diff --git a/_data/guides.yml b/_data/guides.yml index d6e63558b4..e31411ea48 100644 --- a/_data/guides.yml +++ b/_data/guides.yml @@ -70,6 +70,8 @@ toc: path: /docs/getting-started-guides/network-policy/walkthrough/ - title: Using Calico for NetworkPolicy path: /docs/getting-started-guides/network-policy/calico/ + - title: Using Romana for NetworkPolicy + path: /docs/getting-started-guides/network-policy/romana/ - title: Batch Jobs section: diff --git a/docs/admin/addons.md b/docs/admin/addons.md index 6e28edfaa2..e802343ab9 100644 --- a/docs/admin/addons.md +++ b/docs/admin/addons.md @@ -12,6 +12,7 @@ This page lists some of the available add-ons and links to their respective inst * [Weave Net](https://github.com/weaveworks/weave-kube) provides networking and network policy, will carry on working on both sides of a network partition, and does not require an external database. * [Calico](https://github.com/projectcalico/calico-containers/tree/master/docs/cni/kubernetes/manifests/kubeadm) is a secure L3 networking and network policy provider. * [Canal](https://github.com/tigera/canal/tree/master/k8s-install/kubeadm) unites Flannel and Calico, providing networking and network policy. +* [Romana](http://romana.io) is a Layer 3 networking solution for pod networks that also supports the [NetworkPolicy API](/docs/user-guide/networkpolicies/). Kubeadm add-on installation details available [here](https://github.com/romana/romana/tree/master/containerize). ## Visualization & Control diff --git a/docs/admin/networking.md b/docs/admin/networking.md index 9275b88565..2acbf062d4 100644 --- a/docs/admin/networking.md +++ b/docs/admin/networking.md @@ -1,4 +1,4 @@ ---- +--- assignees: - lavalamp - thockin @@ -191,7 +191,7 @@ Calico can also be run in policy enforcement mode in conjunction with other netw ### Romana -[Romana](http://romana.io) is an open source software defined networking (SDN) solution that lets you deploy Kubernetes without an overlay network. +[Romana](http://romana.io) is an open source network and security automation solution that lets you deploy Kubernetes without an overlay network. Romana supports Kubernetes [Network Policy](/docs/user-guide/networkpolicies/) to provide isolation across network namespaces. ### Contiv diff --git a/docs/getting-started-guides/kubeadm.md b/docs/getting-started-guides/kubeadm.md index 08148bd7c3..5848fbdc5f 100644 --- a/docs/getting-started-guides/kubeadm.md +++ b/docs/getting-started-guides/kubeadm.md @@ -157,18 +157,17 @@ This will remove the "dedicated" taint from any nodes that have it, including th ### (3/4) Installing a pod network You must install a pod network add-on so that your pods can communicate with each other. -In the meantime, the kubenet network plugin doesn't work. Instead, CNI plugin networks are supported, those you see below. -**It is necessary to do this before you try to deploy any applications to your cluster, and before `kube-dns` will start up.** -Several projects provide Kubernetes pod networks. -You can see a complete list of available network add-ons on the [add-ons page](/docs/admin/addons/). + **It is necessary to do this before you try to deploy any applications to your cluster, and before `kube-dns` will start up. Note also that `kubeadm` only supports CNI based networks and therefore kubenet based networks will not work.** -By way of example, you can install [Weave Net](https://github.com/weaveworks/weave-kube) by logging in to the master and running: +Several projects provide Kubernetes pod networks using CNI, some of which +also support [Network Policy](/docs/user-guide/networkpolicies/). See the [add-ons page](/docs/admin/addons/) for a complete list of available network add-ons. - # kubectl apply -f https://git.io/weave-kube - daemonset "weave-net" created +You can install a pod network add-on with the following command: -If you prefer [Calico](https://github.com/projectcalico/calico-containers/tree/master/docs/cni/kubernetes/manifests/kubeadm) or [Canal](https://github.com/tigera/canal/tree/master/k8s-install/kubeadm), please refer to their respective installation guides. + # kubectl apply -f + +Please refer to the specific add-on installation guide for exact details. You