whentimeslows/website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Revert NetworkPolicy v1 docs (#3849)

Browse Source 
* Revert "Update configure-namespace-isolation.md (#3758)"

This reverts commit a712b13a3b.

* Revert "Add Configure Namespace Isolation task"

This reverts commit f050c4cc57.

* Revert "Update networkpolicies.md (#3755)"

This reverts commit 15ca8f0b2f.

* Revert "Update NetworkPolicy docs for v1"

This reverts commit 3a158ecf296e3009db1284d69849e7e24479245a.
This commit is contained in:
Dan Winship
2017-05-22 14:54:57 -04:00
committed by Andrew Chen
parent 71ff265e47
commit a58afb2a2e
4 changed files with 48 additions and 68 deletions
Download Patch File Download Diff File Expand all files Collapse all files
_data/tasks.yml
-1
View File
@@ -111,7 +111,6 @@ toc:
- docs/tasks/administer-cluster/upgrade-1-6.md
- docs/tasks/administer-cluster/namespaces.md
- docs/tasks/administer-cluster/namespaces-walkthrough.md
- docs/tasks/administer-cluster/configure-namespace-isolation.md
- docs/tasks/administer-cluster/dns-horizontal-autoscaling.md
- docs/tasks/administer-cluster/safely-drain-node.md
- docs/tasks/administer-cluster/declare-network-policy.md
docs/concepts/services-networking/networkpolicies.md
+46 -13
View File
@@ -2,27 +2,64 @@
assignees:
- thockin
- caseydavenport
- danwinship
title: Network Policies
redirect_from:
- "/docs/user-guide/networkpolicies/"
- "/docs/user-guide/networkpolicies.html"
---
{% capture overview %}
A network policy is a specification of how groups of pods are allowed to communicate with each other and other network endpoints.
* TOC
{:toc}
A network policy is a specification of how groups of pods are allowed to communicate with each other and other network endpoints.
`NetworkPolicy` resources use labels to select pods and define whitelist rules which allow traffic to the selected pods in addition to what is allowed by the isolation policy for a given namespace.
{% endcapture %}
{% capture body %}
## Prerequisites
You must enable the `extensions/v1beta1/networkpolicies` runtime config in your apiserver to enable this resource.
You must also be using a networking solution which supports `NetworkPolicy` - simply creating the
resource without a controller to implement it will have no effect.
## Configuring Namespace Isolation
By default, all traffic is allowed between all pods (and `NetworkPolicy` resources have no effect).
Isolation can be configured on a per-namespace basis. Currently, only isolation on inbound traffic (ingress) can be defined. When a namespace has been configured to isolate inbound traffic, all traffic to pods in that namespace (even from other pods in the same namespace) will be blocked. `NetworkPolicy` objects can then be added to the isolated namespace to specify what traffic should be allowed.
Ingress isolation can be enabled using an annotation on the Namespace.
```yaml
kind: Namespace
apiVersion: v1
metadata:
annotations:
net.beta.kubernetes.io/network-policy: |
{
"ingress": {
"isolation": "DefaultDeny"
}
}
```
To configure the annotation via `kubectl`:
```shell
{% raw %}
kubectl annotate ns <namespace> "net.beta.kubernetes.io/network-policy={\"ingress\": {\"isolation\": \"DefaultDeny\"}}"
{% endraw %}
```
## The `NetworkPolicy` Resource
See the [api-reference](/docs/api-reference/networking/v1/definitions/#_v1_networkpolicy) for a full definition of the resource.
See the [api-reference](/docs/api-reference/extensions/v1beta1/definitions/#_v1beta1_networkpolicy) for a full definition of the resource.
An example `NetworkPolicy` might look like this:
```yaml
apiVersion: networking/v1
apiVersion: extensions/v1beta1
kind: NetworkPolicy
metadata:
name: test-network-policy
@@ -58,10 +95,6 @@ So, the example NetworkPolicy:
