Repository: kumahq/kuma
Pull request #12540 (2025-01-14 11:55:40)

chore(deps): upgrade security-actions/sign-docker-image to v4.0.1
## Motivation

Sometimes we can observe sign image errors related to token validation. This version has a fix which should solve the problem

```
Retrieving signed certificate...
Non-interactive mode detected, using device flow.
Enter the verification code DZXT-XKLG in your browser at: https://oauth2.sigstore.dev/auth/device?user_code=DZXT-XKLG
Code will be valid for 300 seconds
Error: signing [docker.io/kumahq/kuma-cp@sha256:f1798ae5df07acf3968a23f44fd73e1d47ba998ad1ec2612efb92ba752ead4ec]: getting signer: getting key from Fulcio: retrieving cert: error obtaining token: expired_token
main.go:74: error during command execution: signing [docker.io/kumahq/kuma-cp@sha256:f1798ae5df07acf3968a23f44fd73e1d47ba998ad1ec2612efb92ba752ead4ec]: getting signer: getting key from Fulcio: retrieving cert: error obtaining token: expired_token
```


Patch:
diff --git a/.github/workflows/_build_publish.yaml b/.github/workflows/_build_publish.yaml
index 29f9852bb..ff8b59109 100644
--- a/.github/workflows/_build_publish.yaml
+++ b/.github/workflows/_build_publish.yaml
@@ -192,7 +192,7 @@ jobs:
       - name: sign image
         if: ${{ fromJSON(inputs.ALLOW_PUSH) }}
         id: sign
-        uses: Kong/public-shared-actions/security-actions/sign-docker-image@0ccacffed804d85da3f938a1b78c12831935f992 # v2.8.0
+        uses: Kong/public-shared-actions/security-actions/sign-docker-image@fbf0fcb6762ab4080fd2813d2e3eec0564cbdbf0 # v4.0.1
         with:
           image_digest: ${{ steps.image_digest.outputs.digest }}
           tags: ${{ steps.image_meta.outputs.image }}
diff --git a/deployments/charts/kuma/crds/kuma.io_meshtimeouts.yaml b/deployments/charts/kuma/crds/kuma.io_meshtimeouts.yaml
index 5f4abe12c..60292a2e8 100644
--- a/deployments/charts/kuma/crds/kuma.io_meshtimeouts.yaml
+++ b/deployments/charts/kuma/crds/kuma.io_meshtimeouts.yaml
@@ -172,6 +172,64 @@ spec:
                   - targetRef
                   type: object
                 type: array
+              rules:
+                description: |-
+                  Rules defines inbound timeout configurations. Currently limited to exactly one rule containing
+                  default timeouts that apply to all inbound traffic, as L7 matching is not yet implemented.
+                items:
+                  properties:
+                    default:
+                      description: Default contains configuration of the inbound timeouts
+                      properties:
+                        connectionTimeout:
+                          description: |-
+                            ConnectionTimeout specifies the amount of time proxy will wait for an TCP connection to be established.
+                            Default value is 5 seconds. Cannot be set to 0.
+                          type: string
+                        http:
+                          description: Http provides configuration for HTTP specific
+                            timeouts
+                          properties:
+                            maxConnectionDuration:
+                              description: |-
+                                MaxConnectionDuration is the time after which a connection will be drained and/or closed,
+                                starting from when it was first established. Setting this timeout to 0 will disable it.
+                                Disabled by default.
+                              type: string
+                            maxStreamDuration:
+                              description: |-
+                                MaxStreamDuration is the maximum time that a stream’s lifetime will span.
+                                Setting this timeout to 0 will disable it. Disabled by default.
+                              type: string
+                            requestHeadersTimeout:
+                              description: |-
+                                RequestHeadersTimeout The amount of time that proxy will wait for the request headers to be received. The timer is
+                                activated when the first byte of the headers is received, and is disarmed when the last byte of
+                                the headers has been received. If not specified or set to 0, this timeout is disabled.
+                                Disabled by default.
+                              type: string
+                            requestTimeout:
+                              description: |-
+                                RequestTimeout The amount of time that proxy will wait for the entire request to be received.
+                                The timer is activated when the request is initiated, and is disarmed when the last byte of the request is sent,
+                                OR when the response is initiated. Setting this timeout to 0 will disable it.
+                                Default is 15s.
+                              type: string
+                            streamIdleTimeout:
+                              description: |-
+                                StreamIdleTimeout is the amount of time that proxy will allow a stream to exist with no activity.
+                                Setting this timeout to 0 will disable it. Default is 30m
+                              type: string
+                          type: object
+                        idleTimeout:
+                          description: |-
+                            IdleTimeout is defined as the period in which there are no bytes sent or received on connection
+                            Setting this timeout to 0 will disable it. Be cautious when disabling it because
+                            it can lead to connection leaking. Default value is 1h.
+                          type: string
+                      type: object
+                  type: object
+                type: array
               targetRef:
                 description: |-
                   TargetRef is a reference to the resource the policy takes an effect on.
diff --git a/docs/generated/openapi.yaml b/docs/generated/openapi.yaml
index bb8098412..cd4cf07ba 100644
--- a/docs/generated/openapi.yaml
+++ b/docs/generated/openapi.yaml
@@ -10491,6 +10491,97 @@ components:
                   - targetRef
                 type: object
               type: array
+            rules:
+              description: >-
+                Rules defines inbound timeout configurations. Currently limited
+                to exactly one rule containing
+
+                default timeouts that apply to all inbound traffic, as L7
+                matching is not yet implemented.
