Add weights, move files: Tasks>AdminClust>NetPol. (#8634)
* Add weights, move files: Tasks>AdminClust>NetPol. * Update _index.md
This commit is contained in:
Steve Perry
committed by
k8s-ci-robot
k8s-ci-robot
parent
9c94281570
commit
eb420cf183
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: Install a Network Policy Provider
|
||||
weight: 30
|
||||
---
|
||||
+53
@@ -0,0 +1,53 @@
|
||||
---
|
||||
reviewers:
|
||||
- caseydavenport
|
||||
title: Use Calico for NetworkPolicy
|
||||
content_template: templates/task
|
||||
weight: 10
|
||||
---
|
||||
|
||||
{{% capture overview %}}
|
||||
This page shows a couple of quick ways to create a Calico cluster on Kubernetes.
|
||||
{{% /capture %}}
|
||||
|
||||
{{% capture prerequisites %}}
|
||||
Decide whether you want to deploy a [cloud](#creating-a-calico-cluster-with-google-kubernetes-engine-gke) or [local](#creating-a-local-calico-cluster-with-kubeadm) cluster.
|
||||
{{% /capture %}}
|
||||
|
||||
{{% capture steps %}}
|
||||
## Creating a Calico cluster with Google Kubernetes Engine (GKE)
|
||||
|
||||
**Prerequisite**: [gcloud](https://cloud.google.com/sdk/docs/quickstarts).
|
||||
|
||||
1. To launch a GKE cluster with Calico, just include the `--enable-network-policy` flag.
|
||||
|
||||
**Syntax**
|
||||
```shell
|
||||
gcloud container clusters create [CLUSTER_NAME] --enable-network-policy
|
||||
```
|
||||
|
||||
**Example**
|
||||
```shell
|
||||
gcloud container clusters create my-calico-cluster --enable-network-policy
|
||||
```
|
||||
|
||||
1. To verify the deployment, use the following command.
|
||||
|
||||
```shell
|
||||
kubectl get pods --namespace=kube-system
|
||||
```
|
||||
|
||||
The Calico pods begin with `calico`. Check to make sure each one has a status of `Running`.
|
||||
|
||||
## Creating a local Calico cluster with kubeadm
|
||||
|
||||
To get a local single-host Calico cluster in fifteen minutes using kubeadm, refer to the
|
||||
[Calico Quickstart](https://docs.projectcalico.org/latest/getting-started/kubernetes/).
|
||||
|
||||
{{% /capture %}}
|
||||
|
||||
|
||||
{{% capture whatsnext %}}
|
||||
Once your cluster is running, you can follow the [Declare Network Policy](/docs/tasks/administer-cluster/declare-network-policy/) to try out Kubernetes NetworkPolicy.
|
||||
{{% /capture %}}
|
||||
|
||||
+94
@@ -0,0 +1,94 @@
|
||||
---
|
||||
reviewers:
|
||||
- danwent
|
||||
title: Use Cilium for NetworkPolicy
|
||||
content_template: templates/task
|
||||
weight: 20
|
||||
---
|
||||
|
||||
{{% capture overview %}}
|
||||
This page shows how to use Cilium for NetworkPolicy.
|
||||
|
||||
For background on Cilium, read the [Introduction to Cilium](https://cilium.readthedocs.io/en/latest/intro).
|
||||
{{% /capture %}}
|
||||
|
||||
{{% capture prerequisites %}}
|
||||
|
||||
{{< include "task-tutorial-prereqs.md" >}} {{< version-check >}}
|
||||
|
||||
{{% /capture %}}
|
||||
|
||||
{{% capture steps %}}
|
||||
## Deploying Cilium on Minikube for Basic Testing
|
||||
|
||||
To get familiar with Cilium easily you can follow the
|
||||
[Cilium Kubernetes Getting Started Guide](https://docs.cilium.io/en/latest/gettingstarted/minikube/)
|
||||
to perform a basic DaemonSet installation of Cilium in minikube.
|
||||
|
||||
Installation in a minikube setup uses a simple ''all-in-one'' YAML
|
||||
file that includes DaemonSet configurations for Cilium, to connect
|
||||
to the minikube's etcd instance as well as appropriate RBAC settings:
|
||||
|
||||
```shell
|
||||
$ kubectl create -f https://raw.githubusercontent.com/cilium/cilium/master/examples/kubernetes/cilium.yaml
|
||||
configmap "cilium-config" created
|
||||
secret "cilium-etcd-secrets" created
|
||||
serviceaccount "cilium" created
|
||||
clusterrolebinding "cilium" created
|
||||
daemonset "cilium" created
|
||||
clusterrole "cilium" created
|
||||
```
|
||||
|
||||
The remainder of the Getting Started Guide explains how to enforce both L3/L4
|
||||
(i.e., IP address + port) security policies, as well as L7 (e.g., HTTP) security
|
||||
policies using an example application.
