TrafficTarget without rule?

[SantoDE]

Hey folks,

we're currently wondering, if we didn't missinterpret the TrafficTarget rules for maesh. What is supposed to happen, when the TrafficTarget has empty / non rules? Will it go with all traffic should be denied then? Or is it an allow for everything? It's probably the first, but just to be sure ;-)

[patricekrakow]

I am not using Maesh, but OSM. After "onboarding" the services in the Mesh (i.e. inject the container proxy in all pods) all traffic is blocked/denied (returning 404). Then, you MUST configure appropriate TrafficTarget to have traffic.

[SantoDE]

Yeah, that is fine. Not asking that. I asked especially for a TrafficTarget without rules :)

[patricekrakow]

OK, that's indeed an interesting question... will you just get a L4 access control?
When playing with OSM, I have tested this

# traffic.L4.yaml
---
# Deploy the 'tcp-route' TCPRoute
apiVersion: specs.smi-spec.io/v1alpha3
kind: TCPRoute
metadata:
  name: tcp-route
  namespace: demo-01
spec: {}
---
# Deploy the 'allow-client-x-to-service-a' TrafficTarget
kind: TrafficTarget
apiVersion: access.smi-spec.io/v1alpha2
metadata:
  name: allow-client-x-to-service-a
  namespace: demo-01
spec:
  destination:
    kind: ServiceAccount
    name: service-a
    namespace: demo-01
    port: 3000
  rules:
  - kind: TCPRoute
    name: tcp-route
  sources:
  - kind: ServiceAccount
    name: client-x
    namespace: demo-01

in which the presence of the rules is pretty useless indeed.

If I (finally) understand your question right, you are asking if I could have written it just as:

kind: TrafficTarget
apiVersion: access.smi-spec.io/v1alpha2
metadata:
  name: allow-client-x-to-service-a
  namespace: demo-01
spec:
  destination:
    kind: ServiceAccount
    name: service-a
    namespace: demo-01
    port: 3000
  sources:
  - kind: ServiceAccount
    name: client-x
    namespace: demo-01

Is this a good way to re-formulate your question ? Or, am I again next to your question ?

[patricekrakow]

@SantoDE I have just tested the TrafficTarget above with OSM and it does not allow the traffic.

But, I like the idea that it could, if you would just need a L4 access control, a TrafficTarget without rules should do the job.

However, in your original question you said It's probably the first, but just to be sure ;-) the first being Will it go with all traffic should be denied then? Why were you thinking that?

Now, I am thinking that if you do not want to put any L7 "rules" within your access control, you should simply be able to do so...

@SantoDE I would like to hear you back first, before creating an issue and a PR.

[patricekrakow]

That would require quite some re-writing of the Traffic Access Control specification, but it might be worth it. For instance, the current text says:

A TrafficTarget associates a set of traffic definitions (rules) with a service identity which is allocated to a group of pods.

and I think it is not quite complete, it's not about only about the "rules", but it's also about the "sources" which are not part (but siblings) of the "rules". Then, we could remove the "central" role of "rules" and have them as optional part of the TrafficTarget.

@SantoDE I am waiting for your feedback...

[SantoDE]

I'm asking for the specification point of view on that. :-)

I think, a TrafficTarget without a rule is intended to block Traffic as OSM does. For plain LVL4 traffic, you could still just use a TCPRoute as a rule, so I don't think we should change something on the spec for that.

Thanks, I guess I got my answer :)