+              items:
+                properties:
+                  default:
+                    description: Default contains configuration of the inbound timeouts
+                    properties:
+                      connectionTimeout:
+                        description: >-
+                          ConnectionTimeout specifies the amount of time proxy
+                          will wait for an TCP connection to be established.
+
+                          Default value is 5 seconds. Cannot be set to 0.
+                        type: string
+                      http:
+                        description: Http provides configuration for HTTP specific timeouts
+                        properties:
+                          maxConnectionDuration:
+                            description: >-
+                              MaxConnectionDuration is the time after which a
+                              connection will be drained and/or closed,
+
+                              starting from when it was first established.
+                              Setting this timeout to 0 will disable it.
+
+                              Disabled by default.
+                            type: string
+                          maxStreamDuration:
+                            description: >-
+                              MaxStreamDuration is the maximum time that a
+                              stream’s lifetime will span.
+
+                              Setting this timeout to 0 will disable it.
+                              Disabled by default.
+                            type: string
+                          requestHeadersTimeout:
+                            description: >-
+                              RequestHeadersTimeout The amount of time that
+                              proxy will wait for the request headers to be
+                              received. The timer is
+
+                              activated when the first byte of the headers is
+                              received, and is disarmed when the last byte of
+
+                              the headers has been received. If not specified or
+                              set to 0, this timeout is disabled.
+
+                              Disabled by default.
+                            type: string
+                          requestTimeout:
+                            description: >-
+                              RequestTimeout The amount of time that proxy will
+                              wait for the entire request to be received.
+
+                              The timer is activated when the request is
+                              initiated, and is disarmed when the last byte of
+                              the request is sent,
+
+                              OR when the response is initiated. Setting this
+                              timeout to 0 will disable it.
+
+                              Default is 15s.
+                            type: string
+                          streamIdleTimeout:
+                            description: >-
+                              StreamIdleTimeout is the amount of time that proxy
+                              will allow a stream to exist with no activity.
+
+                              Setting this timeout to 0 will disable it. Default
+                              is 30m
+                            type: string
+                        type: object
+                      idleTimeout:
+                        description: >-
+                          IdleTimeout is defined as the period in which there
+                          are no bytes sent or received on connection
+
+                          Setting this timeout to 0 will disable it. Be cautious
+                          when disabling it because
+
+                          it can lead to connection leaking. Default value is
+                          1h.
+                        type: string
+                    type: object
+                type: object
+              type: array
             targetRef:
               description: >-
                 TargetRef is a reference to the resource the policy takes an
diff --git a/docs/generated/raw/crds/kuma.io_meshtimeouts.yaml b/docs/generated/raw/crds/kuma.io_meshtimeouts.yaml
index 5f4abe12c..60292a2e8 100644
--- a/docs/generated/raw/crds/kuma.io_meshtimeouts.yaml
+++ b/docs/generated/raw/crds/kuma.io_meshtimeouts.yaml
@@ -172,6 +172,64 @@ spec:
                   - targetRef
                   type: object
                 type: array
+              rules:
+                description: |-
+                  Rules defines inbound timeout configurations. Currently limited to exactly one rule containing
+                  default timeouts that apply to all inbound traffic, as L7 matching is not yet implemented.
+                items:
+                  properties:
+                    default:
+                      description: Default contains configuration of the inbound timeouts
+                      properties:
+                        connectionTimeout:
+                          description: |-
+                            ConnectionTimeout specifies the amount of time proxy will wait for an TCP connection to be established.
+                            Default value is 5 seconds. Cannot be set to 0.
+                          type: string
+                        http:
+                          description: Http provides configuration for HTTP specific
+                            timeouts
+                          properties:
+                            maxConnectionDuration:
+                              description: |-
+                                MaxConnectionDuration is the time after which a connection will be drained and/or closed,
+                                starting from when it was first established. Setting this timeout to 0 will disable it.
+                                Disabled by default.
+                              type: string
+                            maxStreamDuration:
+                              description: |-
+                                MaxStreamDuration is the maximum time that a stream’s lifetime will span.
+                                Setting this timeout to 0 will disable it. Disabled by default.
+                              type: string
+                            requestHeadersTimeout:
+                              description: |-
+                                RequestHeadersTimeout The amount of time that proxy will wait for the request headers to be received. The timer is
+                                activated when the first byte of the headers is received, and is disarmed when the last byte of
+                                the headers has been received. If not specified or set to 0, this timeout is disabled.
+                                Disabled by default.
+                              type: string
+                            requestTimeout:
+                              description: |-
+                                RequestTimeout The amount of time that proxy will wait for the entire request to be received.
+                                The timer is activated when the request is initiated, and is disarmed when the last byte of the request is sent,
+                                OR when the response is initiated. Setting this timeout to 0 will disable it.
+                                Default is 15s.
+                              type: string
+                            streamIdleTimeout:
+                              description: |-
+                                StreamIdleTimeout is the amount of time that proxy will allow a stream to exist with no activity.
+                                Setting this timeout to 0 will disable it. Default is 30m
+                              type: string
+                          type: object
+                        idleTimeout:
+                          description: |-
+                            IdleTimeout is defined as the period in which there are no bytes sent or received on connection
+                            Setting this timeout to 0 will disable it. Be cautious when disabling it because
+                            it can lead to connection leaking. Default value is 1h.