1. allows connections to tcp port 6379 of "role=db" pods in the "default" namespace from any pod in the "default" namespace with the label "role=frontend"
2. allows connections to tcp port 6379 of "role=db" pods in the "default" namespace from any pod in a namespace with the label "project=myproject"
{% endcapture %}
{% capture whatsnext %}
* For configuration instructions, see [Configuring Namespace Isolation](/docs/tasks/administer-cluster/configure-namespace-isolation).
* For more NetworkPolicy examples, see the [NetworkPolicy getting started guide](/docs/getting-started-guides/network-policy/walkthrough).
{% endcapture %}
{% include templates/concept.md %}
See the [NetworkPolicy getting started guide](/docs/getting-started-guides/network-policy/walkthrough) for further examples.
docs/tasks/administer-cluster/configure-namespace-isolation.md
-51
View File
@@ -1,51 +0,0 @@
---
assignees:
- thockin
- caseydavenport
- danwinship
title: Configuring Namespace Isolation
---
{% capture overview %}
This page shows how to add `NetworkPolicy` objects to an isolated namespace to specify what traffic should be allowed.
{% endcapture %}
{% capture prerequisites %}
Network policies are implemented by the network plugin, so you must be using a networking solution which supports `NetworkPolicy` - simply creating the resource without a controller to implement it will have no effect.
{% endcapture %}
{% capture steps %}
## Configuring Namespace Isolation
By default, all traffic is allowed between all pods (and `NetworkPolicy` resources have no effect).
Isolation can be configured on a per-namespace basis. Currently, only isolation on inbound traffic (ingress) can be defined. When a namespace has been configured to isolate inbound traffic, all traffic to pods in that namespace (even from other pods in the same namespace) will be blocked. `NetworkPolicy` objects can then be added to the isolated namespace to specify what traffic should be allowed.
Isolation is enabled via the `NetworkPolicy` field of the `Namespace` object. To enable isolation via `kubectl`:
```shell
{% raw %}
kubectl patch ns <namespace> -p '{"spec": {"networkPolicy": {"ingress": {"isolation": "DefaultDeny"}}}}'
{% endraw %}
```
To disable it:
```shell
{% raw %}
kubectl patch ns <namespace> -p '{"spec": {"networkPolicy": null}}'
{% endraw %}
```
NOTE: older network plugins may instead require the v1beta1 syntax, using an annotation:
```shell
{% raw %}
kubectl annotate ns <namespace> "net.beta.kubernetes.io/network-policy={\"ingress\": {\"isolation\": \"DefaultDeny\"}}"
{% endraw %}
```
{% endcapture %}
{% capture whatsnext %}
* For conceptual information about Network Policies, see [Network Policies](/docs/concepts/services-networking/networkpolicies).
{% endcapture %}
{% include templates/task.md %}
docs/tasks/administer-cluster/declare-network-policy.md
+2 -3
View File
@@ -1,7 +1,6 @@
---
assignees:
- caseydavenport
- danwinship
title: Declaring Network Policy
redirect_from:
- "/docs/getting-started-guides/network-policy/walkthrough/"
@@ -72,7 +71,7 @@ Connecting to nginx (10.100.0.16:80)
Let's say you want to limit access to the `nginx` service so that only pods with the label `access: true` can query it. The first step is to enable ingress isolation on the `default` namespace. This prevents **_any_** pods from accessing the `nginx` service.
```console
$ kubectl patch ns default -p '{"spec": {"networkPolicy": {"ingress": {"isolation": "DefaultDeny"}}}}'
$ kubectl annotate ns default "net.beta.kubernetes.io/network-policy={\"ingress\": {\"isolation\": \"DefaultDeny\"}}"
```
## Test the access limitation
@@ -97,7 +96,7 @@ Next, create a `NetworkPolicy` that allows connections from pods with the label
```yaml
kind: NetworkPolicy
apiVersion: networking/v1
apiVersion: extensions/v1beta1
metadata:
name: access-nginx
spec: