klauvsteinen/unifi-network-operator
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Firewall rule API, including needed changes in other APIs

Browse Source
This commit is contained in:
Vegard Engen
2025-04-18 23:59:19 +02:00
parent 89a811bef9
commit c63d52bb46
15 changed files with 1084 additions and 80 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
api/v1beta1/common_types.go
View File

@@ -4,17 +4,38 @@ package v1beta1
// NOTE: json tags are required. Any new fields you add must have json tags for the fields to be serialized.
// FirewallRuleSpec defines the desired state of FirewallRule.
type ServiceSpec struct {
type NamedUnifiResource struct {
Name string `json:"name,omitempty"`
ID string `json:"id,omitempty"`
}
type ServiceEntry struct {
Namespace string `json:"namespace,omitempty"`
Name string `json:"name,omitempty"`
}
type FirewallGroupEntry struct {
Namespace string `json:"namespace,omitempty"`
Name string `json:"name,omitempty"`
}
type FirewallZoneEntry struct {
Namespace string `json:"namespace,omitempty"`
Name string `json:"name,omitempty"`
}
type FirewallRuleEntry struct {
Namespace string `json:"namespace,omitempty"`
Name string `json:"name,omitempty"`
}
type NetworkEntry struct {
Namespace string `json:"namespace,omitempty"`
Name string `json:"name,omitempty"`
}
type FirewallSource struct {
Zones []string `json:"from_zones,omitempty"`
Networks []string `json:"from_networks,omitempty"`
FirewallZones []FirewallZoneEntry `json:"from_zones,omitempty"`
Networks []NetworkEntry `json:"from_networks,omitempty"`
}
type FirewallDestination struct {
FirewallGroups []string `json:"firewall_group,omitempty"`
Services []ServiceSpec `json:"service,omitempty"`
FirewallGroups []FirewallGroupEntry `json:"firewall_groups,omitempty"`
Services []ServiceEntry `json:"services,omitempty"`
}

22
api/v1beta1/firewallgroup_types.go
View File

@@ -31,15 +31,17 @@ type FirewallGroupSpec struct {
// Foo is an example field of FirewallGroup. Edit firewallgroup_types.go to remove/update
// Description is a human-readable explanation for the object
ID string `json:"id,omitempty"`
Name string `json:"name,omitempty"`
MatchServicesInAllNamespaces bool `json:"matchServicesInAllNamespaces,omitempty"`
// ManualAddresses is a list of manual IPs or CIDRs (IPv4 or IPv6)
// +optional
ManualAddresses []string `json:"manualAddresses,omitempty"`
ManualPorts []string `json:"manualPorts,omitempty"`
ManualAddresses []string `json:"manualAddresses,omitempty"`
ManualPorts []string `json:"manualPorts,omitempty"`
ManualServices []ServiceEntry `json:"manual_services,omitempty"`
AutoCreatedFrom ServiceSpec `json:"auto_created_from,omitempty"`
AutoCreatedFrom FirewallRuleEntry `json:"auto_created_from,omitempty"`
// AutoIncludeSelector defines which services to extract addresses from
// +optional
@@ -51,17 +53,29 @@ type FirewallGroupStatus struct {
// INSERT ADDITIONAL STATUS FIELD - define observed state of cluster
// Important: Run "make" to regenerate code after modifying this file
ResolvedAddresses []string `json:"resolvedAddresses,omitempty"`
ResolvedIPV4Addresses []string `json:"resolvedIPV4Addresses,omitempty"`
ResolvedIPV6Addresses []string `json:"resolvedIPV6Addresses,omitempty"`
ResolvedTCPPorts []string `json:"resolvedTCPorts,omitempty"`
ResolvedUDPPorts []string `json:"resolvedUDPorts,omitempty"`
// SyncedWithUnifi indicates whether the addresses are successfully pushed
// +optional
SyncedWithUnifi bool `json:"syncedWithUnifi,omitempty"`
ResourcesManaged *FirewallGroupResourcesManaged `json:"resources_managed,omitempty"`
// LastSyncTime is the last time the object was synced
// +optional
LastSyncTime *metav1.Time `json:"lastSyncTime,omitempty"`
}
type FirewallGroupResourcesManaged struct {
IPV4Object *NamedUnifiResource `json:"ipv4_object,omitempty"`
IPV6Object *NamedUnifiResource `json:"ipv6_object,omitempty"`
TCPPortsObject *NamedUnifiResource `json:"tcp_ports_object,omitempty"`
UDPPortsObject *NamedUnifiResource `json:"udp_ports_object,omitempty"`
}
// +kubebuilder:object:root=true
// +kubebuilder:subresource:status