+                          type: string
+                      type: object
+                  type: object
+                type: array
               targetRef:
                 description: |-
                   TargetRef is a reference to the resource the policy takes an effect on.
diff --git a/pkg/core/resources/model/resource.go b/pkg/core/resources/model/resource.go
index ec4caf15c..461980efb 100644
--- a/pkg/core/resources/model/resource.go
+++ b/pkg/core/resources/model/resource.go
@@ -725,6 +725,10 @@ type PolicyItem interface {
 	GetDefault() interface{}
 }
 
+type RuleItem interface {
+	GetDefault() interface{}
+}
+
 type TransformDefaultAfterMerge interface {
 	Transform()
 }
diff --git a/pkg/plugins/policies/donothingpolicy/api/v1alpha1/validator.go b/pkg/plugins/policies/donothingpolicy/api/v1alpha1/validator.go
index 1cf2fa92c..0bfc74a21 100644
--- a/pkg/plugins/policies/donothingpolicy/api/v1alpha1/validator.go
+++ b/pkg/plugins/policies/donothingpolicy/api/v1alpha1/validator.go
@@ -60,7 +60,7 @@ func validateTo(to []To) validators.ValidationError {
 	return verr
 }
 
-func validateDefault(conf Conf) validators.ValidationError {
+func validateDefault(_ Conf) validators.ValidationError {
 	var verr validators.ValidationError
 	// TODO add default conf validation
 	return verr
diff --git a/pkg/plugins/policies/meshtimeout/api/v1alpha1/meshtimeout.go b/pkg/plugins/policies/meshtimeout/api/v1alpha1/meshtimeout.go
index 92c23f5b9..5c016878d 100644
--- a/pkg/plugins/policies/meshtimeout/api/v1alpha1/meshtimeout.go
+++ b/pkg/plugins/policies/meshtimeout/api/v1alpha1/meshtimeout.go
@@ -17,6 +17,14 @@ type MeshTimeout struct {
 	To []To `json:"to,omitempty"`
 	// From list makes a match between clients and corresponding configurations
 	From []From `json:"from,omitempty"`
+	// Rules defines inbound timeout configurations. Currently limited to exactly one rule containing
+	// default timeouts that apply to all inbound traffic, as L7 matching is not yet implemented.
+	Rules []Rule `json:"rules,omitempty"`
+}
+
+type Rule struct {
+	// Default contains configuration of the inbound timeouts
+	Default Conf `json:"default,omitempty"`
 }
 
 type To struct {
diff --git a/pkg/plugins/policies/meshtimeout/api/v1alpha1/schema.yaml b/pkg/plugins/policies/meshtimeout/api/v1alpha1/schema.yaml
index e5203cbfd..3e0bd8c09 100644
--- a/pkg/plugins/policies/meshtimeout/api/v1alpha1/schema.yaml
+++ b/pkg/plugins/policies/meshtimeout/api/v1alpha1/schema.yaml
@@ -141,6 +141,63 @@ properties:
             - targetRef
           type: object
         type: array
+      rules:
+        description: |-
+          Rules defines inbound timeout configurations. Currently limited to exactly one rule containing
+          default timeouts that apply to all inbound traffic, as L7 matching is not yet implemented.
+        items:
+          properties:
+            default:
+              description: Default contains configuration of the inbound timeouts
+              properties:
+                connectionTimeout:
+                  description: |-
+                    ConnectionTimeout specifies the amount of time proxy will wait for an TCP connection to be established.
+                    Default value is 5 seconds. Cannot be set to 0.
+                  type: string
+                http:
+                  description: Http provides configuration for HTTP specific timeouts
+                  properties:
+                    maxConnectionDuration:
+                      description: |-
+                        MaxConnectionDuration is the time after which a connection will be drained and/or closed,
+                        starting from when it was first established. Setting this timeout to 0 will disable it.
+                        Disabled by default.
+                      type: string
+                    maxStreamDuration:
+                      description: |-
+                        MaxStreamDuration is the maximum time that a stream’s lifetime will span.
+                        Setting this timeout to 0 will disable it. Disabled by default.
+                      type: string
+                    requestHeadersTimeout:
+                      description: |-
+                        RequestHeadersTimeout The amount of time that proxy will wait for the request headers to be received. The timer is
+                        activated when the first byte of the headers is received, and is disarmed when the last byte of
+                        the headers has been received. If not specified or set to 0, this timeout is disabled.
+                        Disabled by default.
+                      type: string
+                    requestTimeout:
+                      description: |-
+                        RequestTimeout The amount of time that proxy will wait for the entire request to be received.
+                        The timer is activated when the request is initiated, and is disarmed when the last byte of the request is sent,
+                        OR when the response is initiated. Setting this timeout to 0 will disable it.
+                        Default is 15s.
+                      type: string
+                    streamIdleTimeout:
+                      description: |-
+                        StreamIdleTimeout is the amount of time that proxy will allow a stream to exist with no activity.
+                        Setting this timeout to 0 will disable it. Default is 30m
+                      type: string
+                  type: object
+                idleTimeout:
+                  description: |-
+                    IdleTimeout is defined as the period in which there are no bytes sent or received on connection
+                    Setting this timeout to 0 will disable it. Be cautious when disabling it because
+                    it can lead to connection leaking. Default value is 1h.
