From 5a7e1165bb6331b1ffef24002d1b6fccfa66739e Mon Sep 17 00:00:00 2001 From: Eric Paris Date: Thu, 22 Sep 2016 11:47:29 -0400 Subject: [PATCH 1/6] 'namespaceSelector' in the NetworkPolicy example --- docs/user-guide/networkpolicies.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/docs/user-guide/networkpolicies.md b/docs/user-guide/networkpolicies.md index eb4bbe1b74..22c2ed2952 100644 --- a/docs/user-guide/networkpolicies.md +++ b/docs/user-guide/networkpolicies.md @@ -64,6 +64,9 @@ spec: role: db ingress: - from: + - namespaceSelector: + matchLabels: + project: myproject - podSelector: matchLabels: role: frontend From 3c7d5fc9c618e0116d5fd813cd079da41e00d4b3 Mon Sep 17 00:00:00 2001 From: Eric Paris Date: Thu, 22 Sep 2016 12:52:39 -0400 Subject: [PATCH 2/6] Update networkpolicies.md --- docs/user-guide/networkpolicies.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/docs/user-guide/networkpolicies.md b/docs/user-guide/networkpolicies.md index 22c2ed2952..0afe1791b2 100644 --- a/docs/user-guide/networkpolicies.md +++ b/docs/user-guide/networkpolicies.md @@ -84,3 +84,9 @@ __spec__: `NetworkPolicy` [spec](https://github.com/kubernetes/kubernetes/tree/{ __podSelector__: Each `NetworkPolicy` includes a `podSelector` which selects the grouping of pods to which the `ingress` rules in the policy apply. __ingress__: Each `NetworkPolicy` includes a list of whitelist `ingress` rules. Each rule allows traffic which matches both the `from` and `ports` sections. + +In plain language, this example NetworkPolicy: + +1. applies to all pods in the current (???) namespace with the label "role=db" +2. allows tcp/6379 ingress traffic to the "role=db" pods from any pod in the current namespace with the label "role=frontend" (due to the podSelector list element) +3. allows tcp/6379 ingress traffic to the "role=db" pods from any pod in the namespace "myproject" (due to the namespaceSelector list element) From c31b8d608b8c1ea55badc71b2ec1c2ff18f4329f Mon Sep 17 00:00:00 2001 From: Eric Paris Date: Thu, 22 Sep 2016 12:55:09 -0400 Subject: [PATCH 3/6] Update networkpolicies.md --- docs/user-guide/networkpolicies.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/docs/user-guide/networkpolicies.md b/docs/user-guide/networkpolicies.md index 0afe1791b2..bb9ab465f8 100644 --- a/docs/user-guide/networkpolicies.md +++ b/docs/user-guide/networkpolicies.md @@ -56,6 +56,7 @@ A minimal `NetworkPolicy` might look like this: ```yaml apiVersion: extensions/v1beta1 kind: NetworkPolicy +namespace: default metadata: name: test-network-policy spec: @@ -87,6 +88,6 @@ __ingress__: Each `NetworkPolicy` includes a list of whitelist `ingress` rules. In plain language, this example NetworkPolicy: -1. applies to all pods in the current (???) namespace with the label "role=db" +1. applies to all pods in the default namespace with the label "role=db" 2. allows tcp/6379 ingress traffic to the "role=db" pods from any pod in the current namespace with the label "role=frontend" (due to the podSelector list element) 3. allows tcp/6379 ingress traffic to the "role=db" pods from any pod in the namespace "myproject" (due to the namespaceSelector list element) From a27740b33ada451ba557c04696cf9438ed76ed85 Mon Sep 17 00:00:00 2001 From: Eric Paris Date: Thu, 22 Sep 2016 13:11:18 -0400 Subject: [PATCH 4/6] Update networkpolicies.md --- docs/user-guide/networkpolicies.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/user-guide/networkpolicies.md b/docs/user-guide/networkpolicies.md index bb9ab465f8..6fb1829713 100644 --- a/docs/user-guide/networkpolicies.md +++ b/docs/user-guide/networkpolicies.md @@ -56,9 +56,9 @@ A minimal `NetworkPolicy` might look like this: ```yaml apiVersion: extensions/v1beta1 kind: NetworkPolicy -namespace: default metadata: name: test-network-policy + namespace: default spec: podSelector: matchLabels: From 273ac45bb496b1aac9385548d5dbbc36573cfea0 Mon Sep 17 00:00:00 2001 From: Eric Paris Date: Thu, 22 Sep 2016 13:18:18 -0400 Subject: [PATCH 5/6] Update networkpolicies.md --- docs/user-guide/networkpolicies.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/user-guide/networkpolicies.md b/docs/user-guide/networkpolicies.md index 6fb1829713..402e1a32d2 100644 --- a/docs/user-guide/networkpolicies.md +++ b/docs/user-guide/networkpolicies.md @@ -66,7 +66,7 @@ spec: ingress: - from: - namespaceSelector: - matchLabels: + matchLabels: project: myproject - podSelector: matchLabels: From 0a28be36134737da3af0593e591f5e545cec4f50 Mon Sep 17 00:00:00 2001 From: Eric Paris Date: Wed, 19 Oct 2016 08:55:03 -0400 Subject: [PATCH 6/6] Update networkpolicies.md --- docs/user-guide/networkpolicies.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/user-guide/networkpolicies.md b/docs/user-guide/networkpolicies.md index d7c4f572bb..91646633cd 100644 --- a/docs/user-guide/networkpolicies.md +++ b/docs/user-guide/networkpolicies.md @@ -89,7 +89,7 @@ __podSelector__: Each `NetworkPolicy` includes a `podSelector` which selects the __ingress__: Each `NetworkPolicy` includes a list of whitelist `ingress` rules. Each rule allows traffic which matches both the `from` and `ports` sections. -In plain language, this example NetworkPolicy: +This example NetworkPolicy has the following characteristics: 1. applies to all pods in the default namespace with the label "role=db" 2. allows tcp/6379 ingress traffic to the "role=db" pods from any pod in the current namespace with the label "role=frontend" (due to the podSelector list element)