Skip to content

Commit 31e1334

Browse files
mateiidavidolix0r
mateiidavid
and
olix0r
authored
Introduce ExternalWorkload CRD (#11805)
To support mesh expansion, the control plane needs to read configuration associated with an external instance (i.e. a VM) for the purpose of service and inbound authorization policy discovery. This change introduces a new CRD that supports the required configuration options. The resource supports: * a list of workload IPs (with a generic format to support ipv4 now and ipv6 in the future) * a set of mesh TLS settings (SNI and identity) * a set of ports exposed by the workload * a set of status conditions --------- Signed-off-by: Matei David <[email protected]> Co-authored-by: Oliver Gould <[email protected]>
1 parent cf2999d commit 31e1334

File tree

5 files changed

+633
-0
lines changed

5 files changed

+633
-0
lines changed

‎charts/linkerd-crds/templates/workload/external-workload.yaml

+157
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,157 @@
1+
---
2+
apiVersion: apiextensions.k8s.io/v1
3+
kind: CustomResourceDefinition
4+
metadata:
5+
name: externalworkloads.workload.linkerd.io
6+
annotations:
7+
{{ include "partials.annotations.created-by" . }}
8+
labels:
9+
helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
10+
linkerd.io/control-plane-ns: {{.Release.Namespace}}
11+
spec:
12+
group: workload.linkerd.io
13+
names:
14+
categories:
15+
- external
16+
kind: ExternalWorkload
17+
listKind: ExternalWorkloadList
18+
plural: externalworkloads
19+
singular: externalworkload
20+
shortNames: []
21+
scope: Namespaced
22+
versions:
23+
- additionalPrinterColumns:
24+
- jsonPath: .spec.meshTls.identity
25+
name: Identity
26+
type: string
27+
- jsonPath: .metadata.creationTimestamp
28+
name: Age
29+
type: date
30+
name: v1alpha1
31+
served: true
32+
storage: true
33+
schema:
34+
openAPIV3Schema:
35+
description: >-
36+
An ExternalWorkload describes a single workload (i.e. a deployable unit) external
37+
to the cluster that should be enrolled in the mesh.
38+
type: object
39+
required: [spec]
40+
properties:
41+
apiVerson:
42+
type: string
43+
kind:
44+
type: string
45+
metadata:
46+
type: object
47+
spec:
48+
properties:
49+
meshTls:
50+
description: meshTls describes TLS settings associated with an
51+
external workload.
52+
properties:
53+
identity:
54+
type: string
55+
description: identity of the workload. Corresponds to the
56+
identity used in the workload's certificate. It is used
57+
by peers to perform verification in the mTLS handshake.
58+
minLength: 1
59+
maxLength: 253
60+
serverName:
61+
type: string
62+
description: serverName is the name of the workload in DNS
63+
format. It is used by the workload to terminate TLS using
64+
SNI.
65+
minLength: 1
66+
maxLength: 253
67+
type: object
68+
ports:
69+
type: array
70+
description: ports describes a list of ports exposed by the
71+
workload
72+
items:
73+
type: object
74+
properties:
75+
name:
76+
type: string
77+
description: name must be an IANA_SVC_NAME and unique
78+
within the ports set. Each named port can be referred
79+
to by services.
80+
port:
81+
format: int32
82+
maximum: 65535
83+
minimum: 1
84+
type: integer
85+
protocol:
86+
description: protocol exposed by the port. Must be UDP or
87+
TCP. Defaults to TCP.
88+
type: string
89+
default: "TCP"
90+
workloadIPs:
91+
type: array
92+
description: workloadIPs contains a list of IP addresses that
93+
can be used to send traffic to the workload.
94+
items:
95+
type: object
96+
properties:
97+
ip:
98+
type: string
99+
type: object
100+
required:
101+
- ports
102+
- workloadIPs
103+
status:
104+
type: object
105+
properties:
106+
conditions:
107+
type: array
108+
items:
109+
type: object
110+
properties:
111+
lastProbeTime:
112+
description: lastProbeTime is the last time the
113+
healthcheck endpoint was probed.
114+
format: date-time
115+
type: string
116+
lastTransitionTime:
117+
description: lastTransitionTime is the last time the
118+
condition transitioned from one status to another.
119+
format: date-time
120+
type: string
121+
status:
122+
description: status of the condition (one of True, False, Unknown)
123+
enum:
124+
- "True"
125+
- "False"
126+
- Unknown
127+
type: string
128+
type:
129+
description: type of the condition in CamelCase or in
130+
foo.example.com/CamelCase.
131+
maxLength: 316
132+
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
133+
type: string
134+
reason:
135+
description: reason contains a programmatic identifier
136+
indicating the reason for the condition's last
137+
transition. Producers of specific condition types may
138+
define expected values and meanings for this field, and
139+
whether the values are considered a guaranteed API. The
140+
value should be a CamelCase string. This field may not
141+
be empty.
142+
maxLength: 1024
143+
minLength: 1
144+
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
145+
type: string
146+
message:
147+
description: message is a human readable message
148+
indicating details about the transition. This may be an
149+
empty string.
150+
maxLength: 32768
151+
type: string
152+
required:
153+
- lastTransitionTime
154+
- status
155+
- type
156+
- reason
157+
- message

‎cli/cmd/install.go

+1
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,7 @@ var (
5555
"templates/policy/server.yaml",
5656
"templates/serviceprofile.yaml",
5757
"templates/gateway.networking.k8s.io_httproutes.yaml",
58+
"templates/workload/external-workload.yaml",
5859
}
5960

6061
templatesControlPlane = []string{

‎cli/cmd/testdata/install_crds.golden

+157
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)