policy: Serve EgressNetwork responses

Cargo.lock

@@ -1325,8 +1325,7 @@ dependencies = [
 [[package]]
 name = "linkerd2-proxy-api"
 version = "0.14.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26c72fb98d969e1e94e95d52a6fcdf4693764702c369e577934256e72fb5bc61"
+source = "git+https://github.com/linkerd/linkerd2-proxy-api?branch=zd/add-error-type-to-tls-and-tcp-route#d7385b43d087da05ef4356e51d81be0a1a736a14"
 dependencies = [
  "http",
  "ipnet",

Cargo.toml

@@ -12,3 +12,6 @@ members = [
 
 [profile.release]
 lto = "thin"
+
+[patch.crates-io]
+linkerd2-proxy-api = { git = 'https://github.com/linkerd/linkerd2-proxy-api', branch = 'zd/add-error-type-to-tls-and-tcp-route' }

policy-controller/core/src/outbound.rs

@@ -6,7 +6,16 @@ use ahash::AHashMap as HashMap;
 use anyhow::Result;
 use chrono::{offset::Utc, DateTime};
 use futures::prelude::*;
-use std::{net::IpAddr, num::NonZeroU16, pin::Pin, time};
+use std::{
+    net::{IpAddr, SocketAddr},
+    num::NonZeroU16,
+    pin::Pin,
+    time,
+};
+
+pub trait Route {
+    fn creation_timestamp(&self) -> Option<DateTime<Utc>>;
+}
 
 /// Models outbound policy discovery.
 #[async_trait::async_trait]
@@ -22,20 +31,40 @@ pub type OutboundPolicyStream = Pin<Box<dyn Stream<Item = OutboundPolicy> + Send
 
 pub type HttpRoute = OutboundRoute<HttpRouteMatch, HttpRetryCondition>;
 pub type GrpcRoute = OutboundRoute<GrpcRouteMatch, GrpcRetryCondition>;
+
 pub type RouteSet<T> = HashMap<GroupKindNamespaceName, T>;
 
+#[derive(Debug, Copy, Clone, Hash, PartialEq, Eq)]
+pub enum TrafficPolicy {
+    Allow,
+    Deny,
+}
+
+#[derive(Debug, Copy, Clone, Hash, PartialEq, Eq)]
+pub enum Kind {
+    EgressNetwork {
+        original_dst: SocketAddr,
+        traffic_policy: TrafficPolicy,
+    },
+    Service,
+}
+
+#[derive(Clone, Debug)]
 pub struct OutboundDiscoverTarget {
-    pub service_name: String,
-    pub service_namespace: String,
-    pub service_port: NonZeroU16,
+    pub name: String,
+    pub namespace: String,
+    pub port: NonZeroU16,
     pub source_namespace: String,
+    pub kind: Kind,
 }
 
 #[derive(Clone, Debug, PartialEq)]
 pub struct OutboundPolicy {
     pub http_routes: RouteSet<HttpRoute>,
     pub grpc_routes: RouteSet<GrpcRoute>,
-    pub authority: String,
+    pub tls_routes: RouteSet<TlsRoute>,
+    pub tcp_routes: RouteSet<TcpRoute>,
+    pub service_authority: String,
     pub name: String,
     pub namespace: String,
     pub port: NonZeroU16,
@@ -56,6 +85,24 @@ pub struct OutboundRoute<M, R> {
     pub creation_timestamp: Option<DateTime<Utc>>,
 }
 
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct TlsRoute {
+    pub hostnames: Vec<HostMatch>,
+    pub rule: TcpRouteRule,
+    /// This is required for ordering returned routes
+    /// by their creation timestamp.
+    pub creation_timestamp: Option<DateTime<Utc>>,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct TcpRoute {
+    pub rule: TcpRouteRule,
+
+    /// This is required for ordering returned routes
+    /// by their creation timestamp.
+    pub creation_timestamp: Option<DateTime<Utc>>,
+}
+
 #[derive(Clone, Debug, PartialEq, Eq)]
 pub struct OutboundRouteRule<M, R> {
     pub matches: Vec<M>,
@@ -65,10 +112,16 @@ pub struct OutboundRouteRule<M, R> {
     pub filters: Vec<Filter>,
 }
 
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct TcpRouteRule {
+    pub backends: Vec<Backend>,
+}
+
 #[derive(Clone, Debug, PartialEq, Eq)]
 pub enum Backend {
     Addr(WeightedAddr),
     Service(WeightedService),
+    EgressNetwork(WeightedEgressNetwork),
     Invalid { weight: u32, message: String },
 }
 
@@ -90,6 +143,16 @@ pub struct WeightedService {
     pub exists: bool,
 }
 
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct WeightedEgressNetwork {
+    pub weight: u32,
+    pub name: String,
+    pub namespace: String,
+    pub port: Option<NonZeroU16>,
+    pub filters: Vec<Filter>,
+    pub exists: bool,
+}
+
 #[derive(Copy, Clone, Debug, PartialEq)]
 pub enum FailureAccrual {
     Consecutive { max_failures: u32, backoff: Backoff },
@@ -138,3 +201,21 @@ pub enum GrpcRetryCondition {
     Internal,
     Unavailable,
 }
+
+impl<M, R> Route for OutboundRoute<M, R> {
+    fn creation_timestamp(&self) -> Option<DateTime<Utc>> {
+        self.creation_timestamp
+    }
+}
+
+impl Route for TcpRoute {
+    fn creation_timestamp(&self) -> Option<DateTime<Utc>> {
+        self.creation_timestamp
+    }
+}
+
+impl Route for TlsRoute {
+    fn creation_timestamp(&self) -> Option<DateTime<Utc>> {
+        self.creation_timestamp
+    }
+}