Add core code to support namespace based CRDs

For security reasons, cluster admins may want to limit certain applications
to only loading eBPF programs within a given namespace. Currently, all bpfman
Custom Resource Definitions (CRDs) are Cluster scoped. To provide cluster admins
with tighter controls on eBPF program loading, some of the bpfman CRDs also need
to be Namespace scoped.

See Design Doc: bpfman/bpfman#1359

Signed-off-by: Billy McFall <22157057+Billy99@users.noreply.github.com>

apis/v1alpha1/bpfNsApplication_types.go

@@ -0,0 +1,97 @@
+/*
+Copyright 2024.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// BpfNsApplicationProgram defines the desired state of BpfApplication
+// +union
+// +kubebuilder:validation:XValidation:rule="has(self.type) && self.type == 'XDP' ?  has(self.xdp) : !has(self.xdp)",message="xdp configuration is required when type is XDP, and forbidden otherwise"
+// +kubebuilder:validation:XValidation:rule="has(self.type) && self.type == 'TC' ?  has(self.tc) : !has(self.tc)",message="tc configuration is required when type is TC, and forbidden otherwise"
+// +kubebuilder:validation:XValidation:rule="has(self.type) && self.type == 'TCX' ?  has(self.tcx) : !has(self.tcx)",message="tcx configuration is required when type is TCX, and forbidden otherwise"
+// +kubebuilder:validation:XValidation:rule="has(self.type) && self.type == 'Uprobe' ?  has(self.uprobe) : !has(self.uprobe)",message="uprobe configuration is required when type is Uprobe, and forbidden otherwise"
+// +kubebuilder:validation:XValidation:rule="has(self.type) && self.type == 'Uretprobe' ?  has(self.uretprobe) : !has(self.uretprobe)",message="uretprobe configuration is required when type is Uretprobe, and forbidden otherwise"
+type BpfNsApplicationProgram struct {
+	// Type specifies the bpf program type
+	// +unionDiscriminator
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:Enum:="XDP";"TC";"TCX";"Uprobe";"Uretprobe"
+	Type EBPFProgType `json:"type,omitempty"`
+
+	// xdp defines the desired state of the application's XdpNsPrograms.
+	// +unionMember
+	// +optional
+	XDP *XdpNsProgramInfo `json:"xdp,omitempty"`
+
+	// tc defines the desired state of the application's TcNsPrograms.
+	// +unionMember
+	// +optional
+	TC *TcNsProgramInfo `json:"tc,omitempty"`
+
+	// tcx defines the desired state of the application's TcxNsPrograms.
+	// +unionMember
+	// +optional
+	TCX *TcxNsProgramInfo `json:"tcx,omitempty"`
+
+	// uprobe defines the desired state of the application's UprobeNsPrograms.
+	// +unionMember
+	// +optional
+	Uprobe *UprobeNsProgramInfo `json:"uprobe,omitempty"`
+
+	// uretprobe defines the desired state of the application's UretprobeNsPrograms.
+	// +unionMember
+	// +optional
+	Uretprobe *UprobeNsProgramInfo `json:"uretprobe,omitempty"`
+}
+
+// BpfApplicationSpec defines the desired state of BpfApplication
+type BpfNsApplicationSpec struct {
+	BpfAppCommon `json:",inline"`
+
+	// Programs is a list of bpf programs supported for a specific application.
+	// It's possible that the application can selectively choose which program(s)
+	// to run from this list.
+	// +kubebuilder:validation:MinItems:=1
+	Programs []BpfNsApplicationProgram `json:"programs,omitempty"`
+}
+
+// +genclient
+//+kubebuilder:object:root=true
+//+kubebuilder:subresource:status
+//+kubebuilder:resource:scope=Namespaced
+
+// BpfNsApplication is the Schema for the bpfapplications API
+// +kubebuilder:printcolumn:name="NodeSelector",type=string,JSONPath=`.spec.nodeselector`
+// +kubebuilder:printcolumn:name="Status",type=string,JSONPath=`.status.conditions[0].reason`
+// +kubebuilder:printcolumn:name="Age",type="date",JSONPath=".metadata.creationTimestamp"
+type BpfNsApplication struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	Spec   BpfNsApplicationSpec `json:"spec,omitempty"`
+	Status BpfApplicationStatus `json:"status,omitempty"`
+}
+
+// +kubebuilder:object:root=true
+// BpfNsApplicationList contains a list of BpfNsApplications
+type BpfNsApplicationList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []BpfNsApplication `json:"items"`
+}

