Update to version 3.20.0 from upstream
All checks were successful
continuous-integration/drone/push Build is passing
All checks were successful
continuous-integration/drone/push Build is passing
This commit is contained in:
parent
8248e2f847
commit
c1c09c62fb
GPG key ID:
DA7B27055C66D6DE
11 changed files with 299 additions and 97 deletions
|
|
@ -64,16 +64,17 @@ spec:
|
|||
contains a selector expression. Only traffic that originates
|
||||
from (or terminates at) endpoints within the selected
|
||||
namespaces will be matched. When both NamespaceSelector
|
||||
and Selector are defined on the same rule, then only workload
|
||||
endpoints that are matched by both selectors will be selected
|
||||
by the rule. \n For NetworkPolicy, an empty NamespaceSelector
|
||||
implies that the Selector is limited to selecting only
|
||||
workload endpoints in the same namespace as the NetworkPolicy.
|
||||
\n For NetworkPolicy, `global()` NamespaceSelector implies
|
||||
that the Selector is limited to selecting only GlobalNetworkSet
|
||||
or HostEndpoint. \n For GlobalNetworkPolicy, an empty
|
||||
NamespaceSelector implies the Selector applies to workload
|
||||
endpoints across all namespaces."
|
||||
and another selector are defined on the same rule, then
|
||||
only workload endpoints that are matched by both selectors
|
||||
will be selected by the rule. \n For NetworkPolicy, an
|
||||
empty NamespaceSelector implies that the Selector is limited
|
||||
to selecting only workload endpoints in the same namespace
|
||||
as the NetworkPolicy. \n For NetworkPolicy, `global()`
|
||||
NamespaceSelector implies that the Selector is limited
|
||||
to selecting only GlobalNetworkSet or HostEndpoint. \n
|
||||
For GlobalNetworkPolicy, an empty NamespaceSelector implies
|
||||
the Selector applies to workload endpoints across all
|
||||
namespaces."
|
||||
type: string
|
||||
nets:
|
||||
description: Nets is an optional field that restricts the
|
||||
|
|
@ -161,6 +162,26 @@ spec:
|
|||
AND'ed.
|
||||
type: string
|
||||
type: object
|
||||
services:
|
||||
description: "Services is an optional field that contains
|
||||
options for matching Kubernetes Services. If specified,
|
||||
only traffic that originates from or terminates at endpoints
|
||||
within the selected service(s) will be matched, and only
|
||||
to/from each endpoint's port. \n Services cannot be specified
|
||||
on the same rule as Selector, NotSelector, NamespaceSelector,
|
||||
Ports, NotPorts, Nets, NotNets or ServiceAccounts. \n
|
||||
Only valid on egress rules."
|
||||
properties:
|
||||
name:
|
||||
description: Name specifies the name of a Kubernetes
|
||||
Service to match.
|
||||
type: string
|
||||
namespace:
|
||||
description: Namespace specifies the namespace of the
|
||||
given Service. If left empty, the rule will match
|
||||
within this policy's namespace.
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
http:
|
||||
description: HTTP contains match criteria that apply to HTTP
|
||||
|
|
@ -269,16 +290,17 @@ spec:
|
|||
contains a selector expression. Only traffic that originates
|
||||
from (or terminates at) endpoints within the selected
|
||||
namespaces will be matched. When both NamespaceSelector
|
||||
and Selector are defined on the same rule, then only workload
|
||||
endpoints that are matched by both selectors will be selected
|
||||
by the rule. \n For NetworkPolicy, an empty NamespaceSelector
|
||||
implies that the Selector is limited to selecting only
|
||||
workload endpoints in the same namespace as the NetworkPolicy.
|
||||
\n For NetworkPolicy, `global()` NamespaceSelector implies
|
||||
that the Selector is limited to selecting only GlobalNetworkSet
|
||||
or HostEndpoint. \n For GlobalNetworkPolicy, an empty
|
||||
NamespaceSelector implies the Selector applies to workload
|
||||
endpoints across all namespaces."
|
||||
and another selector are defined on the same rule, then
|
||||
only workload endpoints that are matched by both selectors
|
||||
will be selected by the rule. \n For NetworkPolicy, an
|
||||
empty NamespaceSelector implies that the Selector is limited
|
||||
to selecting only workload endpoints in the same namespace
|
||||
as the NetworkPolicy. \n For NetworkPolicy, `global()`
|
||||
NamespaceSelector implies that the Selector is limited
|
||||
to selecting only GlobalNetworkSet or HostEndpoint. \n
|
||||
For GlobalNetworkPolicy, an empty NamespaceSelector implies
|
||||
the Selector applies to workload endpoints across all
|
||||
namespaces."
|
||||
type: string
|
||||
nets:
|
||||
description: Nets is an optional field that restricts the
|
||||
|
|
@ -366,6 +388,26 @@ spec:
|
|||
AND'ed.
|
||||
type: string
|
||||
type: object
|
||||
services:
|
||||
description: "Services is an optional field that contains
|
||||
options for matching Kubernetes Services. If specified,
|
||||
only traffic that originates from or terminates at endpoints
|
||||
within the selected service(s) will be matched, and only
|
||||
to/from each endpoint's port. \n Services cannot be specified
|
||||
on the same rule as Selector, NotSelector, NamespaceSelector,
|
||||
Ports, NotPorts, Nets, NotNets or ServiceAccounts. \n
|
||||
Only valid on egress rules."
|
||||
properties:
|
||||
name:
|
||||
description: Name specifies the name of a Kubernetes
|
||||
Service to match.
|
||||
type: string
|
||||
namespace:
|
||||
description: Namespace specifies the namespace of the
|
||||
given Service. If left empty, the rule will match
|
||||
within this policy's namespace.
