(context.Background(), r.UnifiClient.SiteID, &firewall_group) + firewall_group_result, err := r.UnifiClient.Client.CreateFirewallGroup(context.Background(), r.UnifiClient.SiteID, &firewall_group) + log.Info(fmt.Sprintf("%+v", firewall_group_result)) if err != nil { log.Error(err, "Could not create firewall group") return reconcile.Result{}, err + } else { + firewall_group = *firewall_group_result } + nwObj.Status.ResourcesManaged.UDPPortsObject.ID = firewall_group.ID + nwObj.Status.ResourcesManaged.UDPPortsObject.Name = firewall_group.Name } + log.Info(fmt.Sprintf("Updating status for %s: %+v", nwObj.Name, nwObj.Status)) if err := r.Status().Update(ctx, &nwObj); err != nil { log.Error(err, "unable to update FirewallGroup status") return reconcile.Result{}, err diff --git a/internal/controller/firewallrule_controller.go b/internal/controller/firewallrule_controller.go index badd2cf..3727c70 100644 --- a/internal/controller/firewallrule_controller.go +++ b/internal/controller/firewallrule_controller.go @@ -18,6 +18,9 @@ package controller import ( "context" + "fmt" + // "strings" + "encoding/json" "time" corev1 "k8s.io/api/core/v1" @@ -28,6 +31,7 @@ import ( "sigs.k8s.io/controller-runtime/pkg/handler" "sigs.k8s.io/controller-runtime/pkg/log" + goUnifi "github.com/vegardengen/go-unifi/unifi" unifiv1beta1 "github.com/vegardengen/unifi-network-operator/api/v1beta1" "github.com/vegardengen/unifi-network-operator/internal/config" "github.com/vegardengen/unifi-network-operator/internal/unifi" @@ -56,6 +60,38 @@ type FirewallRuleReconciler struct { // // For more details, check Reconcile and its Result here: // - https://pkg.go.dev/sigs.k8s.io/controller-runtime@v0.20.2/pkg/reconcile + +func fillDefaultRule() goUnifi.FirewallPolicy { + var firewallRule goUnifi.FirewallPolicy + firewallRule.Action = "ALLOW" + firewallRule.CreateAllowRespond = true + firewallRule.ConnectionStateType = "ALL" + firewallRule.ConnectionStates = []string{} + firewallRule.Destination = goUnifi.FirewallDestination{ + MatchOppositePorts: false, + MatchingTarget: "IP", + MatchingTargetType: "OBJECT", + } + firewallRule.Enabled = true + firewallRule.ICMPTypename = "ANY" + firewallRule.ICMPV6Typename = "ANY" + firewallRule.MatchIPSec = false + firewallRule.MatchOppositeProtocol = false + firewallRule.Predefined = false + firewallRule.Schedule = goUnifi.FirewallSchedule{ + Mode: "ALWAYS", + RepeatOnDays: []string{}, + TimeAllDay: false, + } + firewallRule.Source = goUnifi.FirewallSource{ + MatchMac: false, + MatchOppositePorts: false, + MatchOppositeNetworks: false, + } + + return firewallRule +} + func (r *FirewallRuleReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) { log := log.FromContext(ctx) @@ -67,39 +103,10 @@ func (r *FirewallRuleReconciler) Reconcile(ctx context.Context, req ctrl.Request } defaultNs := cfg.Data["defaultNamespace"] + kubernetesZone := cfg.Data["kubernetesUnifiZone"] + var kubernetesZoneID string log.Info(defaultNs) - - err = r.UnifiClient.Reauthenticate() - if err != nil { - return ctrl.Result{}, err - } - - var zoneCRDs unifiv1beta1.FirewallZoneList - var networkCRDs unifiv1beta1.NetworkconfigurationList - - err = r.List(ctx, &zoneCRDs, client.InNamespace(defaultNs)) - if err != nil { - log.Error(err, "Could not list firewall zones") - return ctrl.Result{RequeueAfter: 10 * time.Minute}, err - } - - zoneCRDNames := make(map[string]struct{}) - - for _, zoneCRD := range zoneCRDs.Items { - zoneCRDNames[zoneCRD.Name] = struct{}{} - } - - err = r.List(ctx, &networkCRDs, client.InNamespace(defaultNs)) - if err != nil { - log.Error(err, "Could not list networks") - return ctrl.Result{RequeueAfter: 