13
api/v1beta1/firewallrule_types.go
View File

@@ -54,6 +54,19 @@ type FirewallRuleSpec struct {
type FirewallRuleStatus struct {
// INSERT ADDITIONAL STATUS FIELD - define observed state of cluster
// Important: Run "make" to regenerate code after modifying this file
ResourcesManaged *FirewallRuleResourcesManaged `json:"resources_managed,omitempty"`
}
type FirewallRuleResourcesManaged struct {
UnifiFirewallRules []UnifiFirewallRuleEntry `json:"firewall_rules_managed,omitempty"`
FirewallGroups []FirewallGroupEntry `json:"firewall_groups_managed,omitempty"`
}
type UnifiFirewallRuleEntry struct {
From string `json:"from"`
To string `json:"to"`
RuleID string `json:"rule_id"`
}
// +kubebuilder:object:root=true

6
api/v1beta1/firewallzone_types.go
View File

@@ -39,6 +39,12 @@ type FirewallZoneSpec struct {
type FirewallZoneStatus struct {
// INSERT ADDITIONAL STATUS FIELD - define observed state of cluster
// Important: Run "make" to regenerate code after modifying this file
ResourcesManaged *FirewallZoneResourcesManaged `json:"resources_managed,omitempty"`
}
type FirewallZoneResourcesManaged struct {
UnifiFirewallZones []NamedUnifiResource `json:"firewall_zones_managed,omitempty"`
}
// +kubebuilder:object:root=true

5
api/v1beta1/networkconfiguration_types.go
View File

@@ -58,11 +58,16 @@ type NetworkconfigurationStatus struct {
// +optional
SyncedWithUnifi bool `json:"syncedWithUnifi,omitempty"`
ResourcesManaged *NetworkconfigurationResourcesManaged `json:"resources_managed,omitempty"`
// LastSyncTime is the last time the object was synced
// +optional
LastSyncTime *metav1.Time `json:"lastSyncTime,omitempty"`
}
type NetworkconfigurationResourcesManaged struct {
UnifiNetworks []NamedUnifiResource `json:"networks_managed,omitempty"`
}
// +kubebuilder:object:root=true
// +kubebuilder:subresource:status