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
required:
|
||||
- action
|
||||
|
|
@ -395,16 +437,17 @@ spec:
|
|||
contains a selector expression. Only traffic that originates
|
||||
from (or terminates at) endpoints within the selected
|
||||
namespaces will be matched. When both NamespaceSelector
|
||||
and Selector are defined on the same rule, then only workload
|
||||
endpoints that are matched by both selectors will be selected
|
||||
by the rule. \n For NetworkPolicy, an empty NamespaceSelector
|
||||
implies that the Selector is limited to selecting only
|
||||
workload endpoints in the same namespace as the NetworkPolicy.
|
||||
\n For NetworkPolicy, `global()` NamespaceSelector implies
|
||||
that the Selector is limited to selecting only GlobalNetworkSet
|
||||
or HostEndpoint. \n For GlobalNetworkPolicy, an empty
|
||||
NamespaceSelector implies the Selector applies to workload
|
||||
endpoints across all namespaces."
|
||||
and another selector are defined on the same rule, then
|
||||
only workload endpoints that are matched by both selectors
|
||||
will be selected by the rule. \n For NetworkPolicy, an
|
||||
empty NamespaceSelector implies that the Selector is limited
|
||||
to selecting only workload endpoints in the same namespace
|
||||
as the NetworkPolicy. \n For NetworkPolicy, `global()`
|
||||
NamespaceSelector implies that the Selector is limited
|
||||
to selecting only GlobalNetworkSet or HostEndpoint. \n
|
||||
For GlobalNetworkPolicy, an empty NamespaceSelector implies
|
||||
the Selector applies to workload endpoints across all
|
||||
namespaces."
|
||||
type: string
|
||||
nets:
|
||||
description: Nets is an optional field that restricts the
|
||||
|
|
@ -492,6 +535,26 @@ spec:
|
|||
AND'ed.
|
||||
type: string
|
||||
type: object
|
||||
services:
|
||||
description: "Services is an optional field that contains
|
||||
options for matching Kubernetes Services. If specified,
|
||||
only traffic that originates from or terminates at endpoints
|
||||
within the selected service(s) will be matched, and only
|
||||
to/from each endpoint's port. \n Services cannot be specified
|
||||
on the same rule as Selector, NotSelector, NamespaceSelector,
|
||||
Ports, NotPorts, Nets, NotNets or ServiceAccounts. \n
|
||||
Only valid on egress rules."
|
||||
properties:
|
||||
name:
|
||||
description: Name specifies the name of a Kubernetes
|
||||
Service to match.
|
||||
type: string
|
||||
namespace:
|
||||
description: Namespace specifies the namespace of the
|
||||
given Service. If left empty, the rule will match
|
||||
within this policy's namespace.
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
http:
|
||||
description: HTTP contains match criteria that apply to HTTP
|
||||
|
|
@ -600,16 +663,17 @@ spec:
|
|||
contains a selector expression. Only traffic that originates
|
||||
from (or terminates at) endpoints within the selected
|
||||
namespaces will be matched. When both NamespaceSelector
|
||||
and Selector are defined on the same rule, then only workload
|
||||
endpoints that are matched by both selectors will be selected
|
||||
by the rule. \n For NetworkPolicy, an empty NamespaceSelector
|
||||
implies that the Selector is limited to selecting only
|
||||
workload endpoints in the same namespace as the NetworkPolicy.
|
||||
\n For NetworkPolicy, `global()` NamespaceSelector implies
|
||||
that the Selector is limited to selecting only GlobalNetworkSet
|
||||
or HostEndpoint. \n For GlobalNetworkPolicy, an empty
|
||||
NamespaceSelector implies the Selector applies to workload
|
||||
endpoints across all namespaces."
|
||||
and another selector are defined on the same rule, then
|
||||
only workload endpoints that are matched by both selectors
|
||||
will be selected by the rule. \n For NetworkPolicy, an
|
||||
empty NamespaceSelector implies that the Selector is limited
|
||||
to selecting only workload endpoints in the same namespace
|
||||
as the NetworkPolicy. \n For NetworkPolicy, `global()`
|
||||
NamespaceSelector implies that the Selector is limited
|
||||
to selecting only GlobalNetworkSet or HostEndpoint. \n
|
||||
For GlobalNetworkPolicy, an empty NamespaceSelector implies
|
||||
the Selector applies to workload endpoints across all
|
||||
namespaces."
|
||||
type: string
|
||||
nets:
|
||||
description: Nets is an optional field that restricts the
|
||||
|
|
@ -697,6 +761,26 @@ spec:
|
|||
AND'ed.
|
||||
type: string
|
||||
type: object
|
||||
services:
|
||||
description: "Services is an optional field that contains
|
||||
options for matching Kubernetes Services. If specified,
|
||||
only traffic that originates from or terminates at endpoints
|
||||
within the selected service(s) will be matched, and only
|
||||
to/from each endpoint's port. \n Services cannot be specified
|
||||
on the same rule as Selector, NotSelector, NamespaceSelector,
|
||||
Ports, NotPorts, Nets, NotNets or ServiceAccounts. \n
|
||||
Only valid on egress rules."
|
||||
properties:
|
||||
name:
|
||||
description: Name specifies the name of a Kubernetes
|
||||
Service to match.
|
||||
type: string
|
||||
namespace:
|
||||
description: Namespace specifies the namespace of the
|
||||
given Service. If left empty, the rule will match
|
||||
within this policy's namespace.
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
required:
|
||||
- action
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue