Merge branch 'master' into lahabana-patch-1

.github/workflows/build-test-distribute.yaml

@@ -168,7 +168,7 @@ jobs:
       - name: Push security assets to cloudsmith
         id: push_security_assets
         if: ${{ needs.provenance.result == 'success' || needs.build_publish.result == 'success' }}
-        uses: cloudsmith-io/action@468883caf5ea64dd980d5266ff72dcf281c83df6 # v0.6.7
+        uses: cloudsmith-io/action@e84016ef48713f4dfdb00210c4720a286662e4f4 # v0.6.8
         with:
           api-key: ${{ secrets.CLOUDSMITH_API_KEY }}
           command: "push"

api/common/v1alpha1/ref.go

@@ -13,21 +13,23 @@ import (
 type TargetRefKind string
 
 var (
-	Mesh              TargetRefKind = "Mesh"
-	MeshSubset        TargetRefKind = "MeshSubset"
-	MeshGateway       TargetRefKind = "MeshGateway"
-	MeshService       TargetRefKind = "MeshService"
-	MeshServiceSubset TargetRefKind = "MeshServiceSubset"
-	MeshHTTPRoute     TargetRefKind = "MeshHTTPRoute"
+	Mesh                TargetRefKind = "Mesh"
+	MeshSubset          TargetRefKind = "MeshSubset"
+	MeshGateway         TargetRefKind = "MeshGateway"
+	MeshService         TargetRefKind = "MeshService"
+	MeshExternalService TargetRefKind = "MeshExternalService"
+	MeshServiceSubset   TargetRefKind = "MeshServiceSubset"
+	MeshHTTPRoute       TargetRefKind = "MeshHTTPRoute"
 )
 
 var order = map[TargetRefKind]int{
-	Mesh:              1,
-	MeshSubset:        2,
-	MeshGateway:       3,
-	MeshService:       4,
-	MeshServiceSubset: 5,
-	MeshHTTPRoute:     6,
+	Mesh:                1,
+	MeshSubset:          2,
+	MeshGateway:         3,
+	MeshService:         4,
+	MeshExternalService: 5,
+	MeshServiceSubset:   6,
+	MeshHTTPRoute:       7,
 }
 
 // +kubebuilder:validation:Enum=Sidecar;Gateway
@@ -38,8 +40,8 @@ var (
 	Gateway TargetRefProxyType = "Gateway"
 )
 
-func (k TargetRefKind) Less(o TargetRefKind) bool {
-	return order[k] < order[o]
+func (k TargetRefKind) Compare(o TargetRefKind) int {
+	return order[k] - order[o]
 }
 
 func AllTargetRefKinds() []TargetRefKind {
@@ -57,7 +59,7 @@ func (x TargetRefKindSlice) Swap(i, j int)      { x[i], x[j] = x[j], x[i] }
 // TargetRef defines structure that allows attaching policy to various objects
 type TargetRef struct {
 	// Kind of the referenced resource
-	// +kubebuilder:validation:Enum=Mesh;MeshSubset;MeshGateway;MeshService;MeshServiceSubset;MeshHTTPRoute
+	// +kubebuilder:validation:Enum=Mesh;MeshSubset;MeshGateway;MeshService;MeshExternalService;MeshServiceSubset;MeshHTTPRoute
 	Kind TargetRefKind `json:"kind,omitempty"`
 	// Name of the referenced resource. Can only be used with kinds: `MeshService`,
 	// `MeshServiceSubset` and `MeshGatewayRoute`
@@ -71,6 +73,15 @@ type TargetRef struct {
 	// all data plane types are targeted by the policy.
 	// +kubebuilder:validation:MinItems=1
 	ProxyTypes []TargetRefProxyType `json:"proxyTypes,omitempty"`
+	// Namespace specifies the namespace of target resource. If empty only resources in policy namespace
+	// will be targeted.
+	Namespace string `json:"namespace,omitempty"`
+	// Labels are used to select group of MeshServices that match labels. Either Labels or
+	// Name and Namespace can be used.
+	Labels map[string]string `json:"labels,omitempty"`
+	// SectionName is used to target specific section of resource.
+	// For example, you can target port from MeshService.ports[] by its name. Only traffic to this port will be affected.
+	SectionName string `json:"sectionName,omitempty"`
 }
 
 func IncludesGateways(ref TargetRef) bool {

api/mesh/v1alpha1/dataplane_helpers.go

@@ -56,6 +56,10 @@ const (
 	// at this moment is "shadow". When effect is "shadow" the policy doesn't change the DPPs configs, but could be
 	// observed using the Inspect API.
 	EffectLabel = "kuma.io/effect"
+
+	// PolicyRoleLabel is a standard label that reflects the role of the policy. The value is automatically set by the
+	// Kuma CP based on the policy spec. Supported values are "producer", "consumer", "system" and "workload-owner".
+	PolicyRoleLabel = "kuma.io/policy-role"
 )
 
 type ResourceOrigin string
@@ -65,6 +69,15 @@ const (
 	ZoneResourceOrigin   ResourceOrigin = "zone"
 )
 
+type PolicyRole string
+
+const (
+	ProducerPolicyRole      PolicyRole = "producer"
+	ConsumerPolicyRole      PolicyRole = "consumer"
+	SystemPolicyRole        PolicyRole = "system"
+	WorkloadOwnerPolicyRole PolicyRole = "workload-owner"
+)
+
 func (o ResourceOrigin) IsValid() error {
 	switch o {
 	case GlobalResourceOrigin, ZoneResourceOrigin:

app/kuma-dp/pkg/dataplane/envoy/remote_bootstrap.go

@@ -189,6 +189,7 @@ func (b *remoteBootstrap) requestForBootstrap(ctx context.Context, client *http.
 			CertPath:   params.MetricsCertPath,
 			KeyPath:    params.MetricsKeyPath,
 		},
+		SystemCaPath: params.SystemCaPath,
 	}
 	jsonBytes, err := json.MarshalIndent(request, "", " ")
 	if err != nil {