258
api/v1beta1/zz_generated.deepcopy.go
View File

@@ -30,12 +30,12 @@ func (in *FirewallDestination) DeepCopyInto(out *FirewallDestination) {
*out = *in
if in.FirewallGroups != nil {
in, out := &in.FirewallGroups, &out.FirewallGroups
*out = make([]string, len(*in))
*out = make([]FirewallGroupEntry, len(*in))
copy(*out, *in)
}
if in.Services != nil {
in, out := &in.Services, &out.Services
*out = make([]ServiceSpec, len(*in))
*out = make([]ServiceEntry, len(*in))
copy(*out, *in)
}
}
@@ -77,6 +77,21 @@ func (in *FirewallGroup) DeepCopyObject() runtime.Object {
return nil
}
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (in *FirewallGroupEntry) DeepCopyInto(out *FirewallGroupEntry) {
*out = *in
}
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new FirewallGroupEntry.
func (in *FirewallGroupEntry) DeepCopy() *FirewallGroupEntry {
if in == nil {
return nil
}
out := new(FirewallGroupEntry)
in.DeepCopyInto(out)
return out
}
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (in *FirewallGroupList) DeepCopyInto(out *FirewallGroupList) {
*out = *in
@@ -109,6 +124,41 @@ func (in *FirewallGroupList) DeepCopyObject() runtime.Object {
return nil
}
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (in *FirewallGroupResourcesManaged) DeepCopyInto(out *FirewallGroupResourcesManaged) {
*out = *in
if in.IPV4Object != nil {
in, out := &in.IPV4Object, &out.IPV4Object
*out = new(NamedUnifiResource)
**out = **in
}
if in.IPV6Object != nil {
in, out := &in.IPV6Object, &out.IPV6Object
*out = new(NamedUnifiResource)
**out = **in
}
if in.TCPPortsObject != nil {
in, out := &in.TCPPortsObject, &out.TCPPortsObject
*out = new(NamedUnifiResource)
**out = **in
}
if in.UDPPortsObject != nil {
in, out := &in.UDPPortsObject, &out.UDPPortsObject
*out = new(NamedUnifiResource)
**out = **in
}
}
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new FirewallGroupResourcesManaged.
func (in *FirewallGroupResourcesManaged) DeepCopy() *FirewallGroupResourcesManaged {
if in == nil {
return nil
}
out := new(FirewallGroupResourcesManaged)
in.DeepCopyInto(out)
return out
}
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (in *FirewallGroupSpec) DeepCopyInto(out *FirewallGroupSpec) {
*out = *in
@@ -122,6 +172,11 @@ func (in *FirewallGroupSpec) DeepCopyInto(out *FirewallGroupSpec) {
*out = make([]string, len(*in))
copy(*out, *in)
}
if in.ManualServices != nil {
in, out := &in.ManualServices, &out.ManualServices
*out = make([]ServiceEntry, len(*in))
copy(*out, *in)
}
out.AutoCreatedFrom = in.AutoCreatedFrom
if in.AutoIncludeSelector != nil {
in, out := &in.AutoIncludeSelector, &out.AutoIncludeSelector
@@ -143,11 +198,31 @@ func (in *FirewallGroupSpec) DeepCopy() *FirewallGroupSpec {
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (in *FirewallGroupStatus) DeepCopyInto(out *FirewallGroupStatus) {
*out = *in
if in.ResolvedAddresses != nil {
in, out := &in.ResolvedAddresses, &out.ResolvedAddresses
if in.ResolvedIPV4Addresses != nil {
in, out := &in.ResolvedIPV4Addresses, &out.ResolvedIPV4Addresses
*out = make([]string, len(*in))
copy(*out, *in)
}
if in.ResolvedIPV6Addresses != nil {
in, out := &in.ResolvedIPV6Addresses, &out.ResolvedIPV6Addresses
*out = make([]string, len(*in))
copy(*out, *in)
}
if in.ResolvedTCPPorts != nil {
in, out := &in.ResolvedTCPPorts, &out.ResolvedTCPPorts
*out = make([]string, len(*in))
copy(*out, *in)
}
if in.ResolvedUDPPorts != nil {
in, out := &in.ResolvedUDPPorts, &out.ResolvedUDPPorts
*out = make([]string, len(*in))
copy(*out, *in)
}
if in.ResourcesManaged != nil {
in, out := &in.ResourcesManaged, &out.ResourcesManaged
*out = new(FirewallGroupResourcesManaged)
(*in).DeepCopyInto(*out)
}
if in.LastSyncTime != nil {
in, out := &in.LastSyncTime, &out.LastSyncTime
*out = (*in).DeepCopy()
@@ -170,7 +245,7 @@ func (in *FirewallRule) DeepCopyInto(out *FirewallRule) {
out.TypeMeta = in.TypeMeta
in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
in.Spec.DeepCopyInto(&out.Spec)
out.Status = in.Status
in.Status.DeepCopyInto(&out.Status)
}