+                  type: string
+              type: object
+          type: object
+        type: array
       targetRef:
         description: |-
           TargetRef is a reference to the resource the policy takes an effect on.
diff --git a/pkg/plugins/policies/meshtimeout/api/v1alpha1/validator.go b/pkg/plugins/policies/meshtimeout/api/v1alpha1/validator.go
index db4d3c820..9e42e8094 100644
--- a/pkg/plugins/policies/meshtimeout/api/v1alpha1/validator.go
+++ b/pkg/plugins/policies/meshtimeout/api/v1alpha1/validator.go
@@ -13,8 +13,11 @@ func (r *MeshTimeoutResource) validate() error {
 	var verr validators.ValidationError
 	path := validators.RootedAt("spec")
 	verr.AddErrorAt(path.Field("targetRef"), r.validateTop(r.Spec.TargetRef))
-	if len(r.Spec.To) == 0 && len(r.Spec.From) == 0 {
-		verr.AddViolationAt(path, "at least one of 'from', 'to' has to be defined")
+	if len(r.Spec.Rules) > 0 && (len(r.Spec.To) > 0 || len(r.Spec.From) > 0) {
+		verr.AddViolationAt(path, "fields 'to' and 'from' must be empty when 'rules' is defined")
+	}
+	if len(r.Spec.To) == 0 && len(r.Spec.From) == 0 && len(r.Spec.Rules) == 0 {
+		verr.AddViolationAt(path, "at least one of 'from', 'to' or 'rules' has to be defined")
 	}
 	topLevel := pointer.DerefOr(r.Spec.TargetRef, common_api.TargetRef{Kind: common_api.Mesh})
 	verr.AddErrorAt(path, validateFrom(r.Spec.From, topLevel.Kind))
diff --git a/pkg/plugins/policies/meshtimeout/api/v1alpha1/zz_generated.deepcopy.go b/pkg/plugins/policies/meshtimeout/api/v1alpha1/zz_generated.deepcopy.go
index de2a7e59d..c14fcf8d6 100644
--- a/pkg/plugins/policies/meshtimeout/api/v1alpha1/zz_generated.deepcopy.go
+++ b/pkg/plugins/policies/meshtimeout/api/v1alpha1/zz_generated.deepcopy.go
@@ -118,6 +118,13 @@ func (in *MeshTimeout) DeepCopyInto(out *MeshTimeout) {
 			(*in)[i].DeepCopyInto(&(*out)[i])
 		}
 	}
+	if in.Rules != nil {
+		in, out := &in.Rules, &out.Rules
+		*out = make([]Rule, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new MeshTimeout.
@@ -130,6 +137,22 @@ func (in *MeshTimeout) DeepCopy() *MeshTimeout {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Rule) DeepCopyInto(out *Rule) {
+	*out = *in
+	in.Default.DeepCopyInto(&out.Default)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Rule.
+func (in *Rule) DeepCopy() *Rule {
+	if in == nil {
+		return nil
+	}
+	out := new(Rule)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *To) DeepCopyInto(out *To) {
 	*out = *in
diff --git a/pkg/plugins/policies/meshtimeout/api/v1alpha1/zz_generated.helpers.go b/pkg/plugins/policies/meshtimeout/api/v1alpha1/zz_generated.helpers.go
index 0ab90c65b..7a4a1a100 100644
--- a/pkg/plugins/policies/meshtimeout/api/v1alpha1/zz_generated.helpers.go
+++ b/pkg/plugins/policies/meshtimeout/api/v1alpha1/zz_generated.helpers.go
@@ -47,3 +47,16 @@ func (x *MeshTimeout) GetToList() []core_model.PolicyItem {
 	}
 	return result
 }
+
+func (x *Rule) GetDefault() interface{} {
+	return x.Default
+}
+
+func (x *MeshTimeout) GetRules() []core_model.RuleItem {
+	var result []core_model.RuleItem
+	for i := range x.Rules {
+		item := x.Rules[i]
+		result = append(result, &item)
+	}
+	return result
+}
diff --git a/pkg/plugins/policies/meshtimeout/k8s/crd/kuma.io_meshtimeouts.yaml b/pkg/plugins/policies/meshtimeout/k8s/crd/kuma.io_meshtimeouts.yaml
index 5f4abe12c..60292a2e8 100644
--- a/pkg/plugins/policies/meshtimeout/k8s/crd/kuma.io_meshtimeouts.yaml
+++ b/pkg/plugins/policies/meshtimeout/k8s/crd/kuma.io_meshtimeouts.yaml
@@ -172,6 +172,64 @@ spec:
                   - targetRef
                   type: object
                 type: array
+              rules:
+                description: |-
+                  Rules defines inbound timeout configurations. Currently limited to exactly one rule containing
+                  default timeouts that apply to all inbound traffic, as L7 matching is not yet implemented.
+                items:
+                  properties:
+                    default:
+                      description: Default contains configuration of the inbound timeouts
+                      properties:
+                        connectionTimeout:
+                          description: |-
+                            ConnectionTimeout specifies the amount of time proxy will wait for an TCP connection to be established.
+                            Default value is 5 seconds. Cannot be set to 0.
+                          type: string
+                        http:
+                          description: Http provides configuration for HTTP specific
+                            timeouts
+                          properties:
+                            maxConnectionDuration:
+                              description: |-
+                                MaxConnectionDuration is the time after which a connection will be drained and/or closed,
+                                starting from when it was first established. Setting this timeout to 0 will disable it.
+                                Disabled by default.
+                              type: string
+                            maxStreamDuration:
+                              description: |-
+                                MaxStreamDuration is the maximum time that a stream’s lifetime will span.
+                                Setting this timeout to 0 will disable it. Disabled by default.
+                              type: string
+                            requestHeadersTimeout:
+                              description: |-
+                                RequestHeadersTimeout The amount of time that proxy will wait for the request headers to be received. The timer is
+                                activated when the first byte of the headers is received, and is disarmed when the last byte of
+                                the headers has been received. If not specified or set to 0, this timeout is disabled.
+                                Disabled by default.
+                              type: string
+                            requestTimeout:
+                              description: |-
+                                RequestTimeout The amount of time that proxy will wait for the entire request to be received.
