Internal flag

api/v1alpha1/application_types.go

@@ -3,9 +3,11 @@ package v1alpha1
 import (
 	"encoding/json"
 	"errors"
+	"fmt"
 	"github.com/kartverket/skiperator/api/v1alpha1/digdirator"
 	"github.com/kartverket/skiperator/api/v1alpha1/istiotypes"
 	"github.com/kartverket/skiperator/api/v1alpha1/podtypes"
+	"github.com/kartverket/skiperator/pkg/util"
 	corev1 "k8s.io/api/core/v1"
 	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -68,7 +70,7 @@ type ApplicationSpec struct {
 	// They can optionally be suffixed with a plus and name of a custom TLS secret located in the istio-gateways namespace.
 	// E.g. "foo.atkv3-dev.kartverket-intern.cloud+env-wildcard-cert"
 	//+kubebuilder:validation:Optional
-	Ingresses []string `json:"ingresses,omitempty"`
+	Ingresses *apiextensionsv1.JSON `json:"ingresses,omitempty"`
 
 	// An optional priority. Supported values are 'low', 'medium' and 'high'.
 	// The default value is 'medium'.
@@ -335,6 +337,11 @@ type PrometheusConfig struct {
 	AllowAllMetrics bool `json:"allowAllMetrics,omitempty"`
 }
 
+type Ingress struct {
+	Hostname string
+	Internal *bool
+}
+
 func NewDefaultReplicas() Replicas {
 	return Replicas{
 		Min:                  2,
@@ -442,15 +449,53 @@ func (a *Application) GetCommonSpec() *CommonSpec {
 	}
 }
 
+func MarshalledIngresses(ingresses interface{}) (*apiextensionsv1.JSON, error) {
+	marshalled := &apiextensionsv1.JSON{}
+	var err error
+
+	if marshalled.Raw, err = json.Marshal(ingresses); err != nil {
+		return nil, fmt.Errorf("could not marshal ingresses: %w", err)
+	}
+
+	return marshalled, nil
+}
+
 func (s *ApplicationSpec) Hosts() (HostCollection, error) {
+	var ingressesAsString []string
+	var ingressesAsObject []Ingress
+	var errorsFound []error
 	hosts := NewCollection()
 
-	var errorsFound []error
-	for _, ingress := range s.Ingresses {
-		err := hosts.Add(ingress)
+	ingresses, err := MarshalledIngresses(s.Ingresses)
+	if err != nil {
+		return hosts, err
+	}
+	aErr := json.Unmarshal(ingresses.Raw, &ingressesAsString)
+
+	// If the ingress supplied is not a string, we assume it's an object
+	if aErr != nil {
+		if mErr := json.Unmarshal(ingresses.Raw, &ingressesAsObject); mErr != nil {
+			errorsFound = append(errorsFound, mErr)
+			return NewCollection(), errors.Join(errorsFound...)
+		}
+
+		for _, ingress := range ingressesAsObject {
+			if ingress.Internal == nil {
+				ingress.Internal = util.PointTo(isInternal(ingress.Hostname))
+			}
+
+			if aErr := hosts.Add(ingress.Hostname, *ingress.Internal); aErr != nil {
+				errorsFound = append(errorsFound, aErr)
+			}
+		}
+		return hosts, errors.Join(errorsFound...)
+	}
+
+	//Handle legacy ingress format
+	for _, ingress := range ingressesAsString {
+		err := hosts.Add(ingress, isInternal(ingress))
 		if err != nil {
 			errorsFound = append(errorsFound, err)
-			continue
 		}
 	}
 

api/v1alpha1/hosts.go

@@ -3,16 +3,20 @@ package v1alpha1
 import (
 	"fmt"
 	"github.com/chmike/domain"
+	"regexp"
 	"strings"
 )
 
 const hostnameSecretSeparator = "+"
 
