Policy

Policy applies lists, schedules and resolver settings to client groups.


API version	`kudurru.io/v1alpha1`
Kind	`Policy`
Scope	Namespaced
Resource	`policies.kudurru.io`
Short names	`pol`
Subresources	`status`

Columns of kubectl get policies:

Column	Type	Value
GROUPS	string	`.spec.clientGroupRefs`
PRIORITY	integer	`.spec.priority`
READY	string	`.status.conditions[?(@.type=="Ready")].status`

Spec

PolicySpec binds client groups to lists and resolver behaviour.

Field	Type	Description
`spec.allowListRefs`	`[]string`
`spec.allowOnly`	`boolean`	AllowOnly answers only names present in the allow lists.
`spec.allowedServices`	`[]string`	AllowedServices are exceptions to blockedCategories: services of a blocked category this policy does not block. They do not cancel an ID listed in blockedServices, nor another policy's blocks; allow lists still win over every service. Items: at most 256 List type: `set`
`spec.blockListRefs`	`[]string`
`spec.blockMode`	`string`	BlockResponse is how a blocked query is answered: nxdomain, zeroIP (0.0.0.0 / ::), refused, customIP (the customIP addresses) or blockPage (the addresses of the block page listener, blockPage.ipv4/ipv6, so browsers show why the name is blocked). One of: `nxdomain`, `zeroIP`, `refused`, `customIP`, `blockPage`
`spec.blockTTL`	`string`	Default: `10m`
`spec.blockedCategories`	`[]string`	BlockedCategories names categories of the catalogue (GET /api/v1/catalogue/categories: ai, social, gaming, ...); every service in them is blocked as if listed in blockedServices, including services a later catalogue adds to the category. Unknown IDs are reported as Degraded{UnknownCategory}. Items: at most 64 List type: `set`
`spec.blockedServices`	`[]string`	BlockedServices names services of the blocked-services catalogue (GET /api/v1/catalogue/services: youtube, tiktok, ...) whose domains this policy blocks like a block list; the query log names the service as the list, "service:<id>". IDs are checked against the catalogue in service, which can change at runtime, so an unknown ID is reported as Degraded{UnknownService} rather than refused. Items: at most 256 List type: `set`
`spec.clientGroupRefs`	`[]string`
`spec.priority`	`integer`	Priority breaks ties when several policies match; highest wins.
`spec.queryLog`	`boolean`	QueryLog false excludes matching clients from the query log.
`spec.rewrites`	`[]object`
`spec.rewrites[].cname`	`string`
`spec.rewrites[].name`	`string`	Required.
`spec.rewrites[].targets`	`[]string`
`spec.rewrites[].type`	`string`
`spec.safeSearch`	`boolean`	SafeSearch true answers the search engines' and YouTube's host names with their vendor's safe-search target (a CNAME to forcesafesearch.google.com, strict.bing.com, ...; see the catalogue).
`spec.safeSearchMode`	`string`	SafeSearchMode is the level for engines that offer two: strict (the default) or moderate. Only YouTube has two levels (Strict or Moderate Restricted Mode); every other engine is always strict. One of: `strict`, `moderate`
`spec.schedule`	`object`	Schedule limits when a policy applies.
`spec.schedule.end`	`string`	Required. Pattern: `^([01][0-9]\|2[0-3]):[0-5][0-9]$`
`spec.schedule.start`	`string`	Required. Start and End are "HH:MM" in TZ. Pattern: `^([01][0-9]\|2[0-3]):[0-5][0-9]$`
`spec.schedule.tz`	`string`	Default: `UTC`
`spec.schedule.weekdays`	`[]string`
`spec.upstreamGroup`	`string`

Status

PolicyStatus is the observed state of a policy.

Field	Type	Description
`status.conditions`	`[]Condition`	List type: `map`, keyed by `type`
`status.observedGeneration`	`integer`	Format: `int64`

Example

config/samples/kudurru.io_v1alpha1_policy.yaml:

apiVersion: kudurru.io/v1alpha1
kind: Policy
metadata:
  name: kids
  namespace: dns
spec:
  clientGroupRefs: [kids]
  blockListRefs: [default-ads, adult]
  blockMode: zeroIP
  blockTTL: 10m
  schedule:
    weekdays: [mon, tue, wed, thu, fri]
    start: "08:00"
    end: "20:00"
    tz: Europe/Berlin
  priority: 10