+                                The timer is activated when the request is initiated, and is disarmed when the last byte of the request is sent,
+                                OR when the response is initiated. Setting this timeout to 0 will disable it.
+                                Default is 15s.
+                              type: string
+                            streamIdleTimeout:
+                              description: |-
+                                StreamIdleTimeout is the amount of time that proxy will allow a stream to exist with no activity.
+                                Setting this timeout to 0 will disable it. Default is 30m
+                              type: string
+                          type: object
+                        idleTimeout:
+                          description: |-
+                            IdleTimeout is defined as the period in which there are no bytes sent or received on connection
+                            Setting this timeout to 0 will disable it. Be cautious when disabling it because
+                            it can lead to connection leaking. Default value is 1h.
+                          type: string
+                      type: object
+                  type: object
+                type: array
               targetRef:
                 description: |-
                   TargetRef is a reference to the resource the policy takes an effect on.
diff --git a/tools/policy-gen/generator/cmd/helpers.go b/tools/policy-gen/generator/cmd/helpers.go
index 56f04f1ab..a86871ed8 100644
--- a/tools/policy-gen/generator/cmd/helpers.go
+++ b/tools/policy-gen/generator/cmd/helpers.go
@@ -38,6 +38,7 @@ func newHelpers(rootArgs *args) *cobra.Command {
 				"version":               pconfig.Package,
 				"generateTo":            pconfig.HasTo,
 				"generateFrom":          pconfig.HasFrom,
+				"generateRules":         pconfig.HasRules,
 				"skipGetDefault":        pconfig.SkipGetDefault,
 				"generateGetPolicyItem": !pconfig.HasFrom && !pconfig.HasTo,
 			}, outPath)
@@ -108,6 +109,21 @@ func (x *{{.name}}) GetToList() []core_model.PolicyItem {
 }
 {{- end }}
 
+{{ if .generateRules }}
+func (x *Rule) GetDefault() interface{} {
+	return x.Default
+}
+
+func (x *{{.name}}) GetRules() []core_model.RuleItem {
+	var result []core_model.RuleItem
+	for i := range x.Rules {
+		item := x.Rules[i]
+		result = append(result, &item)
+	}
+	return result
+}
+{{- end }}
+
 {{ if .generateGetPolicyItem}}
 {{ if not .skipGetDefault }}
 
diff --git a/tools/policy-gen/generator/pkg/parse/policyconfig.go b/tools/policy-gen/generator/pkg/parse/policyconfig.go
index a488e966f..a09f04a64 100644
--- a/tools/policy-gen/generator/pkg/parse/policyconfig.go
+++ b/tools/policy-gen/generator/pkg/parse/policyconfig.go
@@ -35,6 +35,7 @@ type PolicyConfig struct {
 	AlternativeNames             []string
 	HasTo                        bool
 	HasFrom                      bool
+	HasRules                     bool
 	HasStatus                    bool
 	GoModule                     string
 	ResourceDir                  string
@@ -143,6 +144,7 @@ func newPolicyConfig(pkg, name string, markers map[string]string, fields map[str
 		PluralDisplayName:   core_model.PluralType(core_model.DisplayName(name)),
 		HasTo:               fields["To"],
 		HasFrom:             fields["From"],
+		HasRules:            fields["Rules"],
 		IsPolicy:            true,
 	}
 


Test patch:
diff --git a/app/kumactl/cmd/install/testdata/install-control-plane.defaults.golden.yaml b/app/kumactl/cmd/install/testdata/install-control-plane.defaults.golden.yaml
index 8c1f0f9d3..2a18a189a 100644
--- a/app/kumactl/cmd/install/testdata/install-control-plane.defaults.golden.yaml
+++ b/app/kumactl/cmd/install/testdata/install-control-plane.defaults.golden.yaml
@@ -6321,6 +6321,64 @@ spec:
                   - targetRef
                   type: object
                 type: array
+              rules:
+                description: |-
+                  Rules defines inbound timeout configurations. Currently limited to exactly one rule containing
+                  default timeouts that apply to all inbound traffic, as L7 matching is not yet implemented.
+                items:
+                  properties:
+                    default:
+                      description: Default contains configuration of the inbound timeouts
+                      properties:
+                        connectionTimeout:
+                          description: |-
+                            ConnectionTimeout specifies the amount of time proxy will wait for an TCP connection to be established.
+                            Default value is 5 seconds. Cannot be set to 0.
+                          type: string
+                        http:
+                          description: Http provides configuration for HTTP specific
+                            timeouts
+                          properties:
+                            maxConnectionDuration:
+                              description: |-
+                                MaxConnectionDuration is the time after which a connection will be drained and/or closed,
+                                starting from when it was first established. Setting this timeout to 0 will disable it.
+                                Disabled by default.
+                              type: string
+                            maxStreamDuration:
+                              description: |-
+                                MaxStreamDuration is the maximum time that a stream’s lifetime will span.
+                                Setting this timeout to 0 will disable it. Disabled by default.
+                              type: string
+                            requestHeadersTimeout:
+                              description: |-
+                                RequestHeadersTimeout The amount of time that proxy will wait for the request headers to be received. The timer is
+                                activated when the first byte of the headers is received, and is disarmed when the last byte of
+                                the headers has been received. If not specified or set to 0, this timeout is disabled.
+                                Disabled by default.
+                              type: string
+                            requestTimeout:
+                              description: |-
+                                RequestTimeout The amount of time that proxy will wait for the entire request to be received.
