Documenting SCTP support in Kubernetes (#10279)

* Documenting SCTP support in Kubernetes Service, Endpoint, NetworkPolicy and Pod

* Updates based on comments on the PR

* kubectl expose update with SCTP support

* Updated according to comments in the PR

* Revert "kubectl expose update with SCTP support"

This reverts commit 0d5a1e6720a012390cf100c83e16b4a8c0782356.

content/en/docs/concepts/cluster-administration/proxies.md

@@ -36,7 +36,7 @@ There are several different proxies you may encounter when using Kubernetes:
 1.  The [kube proxy](/docs/concepts/services-networking/service/#ips-and-vips):
 
     - runs on each node
-    - proxies UDP and TCP
+    - proxies UDP, TCP and SCTP
     - does not understand HTTP
     - provides load balancing
     - is just used to reach services
@@ -51,7 +51,8 @@ There are several different proxies you may encounter when using Kubernetes:
 
     - are provided by some cloud providers (e.g. AWS ELB, Google Cloud Load Balancer)
     - are created automatically when the Kubernetes service has type `LoadBalancer`
-    - use UDP/TCP only
+    - usually supports UDP/TCP only
+    - SCTP support is up to the load balancer implementation of the cloud provider
     - implementation varies by cloud provider.
 
 Kubernetes users will typically not need to worry about anything other than the first two types.  The cluster admin

content/en/docs/concepts/services-networking/network-policies.md

@@ -189,6 +189,15 @@ spec:
 
 This ensures that even pods that aren't selected by any other NetworkPolicy will not be allowed ingress or egress traffic.
 
+## SCTP support
+
+{{< feature-state for_k8s_version="v1.12" state="alpha" >}}
+
+Kubernetes supports SCTP as a `protocol` value in `NetworkPolicy` definitions as an alpha feature. To enable this feature, the cluster administrator needs to enable the `SCTPSupport` feature gate on the apiserver, for example, `“--feature-gates=SCTPSupport=true,...”`. When the feature gate is enabled, users can set the `protocol` field of a `NetworkPolicy` to `SCTP`. Kubernetes sets up the network accordingly for the SCTP associations, just like it does for TCP connections.
+
+The CNI plugin has to support SCTP as `protocol` value in `NetworkPolicy`.
+
+
 {{% /capture %}}
 
 {{% capture whatsnext %}}

content/en/docs/concepts/services-networking/service.md

@@ -84,9 +84,13 @@ deploying and evolving your `Services`.  For example, you can change the port
 number that pods expose in the next version of your backend software, without
 breaking clients.
 
-Kubernetes `Services` support `TCP` and `UDP` for protocols.  The default
+Kubernetes `Services` support `TCP`, `UDP` and `SCTP` for protocols.  The default
 is `TCP`.
 
+{{< note >}}
+**Note:** SCTP support is an alpha feature since Kubernetes 1.12 
+{{< /note >}}
+
 ### Services without selectors
 
 Services generally abstract access to Kubernetes `Pods`, but they can also
@@ -459,6 +463,12 @@ cloud provider does not support the feature, the field will be ignored.
 public IP address resource needs to be created first, and it should be in the same resource
 group of the other automatically created resources of the cluster. For example, `MC_myResourceGroup_myAKSCluster_eastus`. Specify the assigned IP address as loadBalancerIP. Ensure that you have updated the securityGroupName in the cloud provider configuration file. For information about troubleshooting `CreatingLoadBalancerFailed` permission issues see, [Use a static IP address with the Azure Kubernetes Service (AKS) load balancer](https://docs.microsoft.com/en-us/azure/aks/static-ip) or [CreatingLoadBalancerFailed on AKS cluster with advanced networking](https://github.com/Azure/AKS/issues/357).
 
+{{< note >}}
+**Note:** The support of SCTP in the cloud provider's load balancer is up to the cloud provider's
+load balancer implementation. If SCTP is not supported by the cloud provider's load balancer the 
+Service creation request is accepted but the creation of the load balancer fails.
+{{< /note >}}
+
 #### Internal load balancer
 In a mixed environment it is sometimes necessary to route traffic from services inside the same VPC.
 
@@ -922,6 +932,32 @@ Service is a top-level resource in the Kubernetes REST API. More details about t
 API object can be found at:
 [Service API object](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#service-v1-core).
 
+## SCTP support
+
+{{< feature-state for_k8s_version="v1.12" state="alpha" >}}
+
+Kubernetes supports SCTP as a `protocol` value in `Service`, `Endpoint`, `NetworkPolicy` and `Pod` definitions as an alpha feature. To enable this feature, the cluster administrator needs to enable the `SCTPSupport` feature gate on the apiserver, for example, `“--feature-gates=SCTPSupport=true,...”`. When the feature gate is enabled, users can set the `protocol` field of a `Service`, `Endpoint`, `NetworkPolicy` and `Pod` to `SCTP`. Kubernetes sets up the network accordingly for the SCTP associations, just like it does for TCP connections.
+
+### Warnings
+
+#### The support of multihomed SCTP associations
+
+The support of multihomed SCTP associations requires that the CNI plugin can support the assignment of multiple interfaces and IP addresses to a `Pod`. 
+
+NAT for multihomed SCTP assoications requires special logic in the corresponding kernel modules.
+
+#### Service with type=LoadBalancer
+
+A `Service` with `type` LoadBalancer and `protocol` SCTP can be created only if the cloud provider's load balancer implementation supports SCTP as a protocol. Otherwise the `Service` creation request is rejected. The current set of cloud load balancer providers (`Azure`, `AWS`, `CloudStack`, `GCE`, `OpenStack`) do not support SCTP.
+
+#### Windows
+
+SCTP is not supported on Windows based nodes.
+
+#### Userspace kube-proxy
+
+The kube-proxy does not support the management of SCTP associations when it is in userspace mode.
+
 {{% /capture %}}
 
 {{% capture whatsnext %}}

content/en/docs/reference/command-line-tools-reference/feature-gates.md

@@ -93,6 +93,7 @@ different Kubernetes components.
 | `RotateKubeletServerCertificate` | `false` | Alpha | 1.7 | |
 | `RunAsGroup` | `false` | Alpha | 1.10 | |
 | `RuntimeClass` | `false` | Alpha | 1.12 | |
+| `SCTPSupport` | `false` | Alpha | 1.12 | |
 | `ServiceNodeExclusion` | `false` | Alpha | 1.8 | |
 | `StorageObjectInUseProtection` | `true` | Beta | 1.10 | 1.10 |
 | `StorageObjectInUseProtection` | `true` | GA | 1.11 | |
@@ -239,6 +240,7 @@ Each feature gate is designed for enabling/disabling a specific feature:
 - `RunAsGroup`: Enable control over the primary group ID set on the init processes of containers.
 - `RuntimeClass`: Enable the [RuntimeClass](/docs/concepts/containers/runtime-class/) feature for selecting container runtime configurations.
 - `ScheduleDaemonSetPods`: Enable DaemonSet Pods to be scheduled by the default scheduler instead of the DaemonSet controller.
+- `SCTPSupport`: Enables the usage of SCTP as `protocol` value in `Service`, `Endpoint`, `NetworkPolicy` and `Pod` definitions
 - `ServiceNodeExclusion`: Enable the exclusion of nodes from load balancers created by a cloud provider.
   A node is eligible for exclusion if annotated with "`alpha.service-controller.kubernetes.io/exclude-balancer`" key.
 - `StorageObjectInUseProtection`: Postpone the deletion of PersistentVolume or