|
||||
|
||||
## Deploying Cilium for Production Use
|
||||
|
||||
For detailed instructions around deploying Cilium for production, see:
|
||||
[Cilium Kubernetes Installation Guide](https://cilium.readthedocs.io/en/latest/kubernetes/install/)
|
||||
This documentation includes detailed requirements, instructions and example
|
||||
production DaemonSet files.
|
||||
|
||||
{{% /capture %}}
|
||||
|
||||
{{% capture discussion %}}
|
||||
## Understanding Cilium components
|
||||
|
||||
Deploying a cluster with Cilium adds Pods to the `kube-system` namespace. To see
|
||||
this list of Pods run:
|
||||
|
||||
```shell
|
||||
kubectl get pods --namespace=kube-system
|
||||
```
|
||||
|
||||
You'll see a list of Pods similar to this:
|
||||
|
||||
```console
|
||||
NAME DESIRED CURRENT READY NODE-SELECTOR AGE
|
||||
cilium 1 1 1 <none> 2m
|
||||
...
|
||||
```
|
||||
|
||||
There are two main components to be aware of:
|
||||
|
||||
- One `cilium` Pod runs on each node in your cluster and enforces network policy
|
||||
on the traffic to/from Pods on that node using Linux BPF.
|
||||
- For production deployments, Cilium should leverage the key-value store cluster
|
||||
(e.g., etcd) used by Kubernetes, which typically runs on the Kubernetes master nodes.
|
||||
The [Cilium Kubernetes Installation Guide](https://cilium.readthedocs.io/en/latest/kubernetes/install/)
|
||||
includes an example DaemonSet which can be customized to point to this key-value
|
||||
store cluster. The simple ''all-in-one'' DaemonSet for minikube requires no such
|
||||
configuration because it automatically connects to the minikube's etcd instance.
|
||||
|
||||
{{% /capture %}}
|
||||
|
||||
{{% capture whatsnext %}}
|
||||
Once your cluster is running, you can follow the
|
||||
[Declare Network Policy](/docs/tasks/administer-cluster/declare-network-policy/)
|
||||
to try out Kubernetes NetworkPolicy with Cilium.
|
||||
Have fun, and if you have questions, contact us using the
|
||||
[Cilium Slack Channel](https://cilium.herokuapp.com/).
|
||||
{{% /capture %}}
|
||||
|
||||
|
||||
+26
@@ -0,0 +1,26 @@
|
||||
---
|
||||
reviewers:
|
||||
- murali-reddy
|
||||
title: Use Kube-router for NetworkPolicy
|
||||
content_template: templates/task
|
||||
weight: 30
|
||||
---
|
||||
|
||||
{{% capture overview %}}
|
||||
This page shows how to use [Kube-router](https://github.com/cloudnativelabs/kube-router) for NetworkPolicy.
|
||||
{{% /capture %}}
|
||||
|
||||
{{% capture prerequisites %}}
|
||||
You need to have a Kubernetes cluster running. If you do not already have a cluster, you can create one by using any of the cluster installers like Kops, Bootkube, Kubeadm etc.
|
||||
{{% /capture %}}
|
||||
|
||||
{{% capture steps %}}
|
||||
## Installing Kube-router addon
|
||||
The Kube-router Addon comes with a Network Policy Controller that watches Kubernetes API server for any NetworkPolicy and pods updated and configures iptables rules and ipsets to allow or block traffic as directed by the policies. Please follow the [trying Kube-router with cluster installers](https://github.com/cloudnativelabs/kube-router/tree/master/Documentation#try-kube-router-with-cluster-installers) guide to install Kube-router addon.
|
||||
{{% /capture %}}
|
||||
|
||||
{{% capture whatsnext %}}
|
||||
Once you have installed the Kube-router addon, you can follow the [Declare Network Policy](/docs/tasks/administer-cluster/declare-network-policy/) to try out Kubernetes NetworkPolicy.
|
||||
{{% /capture %}}
|
||||
|
||||
|
||||
+43
@@ -0,0 +1,43 @@
|
||||
---
|
||||
reviewers:
|
||||
- chrismarino
|
||||
title: Romana for NetworkPolicy
|
||||
content_template: templates/task
|
||||
weight: 40
|
||||
---
|
||||
|
||||
{{% capture overview %}}
|
||||
|
||||
This page shows how to use Romana for NetworkPolicy.
|
||||
|
||||
{{% /capture %}}
|
||||
|
||||
{{% capture prerequisites %}}
|
||||
|
||||
Complete steps 1, 2, and 3 of the [kubeadm getting started guide](/docs/getting-started-guides/kubeadm/).
|
||||
|
||||
{{% /capture %}}
|
||||
|
||||
{{% capture steps %}}
|
||||
|
||||
## Installing Romana with kubeadm
|
||||
|
||||
Follow the [containerized installation guide](https://github.com/romana/romana/tree/master/containerize) for kubeadmin.
|
||||
|
||||
## Applying network policies
|
||||
|
||||
To apply network policies use one of the following:
|
||||
|
||||
* [Romana network policies](https://github.com/romana/romana/wiki/Romana-policies).
|
||||
* [Example of Romana network policy](https://github.com/romana/core/blob/master/doc/policy.md).
|
||||
* The NetworkPolicy API.
|
||||
|
||||
{{% /capture %}}
|
||||
|
||||
{{% capture whatsnext %}}
|
||||
|
||||
Once your have installed Romana, you can follow the [Declare Network Policy](/docs/tasks/administer-cluster/declare-network-policy/) to try out Kubernetes NetworkPolicy.
|
||||
|
||||
{{% /capture %}}
|
||||
|
||||
|
||||
+59
@@ -0,0 +1,59 @@
|
||||
---
|
||||
reviewers:
|
||||
- bboreham
|
||||
title: Weave Net for NetworkPolicy
|
||||
content_template: templates/task
|
||||
weight: 50
|
||||
---
|
||||
|
||||
{{% capture overview %}}
|
||||
|
||||
This page shows how to use Weave Net for NetworkPolicy.
|
||||
|
||||
{{% /capture %}}
|
||||
|
||||
{{% capture prerequisites %}}
|
||||
|
||||
You need to have a Kubernetes cluster. Follow the [kubeadm getting started guide](/docs/getting-started-guides/kubeadm/) to bootstrap one.
|
||||
|
||||
{{% /capture %}}
|
||||
|
||||
{{% capture steps %}}
|
||||
|
||||
## Install the Weave Net addon
|
||||
|
||||
Follow the [Integrating Kubernetes via the Addon](https://www.weave.works/docs/net/latest/kube-addon/) guide.
|
||||
|
||||
The Weave Net addon for Kubernetes comes with a [Network Policy Controller](https://www.weave.works/docs/net/latest/kube-addon/#npc) that automatically monitors Kubernetes for any NetworkPolicy annotations on all namespaces and configures `iptables` rules to allow or block traffic as directed by the policies.
|
||||
|
||||
## Test the installation
|
||||
|
||||
Verify that the weave works.
|
||||
|
||||
Enter the following command:
|
||||
|
||||
```shell
|
||||
kubectl get po -n kube-system -o wide
|
||||
```
|
||||
|
||||
The output is similar to this:
|
||||
|
||||
```
|
||||
NAME READY STATUS RESTARTS AGE IP NODE
|
||||
weave-net-1t1qg 2/2 Running 0 9d 192.168.2.10 worknode3
|
||||
weave-net-231d7 2/2 Running 1 7d 10.2.0.17 worknodegpu
|
||||
weave-net-7nmwt 2/2 Running 3 9d 192.168.2.131 masternode
|
||||
weave-net-pmw8w 2/2 Running 0 9d 192.168.2.216 worknode2
|
||||
```
|
||||
|
||||
Each Node has a weave Pod, and all Pods are `Running` and `2/2 READY`. (`2/2` means that each Pod has `weave` and `weave-npc`.)
|
||||
|
||||
{{% /capture %}}
|
||||
|
||||
{{% capture whatsnext %}}
|
||||
|
||||
Once you have installed the Weave Net addon, you can follow the [Declare Network Policy](/docs/tasks/administer-cluster/declare-network-policy/) to try out Kubernetes NetworkPolicy. If you have any question, contact us at [#weave-community on Slack or Weave User Group](https://github.com/weaveworks/weave#getting-help).
|
||||
|
||||
{{% /capture %}}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user