+                                The timer is activated when the request is initiated, and is disarmed when the last byte of the request is sent,
+                                OR when the response is initiated. Setting this timeout to 0 will disable it.
+                                Default is 15s.
+                              type: string
+                            streamIdleTimeout:
+                              description: |-
+                                StreamIdleTimeout is the amount of time that proxy will allow a stream to exist with no activity.
+                                Setting this timeout to 0 will disable it. Default is 30m
+                              type: string
+                          type: object
+                        idleTimeout:
+                          description: |-
+                            IdleTimeout is defined as the period in which there are no bytes sent or received on connection
+                            Setting this timeout to 0 will disable it. Be cautious when disabling it because
+                            it can lead to connection leaking. Default value is 1h.
+                          type: string
+                      type: object
+                  type: object
+                type: array
               targetRef:
                 description: |-
                   TargetRef is a reference to the resource the policy takes an effect on.
diff --git a/app/kumactl/cmd/install/testdata/install-control-plane.gateway-api-present.yaml b/app/kumactl/cmd/install/testdata/install-control-plane.gateway-api-present.yaml
index 52f55d03a..e907c6265 100644
--- a/app/kumactl/cmd/install/testdata/install-control-plane.gateway-api-present.yaml
+++ b/app/kumactl/cmd/install/testdata/install-control-plane.gateway-api-present.yaml
@@ -6321,6 +6321,64 @@ spec:
                   - targetRef
                   type: object
                 type: array
+              rules:
+                description: |-
+                  Rules defines inbound timeout configurations. Currently limited to exactly one rule containing
+                  default timeouts that apply to all inbound traffic, as L7 matching is not yet implemented.
+                items:
+                  properties:
+                    default:
+                      description: Default contains configuration of the inbound timeouts
+                      properties:
+                        connectionTimeout:
+                          description: |-
+                            ConnectionTimeout specifies the amount of time proxy will wait for an TCP connection to be established.
+                            Default value is 5 seconds. Cannot be set to 0.
+                          type: string
+                        http:
+                          description: Http provides configuration for HTTP specific
+                            timeouts
+                          properties:
+                            maxConnectionDuration:
+                              description: |-
+                                MaxConnectionDuration is the time after which a connection will be drained and/or closed,
+                                starting from when it was first established. Setting this timeout to 0 will disable it.
+                                Disabled by default.
+                              type: string
+                            maxStreamDuration:
+                              description: |-
+                                MaxStreamDuration is the maximum time that a stream’s lifetime will span.
+                                Setting this timeout to 0 will disable it. Disabled by default.
+                              type: string
+                            requestHeadersTimeout:
+                              description: |-
+                                RequestHeadersTimeout The amount of time that proxy will wait for the request headers to be received. The timer is
+                                activated when the first byte of the headers is received, and is disarmed when the last byte of
+                                the headers has been received. If not specified or set to 0, this timeout is disabled.
+                                Disabled by default.
+                              type: string
+                            requestTimeout:
+                              description: |-
+                                RequestTimeout The amount of time that proxy will wait for the entire request to be received.
+                                The timer is activated when the request is initiated, and is disarmed when the last byte of the request is sent,
+                                OR when the response is initiated. Setting this timeout to 0 will disable it.
+                                Default is 15s.
+                              type: string
+                            streamIdleTimeout:
+                              description: |-
+                                StreamIdleTimeout is the amount of time that proxy will allow a stream to exist with no activity.
+                                Setting this timeout to 0 will disable it. Default is 30m
+                              type: string
+                          type: object
+                        idleTimeout:
+                          description: |-
+                            IdleTimeout is defined as the period in which there are no bytes sent or received on connection
+                            Setting this timeout to 0 will disable it. Be cautious when disabling it because
+                            it can lead to connection leaking. Default value is 1h.
+                          type: string
+                      type: object
+                  type: object
+                type: array
               targetRef:
                 description: |-
                   TargetRef is a reference to the resource the policy takes an effect on.
diff --git a/app/kumactl/cmd/install/testdata/install-control-plane.with-helm-set.yaml b/app/kumactl/cmd/install/testdata/install-control-plane.with-helm-set.yaml
index c1b34692e..69c2db5bf 100644
--- a/app/kumactl/cmd/install/testdata/install-control-plane.with-helm-set.yaml
+++ b/app/kumactl/cmd/install/testdata/install-control-plane.with-helm-set.yaml
@@ -6341,6 +6341,64 @@ spec:
                   - targetRef
                   type: object
                 type: array
+              rules:
+                description: |-
+                  Rules defines inbound timeout configurations. Currently limited to exactly one rule containing
+                  default timeouts that apply to all inbound traffic, as L7 matching is not yet implemented.
+                items:
+                  properties:
+                    default:
+                      description: Default contains configuration of the inbound timeouts
+                      properties:
+                        connectionTimeout:
+                          description: |-
+                            ConnectionTimeout specifies the amount of time proxy will wait for an TCP connection to be established.
+                            Default value is 5 seconds. Cannot be set to 0.
+                          type: string
+                        http:
+                          description: Http provides configuration for HTTP specific
+                            timeouts
+                          properties:
+                            maxConnectionDuration:
+                              description: |-
+                                MaxConnectionDuration is the time after which a connection will be drained and/or closed,
+                                starting from when it was first established. Setting this timeout to 0 will disable it.
+                                Disabled by default.
+                              type: string
+                            maxStreamDuration:
+                              description: |-
+                                MaxStreamDuration is the maximum time that a stream’s lifetime will span.
+                                Setting this timeout to 0 will disable it. Disabled by default.