should only install one pod network per cluster. If you are on another architecture than amd64, you should use the flannel overlay network as described in [the multi-platform section](#kubeadm-is-multi-platform) diff --git a/docs/getting-started-guides/network-policy/romana.md b/docs/getting-started-guides/network-policy/romana.md new file mode 100644 index 0000000000..c25835ebb0 --- /dev/null +++ b/docs/getting-started-guides/network-policy/romana.md @@ -0,0 +1,17 @@ +--- +assignees: +- chrismarino + +--- + +# Installation with kubeadm + +Begin by following the [kubeadm getting started guide](/docs/getting-started-guides/kubeadm/) and complete steps 1, 2, and 3. Once completed, follow the [containerized installation guide](https://github.com/romana/romana/tree/master/containerize) for kubeadmin. Kubernetes network policies can then be applied to pods using the NetworkPolicy API. + +#### Additional Romana Network Policy Options + +In addition to the standard Kubernetes NetworkPolicy API, Romana also supports additional network policy functions. + +* [Romana Network Policy Capabilities](https://github.com/romana/romana/wiki/Romana-policies) +* [Example Romana Policies](https://github.com/romana/core/tree/master/policy) + diff --git a/docs/getting-started-guides/network-policy/walkthrough.md b/docs/getting-started-guides/network-policy/walkthrough.md index 122baa653a..49da17e6ef 100644 --- a/docs/getting-started-guides/network-policy/walkthrough.md +++ b/docs/getting-started-guides/network-policy/walkthrough.md @@ -6,7 +6,12 @@ assignees: Kubernetes can be used to declare network policies which govern how Pods can communicate with each other. This document helps you get started using the Kubernetes [NetworkPolicy API](/docs/user-guide/networkpolicies), and provides a demonstration thereof. -In this article we assume that a Kubernetes cluster has been created with network policy support. There are a number of network providers which support NetworkPolicy (see the "Using X for NetworkPolicy" articles in this section). The reference implementation is [Calico](/docs/getting-started-guides/network-policy/calico) running on GCE. +In this article, we assume a Kubernetes cluster has been created with network policy support. There are a number of network providers that support NetworkPolicy including: + +* [Calico](/docs/getting-started-guides/network-policy/calico/) +* [Romana](/docs/getting-started-guides/network-policy/romana/) + +The reference implementation is [Calico](/docs/getting-started-guides/network-policy/calico) running on GCE. The following example walkthrough will work on a Kubernetes cluster using any of the listed providers. diff --git a/docs/getting-started-guides/scratch.md b/docs/getting-started-guides/scratch.md index 970939465d..d1695c0bab 100644 --- a/docs/getting-started-guides/scratch.md +++ b/docs/getting-started-guides/scratch.md @@ -85,6 +85,7 @@ to implement one of the above options: - [Flannel](https://github.com/coreos/flannel) - [Calico](http://https://github.com/projectcalico/calico-containers) - [Weave](http://weave.works/) + - [Romana](http://romana.io/) - [Open vSwitch (OVS)](http://openvswitch.org/) - [More found here](/docs/admin/networking#how-to-achieve-this) - You can also write your own. @@ -129,14 +130,9 @@ Also, you need to pick a static IP for master node. #### Network Policy -Kubernetes enables the definition of fine-grained network policy between Pods -using the [NetworkPolicy](/docs/user-guide/networkpolicy) resource. +Kubernetes enables the definition of fine-grained network policy between Pods using the [NetworkPolicy](/docs/user-guide/network-policy) resource. -Not all networking providers support the Kubernetes NetworkPolicy features. -For clusters which choose to enable NetworkPolicy, the -[Calico policy controller addon](https://github.com/kubernetes/kubernetes/tree/master/cluster/addons/calico-policy-controller) -can enforce the NetworkPolicy API on top of native cloud-provider networking, -Flannel, or Calico networking. +Not all networking providers support the Kubernetes NetworkPolicy API, see [Using Network Policy](/docs/getting-started-guides/network-policy/walkthrough/) for more information. ### Cluster Naming