10 * time.Minute}, err - } - - networkCRDNames := make(map[string]struct{}) - - for _, networkCRD := range networkCRDs.Items { - networkCRDNames[networkCRD.Name] = struct{}{} - } + log.Info(kubernetesZone) var firewallRule unifiv1beta1.FirewallRule @@ -108,12 +115,475 @@ func (r *FirewallRuleReconciler) Reconcile(ctx context.Context, req ctrl.Request } log.Info(firewallRule.Spec.Name) + if firewallRule.Status.ResourcesManaged == nil { + firewallGroupsManaged := []unifiv1beta1.FirewallGroupEntry{} + unifiFirewallRules := []unifiv1beta1.UnifiFirewallRuleEntry{} + firewallRule.Status.ResourcesManaged = &unifiv1beta1.FirewallRuleResourcesManaged{ + UnifiFirewallRules: unifiFirewallRules, + FirewallGroups: firewallGroupsManaged, + } + } + err = r.UnifiClient.Reauthenticate() + if err != nil { + return ctrl.Result{}, err + } + + var zoneCRDs unifiv1beta1.FirewallZoneList + var networkCRDs unifiv1beta1.NetworkconfigurationList + + err = r.List(ctx, &zoneCRDs) + if err != nil { + log.Error(err, "Could not list firewall zones") + return ctrl.Result{RequeueAfter: 10 * time.Minute}, err + } + + zoneCRDNames := make(map[string]int) + + for i, zoneCRD := range zoneCRDs.Items { + namespace := defaultNs + if len(zoneCRD.Namespace) > 0 { + namespace = zoneCRD.Namespace + } + if kubernetesZone == zoneCRD.Name { + kubernetesZoneID = zoneCRD.Spec.ID + log.Info(fmt.Sprintf("Zone for kubernetes resources: %s with ID %s", kubernetesZone, kubernetesZoneID)) + } + zoneCRDNames[namespace+"/"+zoneCRD.Name] = i + } + + err = r.List(ctx, &networkCRDs) + if err != nil { + log.Error(err, "Could not list networks") + return ctrl.Result{RequeueAfter: 10 * time.Minute}, err + } + + networkCRDNames := make(map[string]int) + + for i, networkCRD := range networkCRDs.Items { + namespace := defaultNs + if len(networkCRD.Namespace) > 0 { + namespace = networkCRD.Namespace + } + networkCRDNames[namespace+"/"+networkCRD.Name] = i + } + + destination_services := make(map[string]struct{}) + destination_groups := make(map[string]struct{}) + + for _, dest_group := range firewallRule.Spec.Destination.FirewallGroups { + namespace := defaultNs + if len(dest_group.Namespace) > 0 { + namespace = dest_group.Namespace + } + destination_groups[namespace+"/"+dest_group.Name] = struct{}{} + } + for _, dest_service := range firewallRule.Spec.Destination.Services { + namespace := defaultNs + if len(dest_service.Namespace) > 0 { + namespace = dest_service.Namespace + } + destination_services[namespace+"/"+dest_service.Name] = struct{}{} + } + log.Info(fmt.Sprintf("%+v", destination_services)) + var firewallGroupCRDs unifiv1beta1.FirewallGroupList + var myFirewallGroups []unifiv1beta1.FirewallGroup + if err = r.List(ctx, &firewallGroupCRDs); err != nil { + log.Error(err, "Failed to list firewall groups") + return ctrl.Result{RequeueAfter: 10 * time.Minute}, err + } + + for _, firewallGroup := range firewallGroupCRDs.Items { + if val, found := firewallGroup.Annotations["unifi.engen.priv.no/firewall-rule"]; found && val == firewallRule.Name { + myFirewallGroups = append(myFirewallGroups, firewallGroup) + } else if _, found := destination_groups[firewallGroup.Namespace+"/"+firewallGroup.Name]; found { + myFirewallGroups = append(myFirewallGroups, firewallGroup) + } + } + myFirewallGroupNames := make(map[string]struct{}) + for _, firewallGroup := range myFirewallGroups { + myFirewallGroupNames[firewallGroup.Name] = struct{}{} + } + var serviceCRDs corev1.ServiceList + var myServices []corev1.Service + if err = r.List(ctx, &serviceCRDs); err != nil { + log.Error(err, "Failed to list services") + return ctrl.Result{RequeueAfter: 10 * time.Minute}, err + } + for _, service := range serviceCRDs.Items { + skipService := false + if val, found := service.Annotations["unifi.engen.priv.no/firewall-group"]; found { + if _, found := myFirewallGroupNames[val]; found { + skipService = true + } + } + if val, found := service.Annotations["unifi.engen.priv.no/firewall-rule"]; found && val == firewallRule.Name && !skipService { + myServices = append(myServices, service) + } else if _, found := destination_services[service.Namespace+"/"+service.Name]; found && !skipService { + myServices = append(myServices, service) + } + } + + for _, service := range myServices { + log.Info(fmt.Sprintf("Should handle service %s", service.Name)) + var firewallGroupCRD unifiv1beta1.FirewallGroup + if err := r.Get(ctx, types.NamespacedName{ + Name: toKubeName("k8s-auto" + "_" + service.Namespace + "/" + service.Name), + Namespace: firewallRule.Namespace, + }, &firewallGroupCRD); err == nil { + myFirewallGroups = append(myFirewallGroups, firewallGroupCRD) + } else { + log.Info("Going to create firewall group") + var manualServices []unifiv1beta1.ServiceEntry + manualServices = append(manualServices, unifiv1beta1.ServiceEntry{ + Name: service.Name, + Namespace: service.Namespace, + }) + createdFirewallGroupCRD := &unifiv1beta1.FirewallGroup{ + ObjectMeta: ctrl.ObjectMeta{ + Name: toKubeName("k8s-auto" + "_" + service.Namespace + "/" + service.Name), + Namespace: firewallRule.Namespace, + }, + Spec: unifiv1beta1.FirewallGroupSpec{ + Name: "auto-" + service.Namespace + "/" + service.Name, + AutoCreatedFrom: unifiv1beta1.FirewallRuleEntry{ + Name: firewallRule.Name, + Namespace: firewallRule.Namespace, + }, + ManualServices: manualServices, + MatchServicesInAllNamespaces: true, + }, + } + log.Info(fmt.Sprintf("%+v", createdFirewallGroupCRD)) + if err := r.Create(ctx, createdFirewallGroupCRD); err != nil { + log.Error(err, fmt.Sprintf("Failed to create %s", createdFirewallGroupCRD.Name)) + return ctrl.Result{RequeueAfter: 10 * time.Minute}, err + } else { + _ = r.Get(ctx, types.NamespacedName{Name: createdFirewallGroupCRD.Name, Namespace: createdFirewallGroupCRD.Namespace}, &firewallGroupCRD) + } + log.Info("Adding %+v", firewallGroupCRD) + myFirewallGroups = append(myFirewallGroups, firewallGroupCRD) + found := false + for _, managedFirewallGroup := range firewallRule.Status.ResourcesManaged.FirewallGroups { + if managedFirewallGroup.Name == firewallGroupCRD.Name && managedFirewallGroup.Namespace == firewallGroupCRD.Namespace { + found = true + } + } + if !found { + firewallRule.Status.ResourcesManaged.FirewallGroups = append(firewallRule.Status.ResourcesManaged.FirewallGroups, unifiv1beta1.FirewallGroupEntry{Name: firewallGroupCRD.Name, Namespace: firewallGroupCRD.Namespace}) + if err := r.Status().Update(ctx, &firewallRule); err != nil { + log.Error(err, "Failed to update status with added firewallgroup") + } + } + + } + } + unifi_firewall_rules, err := r.UnifiClient.Client.ListFirewallPolicy(context.Background(), r.UnifiClient.SiteID) + if err != nil { + log.Error(err, "Could not list firewall rules") + return ctrl.Result{}, err + } + unifiFirewallruleNames := make(map[string]struct{}) + for _, unifi_firewall_rule := range unifi_firewall_rules { + unifiFirewallruleNames[unifi_firewall_rule.Name] = struct{}{} + } + log.Info(fmt.Sprintf("Number of firewall rules: %d", len(unifi_firewall_rules))) + + for _, zoneEntry := range firewallRule.Spec.Source.FirewallZones { + namespace := defaultNs + if len(zoneEntry.Namespace) > 0 { + namespace = zoneEntry.Namespace + } + if i, found := zoneCRDNames[namespace+"/"+zoneEntry.Name]; found { + log.Info(fmt.Sprintf("Creating