From a58afb2a2e2f30c8a2deb27c5ade6ecd8b6eabbd Mon Sep 17 00:00:00 2001 From: Dan Winship Date: Mon, 22 May 2017 14:54:57 -0400 Subject: [PATCH] Revert NetworkPolicy v1 docs (#3849) * Revert "Update configure-namespace-isolation.md (#3758)" This reverts commit a712b13a3b2c64869669a75a2ba70cb72844fa8f. * Revert "Add Configure Namespace Isolation task" This reverts commit f050c4cc574e0c01e0d66166a0451c9756cee0fb. * Revert "Update networkpolicies.md (#3755)" This reverts commit 15ca8f0b2fb0a8e5be408a9c7b1a246ae614312b. * Revert "Update NetworkPolicy docs for v1" This reverts commit 3a158ecf296e3009db1284d69849e7e24479245a. --- _data/tasks.yml | 1 - .../services-networking/networkpolicies.md | 59 +++++++++++++++---- .../configure-namespace-isolation.md | 51 ---------------- .../declare-network-policy.md | 5 +- 4 files changed, 48 insertions(+), 68 deletions(-) delete mode 100644 docs/tasks/administer-cluster/configure-namespace-isolation.md diff --git a/_data/tasks.yml b/_data/tasks.yml index 26dfc0b5c6..ba26c355ae 100644 --- a/_data/tasks.yml +++ b/_data/tasks.yml @@ -111,7 +111,6 @@ toc: - docs/tasks/administer-cluster/upgrade-1-6.md - docs/tasks/administer-cluster/namespaces.md - docs/tasks/administer-cluster/namespaces-walkthrough.md - - docs/tasks/administer-cluster/configure-namespace-isolation.md - docs/tasks/administer-cluster/dns-horizontal-autoscaling.md - docs/tasks/administer-cluster/safely-drain-node.md - docs/tasks/administer-cluster/declare-network-policy.md diff --git a/docs/concepts/services-networking/networkpolicies.md b/docs/concepts/services-networking/networkpolicies.md index ff2b2ee2e1..0e2038489a 100644 --- a/docs/concepts/services-networking/networkpolicies.md +++ b/docs/concepts/services-networking/networkpolicies.md @@ -2,27 +2,64 @@ assignees: - thockin - caseydavenport -- danwinship title: Network Policies redirect_from: - "/docs/user-guide/networkpolicies/" - "/docs/user-guide/networkpolicies.html" --- -{% capture overview %} -A network policy is a specification of how groups of pods are allowed to communicate with each other and other network endpoints. + +* TOC +{:toc} + +A network policy is a specification of how groups of pods are allowed to communicate with each other and other network endpoints. `NetworkPolicy` resources use labels to select pods and define whitelist rules which allow traffic to the selected pods in addition to what is allowed by the isolation policy for a given namespace. -{% endcapture %} -{% capture body %} +## Prerequisites + +You must enable the `extensions/v1beta1/networkpolicies` runtime config in your apiserver to enable this resource. + +You must also be using a networking solution which supports `NetworkPolicy` - simply creating the +resource without a controller to implement it will have no effect. + + +## Configuring Namespace Isolation + +By default, all traffic is allowed between all pods (and `NetworkPolicy` resources have no effect). + +Isolation can be configured on a per-namespace basis. Currently, only isolation on inbound traffic (ingress) can be defined. When a namespace has been configured to isolate inbound traffic, all traffic to pods in that namespace (even from other pods in the same namespace) will be blocked. `NetworkPolicy` objects can then be added to the isolated namespace to specify what traffic should be allowed. + +Ingress isolation can be enabled using an annotation on the Namespace. + +```yaml +kind: Namespace +apiVersion: v1 +metadata: + annotations: + net.beta.kubernetes.io/network-policy: | + { + "ingress": { + "isolation": "DefaultDeny" + } + } +``` + +To configure the annotation via `kubectl`: + +```shell +{% raw %} +kubectl annotate ns "net.beta.kubernetes.io/network-policy={\"ingress\": {\"isolation\": \"DefaultDeny\"}}" +{% endraw %} +``` + ## The `NetworkPolicy` Resource -See the [api-reference](/docs/api-reference/networking/v1/definitions/#_v1_networkpolicy) for a full definition of the resource. +See the [api-reference](/docs/api-reference/extensions/v1beta1/definitions/#_v1beta1_networkpolicy) for a full definition of the resource. An example `NetworkPolicy` might look like this: ```yaml -apiVersion: networking/v1 +apiVersion: extensions/v1beta1 kind: NetworkPolicy metadata: name: test-network-policy @@ -58,10 +95,6 @@ So, the example