+var internalPattern = regexp.MustCompile(`[^.]\.skip\.statkart\.no|[^.]\.kartverket-intern.cloud`)
+
 // TODO: Add a mechanism for validating that the
 // hostname is covered by the CustomCertificateSecret if present
 type Host struct {
 	Hostname                string
 	CustomCertificateSecret *string
+	Internal                bool
 }
 
 type HostCollection struct {
@@ -25,6 +29,7 @@ func NewHost(hostname string) (*Host, error) {
 	}
 
 	var h Host
+
 	// If hostname is separated by +, the user wants to use a custom certificate
 	results := strings.Split(hostname, hostnameSecretSeparator)
 
@@ -49,7 +54,7 @@ func NewHost(hostname string) (*Host, error) {
 	if err := domain.Check(h.Hostname); err != nil {
 		return nil, fmt.Errorf("%s: failed validation: %w", h.Hostname, err)
 	}
-
+	h.Internal = isInternal(hostname)
 	return &h, nil
 }
 
@@ -63,14 +68,14 @@ func NewCollection() HostCollection {
 	}
 }
 
-func (hs *HostCollection) Add(hostname string) error {
+func (hs *HostCollection) Add(hostname string, internal bool) error {
 	h, err := NewHost(hostname)
 	if err != nil {
 		return err
 	}
 
+	h.Internal = internal
 	existingValue, alreadyPresent := hs.hosts[h.Hostname]
-
 	switch alreadyPresent {
 	case true:
 		if existingValue.UsesCustomCert() {
@@ -105,3 +110,7 @@ func (hs *HostCollection) Hostnames() []string {
 func (hs *HostCollection) Count() int {
 	return len(hs.hosts)
 }
+
+func isInternal(hostname string) bool {
+	return internalPattern.MatchString(hostname)
+}

api/v1alpha1/routing_types.go

@@ -41,6 +41,9 @@ type RoutingSpec struct {
 	//+kubebuilder:validation:Optional
 	//+kubebuilder:default:=true
 	RedirectToHTTPS *bool `json:"redirectToHTTPS,omitempty"`
+
+	//+kubebuilder:validation:Optional
+	Internal *bool `json:"internal,omitempty"`
 }
 
 // +kubebuilder:object:generate=true

config/crd/skiperator.kartverket.no_applications.yaml

@@ -646,9 +646,7 @@ spec:
                   Ingresses must be lowercase, contain no spaces, be a non-empty string, and have a hostname/domain separated by a period
                   They can optionally be suffixed with a plus and name of a custom TLS secret located in the istio-gateways namespace.
                   E.g. "foo.atkv3-dev.kartverket-intern.cloud+env-wildcard-cert"
-                items:
-                  type: string
-                type: array
+                x-kubernetes-preserve-unknown-fields: true
               istioSettings:
                 default:
                   telemetry:

config/crd/skiperator.kartverket.no_routings.yaml

@@ -45,6 +45,8 @@ spec:
             properties:
               hostname:
                 type: string
+              internal:
+                type: boolean
               redirectToHTTPS:
                 default: true
                 type: boolean

pkg/resourcegenerator/deployment/deployment.go

@@ -204,11 +204,17 @@ func Generate(r reconciliation.Reconciliation) error {
 	}
 
 	// add an external link to argocd
-	ingresses := application.Spec.Ingresses
+	hosts, err := application.Spec.Hosts()
+	if err != nil {
+		ctxLog.Error(err, "could not get hosts from application")
+		return err
+	}
 	if deployment.Annotations == nil {
 		deployment.Annotations = make(map[string]string)
 	}
 
