Skip to content
This repository has been archived by the owner on Oct 20, 2023. It is now read-only.

Create 'Service' CRD to register and reference k8s and non-k8s compute resources #67

Closed
wants to merge 1 commit into from
Closed

Create 'Service' CRD to register and reference k8s and non-k8s compute resources #67

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
43 changes: 43 additions & 0 deletions traffic-access-control.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,6 +73,49 @@ sources:
- kind: ServiceAccount
name: prometheus
namespace: default
- kind: Service
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In the main write-up you mentioned about supporting both ServiceAccount and service. Users can use what they want. Can users use only service name even for single K8S clusters?

name: foo.mesh
- kind: Service
name: bar.mesh
- kind: Service
name: baz.mesh
Comment on lines +76 to +81
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could you reference this as TrafficSplit as I feel it is a more compelling example for this proposal?

```

```yaml
# Register a service 'foo.mesh'
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@delqn - this has the facility to use different source types (e.g. a Kubernetes Service, DNS name, Azure resource name). But does it allow users to also use these types for the destination? This will allow creation of access policies for applications running in VMs, for e.g.

# The service is sesolvable by DNS
apiVersion: specs.smi-spec.io/v1alpha1
kind: Service
metadata:
name: foo.mesh
spec:
type: DNS
```

```yaml
# Register a service already existing within the Kubernetes cluster
apiVersion: specs.smi-spec.io/v1alpha1
kind: Service
metadata:
name: bar.mesh
spec:
type: Kubernetes
cluster: aks-4d61b17c.hcp.westus2.azmk8s.io
locator: /namespace/default/service/bar
```

```yaml
# Register a service consisting of a specific cloud vendor's component
# Members of the service (IP addresses) are resolvable by querying the
# particular cloud provider (type) for the given resource (locator)
apiVersion: specs.smi-spec.io/v1alpha1
kind: Service
metadata:
name: baz.mesh
spec:
type: Azure
locator: /resource/subscriptions/e3f0/resourceGroups/mesh-rg/providers/Microsoft.Compute/virtualMachineScaleSets/baz
port: 7654
```

This example selects all the pods which have the `service-a` `ServiceAccount`.
Expand Down