smi-spec icon indicating copy to clipboard operation
smi-spec copied to clipboard

Namespace question/inconsistency in Traffic Access Control

Open SirNexus opened this issue 5 years ago • 0 comments

Take the example definition in the Traffic Access Control page:

---
kind: TrafficTarget
apiVersion: access.smi-spec.io/v1alpha1
metadata:
  name: path-specific
  namespace: default
destination:
  kind: ServiceAccount
  name: service-a
  namespace: default
  port: 8080
specs:
- kind: HTTPRouteGroup
  name: the-routes
  matches:
  - metrics
sources:
- kind: ServiceAccount
  name: prometheus
  namespace: default

I am wondering if you could shed some light on the reason that TrafficTarget is a namespaced resource. Each source in the sources list specifies a namespace, as well as the destination. What is the point of the TrafficTarget itself being namespaced? For example:

---
kind: TrafficTarget
apiVersion: access.smi-spec.io/v1alpha1
metadata:
  name: path-specific
  namespace: other-namespace
destination:
  kind: ServiceAccount
  name: service-a
  namespace: default
  port: 8080
specs:
- kind: HTTPRouteGroup
  name: the-routes
  matches:
  - metrics
sources:
- kind: ServiceAccount
  name: prometheus
  namespace: default

Do you see this as valid yaml? Both the destination and sources have namespace default, but the TrafficTarget resource itself has namespace other-namespace. If this is valid, how should the namespace in TrafficTarget influence the namespaces specified in destination and sources? Should it influence them at all? If not, what's the point of having TrafficTarget be a namespaced resource?

SirNexus avatar Feb 06 '20 19:02 SirNexus