+                              type: string
+                            requestHeadersTimeout:
+                              description: |-
+                                RequestHeadersTimeout The amount of time that proxy will wait for the request headers to be received. The timer is
+                                activated when the first byte of the headers is received, and is disarmed when the last byte of
+                                the headers has been received. If not specified or set to 0, this timeout is disabled.
+                                Disabled by default.
+                              type: string
+                            requestTimeout:
+                              description: |-
+                                RequestTimeout The amount of time that proxy will wait for the entire request to be received.
+                                The timer is activated when the request is initiated, and is disarmed when the last byte of the request is sent,
+                                OR when the response is initiated. Setting this timeout to 0 will disable it.
+                                Default is 15s.
+                              type: string
+                            streamIdleTimeout:
+                              description: |-
+                                StreamIdleTimeout is the amount of time that proxy will allow a stream to exist with no activity.
+                                Setting this timeout to 0 will disable it. Default is 30m
+                              type: string
+                          type: object
+                        idleTimeout:
+                          description: |-
+                            IdleTimeout is defined as the period in which there are no bytes sent or received on connection
+                            Setting this timeout to 0 will disable it. Be cautious when disabling it because
+                            it can lead to connection leaking. Default value is 1h.
+                          type: string
+                      type: object
+                  type: object
+                type: array
               targetRef:
                 description: |-
                   TargetRef is a reference to the resource the policy takes an effect on.
diff --git a/app/kumactl/cmd/install/testdata/install-crds.all.golden.yaml b/app/kumactl/cmd/install/testdata/install-crds.all.golden.yaml
index 6bafbfae3..db6413b1e 100644
--- a/app/kumactl/cmd/install/testdata/install-crds.all.golden.yaml
+++ b/app/kumactl/cmd/install/testdata/install-crds.all.golden.yaml
@@ -7885,6 +7885,64 @@ spec:
                   - targetRef
                   type: object
                 type: array
+              rules:
+                description: |-
+                  Rules defines inbound timeout configurations. Currently limited to exactly one rule containing
+                  default timeouts that apply to all inbound traffic, as L7 matching is not yet implemented.
+                items:
+                  properties:
+                    default:
+                      description: Default contains configuration of the inbound timeouts
+                      properties:
+                        connectionTimeout:
+                          description: |-
+                            ConnectionTimeout specifies the amount of time proxy will wait for an TCP connection to be established.
+                            Default value is 5 seconds. Cannot be set to 0.
+                          type: string
+                        http:
+                          description: Http provides configuration for HTTP specific
+                            timeouts
+                          properties:
+                            maxConnectionDuration:
+                              description: |-
+                                MaxConnectionDuration is the time after which a connection will be drained and/or closed,
+                                starting from when it was first established. Setting this timeout to 0 will disable it.
+                                Disabled by default.
+                              type: string
+                            maxStreamDuration:
+                              description: |-
+                                MaxStreamDuration is the maximum time that a stream’s lifetime will span.
+                                Setting this timeout to 0 will disable it. Disabled by default.
+                              type: string
+                            requestHeadersTimeout:
+                              description: |-
+                                RequestHeadersTimeout The amount of time that proxy will wait for the request headers to be received. The timer is
+                                activated when the first byte of the headers is received, and is disarmed when the last byte of
+                                the headers has been received. If not specified or set to 0, this timeout is disabled.
+                                Disabled by default.
+                              type: string
+                            requestTimeout:
+                              description: |-
+                                RequestTimeout The amount of time that proxy will wait for the entire request to be received.
+                                The timer is activated when the request is initiated, and is disarmed when the last byte of the request is sent,
+                                OR when the response is initiated. Setting this timeout to 0 will disable it.
+                                Default is 15s.
+                              type: string
+                            streamIdleTimeout:
+                              description: |-
+                                StreamIdleTimeout is the amount of time that proxy will allow a stream to exist with no activity.
+                                Setting this timeout to 0 will disable it. Default is 30m
+                              type: string
+                          type: object
+                        idleTimeout:
+                          description: |-
+                            IdleTimeout is defined as the period in which there are no bytes sent or received on connection
+                            Setting this timeout to 0 will disable it. Be cautious when disabling it because
+                            it can lead to connection leaking. Default value is 1h.
+                          type: string
+                      type: object
+                  type: object
+                type: array
               targetRef:
                 description: |-
                   TargetRef is a reference to the resource the policy takes an effect on.