apis/v1alpha1/bpfNsProgram_types.go

@@ -0,0 +1,79 @@
+/*
+Copyright 2024.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// All fields are required unless explicitly marked optional
+// +kubebuilder:validation:Required
+package v1alpha1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	metav1types "k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+)
+
+// +genclient
+//+kubebuilder:object:root=true
+//+kubebuilder:subresource:status
+
+// BpfNsProgram is the Schema for the Bpfnsprograms API
+// +kubebuilder:printcolumn:name="Type",type=string,JSONPath=`.spec.type`
+// +kubebuilder:printcolumn:name="Status",type=string,JSONPath=`.status.conditions[0].reason`
+// +kubebuilder:printcolumn:name="Age",type="date",JSONPath=".metadata.creationTimestamp"
+type BpfNsProgram struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	Spec BpfProgramSpec `json:"spec"`
+	// +optional
+	Status BpfProgramStatus `json:"status,omitempty"`
+}
+
+//+kubebuilder:object:root=true
+
+// BpfNsProgramList contains a list of BpfProgram
+type BpfNsProgramList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []BpfNsProgram `json:"items"`
+}
+
+func (bp BpfNsProgram) GetName() string {
+	return bp.Name
+}
+
+func (bp BpfNsProgram) GetUID() metav1types.UID {
+	return bp.UID
+}
+
+func (bp BpfNsProgram) GetAnnotations() map[string]string {
+	return bp.Annotations
+}
+
+func (bp BpfNsProgram) GetLabels() map[string]string {
+	return bp.Labels
+}
+
+func (bp BpfNsProgram) GetStatus() *BpfProgramStatus {
+	return &bp.Status
+}
+
+func (bp BpfNsProgram) GetClientObject() client.Object {
+	return &bp
+}
+
+func (bpl BpfNsProgramList) GetItems() []BpfNsProgram {
+	return bpl.Items
+}

apis/v1alpha1/bpfprogram_types.go → apis/v1alpha1/bpfProgram_types.go

@@ -20,6 +20,8 @@ package v1alpha1
 
 import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	metav1types "k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/controller-runtime/pkg/client"
 )
 
 // +genclient
@@ -69,3 +71,31 @@ type BpfProgramList struct {
 	metav1.ListMeta `json:"metadata,omitempty"`
 	Items           []BpfProgram `json:"items"`
 }
+
+func (bp BpfProgram) GetName() string {
+	return bp.Name
+}
+
+func (bp BpfProgram) GetUID() metav1types.UID {
+	return bp.UID
+}
+
+func (bp BpfProgram) GetAnnotations() map[string]string {
+	return bp.Annotations
+}
+
+func (bp BpfProgram) GetLabels() map[string]string {
+	return bp.Labels
+}
+
+func (bp BpfProgram) GetStatus() *BpfProgramStatus {
+	return &bp.Status
+}
+
+func (bp BpfProgram) GetClientObject() client.Object {
+	return &bp
+}
+
+func (bpl BpfProgramList) GetItems() []BpfProgram {
+	return bpl.Items
+}

apis/v1alpha1/kprobeProgram_types.go

@@ -71,10 +71,6 @@ type KprobeProgramInfo struct {
 	// +optional
 	// +kubebuilder:default:=false
 	RetProbe bool `json:"retprobe"`
-
-	// // Host PID of container to attach the uprobe in. (Not supported yet by bpfman.)
-	// // +optional
-	// ContainerPid string `json:"containerpid"`
 }
 
 // KprobeProgramStatus defines the observed state of KprobeProgram

apis/v1alpha1/shared_types.go

@@ -53,6 +53,20 @@ type ContainerSelector struct {
 	ContainerNames *[]string `json:"containernames,omitempty"`
 }
 