+	var ingresses = hosts.Hostnames()
+
 	if len(ingresses) > 0 {
 		deployment.Annotations[AnnotationKeyLinkPrefix] = fmt.Sprintf("https://%s", ingresses[0])
 	}

pkg/resourcegenerator/istio/gateway/application.go

@@ -2,9 +2,9 @@ package gateway
 
 import (
 	"fmt"
-
 	skiperatorv1alpha1 "github.com/kartverket/skiperator/api/v1alpha1"
 	"github.com/kartverket/skiperator/pkg/reconciliation"
+	"github.com/kartverket/skiperator/pkg/resourcegenerator/resourceutils"
 	"github.com/kartverket/skiperator/pkg/util"
 	networkingv1beta1api "istio.io/api/networking/v1beta1"
 	networkingv1beta1 "istio.io/client-go/pkg/apis/networking/v1beta1"
@@ -38,7 +38,7 @@ func generateForApplication(r reconciliation.Reconciliation) error {
 		name := fmt.Sprintf("%s-ingress-%x", application.Name, util.GenerateHashFromName(h.Hostname))
 		gateway := networkingv1beta1.Gateway{ObjectMeta: metav1.ObjectMeta{Namespace: application.Namespace, Name: name}}
 
-		gateway.Spec.Selector = util.GetIstioGatewayLabelSelector(h.Hostname)
+		gateway.Spec.Selector = resourceutils.GetIstioGatewayLabelSelector(h)
 
 		gatewayServersToAdd := []*networkingv1beta1api.Server{}
 

pkg/resourcegenerator/istio/gateway/routing.go

@@ -2,10 +2,9 @@ package gateway
 
 import (
 	"fmt"
-
 	skiperatorv1alpha1 "github.com/kartverket/skiperator/api/v1alpha1"
 	"github.com/kartverket/skiperator/pkg/reconciliation"
-	"github.com/kartverket/skiperator/pkg/util"
+	"github.com/kartverket/skiperator/pkg/resourcegenerator/resourceutils"
 	networkingv1beta1api "istio.io/api/networking/v1beta1"
 	networkingv1beta1 "istio.io/client-go/pkg/apis/networking/v1beta1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -31,6 +30,9 @@ func generateForRouting(r reconciliation.Reconciliation) error {
 	if err != nil {
 		return err
 	}
+	if routing.Spec.Internal != nil {
+		h.Internal = *routing.Spec.Internal
+	}
 
 	gateway := networkingv1beta1.Gateway{ObjectMeta: metav1.ObjectMeta{Namespace: routing.Namespace, Name: routing.GetGatewayName()}}
 
@@ -44,7 +46,7 @@ func generateForRouting(r reconciliation.Reconciliation) error {
 		}
 	}
 
-	gateway.Spec.Selector = util.GetIstioGatewayLabelSelector(h.Hostname)
+	gateway.Spec.Selector = resourceutils.GetIstioGatewayLabelSelector(h)
 	gateway.Spec.Servers = []*networkingv1beta1api.Server{
 		{
 			Hosts: []string{h.Hostname},

pkg/resourcegenerator/networkpolicy/dynamic/common.go

@@ -37,14 +37,20 @@ func generateForCommon(r reconciliation.Reconciliation) error {
 	}
 
 	accessPolicy := object.GetCommonSpec().AccessPolicy
-	var ingresses []string
+	var hosts = skiperatorv1alpha1.NewCollection()
 	var inboundPort int32
+
 	if r.GetType() == reconciliation.ApplicationType {
-		ingresses = object.(*skiperatorv1alpha1.Application).Spec.Ingresses
+		var err error
+		hosts, err = object.(*skiperatorv1alpha1.Application).Spec.Hosts()
+		if err != nil {
+			ctxLog.Error(err, "Failed to get hosts for networkpolicy", "type", r.GetType(), "namespace", namespace)
+			return err
+		}
 		inboundPort = int32(object.(*skiperatorv1alpha1.Application).Spec.Port)
 	}
 
-	ingressRules := getIngressRules(accessPolicy, ingresses, r.IsIstioEnabled(), namespace, inboundPort)
+	ingressRules := getIngressRules(accessPolicy, hosts, r.IsIstioEnabled(), namespace, inboundPort)
 	egressRules := getEgressRules(accessPolicy, namespace)
 
 	netpolSpec := networkingv1.NetworkPolicySpec{
@@ -113,20 +119,14 @@ func getEgressRule(outboundRule podtypes.InternalRule, namespace string) network
 }
 