diff --git a/pkg/plugins/policies/core/rules/testdata/rules/from/06.golden.yaml b/pkg/plugins/policies/core/rules/testdata/rules/from/06.golden.yaml
index 86773516f..c4ed7762b 100644
--- a/pkg/plugins/policies/core/rules/testdata/rules/from/06.golden.yaml
+++ b/pkg/plugins/policies/core/rules/testdata/rules/from/06.golden.yaml
@@ -1,31 +1,31 @@
 Rules:
   127.0.0.1:80:
-    - BackendRefOriginIndex: {}
-      Conf:
-        action: Allow
-      Origin:
-        - creationTime: "0001-01-01T00:00:00Z"
-          mesh: default
-          modificationTime: "0001-01-01T00:00:00Z"
-          name: mtp-allow-kuma-other-ns-and-tag
-          type: MeshTrafficPermission
-      Subset:
-        - Key: abcd
-          Not: false
-          Value: abcd
-        - Key: k8s.kuma.io/namespace
-          Not: false
-          Value: kuma-other
-    - BackendRefOriginIndex: {}
-      Conf:
-        action: Allow
-      Origin:
-        - creationTime: "0001-01-01T00:00:00Z"
-          mesh: default
-          modificationTime: "0001-01-01T00:00:00Z"
-          name: mtp-allow-kuma-one
-          type: MeshTrafficPermission
-      Subset:
-        - Key: k8s.kuma.io/namespace
-          Not: false
-          Value: kuma-one
+  - BackendRefOriginIndex: {}
+    Conf:
+      action: Allow
+    Origin:
+    - creationTime: "0001-01-01T00:00:00Z"
+      mesh: default
+      modificationTime: "0001-01-01T00:00:00Z"
+      name: mtp-allow-kuma-other-ns-and-tag
+      type: MeshTrafficPermission
+    Subset:
+    - Key: abcd
+      Not: false
+      Value: abcd
+    - Key: k8s.kuma.io/namespace
+      Not: false
+      Value: kuma-other
+  - BackendRefOriginIndex: {}
+    Conf:
+      action: Allow
+    Origin:
+    - creationTime: "0001-01-01T00:00:00Z"
+      mesh: default
+      modificationTime: "0001-01-01T00:00:00Z"
+      name: mtp-allow-kuma-one
+      type: MeshTrafficPermission
+    Subset:
+    - Key: k8s.kuma.io/namespace
+      Not: false
+      Value: kuma-one
diff --git a/pkg/plugins/policies/core/rules/testdata/rules/from/07.golden.yaml b/pkg/plugins/policies/core/rules/testdata/rules/from/07.golden.yaml
index 21032a1b0..c30508d5c 100644
--- a/pkg/plugins/policies/core/rules/testdata/rules/from/07.golden.yaml
+++ b/pkg/plugins/policies/core/rules/testdata/rules/from/07.golden.yaml
@@ -1,34 +1,34 @@
 Rules:
   127.0.0.1:80:
-    - BackendRefOriginIndex: {}
-      Conf:
-        action: Deny
-      Origin:
-        - creationTime: "0001-01-01T00:00:00Z"
-          mesh: default
-          modificationTime: "0001-01-01T00:00:00Z"
-          name: mtp-allow-kuma-one
-          type: MeshTrafficPermission
-      Subset:
-        - Key: app
-          Not: false
-          Value: demo
-        - Key: k8s.kuma.io/namespace
-          Not: false
-          Value: kuma-one
-    - BackendRefOriginIndex: {}
-      Conf:
-        action: Allow
-      Origin:
-        - creationTime: "0001-01-01T00:00:00Z"
-          mesh: default
-          modificationTime: "0001-01-01T00:00:00Z"
-          name: mtp-allow-kuma-one
-          type: MeshTrafficPermission
-      Subset:
-        - Key: app
-          Not: true
-          Value: demo
-        - Key: k8s.kuma.io/namespace
-          Not: false
-          Value: kuma-one
\ No newline at end of file
+  - BackendRefOriginIndex: {}
+    Conf:
+      action: Deny
+    Origin:
+    - creationTime: "0001-01-01T00:00:00Z"
+      mesh: default
+      modificationTime: "0001-01-01T00:00:00Z"
+      name: mtp-allow-kuma-one
+      type: MeshTrafficPermission
+    Subset:
+    - Key: app
+      Not: false
+      Value: demo
+    - Key: k8s.kuma.io/namespace
+      Not: false
+      Value: kuma-one
+  - BackendRefOriginIndex: {}
+    Conf:
+      action: Allow
+    Origin:
+    - creationTime: "0001-01-01T00:00:00Z"
+      mesh: default
+      modificationTime: "0001-01-01T00:00:00Z"
+      name: mtp-allow-kuma-one
+      type: MeshTrafficPermission
+    Subset:
+    - Key: app
+      Not: true
+      Value: demo
+    - Key: k8s.kuma.io/namespace
+      Not: false
+      Value: kuma-one
diff --git a/pkg/plugins/policies/meshtimeout/api/v1alpha1/validator_test.go b/pkg/plugins/policies/meshtimeout/api/v1alpha1/validator_test.go
index 63e7a222e..93a531205 100644
--- a/pkg/plugins/policies/meshtimeout/api/v1alpha1/validator_test.go
+++ b/pkg/plugins/policies/meshtimeout/api/v1alpha1/validator_test.go
@@ -140,7 +140,7 @@ targetRef:
 				expected: `
 violations:
   - field: spec
-    message: at least one of 'from', 'to' has to be defined`,
+    message: at least one of 'from', 'to' or 'rules' has to be defined`,
 			}),
 			Entry("unsupported kind in from selector", testCase{
 				inputYaml: `
@@ -324,6 +324,41 @@ violations:
   - field: spec.to[0].targetRef.labels
     message: either labels or name must be specified`,
 			}),
+			Entry("when rules is defined, to cannot be defined", testCase{
+				inputYaml: `
+targetRef:
+  kind: Mesh
+rules:
+  - default:
+      connectionTimeout: 10s
+to:
+  - targetRef:
+      kind: MeshService
+      name: web-backend
+    default:
+      connectionTimeout: 10s`,
+				expected: `
+violations:
+  - field: spec
+    message: fields 'to' and 'from' must be empty when 'rules' is defined`,
+			}),
+			Entry("when rules is defined, from cannot be defined", testCase{
+				inputYaml: `
+targetRef:
+  kind: Mesh
+rules:
+  - default:
+      connectionTimeout: 10s
+from:
+  - targetRef:
+      kind: Mesh
+    default:
+      connectionTimeout: 10s`,
+				expected: `
+violations:
+  - field: spec
+    message: fields 'to' and 'from' must be empty when 'rules' is defined`,
+			}),
 		)
 	})
 })