Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Documenting available attributes for access policies #673

Merged
merged 1 commit into from
Jul 21, 2024
Merged

Documenting available attributes for access policies #673

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 29 additions & 0 deletions website/content/en/docs/main/concepts/policies.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -126,6 +126,7 @@ A `WorkloadSetOrSelector` object has two fields; exactly one of them must be spe
defining a set of client workloads or a set of services, based on their
attributes. An empty selector matches all workloads/services.

### Example policies
The following policy allows all incoming/outgoing connections in the `default` namespace.

```yaml
Expand All @@ -142,8 +143,36 @@ spec:
- workloadSelector: {}
```

The following privileged policy denies incoming/outgoing connections originating from a cluster with a Peer named `testing`.
```yaml
apiVersion: clusterlink.net/v1alpha1
kind: PrivilegedAccessPolicy
metadata:
name: deny-from-testing
spec:
action: deny
from:
- workloadSelector:
matchLabels:
peer.clusterlink.net/name: testing
to:
- workloadSelector: {}
```

More examples are available on our repo under [examples/policies][].

### Available attributes
The following attributes (labels) are set by ClusterLink on each connection request, and can be used in access policies within a `workloadSelector`.
#### Peer attributes - set when running `clusterlink deploy peer`
* `peer.clusterlink.net/name` - Peer name
#### Client attributes - derived from Pod info, as retrieved from Kubernetes API. Only relevant in the `from` section of access policies
* `client.clusterlink.net/namespace` - Pod's Namespace
* `client.clusterlink.net/service-account` - Pod's Service Account
* `client.clusterlink.net/labels.<label-key>` - Pod's labels - an attribute for each Pod label with key `<label-key>`
#### Service attributes - derived from the Export CR. Only relevant in the `to` section of access policies
* `export.clusterlink.net/name` - Export name
* `export.clusterlink.net/namespace` - Export namespace

[peers]: {{< relref "peers" >}}
[services]: {{< relref "services" >}}
[micro-segmentation]: https://en.wikipedia.org/wiki/Microsegmentation_(network_security)
Expand Down
Loading