+// ContainerNsSelector identifies a set of containers. It is different from ContainerSelector
+// in that "Namespace" was removed. Namespace scoped programs can only attach to the namespace
+// they are created in, so namespace at this level doesn't apply.
+type ContainerNsSelector struct {
+	// Target pods. This field must be specified, to select all pods use
+	// standard metav1.LabelSelector semantics and make it empty.
+	Pods metav1.LabelSelector `json:"pods"`
+
+	// Name(s) of container(s).  If none are specified, all containers in the
+	// pod are selected.
+	// +optional
+	ContainerNames *[]string `json:"containernames,omitempty"`
+}
+
 // BpfProgramCommon defines the common attributes for all BPF programs
 type BpfProgramCommon struct {
 	// BpfFunctionName is the name of the function that is the entry point for the BPF

apis/v1alpha1/tcNsProgram_types.go

@@ -0,0 +1,90 @@
+/*
+Copyright 2024.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// All fields are required unless explicitly marked optional
+// +kubebuilder:validation:Required
+package v1alpha1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// +genclient
+//+kubebuilder:object:root=true
+//+kubebuilder:subresource:status
+//+kubebuilder:resource:scope=Namespaced
+
+// TcNsProgram is the Schema for the TcNsProgram API
+// +kubebuilder:printcolumn:name="BpfFunctionName",type=string,JSONPath=`.spec.bpffunctionname`
+// +kubebuilder:printcolumn:name="NodeSelector",type=string,JSONPath=`.spec.nodeselector`
+// +kubebuilder:printcolumn:name="Status",type=string,JSONPath=`.status.conditions[0].reason`
+// +kubebuilder:printcolumn:name="Priority",type=string,JSONPath=`.spec.priority`,priority=1
+// +kubebuilder:printcolumn:name="Direction",type=string,JSONPath=`.spec.direction`,priority=1
+// +kubebuilder:printcolumn:name="InterfaceSelector",type=string,JSONPath=`.spec.interfaceselector`,priority=1
+// +kubebuilder:printcolumn:name="ProceedOn",type=string,JSONPath=`.spec.proceedon`,priority=1
+type TcNsProgram struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	Spec TcNsProgramSpec `json:"spec"`
+	// +optional
+	Status TcProgramStatus `json:"status,omitempty"`
+}
+
+// TcNsProgramSpec defines the desired state of TcNsProgram
+type TcNsProgramSpec struct {
+	TcNsProgramInfo `json:",inline"`
+	BpfAppCommon    `json:",inline"`
+}
+
+// TcNsProgramInfo defines the tc program details
+type TcNsProgramInfo struct {
+	BpfProgramCommon `json:",inline"`
+
+	// Selector to determine the network interface (or interfaces)
+	InterfaceSelector InterfaceSelector `json:"interfaceselector"`
+
+	// Containers identifies the set of containers in which to attach the eBPF
+	// program.
+	Containers *ContainerNsSelector `json:"containers"`
+
+	// Priority specifies the priority of the tc program in relation to
+	// other programs of the same type with the same attach point. It is a value
+	// from 0 to 1000 where lower values have higher precedence.
+	// +kubebuilder:validation:Minimum=0
+	// +kubebuilder:validation:Maximum=1000
+	Priority int32 `json:"priority"`
+
+	// Direction specifies the direction of traffic the tc program should
+	// attach to for a given network device.
+	// +kubebuilder:validation:Enum=ingress;egress
+	Direction string `json:"direction"`
+
+	// ProceedOn allows the user to call other tc programs in chain on this exit code.
+	// Multiple values are supported by repeating the parameter.
+	// +optional
+	// +kubebuilder:validation:MaxItems=11
+	// +kubebuilder:default:={pipe,dispatcher_return}
+	ProceedOn []TcProceedOnValue `json:"proceedon"`
+}
+
+// +kubebuilder:object:root=true
+// TcNsProgramList contains a list of TcNsPrograms
+type TcNsProgramList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []TcNsProgram `json:"items"`
+}

apis/v1alpha1/tcProgram_types.go

@@ -61,7 +61,7 @@ type TcProgramInfo struct {
 	// Selector to determine the network interface (or interfaces)
 	InterfaceSelector InterfaceSelector `json:"interfaceselector"`
 
-	// Containers identifes the set of containers in which to attach the eBPF
+	// Containers identifies the set of containers in which to attach the eBPF
 	// program. If Containers is not specified, the BPF program will be attached
 	// in the root network namespace.
 	// +optional