firewallrules for %s", zoneCRDs.Items[i].Name)) + for _, firewallGroup := range myFirewallGroups { + if len(firewallGroup.Status.ResolvedIPV4Addresses) > 0 { + if len(firewallGroup.Status.ResolvedTCPPorts) > 0 { + rulename := "k8s-fw-" + firewallRule.Name + "-" + zoneCRDs.Items[i].Name + "-" + firewallGroup.Name + "-ipv4-tcp" + if _, found := unifiFirewallruleNames[rulename]; !found { + log.Info(fmt.Sprintf("Creating ipv4 tcp firewallrule for %s to %s: %s", zoneCRDs.Items[i].Name, firewallGroup.Name, rulename)) + firewallRule := fillDefaultRule() + firewallRule.Name = rulename + firewallRule.Source.PortMatchingType = "ANY" + firewallRule.Source.ZoneID = zoneCRDs.Items[i].Spec.ID + firewallRule.Source.MatchingTarget = "ANY" + firewallRule.Protocol = "tcp" + firewallRule.IPVersion = "IPV4" + firewallRule.Description = fmt.Sprintf("Allow tcp IPV4 from %s to %s", zoneCRDs.Items[i].Name, firewallGroup.Name) + firewallRule.Destination.MatchingTargetType = "OBJECT" + firewallRule.Destination.IPGroupID = firewallGroup.Status.ResourcesManaged.IPV4Object.ID + firewallRule.Destination.MatchingTarget = "IP" + firewallRule.Destination.PortMatchingType = "OBJECT" + firewallRule.Destination.PortGroupID = firewallGroup.Status.ResourcesManaged.TCPPortsObject.ID + firewallRule.Destination.ZoneID = kubernetesZoneID + + log.Info(fmt.Sprintf("Trying to create firewall rule from zone %s to %s: %+v", zoneCRDs.Items[i].Name, firewallGroup.Name, firewallRule)) + pretty, _ := json.MarshalIndent(firewallRule, "", " ") + log.Info(string(pretty)) + _, err := r.UnifiClient.Client.CreateFirewallPolicy(context.Background(), r.UnifiClient.SiteID, &firewallRule) + if err != nil { + log.Error(err, "Could not create firewall policy") + return ctrl.Result{}, err + } + + } else { + log.Info(fmt.Sprintf("Firewall rule for ipv4 tcp %s to %s already exists", zoneCRDs.Items[i].Name, firewallGroup.Name)) + } + } + if len(firewallGroup.Status.ResolvedUDPPorts) > 0 { + rulename := "k8s-fw-" + firewallRule.Name + "-" + zoneCRDs.Items[i].Name + "-" + firewallGroup.Name + "-ipv4-udp" + if _, found := unifiFirewallruleNames[rulename]; !found { + log.Info(fmt.Sprintf("Creating ipv4 udp firewallrule for %s to %s: %s", zoneCRDs.Items[i].Name, firewallGroup.Name, rulename)) + firewallRule := fillDefaultRule() + firewallRule.Name = rulename + firewallRule.Source.PortMatchingType = "ANY" + firewallRule.Source.ZoneID = zoneCRDs.Items[i].Spec.ID + firewallRule.Source.MatchingTarget = "ANY" + firewallRule.Protocol = "udp" + firewallRule.IPVersion = "IPV4" + firewallRule.Description = fmt.Sprintf("Allow udp IPV4 from %s to %s", zoneCRDs.Items[i].Name, firewallGroup.Name) + firewallRule.Destination.MatchingTargetType = "OBJECT" + firewallRule.Destination.IPGroupID = firewallGroup.Status.ResourcesManaged.IPV4Object.ID + firewallRule.Destination.MatchingTarget = "IP" + firewallRule.Destination.PortMatchingType = "OBJECT" + firewallRule.Destination.PortGroupID = firewallGroup.Status.ResourcesManaged.UDPPortsObject.ID + firewallRule.Destination.ZoneID = kubernetesZoneID + + log.Info(fmt.Sprintf("Trying to create firewall rule from zone %s to %s: %+v", zoneCRDs.Items[i].Name, firewallGroup.Name, firewallRule)) + pretty, _ := json.MarshalIndent(firewallRule, "", " ") + log.Info(string(pretty)) + _, err := r.UnifiClient.Client.CreateFirewallPolicy(context.Background(), r.UnifiClient.SiteID, &firewallRule) + if err != nil { + log.Error(err, "Could not create firewall policy") + return ctrl.Result{}, err + } + + } else { + log.Info(fmt.Sprintf("Firewall rule for ipv4 udp %s to %s already exists", zoneCRDs.Items[i].Name, firewallGroup.Name)) + } + } + } + if