 // TODO Clean up better
-func getIngressRules(accessPolicy *podtypes.AccessPolicy, ingresses []string, istioEnabled bool, namespace string, port int32) []networkingv1.NetworkPolicyIngressRule {
+func getIngressRules(accessPolicy *podtypes.AccessPolicy, hostCollection skiperatorv1alpha1.HostCollection, istioEnabled bool, namespace string, port int32) []networkingv1.NetworkPolicyIngressRule {
 	var ingressRules []networkingv1.NetworkPolicyIngressRule
 
-	if ingresses != nil && len(ingresses) > 0 {
-		if hasInternalIngress(ingresses) {
-			ingressRules = append(ingressRules, getGatewayIngressRule(true, port))
-		}
-
-		if hasExternalIngress(ingresses) {
-			ingressRules = append(ingressRules, getGatewayIngressRule(false, port))
-		}
+	for _, host := range hostCollection.AllHosts() {
+		ingressRules = append(ingressRules, getGatewayIngressRule(host.Internal, port))
 	}
 
-	// Allow grafana-agent to scrape
+	// Allow grafana-agent and Alloy to scrape
 	if istioEnabled {
 		promScrapeRuleGrafana := networkingv1.NetworkPolicyIngressRule{
 			From: []networkingv1.NetworkPolicyPeer{
@@ -226,26 +226,6 @@ func getNamespaceSelector(rule podtypes.InternalRule, appNamespace string) *meta
 	}
 }
 
-func hasExternalIngress(ingresses []string) bool {
-	for _, hostname := range ingresses {
-		if !util.IsInternal(hostname) {
-			return true
-		}
-	}
-
-	return false
-}
-
-func hasInternalIngress(ingresses []string) bool {
-	for _, hostname := range ingresses {
-		if util.IsInternal(hostname) {
-			return true
-		}
-	}
-
-	return false
-}
-
 func getGatewayIngressRule(isInternal bool, port int32) networkingv1.NetworkPolicyIngressRule {
 	ingressRule := networkingv1.NetworkPolicyIngressRule{
 		From: []networkingv1.NetworkPolicyPeer{
@@ -254,6 +234,7 @@ func getGatewayIngressRule(isInternal bool, port int32) networkingv1.NetworkPoli
 					MatchLabels: map[string]string{"kubernetes.io/metadata.name": "istio-gateways"},
 				},
 				PodSelector: &metav1.LabelSelector{
+
 					MatchLabels: getIngressGatewayLabel(isInternal),
 				},
 			},

pkg/resourcegenerator/networkpolicy/dynamic/routing.go

@@ -5,6 +5,7 @@ import (
 
 	skiperatorv1alpha1 "github.com/kartverket/skiperator/api/v1alpha1"
 	"github.com/kartverket/skiperator/pkg/reconciliation"
+	"github.com/kartverket/skiperator/pkg/resourcegenerator/resourceutils"
 	"github.com/kartverket/skiperator/pkg/util"
 	networkingv1 "k8s.io/api/networking/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -27,7 +28,13 @@ func generateForRouting(r reconciliation.Reconciliation) error {
 	for _, route := range routing.Spec.Routes {
 		uniqueTargetApps[getNetworkPolicyName(routing, route.TargetApp)] = route
 	}
-
+	h, err := routing.Spec.GetHost()
+	if routing.Spec.Internal != nil {
+		h.Internal = *routing.Spec.Internal
+	}
+	if err != nil {
+		return err
+	}
 	for netpolName, route := range uniqueTargetApps {
 		networkPolicy := networkingv1.NetworkPolicy{
 			ObjectMeta: metav1.ObjectMeta{
@@ -50,7 +57,7 @@ func generateForRouting(r reconciliation.Reconciliation) error {
 								MatchLabels: util.GetIstioGatewaySelector(),
 							},
 							PodSelector: &metav1.LabelSelector{
-								MatchLabels: util.GetIstioGatewayLabelSelector(routing.Spec.Hostname),
+								MatchLabels: resourceutils.GetIstioGatewayLabelSelector(h),
 							},
 						},
 					},