From 382a94758d538969a6ef40cf2eba7d4c63be3c9d Mon Sep 17 00:00:00 2001 From: Nikita Skrynnik Date: Fri, 16 Dec 2022 19:10:47 +1100 Subject: [PATCH] add custom policies support Signed-off-by: Nikita Skrynnik --- main.go | 29 ++++++++++++++++------------- 1 file changed, 16 insertions(+), 13 deletions(-) diff --git a/main.go b/main.go index ff3ab95..0e7201d 100644 --- a/main.go +++ b/main.go @@ -76,18 +76,19 @@ import ( // Config holds configuration parameters from environment variables type Config struct { - Name string `default:"istio-proxy-server" desc:"Name of Istio Proxy Server"` - BaseDir string `default:"./" desc:"base directory" split_words:"true"` - ConnectTo url.URL `default:"unix:///var/lib/networkservicemesh/nsm.io.sock" desc:"url to connect to" split_words:"true"` - MaxTokenLifetime time.Duration `default:"10m" desc:"maximum lifetime of tokens" split_words:"true"` - ServiceNames []string `default:"istio-proxy-responder" desc:"Name of provided services" split_words:"true"` - Labels map[string]string `default:"" desc:"Endpoint labels"` - DNSConfigs dnsconfig.Decoder `default:"[]" desc:"DNSConfigs represents array of DNSConfig in json format. See at model definition: https://github.com/networkservicemesh/api/blob/main/pkg/api/networkservice/connectioncontext.pb.go#L426-L435" split_words:"true"` - CidrPrefix []string `default:"169.254.0.0/16" desc:"List of CIDR Prefix to assign IPv4 and IPv6 addresses from" split_words:"true"` - IdleTimeout time.Duration `default:"0" desc:"timeout for automatic shutdown when there were no requests for specified time. Set 0 to disable auto-shutdown." split_words:"true"` - LogLevel string `default:"INFO" desc:"Log level" split_words:"true"` - OpenTelemetryEndpoint string `default:"otel-collector.observability.svc.cluster.local:4317" desc:"OpenTelemetry Collector Endpoint"` - RulesConfigPath string `default:"" desc:"Path to a configmap with iptables rules" split_words:"true"` + Name string `default:"istio-proxy-server" desc:"Name of Istio Proxy Server"` + BaseDir string `default:"./" desc:"base directory" split_words:"true"` + ConnectTo url.URL `default:"unix:///var/lib/networkservicemesh/nsm.io.sock" desc:"url to connect to" split_words:"true"` + MaxTokenLifetime time.Duration `default:"10m" desc:"maximum lifetime of tokens" split_words:"true"` + RegistryClientPolicies []string `default:"etc/nsm/opa/common/.*.rego,etc/nsm/opa/registry/.*.rego,etc/nsm/opa/client/.*.rego" desc:"paths to files and directories that contain registry client policies" split_words:"true"` + ServiceNames []string `default:"istio-proxy-responder" desc:"Name of provided services" split_words:"true"` + Labels map[string]string `default:"" desc:"Endpoint labels"` + DNSConfigs dnsconfig.Decoder `default:"[]" desc:"DNSConfigs represents array of DNSConfig in json format. See at model definition: https://github.com/networkservicemesh/api/blob/main/pkg/api/networkservice/connectioncontext.pb.go#L426-L435" split_words:"true"` + CidrPrefix []string `default:"169.254.0.0/16" desc:"List of CIDR Prefix to assign IPv4 and IPv6 addresses from" split_words:"true"` + IdleTimeout time.Duration `default:"0" desc:"timeout for automatic shutdown when there were no requests for specified time. Set 0 to disable auto-shutdown." split_words:"true"` + LogLevel string `default:"INFO" desc:"Log level" split_words:"true"` + OpenTelemetryEndpoint string `default:"otel-collector.observability.svc.cluster.local:4317" desc:"OpenTelemetry Collector Endpoint"` + RulesConfigPath string `default:"" desc:"Path to a configmap with iptables rules" split_words:"true"` } // Process prints and processes env to config @@ -281,7 +282,9 @@ func main() { registryclient.WithDialOptions(clientOptions...), registryclient.WithNSEAdditionalFunctionality( registrysendfd.NewNetworkServiceEndpointRegistryClient()), - registryclient.WithAuthorizeNSERegistryClient(registryauthorize.NewNetworkServiceEndpointRegistryClient()), + registryclient.WithAuthorizeNSERegistryClient(registryauthorize.NewNetworkServiceEndpointRegistryClient( + registryauthorize.WithPolicies(config.RegistryClientPolicies...), + )), ) nse := getNseEndpoint(config, listenOn) nse, err = nseRegistryClient.Register(ctx, nse)