len(firewallGroup.Status.ResolvedIPV6Addresses) > 0 { + if len(firewallGroup.Status.ResolvedTCPPorts) > 0 { + rulename := "k8s-fw-" + firewallRule.Name + "-" + zoneCRDs.Items[i].Name + "-" + firewallGroup.Name + "-ipv6-tcp" + if _, found := unifiFirewallruleNames[rulename]; !found { + log.Info(fmt.Sprintf("Creating ipv6 tcp firewallrule for %s to %s: %s", zoneCRDs.Items[i].Name, firewallGroup.Name, rulename)) + firewallRule := fillDefaultRule() + firewallRule.Name = rulename + firewallRule.Source.PortMatchingType = "ANY" + firewallRule.Source.ZoneID = zoneCRDs.Items[i].Spec.ID + firewallRule.Source.MatchingTarget = "ANY" + firewallRule.Protocol = "tcp" + firewallRule.IPVersion = "IPV6" + firewallRule.Description = fmt.Sprintf("Allow tcp IPV6 from %s to %s", zoneCRDs.Items[i].Name, firewallGroup.Name) + firewallRule.Destination.MatchingTargetType = "OBJECT" + firewallRule.Destination.IPGroupID = firewallGroup.Status.ResourcesManaged.IPV6Object.ID + firewallRule.Destination.MatchingTarget = "IP" + firewallRule.Destination.PortMatchingType = "OBJECT" + firewallRule.Destination.PortGroupID = firewallGroup.Status.ResourcesManaged.TCPPortsObject.ID + firewallRule.Destination.ZoneID = kubernetesZoneID + + log.Info(fmt.Sprintf("Trying to create firewall rule from zone %s to %s: %+v", zoneCRDs.Items[i].Name, firewallGroup.Name, firewallRule)) + pretty, _ := json.MarshalIndent(firewallRule, "", " ") + log.Info(string(pretty)) + _, err := r.UnifiClient.Client.CreateFirewallPolicy(context.Background(), r.UnifiClient.SiteID, &firewallRule) + if err != nil { + log.Error(err, "Could not create firewall policy") + return ctrl.Result{}, err + } + + } else { + log.Info(fmt.Sprintf("Firewall rule for ipv6 tcp %s to %s already exists", zoneCRDs.Items[i].Name, firewallGroup.Name)) + } + } + if len(firewallGroup.Status.ResolvedUDPPorts) > 0 { + rulename := "k8s-fw-" + firewallRule.Name + "-" + zoneCRDs.Items[i].Name + "-" + firewallGroup.Name + "-ipv6-udp" + if _, found := unifiFirewallruleNames[rulename]; !found { + log.Info(fmt.Sprintf("Creating ipv6 udp firewallrule for %s to %s: %s", zoneCRDs.Items[i].Name, firewallGroup.Name, rulename)) + firewallRule := fillDefaultRule() + firewallRule.Name = rulename + firewallRule.Source.PortMatchingType = "ANY" + firewallRule.Source.ZoneID = zoneCRDs.Items[i].Spec.ID + firewallRule.Source.MatchingTarget = "ANY" + firewallRule.Protocol = "udp" + firewallRule.IPVersion = "IPV6" + firewallRule.Description = fmt.Sprintf("Allow udp IPV6 from %s to %s", zoneCRDs.Items[i].Name, firewallGroup.Name) + firewallRule.Destination.MatchingTargetType = "OBJECT" + firewallRule.Destination.IPGroupID = firewallGroup.Status.ResourcesManaged.IPV6Object.ID + firewallRule.Destination.MatchingTarget = "IP" + firewallRule.Destination.PortMatchingType = "OBJECT" + firewallRule.Destination.PortGroupID = firewallGroup.Status.ResourcesManaged.UDPPortsObject.ID + firewallRule.Destination.ZoneID = kubernetesZoneID + + log.Info(fmt.Sprintf("Trying to create firewall rule from zone %s to %s: %+v", zoneCRDs.Items[i].Name, firewallGroup.Name, firewallRule)) + pretty, _ := json.MarshalIndent(firewallRule, "", " ") + log.Info(string(pretty)) + _, err := r.UnifiClient.Client.CreateFirewallPolicy(context.Background(), r.UnifiClient.SiteID, &firewallRule) + if err != nil { + log.Error(err, "Could not create firewall policy") + return ctrl.Result{}, err + } + + } else { + log.Info(fmt.Sprintf("Firewall rule for ipv6 udp %s to %s already exists", zoneCRDs.Items[i].Name, firewallGroup.Name)) + } + } + } + } + } + } + for _, networkEntry := range firewallRule.Spec.Source.Networks { + namespace := defaultNs + if len(networkEntry.Namespace) > 0 { + namespace = networkEntry.Namespace + } + if i, found := networkCRDNames[namespace+"/"+networkEntry.Name]; found { + log.Info(fmt.Sprintf("Creating firewallrules for %s", networkCRDs.Items[i].Name)) + for _, firewallGroup := range myFirewallGroups { + if len(firewallGroup.Status.ResolvedIPV4Addresses) > 0 { + if len(firewallGroup.Status.ResolvedTCPPorts) > 0 { + rulename := "k8s-fw-" + firewallRule.Name + "-" + networkCRDs.Items[i].Name + "-" + firewallGroup.Name + "-ipv4-tcp" + if _, found := unifiFirewallruleNames[rulename]; !found { + log.Info(fmt.Sprintf("Creating ipv4 tcp firewallrule for %s to %s: %s", networkCRDs.Items[i].Name, firewallGroup.Name, rulename)) + firewallRule := fillDefaultRule() + firewallRule.Name = rulename + firewallRule.Source.NetworkIDs = []string{networkCRDs.Items[i].Spec.ID} + firewallRule.Source.PortMatchingType = "ANY" + firewallRule.Source.ZoneID = networkCRDs.Items[i].Status.FirewallZoneID + firewallRule.Source.MatchingTarget = "NETWORK" + firewallRule.Protocol = "tcp" + firewallRule.IPVersion = "IPV4" + firewallRule.Description = fmt.Sprintf("Allow tcp IPV4 from %s to %s", networkCRDs.Items[i].Name, firewallGroup.Name) + firewallRule.Destination.MatchingTargetType = "OBJECT" + firewallRule.Destination.IPGroupID = firewallGroup.Status.ResourcesManaged.IPV4Object.ID + firewallRule.Destination.MatchingTarget = "IP" + firewallRule.Destination.PortMatchingType = "OBJECT" + firewallRule.Destination.PortGroupID = firewallGroup.Status.ResourcesManaged.TCPPortsObject.ID + firewallRule.Destination.ZoneID = kubernetesZoneID + + log.Info(fmt.Sprintf("Trying to create firewall rule from network %s to %s: %+v", networkCRDs.Items[i].Name, firewallGroup.Name, firewallRule)) + pretty, _ := json.MarshalIndent(firewallRule, "", " ") + log.Info(string(pretty)) + _, err := r.UnifiClient.Client.CreateFirewallPolicy(context.Background(), r.UnifiClient.SiteID, &firewallRule) + if err != nil { + log.Error(err, "Could not create firewall policy") + return ctrl.Result{}, err + } + + } else { + log.Info(fmt.Sprintf("Firewall rule for ipv4 tcp %s to %s already exists", networkCRDs.Items[i].Name, firewallGroup.Name)) + } + } + if len(firewallGroup.Status.ResolvedUDPPorts) > 0 { + rulename := "k8s-fw-" + firewallRule.Name + "-" + networkCRDs.Items[i].Name + "-" + firewallGroup.Name + "-ipv4-udp" + if _, found := unifiFirewallruleNames[rulename]; !found { + log.Info(fmt.Sprintf("Creating ipv4 udp firewallrule for %s to %s: %s", networkCRDs.Items[i].Name, firewallGroup.Name, rulename)) + firewallRule := fillDefaultRule() + firewallRule.Name = rulename + firewallRule.Source.NetworkIDs = []string{networkCRDs.Items[i].Spec.ID} + firewallRule.Source.PortMatchingType = "ANY" + firewallRule.Source.ZoneID = networkCRDs.Items[i].Status.FirewallZoneID + firewallRule.Source.MatchingTarget = "NETWORK" + firewallRule.Protocol = "udp" + firewallRule.IPVersion = "IPV4" + firewallRule.Description = fmt.Sprintf("Allow udp IPV4 from %s to %s", networkCRDs.Items[i].Name, firewallGroup.Name) + firewallRule.Destination.MatchingTargetType = "OBJECT" + firewallRule.Destination.IPGroupID = firewallGroup.Status.ResourcesManaged.IPV4Object.ID + firewallRule.Destination.MatchingTarget = "IP" + firewallRule.Destination.PortMatchingType = "OBJECT" + firewallRule.Destination.PortGroupID = firewallGroup.Status.ResourcesManaged.UDPPortsObject.ID + firewallRule.Destination.ZoneID = kubernetesZoneID + + log.Info(fmt.Sprintf("Trying to create firewall rule from network %s to %s: %+v", networkCRDs.Items[i].Name, firewallGroup.Name, firewallRule)) + pretty, _ := json.MarshalIndent(firewallRule, "", " ") + log.Info(string(pretty)) + _, err := r.UnifiClient.Client.CreateFirewallPolicy(context.Background(), r.UnifiClient.SiteID, &firewallRule) + if err != nil { + log.Error(err, "Could not create firewall policy") + return ctrl.Result{}, err + } + + } else { + log.Info(fmt.Sprintf("Firewall rule for ipv4 udp %s to %s already exists", networkCRDs.Items[i].Name, firewallGroup.Name)) + } + } + } + if len(firewallGroup.Status.ResolvedIPV6Addresses) > 0 { + if len(firewallGroup.Status.ResolvedTCPPorts) > 0 { + rulename := "k8s-fw-" + firewallRule.Name + "-" + networkCRDs.Items[i].Name + "-" + firewallGroup.Name + "-ipv6-tcp" + if _, found := unifiFirewallruleNames[rulename]; !found { + log.Info(fmt.Sprintf("Creating ipv6 tcp firewallrule for %s to %s: %s", networkCRDs.Items[i].Name, firewallGroup.Name, rulename)) + firewallRule := fillDefaultRule() + firewallRule.Name = rulename + firewallRule.Source.NetworkIDs = []string{networkCRDs.Items[i].Spec.ID} + firewallRule.Source.PortMatchingType = "ANY" + firewallRule.Source.ZoneID = networkCRDs.Items[i].Status.FirewallZoneID + firewallRule.Source.MatchingTarget = "NETWORK" + firewallRule.Protocol = "tcp" + firewallRule.IPVersion = "IPV6" + firewallRule.Description = fmt.Sprintf("Allow tcp IPV6 from %s to %s", networkCRDs.Items[i].Name, firewallGroup.Name) + firewallRule.Destination.MatchingTargetType = "OBJECT" + firewallRule.Destination.IPGroupID = firewallGroup.Status.ResourcesManaged.IPV6Object.ID + firewallRule.Destination.MatchingTarget = "IP" + firewallRule.Destination.PortMatchingType = "OBJECT" + firewallRule.Destination.PortGroupID = firewallGroup.Status.ResourcesManaged.TCPPortsObject.ID + firewallRule.Destination.ZoneID = kubernetesZoneID + + log.Info(fmt.Sprintf("Trying to create firewall rule from network %s to %s: %+v", networkCRDs.Items[i].Name, firewallGroup.Name, firewallRule)) + pretty, _ := json.MarshalIndent(firewallRule, "", " ") + log.Info(string(pretty)) + _, err := r.UnifiClient.Client.CreateFirewallPolicy(context.Background(), r.UnifiClient.SiteID, &firewallRule) + if err != nil { + log.Error(err, "Could not create firewall policy") + return ctrl.Result{}, err + } + + } else { + log.Info(fmt.Sprintf("Firewall rule for ipv6 tcp %s to %s already exists", networkCRDs.Items[i].Name, firewallGroup.Name)) + } + } + if len(firewallGroup.Status.ResolvedUDPPorts) > 0 { + rulename := "k8s-fw-" + firewallRule.Name + "-" + networkCRDs.Items[i].Name + "-" + firewallGroup.Name + "-ipv6-udp" + if _, found := unifiFirewallruleNames[rulename]; !found { + log.Info(fmt.Sprintf("Creating ipv6 udp firewallrule for %s to %s: %s", networkCRDs.Items[i].Name, firewallGroup.Name, rulename)) + firewallRule := fillDefaultRule() + firewallRule.Name = rulename + firewallRule.Source.NetworkIDs = []string{networkCRDs.Items[i].Spec.ID} + firewallRule.Source.PortMatchingType = "ANY" + firewallRule.Source.ZoneID = networkCRDs.Items[i].Status.FirewallZoneID + firewallRule.Source.MatchingTarget = "NETWORK" + firewallRule.Protocol = "udp" + firewallRule.IPVersion = "IPV6" + firewallRule.Description = fmt.Sprintf("Allow udp IPV6 from %s to %s", networkCRDs.Items[i].Name, firewallGroup.Name) + firewallRule.Destination.MatchingTargetType = "OBJECT" + firewallRule.Destination.IPGroupID = firewallGroup.Status.ResourcesManaged.IPV6Object.ID + firewallRule.Destination.MatchingTarget = "IP" + firewallRule.Destination.PortMatchingType = "OBJECT" + firewallRule.Destination.PortGroupID = firewallGroup.Status.ResourcesManaged.UDPPortsObject.ID + firewallRule.Destination.ZoneID = kubernetesZoneID + + log.Info(fmt.Sprintf("Trying to