Add documentation for ClusterNetworkPolicy #724

abhiraut · 2020-05-20T02:00:23Z

Provide a general overview of ClusterNetworkPolicy CRDs and list key differences between CNP and K8s NP.

antrea-bot · 2020-05-20T02:00:34Z

Thanks for your PR.
Unit tests and code linters are run automatically every time the PR is updated.
E2e, conformance and network policy tests can only be triggered by a member of the vmware-tanzu organization. Regular contributors to the project should join the org.

The following commands are available:

/test-e2e: to trigger e2e tests.
/skip-e2e: to skip e2e tests.
/test-conformance: to trigger conformance tests.
/skip-conformance: to skip conformance tests.
/test-networkpolicy: to trigger networkpolicy tests.
/skip-networkpolicy: to skip networkpolicy tests.
/test-all: to trigger all tests.
/skip-all: to skip all tests.

These commands can only be run by members of the vmware-tanzu organization.

abhiraut · 2020-05-22T02:24:12Z

/skip-all

tnqn · 2020-05-22T16:09:05Z

docs/network-policy.md

+
+- ClusterNetworkPolicy is of cluster scope, hence a `podSelector` without any
+  `namespaceSelector` selects Pods from all Namespaces.
+- There is no automatic isolation of Pods on being selected in appliedTo.


Not sure if I understand it correctly, this means if I want to allow only 80 to a Pod, I should first create a Drop rule in low priority, then create a Allow-80 rule in high priority?

yes.. the rules are as is.. and they will make more sense when we follow up with a ConfigOpt for default antrea cluster policy.. which could be drop policy for cluster
/cc @jianjuns for any follow up comments during my leave

docs/network-policy.md

abhiraut · 2020-05-23T03:31:58Z

/skip-all

docs/network-policy.md

antrea-bot · 2020-06-26T23:20:56Z

Thanks for your PR.
Unit tests and code linters are run automatically every time the PR is updated.
E2e, conformance and network policy tests can only be triggered by a member of the vmware-tanzu organization. Regular contributors to the project should join the org.

The following commands are available:

/test-e2e: to trigger e2e tests.
/skip-e2e: to skip e2e tests.
/test-conformance: to trigger conformance tests.
/skip-conformance: to skip conformance tests.
/test-whole-conformance: to trigger all conformance tests on linux.
/skip-whole-conformance: to skip all conformance tests on linux.
/test-networkpolicy: to trigger networkpolicy tests.
/skip-networkpolicy: to skip networkpolicy tests.
/test-windows-conformance: to trigger windows conformance tests.
/skip-windows-conformance: to skip windows conformance tests.
/test-all: to trigger all tests (except whole conformance).
/skip-all: to skip all tests (except whole conformance).

These commands can only be run by members of the vmware-tanzu organization.

docs/network-policy.md

abhiraut · 2020-06-30T22:46:46Z

/skip-all

abhiraut · 2020-06-30T23:28:33Z

/skip-all

abhiraut · 2020-06-30T23:29:18Z

/skip-whole-conformance

abhiraut · 2020-07-01T00:19:51Z

@lzhecheng any idea why if i skip-all, jenkins-conformance and jenkins-networkpolicy tests are not skipped.. but it does skip the other two ?

lzhecheng · 2020-07-01T05:57:25Z

@abhiraut did it work? I saw history builds to skip jobs for this PR in Jenkins.

abhiraut · 2020-07-01T18:19:29Z

@abhiraut did it work? I saw history builds to skip jobs for this PR in Jenkins.

yeah.. it took a while.. eventually it did work.. thanks for looking!

antoninbas

some comments

I may have missed it but I didn't see the relative precedence of k8s NetworkPolicies with respect to Antrea ClusterNetworkPolicies being called out in the document?

antoninbas · 2020-07-01T23:22:43Z

docs/network-policy.md

+
+ClusterNetworkPolicy is a specification of how workloads within a cluster
+communicate with each other and other external endpoints.
+The ClusterNetworkPolicy is supposed to aid cluster-admins to determine


Suggested change

The ClusterNetworkPolicy is supposed to aid cluster-admins to determine

The ClusterNetworkPolicy is supposed to aid cluster admins to configure

antoninbas · 2020-07-01T23:23:49Z

docs/network-policy.md

+communicate with each other and other external endpoints.
+The ClusterNetworkPolicy is supposed to aid cluster-admins to determine
+the security policy for the cluster, unlike K8s NetworkPolicy, which is
+aimed towards developers to secure their apps.


maybe also mention that they only apply to Pods in a specific namespace

docs/network-policy.md

antoninbas · 2020-07-01T23:32:44Z

docs/network-policy.md

+single port, from one of the two sources, first specified by the `podSelector`
+and second, specified by the combination of `podSelector` and
+`namespaceSelector`.
+**Note**: The order in which the ingress rules are set matter. i.e. rules will be


s/. i.e./, i.e.

docs/network-policy.md

abhiraut · 2020-07-02T00:13:32Z

some comments

I may have missed it but I didn't see the relative precedence of k8s NetworkPolicies with respect to Antrea ClusterNetworkPolicies being called out in the document?

good point.. added a note now

antoninbas

LGTM

docs/network-policy.md

abhiraut · 2020-07-02T02:31:52Z

/skip-all

Add a general overview of the ClusterNetworkPolicy feature and its usage along with the key differences between CNP and K8s NP.