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new FirewallRule.
@@ -191,6 +266,21 @@ func (in *FirewallRule) DeepCopyObject() runtime.Object {
return nil
}
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (in *FirewallRuleEntry) DeepCopyInto(out *FirewallRuleEntry) {
*out = *in
}
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new FirewallRuleEntry.
func (in *FirewallRuleEntry) DeepCopy() *FirewallRuleEntry {
if in == nil {
return nil
}
out := new(FirewallRuleEntry)
in.DeepCopyInto(out)
return out
}
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (in *FirewallRuleList) DeepCopyInto(out *FirewallRuleList) {
*out = *in
@@ -223,6 +313,31 @@ func (in *FirewallRuleList) DeepCopyObject() runtime.Object {
return nil
}
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (in *FirewallRuleResourcesManaged) DeepCopyInto(out *FirewallRuleResourcesManaged) {
*out = *in
if in.UnifiFirewallRules != nil {
in, out := &in.UnifiFirewallRules, &out.UnifiFirewallRules
*out = make([]UnifiFirewallRuleEntry, len(*in))
copy(*out, *in)
}
if in.FirewallGroups != nil {
in, out := &in.FirewallGroups, &out.FirewallGroups
*out = make([]FirewallGroupEntry, len(*in))
copy(*out, *in)
}
}
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new FirewallRuleResourcesManaged.
func (in *FirewallRuleResourcesManaged) DeepCopy() *FirewallRuleResourcesManaged {
if in == nil {
return nil
}
out := new(FirewallRuleResourcesManaged)
in.DeepCopyInto(out)
return out
}
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (in *FirewallRuleSpec) DeepCopyInto(out *FirewallRuleSpec) {
*out = *in
@@ -243,6 +358,11 @@ func (in *FirewallRuleSpec) DeepCopy() *FirewallRuleSpec {
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (in *FirewallRuleStatus) DeepCopyInto(out *FirewallRuleStatus) {
*out = *in
if in.ResourcesManaged != nil {
in, out := &in.ResourcesManaged, &out.ResourcesManaged
*out = new(FirewallRuleResourcesManaged)
(*in).DeepCopyInto(*out)
}
}
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new FirewallRuleStatus.
@@ -258,14 +378,14 @@ func (in *FirewallRuleStatus) DeepCopy() *FirewallRuleStatus {
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (in *FirewallSource) DeepCopyInto(out *FirewallSource) {
*out = *in
if in.Zones != nil {
in, out := &in.Zones, &out.Zones
*out = make([]string, len(*in))
if in.FirewallZones != nil {
in, out := &in.FirewallZones, &out.FirewallZones
*out = make([]FirewallZoneEntry, len(*in))
copy(*out, *in)
}
if in.Networks != nil {
in, out := &in.Networks, &out.Networks
*out = make([]string, len(*in))
*out = make([]NetworkEntry, len(*in))
copy(*out, *in)
}
}
@@ -286,7 +406,7 @@ func (in *FirewallZone) DeepCopyInto(out *FirewallZone) {
out.TypeMeta = in.TypeMeta
in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
in.Spec.DeepCopyInto(&out.Spec)
out.Status = in.Status
in.Status.DeepCopyInto(&out.Status)
}
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new FirewallZone.
@@ -307,6 +427,21 @@ func (in *FirewallZone) DeepCopyObject() runtime.Object {
return nil
}
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (in *FirewallZoneEntry) DeepCopyInto(out *FirewallZoneEntry) {
*out = *in
}
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new FirewallZoneEntry.
func (in *FirewallZoneEntry) DeepCopy() *FirewallZoneEntry {
if in == nil {
return nil
}
out := new(FirewallZoneEntry)
in.DeepCopyInto(out)
return out
}
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (in *FirewallZoneList) DeepCopyInto(out *FirewallZoneList) {
*out = *in
@@ -339,6 +474,26 @@ func (in *FirewallZoneList) DeepCopyObject() runtime.Object {
return nil
}
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (in *FirewallZoneResourcesManaged) DeepCopyInto(out *FirewallZoneResourcesManaged) {
*out = *in
if in.UnifiFirewallZones != nil {
in, out := &in.UnifiFirewallZones, &out.UnifiFirewallZones
*out = make([]NamedUnifiResource, len(*in))
copy(*out, *in)
}
}
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new FirewallZoneResourcesManaged.
func (in *FirewallZoneResourcesManaged) DeepCopy() *FirewallZoneResourcesManaged {
if in == nil {
return nil
}
out := new(FirewallZoneResourcesManaged)
in.DeepCopyInto(out)
return out
}
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (in *FirewallZoneSpec) DeepCopyInto(out *FirewallZoneSpec) {
*out = *in
@@ -362,6 +517,11 @@ func (in *FirewallZoneSpec) DeepCopy() *FirewallZoneSpec {
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (in *FirewallZoneStatus) DeepCopyInto(out *FirewallZoneStatus) {
*out = *in
if in.ResourcesManaged != nil {
in, out := &in.ResourcesManaged, &out.ResourcesManaged
*out = new(FirewallZoneResourcesManaged)
(*in).DeepCopyInto(*out)
}
}
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new FirewallZoneStatus.
@@ -374,6 +534,36 @@ func (in *FirewallZoneStatus) DeepCopy() *FirewallZoneStatus {
return out
}
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (in *NamedUnifiResource) DeepCopyInto(out *NamedUnifiResource) {
*out = *in
}
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NamedUnifiResource.
func (in *NamedUnifiResource) DeepCopy() *NamedUnifiResource {
if in == nil {
return nil
}
out := new(NamedUnifiResource)
in.DeepCopyInto(out)
return out
}
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (in *NetworkEntry) DeepCopyInto(out *NetworkEntry) {
*out = *in
}
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NetworkEntry.
func (in *NetworkEntry) DeepCopy() *NetworkEntry {
if in == nil {
return nil
}
out := new(NetworkEntry)
in.DeepCopyInto(out)
return out
}
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (in *Networkconfiguration) DeepCopyInto(out *Networkconfiguration) {
*out = *in
@@ -433,6 +623,26 @@ func (in *NetworkconfigurationList) DeepCopyObject() runtime.Object {
return nil
}
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (in *NetworkconfigurationResourcesManaged) DeepCopyInto(out *NetworkconfigurationResourcesManaged) {
*out = *in
if in.UnifiNetworks != nil {
in, out := &in.UnifiNetworks, &out.UnifiNetworks
*out = make([]NamedUnifiResource, len(*in))
copy(*out, *in)
}
}
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NetworkconfigurationResourcesManaged.
func (in *NetworkconfigurationResourcesManaged) DeepCopy() *NetworkconfigurationResourcesManaged {
if in == nil {
return nil
}
out := new(NetworkconfigurationResourcesManaged)
in.DeepCopyInto(out)
return out
}
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (in *NetworkconfigurationSpec) DeepCopyInto(out *NetworkconfigurationSpec) {
*out = *in
@@ -451,6 +661,11 @@ func (in *NetworkconfigurationSpec) DeepCopy() *NetworkconfigurationSpec {
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (in *NetworkconfigurationStatus) DeepCopyInto(out *NetworkconfigurationStatus) {
*out = *in
if in.ResourcesManaged != nil {
in, out := &in.ResourcesManaged, &out.ResourcesManaged
*out = new(NetworkconfigurationResourcesManaged)
(*in).DeepCopyInto(*out)
}
if in.LastSyncTime != nil {
in, out := &in.LastSyncTime, &out.LastSyncTime
*out = (*in).DeepCopy()
@@ -468,16 +683,31 @@ func (in *NetworkconfigurationStatus) DeepCopy() *NetworkconfigurationStatus {
}
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (in *ServiceSpec) DeepCopyInto(out *ServiceSpec) {
func (in *ServiceEntry) DeepCopyInto(out *ServiceEntry) {
*out = *in
}
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ServiceSpec.
func (in *ServiceSpec) DeepCopy() *ServiceSpec {
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ServiceEntry.
func (in *ServiceEntry) DeepCopy() *ServiceEntry {
if in == nil {
return nil
}
out := new(ServiceSpec)
out := new(ServiceEntry)
in.DeepCopyInto(out)
return out
}
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (in *UnifiFirewallRuleEntry) DeepCopyInto(out *UnifiFirewallRuleEntry) {
*out = *in
}
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new UnifiFirewallRuleEntry.
func (in *UnifiFirewallRuleEntry) DeepCopy() *UnifiFirewallRuleEntry {
if in == nil {
return nil
}
out := new(UnifiFirewallRuleEntry)
in.DeepCopyInto(out)
return out
}