Closed tnqn closed 4 years ago
Antrea now supports Kubernetes NetworkPolicy except "named port" which we have #122 to track. The implementation has been validated with Kubernetes NetworkPolicy e2e tests, except the following 4 failures:
[Fail] [sig-network] NetworkPolicy [LinuxOnly] NetworkPolicy between server and client [It] should allow egress access on one named port [Feature:NetworkPolicy]
/workspace/anago-v1.16.3-beta.0.56+b3cbbae08ec52a/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/network/network_policy.go:1421
[Fail] [sig-network] NetworkPolicy [LinuxOnly] NetworkPolicy between server and client [It] should allow ingress access on one named port [Feature:NetworkPolicy]
/workspace/anago-v1.16.3-beta.0.56+b3cbbae08ec52a/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/network/network_policy.go:1421
[Fail] [sig-network] NetworkPolicy [LinuxOnly] NetworkPolicy between server and client [It] should allow ingress access from namespace on one named port [Feature:NetworkPolicy]
/workspace/anago-v1.16.3-beta.0.56+b3cbbae08ec52a/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/network/network_policy.go:1421
[Fail] [sig-network] NetworkPolicy [LinuxOnly] NetworkPolicy between server and client [It] should allow ingress access from updated pod [Feature:NetworkPolicy]
/workspace/anago-v1.16.3-beta.0.56+b3cbbae08ec52a/src/k8s.io/kubernetes/_output/dockerized/go/src/k8s.io/kubernetes/test/e2e/network/network_policy.go:1421
3 of them need "named port" support so it's expected, the other one is an invalid test and no CNI can pass (reported this one to K8s community kubernetes/kubernetes#85908 and proposed a fix kubernetes/kubernetes#85909)
Describe what you are trying to solve Make Antrea support Kubernetes NetworkPolicy.
Describe the solution you have in mind Refer to https://github.com/vmware-tanzu-private/antrea/blob/master/docs/architecture.md#networkpolicy
Describe how your solution impacts user flows User can create Kubernetes NetworkPolicy and expect they are enforced by Antrea.
Describe the main design/architecture of your solution Refer to https://github.com/vmware-tanzu-private/antrea/blob/master/docs/architecture.md#networkpolicy
Test plan
Additional context