-
Notifications
You must be signed in to change notification settings - Fork 386
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Add support for NodeNetworkPolicy data plane
Signed-off-by: Hongliang Liu <lhongliang@vmware.com>
- Loading branch information
1 parent
fed260a
commit 783ef52
Showing
38 changed files
with
4,635 additions
and
376 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,116 @@ | ||
| # Antrea Node NetworkPolicy | ||
|
|
||
| ## Table of Contents | ||
|
|
||
| <!-- toc --> | ||
| - [Introduction](#introduction) | ||
| - [Prerequisites](#prerequisites) | ||
| - [Usage](#usage) | ||
| - [Limitations](#limitations) | ||
| <!-- /toc --> | ||
|
|
||
| ## Introduction | ||
|
|
||
| Node NetworkPolicy is designed to secure the Kubernetes Nodes traffic. It is supported by Antrea starting with Antrea | ||
| v1.15. This guide demonstrates how to configure Node NetworkPolicies. | ||
|
|
||
| ## Prerequisites | ||
|
|
||
| Node NetworkPolicy was introduced in v1.15 as an alpha feature and is disabled by default. A feature gate, | ||
| `NodeNetworkPolicy`, must be enabled in antrea-agent.conf in the `antrea-config` ConfigMap. | ||
|
|
||
| ```yaml | ||
| apiVersion: v1 | ||
| kind: ConfigMap | ||
| metadata: | ||
| name: antrea-config | ||
| namespace: kube-system | ||
| data: | ||
| antrea-agent.conf: | | ||
| featureGates: | ||
| NodeNetworkPolicy: true | ||
| ``` | ||
|
|
||
| Alternatively, you can use the following helm installation command to enable the feature gate: | ||
|
|
||
| ```bash | ||
| helm install antrea antrea/antrea --namespace kube-system --set featureGates.NodeNetworkPolicy=true | ||
| ``` | ||
|
|
||
| ## Usage | ||
|
|
||
| Node NetworkPolicy is an extension of Antrea ClusterNetworkPolicy (ACNP). By specifying a `nodeSelector` in the | ||
| policy-level `appliedTo`, an ACNP is applied to the selected Kubernetes Nodes. | ||
|
|
||
| An example Node NetworkPolicy that blocks ingress traffic from Pods with label `app=client` to Nodes with label | ||
| `kubernetes.io/hostname: k8s-node-control-plane`: | ||
|
|
||
| ```yaml | ||
| apiVersion: crd.antrea.io/v1beta1 | ||
| kind: ClusterNetworkPolicy | ||
| metadata: | ||
| name: ingress-drop-pod-to-node | ||
| spec: | ||
| priority: 5 | ||
| tier: application | ||
| appliedTo: | ||
| - nodeSelector: | ||
| matchLabels: | ||
| kubernetes.io/hostname: k8s-node-control-plane | ||
| ingress: | ||
| - name: drop-80 | ||
| action: Drop | ||
| from: | ||
| - podSelector: | ||
| matchLabels: | ||
| app: client | ||
| ports: | ||
| - protocol: TCP | ||
| port: 80 | ||
| ``` | ||
|
|
||
| An example Node NetworkPolicy that blocks egress traffic from Nodes with the label | ||
| `kubernetes.io/hostname: k8s-node-control-plane` to Nodes with the label `kubernetes.io/hostname: k8s-node-worker-1` | ||
| and some IP blocks: | ||
|
|
||
| ```yaml | ||
| apiVersion: crd.antrea.io/v1beta1 | ||
| kind: ClusterNetworkPolicy | ||
| metadata: | ||
| name: egress-drop-node-to-node | ||
| spec: | ||
| priority: 5 | ||
| tier: application | ||
| appliedTo: | ||
| - nodeSelector: | ||
| matchLabels: | ||
| kubernetes.io/hostname: k8s-node-control-plane | ||
| egress: | ||
| - name: drop-22 | ||
| action: Drop | ||
| to: | ||
| - nodeSelector: | ||
| matchLabels: | ||
| kubernetes.io/hostname: k8s-node-worker-1 | ||
| - ipBlock: | ||
| cidr: 192.168.77.0/24 | ||
| - ipBlock: | ||
| cidr: 10.10.0.0/24 | ||
| ports: | ||
| - protocol: TCP | ||
| port: 22 | ||
| ``` | ||
|
|
||
| ## Limitations | ||
|
|
||
| - This feature is currently only supported for Linux Nodes. | ||
| - Be cautious when you configure policies to Nodes, in particular, when configuring a default-deny policy applied to | ||
| Nodes. You should ensure Kubernetes and Antrea control-plane communication is exempt from the deny rules, otherwise | ||
| the cluster may go out-of-service and you may lose connectivity to the Nodes. | ||
| - Only ACNPs can be applied to Nodes. ANPs cannot be applied to Nodes. | ||
| - `nodeSelector` can only be specified in the policy-level `appliedTo` field, not in the rule-level `appliedTo`, and not | ||
| in a `Group` or `ClusterGroup`. | ||
| - ACNPs applied to Nodes cannot be applied to Pods at the same time. | ||
| - FQDN is not supported for ACNPs applied to Nodes. | ||
| - Layer 7 NetworkPolicy is not supported yet. | ||
| - For UDP or SCTP, when the `Reject` action is specified in an egress rule, it behaves identical to the `Drop` action. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.