vmwclabot added the cla-not-required label May 20, 2020

abhiraut force-pushed the devref-cnp branch from 4169ce8 to 25b398a Compare May 20, 2020 02:07

abhiraut requested review from antoninbas, jianjuns and McCodeman May 20, 2020 02:16

abhiraut force-pushed the devref-cnp branch from 25b398a to 2e7d780 Compare May 21, 2020 01:37

abhiraut mentioned this pull request May 21, 2020

Support Cluster wide Network Policies in Antrea in hierarchical fashion #598

Closed

6 tasks

tnqn reviewed May 22, 2020

View reviewed changes

docs/network-policy.md Show resolved Hide resolved

abhiraut requested review from tnqn and Dyanngg June 23, 2020 21:55

Dyanngg reviewed Jun 26, 2020

View reviewed changes

docs/network-policy.md Show resolved Hide resolved

docs/network-policy.md Outdated Show resolved Hide resolved

abhiraut force-pushed the devref-cnp branch from d15a894 to 6960654 Compare June 26, 2020 23:20

abhiraut force-pushed the devref-cnp branch from 6960654 to 71e0049 Compare June 26, 2020 23:23

Dyanngg reviewed Jun 30, 2020

View reviewed changes

docs/network-policy.md Outdated Show resolved Hide resolved

abhiraut force-pushed the devref-cnp branch from 71e0049 to b924790 Compare June 30, 2020 22:10

abhiraut requested a review from Dyanngg June 30, 2020 22:10

Dyanngg previously approved these changes Jul 1, 2020

View reviewed changes

antoninbas reviewed Jul 1, 2020

View reviewed changes

abhiraut dismissed Dyanngg’s stale review via 59309cc July 2, 2020 00:00

abhiraut force-pushed the devref-cnp branch from b924790 to 59309cc Compare July 2, 2020 00:00

abhiraut requested review from antoninbas and Dyanngg July 2, 2020 00:15

Dyanngg previously approved these changes Jul 2, 2020

View reviewed changes

antoninbas reviewed Jul 2, 2020

View reviewed changes

docs/network-policy.md Outdated Show resolved Hide resolved

docs/network-policy.md Outdated Show resolved Hide resolved

docs/network-policy.md Outdated Show resolved Hide resolved

abhiraut dismissed Dyanngg’s stale review via 7a88524 July 2, 2020 01:34

abhiraut requested a review from antoninbas July 2, 2020 01:34

antoninbas previously approved these changes Jul 2, 2020

View reviewed changes

abhiraut added 7 commits July 1, 2020 18:54

Add documentation for ClusterNetworkPolicy

6b70051

Fix sample yaml where action field was incorrectly placed

8c8f7bb

Update apiVersion to v1alpha1 and address comments

cfbcbf2

Fix indentation in sample CNP

0824b02

Address comments

5bee72c

Add note regarding CNP precedence over K8s NP.

196f684

Remove peer reference

d97155c

abhiraut dismissed antoninbas’s stale review via 13d8e30 July 2, 2020 02:05

abhiraut force-pushed the devref-cnp branch from 7a88524 to 13d8e30 Compare July 2, 2020 02:05

Add note regarding feature gate status

bae0217

abhiraut force-pushed the devref-cnp branch from 13d8e30 to bae0217 Compare July 2, 2020 02:20

abhiraut requested review from antoninbas and Dyanngg July 2, 2020 02:21

antoninbas approved these changes Jul 2, 2020

View reviewed changes

abhiraut merged commit 9ef6c93 into antrea-io:master Jul 2, 2020

abhiraut deleted the devref-cnp branch July 2, 2020 17:50

GraysonWu pushed a commit to GraysonWu/antrea that referenced this pull request Sep 22, 2020

Add documentation for ClusterNetworkPolicy (antrea-io#724)

b4d5d89

Add a general overview of the ClusterNetworkPolicy feature and its usage along with the key differences between CNP and K8s NP.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add documentation for ClusterNetworkPolicy #724

Add documentation for ClusterNetworkPolicy #724

abhiraut commented May 20, 2020 •

edited

Loading

antrea-bot commented May 20, 2020

abhiraut commented May 22, 2020

tnqn May 22, 2020

abhiraut May 23, 2020

abhiraut commented May 23, 2020

antrea-bot commented Jun 26, 2020

abhiraut commented Jun 30, 2020

abhiraut commented Jun 30, 2020

abhiraut commented Jun 30, 2020

abhiraut commented Jul 1, 2020

lzhecheng commented Jul 1, 2020

abhiraut commented Jul 1, 2020

antoninbas left a comment

antoninbas Jul 1, 2020

abhiraut Jul 1, 2020

antoninbas Jul 1, 2020

abhiraut Jul 1, 2020

antoninbas Jul 1, 2020

abhiraut Jul 1, 2020

abhiraut commented Jul 2, 2020

antoninbas left a comment

abhiraut commented Jul 2, 2020

	The ClusterNetworkPolicy is supposed to aid cluster-admins to determine
	The ClusterNetworkPolicy is supposed to aid cluster admins to configure

Add documentation for ClusterNetworkPolicy #724

Add documentation for ClusterNetworkPolicy #724

Conversation

abhiraut commented May 20, 2020 • edited Loading

antrea-bot commented May 20, 2020

abhiraut commented May 22, 2020

Choose a reason for hiding this comment

Choose a reason for hiding this comment

abhiraut commented May 23, 2020

antrea-bot commented Jun 26, 2020

abhiraut commented Jun 30, 2020

abhiraut commented Jun 30, 2020

abhiraut commented Jun 30, 2020

abhiraut commented Jul 1, 2020

lzhecheng commented Jul 1, 2020

abhiraut commented Jul 1, 2020

antoninbas left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

abhiraut commented Jul 2, 2020

antoninbas left a comment

Choose a reason for hiding this comment

abhiraut commented Jul 2, 2020

abhiraut commented May 20, 2020 •

edited

Loading