NetworkPolicy: 1. allows connections to tcp port 6379 of "role=db" pods in the "default" namespace from any pod in the "default" namespace with the label "role=frontend" 2. allows connections to tcp port 6379 of "role=db" pods in the "default" namespace from any pod in a namespace with the label "project=myproject" -{% endcapture %} -{% capture whatsnext %} -* For configuration instructions, see [Configuring Namespace Isolation](/docs/tasks/administer-cluster/configure-namespace-isolation). -* For more NetworkPolicy examples, see the [NetworkPolicy getting started guide](/docs/getting-started-guides/network-policy/walkthrough). -{% endcapture %} -{% include templates/concept.md %} +See the [NetworkPolicy getting started guide](/docs/getting-started-guides/network-policy/walkthrough) for further examples. + diff --git a/docs/tasks/administer-cluster/configure-namespace-isolation.md b/docs/tasks/administer-cluster/configure-namespace-isolation.md deleted file mode 100644 index 9e24c45c3b..0000000000 --- a/docs/tasks/administer-cluster/configure-namespace-isolation.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -assignees: -- thockin -- caseydavenport -- danwinship -title: Configuring Namespace Isolation ---- -{% capture overview %} -This page shows how to add `NetworkPolicy` objects to an isolated namespace to specify what traffic should be allowed. -{% endcapture %} - -{% capture prerequisites %} -Network policies are implemented by the network plugin, so you must be using a networking solution which supports `NetworkPolicy` - simply creating the resource without a controller to implement it will have no effect. -{% endcapture %} - -{% capture steps %} -## Configuring Namespace Isolation - -By default, all traffic is allowed between all pods (and `NetworkPolicy` resources have no effect). - -Isolation can be configured on a per-namespace basis. Currently, only isolation on inbound traffic (ingress) can be defined. When a namespace has been configured to isolate inbound traffic, all traffic to pods in that namespace (even from other pods in the same namespace) will be blocked. `NetworkPolicy` objects can then be added to the isolated namespace to specify what traffic should be allowed. - -Isolation is enabled via the `NetworkPolicy` field of the `Namespace` object. To enable isolation via `kubectl`: - -```shell -{% raw %} -kubectl patch ns -p '{"spec": {"networkPolicy": {"ingress": {"isolation": "DefaultDeny"}}}}' -{% endraw %} -``` - -To disable it: - -```shell -{% raw %} -kubectl patch ns -p '{"spec": {"networkPolicy": null}}' -{% endraw %} -``` - -NOTE: older network plugins may instead require the v1beta1 syntax, using an annotation: - -```shell -{% raw %} -kubectl annotate ns "net.beta.kubernetes.io/network-policy={\"ingress\": {\"isolation\": \"DefaultDeny\"}}" -{% endraw %} -``` -{% endcapture %} - -{% capture whatsnext %} -* For conceptual information about Network Policies, see [Network Policies](/docs/concepts/services-networking/networkpolicies). -{% endcapture %} -{% include templates/task.md %} diff --git a/docs/tasks/administer-cluster/declare-network-policy.md b/docs/tasks/administer-cluster/declare-network-policy.md index 632f73f25d..a444d698da 100644 --- a/docs/tasks/administer-cluster/declare-network-policy.md +++ b/docs/tasks/administer-cluster/declare-network-policy.md @@ -1,7 +1,6 @@ --- assignees: - caseydavenport -- danwinship title: Declaring Network Policy redirect_from: - "/docs/getting-started-guides/network-policy/walkthrough/" @@ -72,7 +71,7 @@ Connecting to nginx (10.100.0.16:80) Let's say you want to limit access to the `nginx` service so that only pods with the label `access: true` can query it. The first step is to enable ingress isolation on the `default` namespace. This prevents **_any_** pods from accessing the `nginx` service. ```console -$ kubectl patch ns default -p '{"spec": {"networkPolicy": {"ingress": {"isolation": "DefaultDeny"}}}}' +$ kubectl annotate ns default "net.beta.kubernetes.io/network-policy={\"ingress\": {\"isolation\": \"DefaultDeny\"}}" ``` ## Test the access limitation @@ -97,7 +96,7 @@ Next, create a `NetworkPolicy` that allows connections from pods with the label ```yaml kind: NetworkPolicy -apiVersion: networking/v1 +apiVersion: extensions/v1beta1 metadata: name: access-nginx spec: