Open g1rana opened 6 years ago
This is feature commit to support K8s Network Policy at contiv. Using feature, Contiv will support K8s Ingress Network Policy however egress policy support comes in future code commit
Please describe:
kubectl get netpol
NAME POD-SELECTOR AGE access-nginx app=nginx 6m
Contiv system after k8s policy
default default default-net default default-group default-net ingress-policy,access-nginx
kubectl create -f nginx-deployment.yaml
kubectl create -f apod.yaml
kubectl get pods -o wide NAME READY STATUS RESTARTS AGE IP NODE apod 1/1 Running 0 2m 10.233.64.8 k8s1 nginx-deployment-431080787-6b6zh 1/1 Running 0 2m 10.233.64.7 k8s1 nginx-deployment-431080787-9d949 1/1 Running 0 2m 10.233.64.6 k8s1
kubectl get pods -o wide
netctl policy rule-ls access-nginx Incoming Rules: Rule Priority From EndpointGroup From Network From IpAddress TO IpAddress Protocol Port Action
access-nginx-10.233.64.6-10.233.64.8 2 10.233.64.8 10.233.64.6 0 allow access-nginx-10.233.64.7-10.233.64.8 2 10.233.64.8 10.233.64.7 0 allow Outgoing Rules: Rule Priority To EndpointGroup To Network To IpAddress Protocol Port Action
====
@eng-contiv
After creating EPG, are the spec pods updated to belong to this EPG? If not,will the flow table of ovs install this policy?
Description of the changes
This is feature commit to support K8s Network Policy at contiv. Using feature, Contiv will support K8s Ingress Network Policy however egress policy support comes in future code commit
Type of fix: New feature
Fixes #1089
Please describe:
NAME POD-SELECTOR AGE access-nginx app=nginx 6m
Contiv system after k8s policy
: netctl group ls Tenant Group Network IP Pool CfgdTag Policies Network profiledefault default default-net default default-group default-net ingress-policy,access-nginx
kubectl create -f nginx-deployment.yaml
:kubectl create -f apod.yaml
kubectl get pods -o wide
NAME READY STATUS RESTARTS AGE IP NODE apod 1/1 Running 0 2m 10.233.64.8 k8s1 nginx-deployment-431080787-6b6zh 1/1 Running 0 2m 10.233.64.7 k8s1 nginx-deployment-431080787-9d949 1/1 Running 0 2m 10.233.64.6 k8s1netctl policy rule-ls access-nginx Incoming Rules: Rule Priority From EndpointGroup From Network From IpAddress TO IpAddress Protocol Port Action
access-nginx-10.233.64.6-10.233.64.8 2 10.233.64.8 10.233.64.6 0 allow access-nginx-10.233.64.7-10.233.64.8 2 10.233.64.8 10.233.64.7 0 allow Outgoing Rules: Rule Priority To EndpointGroup To Network To IpAddress Protocol Port Action
====