create firewall rule from network %s to %s: %+v", networkCRDs.Items[i].Name, firewallGroup.Name, firewallRule)) + pretty, _ := json.MarshalIndent(firewallRule, "", " ") + log.Info(string(pretty)) + _, err := r.UnifiClient.Client.CreateFirewallPolicy(context.Background(), r.UnifiClient.SiteID, &firewallRule) + if err != nil { + log.Error(err, "Could not create firewall policy") + return ctrl.Result{}, err + } + + } else { + log.Info(fmt.Sprintf("Firewall rule for ipv6 udp %s to %s already exists", networkCRDs.Items[i].Name, firewallGroup.Name)) + } + } + } + } + } + } return ctrl.Result{}, nil } func (r *FirewallRuleReconciler) mapFirewallGroupToFirewallRules(ctx context.Context, obj client.Object) []ctrl.Request { var requests []ctrl.Request - service, ok := obj.(*corev1.Service) + firewallGroup, ok := obj.(*unifiv1beta1.FirewallGroup) if !ok { return requests } @@ -125,10 +595,10 @@ func (r *FirewallRuleReconciler) mapFirewallGroupToFirewallRules(ctx context.Con } for _, rule := range allFirewallRules.Items { - if rule.Spec.MatchFirewallGroupsInAllNamespaces || rule.Namespace == service.Namespace { + if rule.Spec.MatchFirewallGroupsInAllNamespaces || rule.Namespace == firewallGroup.Namespace { annotationKey := "unifi.engen.priv.no/firewall-rule" annotationVal := rule.Name - if val, ok := service.Annotations[annotationKey]; ok && (annotationVal == "" || val == annotationVal) { + if val, ok := firewallGroup.Annotations[annotationKey]; ok && (annotationVal == "" || val == annotationVal) { requests = append(requests, ctrl.Request{ NamespacedName: types.NamespacedName{ Name: rule.Name, diff --git a/internal/controller/networkconfiguration_controller.go b/internal/controller/networkconfiguration_controller.go index 3d580da..14d91c3 100644 --- a/internal/controller/networkconfiguration_controller.go +++ b/internal/controller/networkconfiguration_controller.go @@ -22,6 +22,7 @@ import ( "time" "k8s.io/apimachinery/pkg/runtime" + "k8s.io/apimachinery/pkg/types" ctrl "sigs.k8s.io/controller-runtime" "sigs.k8s.io/controller-runtime/pkg/client" "sigs.k8s.io/controller-runtime/pkg/log" @@ -178,6 +179,10 @@ func (r *NetworkconfigurationReconciler) Reconcile(ctx context.Context, req ctrl Vlan: int64(unifinetwork.VLAN), VlanEnabled: unifinetwork.VLANEnabled, } + networkStatus := unifiv1.NetworkconfigurationStatus{ + FirewallZoneID: unifinetwork.FirewallZoneID, + } + log.Info(fmt.Sprintf("Network status %s: %+v", networkSpec.Name, networkStatus)) if _, found := networkNamesCRDs[unifinetwork.Name]; !found { firewallZoneNamesCRDs := make(map[string]struct{}) firewallZoneIdsCRDs := make(map[string]struct{}) @@ -190,12 +195,18 @@ func (r *NetworkconfigurationReconciler) Reconcile(ctx context.Context, req ctrl Name: toKubeName(unifinetwork.Name), Namespace: defaultNs, }, - Spec: networkSpec, + Spec: networkSpec, + Status: networkStatus, } err = r.Create(ctx, networkCRD) if err != nil { return ctrl.Result{RequeueAfter: 10 * time.Minute}, err } + err = r.Get(ctx, types.NamespacedName{Name: networkCRD.Name, Namespace: networkCRD.Namespace}, networkCRD) + networkCRD.Status = networkStatus + if err = r.Status().Update(ctx, networkCRD); err != nil { + return ctrl.Result{RequeueAfter: 10 * time.Minute}, err + } } else { for _, networkCRD := range networkCRDs.Items { if networkCRD.Spec.Name == unifinetwork.Name { @@ -205,6 +216,9 @@ func (r *NetworkconfigurationReconciler) Reconcile(ctx context.Context, req ctrl if err != nil { return ctrl.Result{RequeueAfter: 10 * time.Minute}, err } + if err = r.Status().Update(ctx, &networkCRD); err != nil { + return ctrl.Result{RequeueAfter: 10 * time.Minute}, err + } } } }