You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: Standards/scs-0219-v1-kaas-networking.md
+7-7Lines changed: 7 additions & 7 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -7,11 +7,11 @@ track: KaaS
7
7
8
8
## Introduction
9
9
10
-
Kubernetes defines a networking model that needs to be implented by a separate CNI plugin.
10
+
Kubernetes defines a networking model that needs to be implemented by a separate CNI plugin.
11
11
Beyond basic connectivity within the cluster, however, there are many networking features that are specified but optional.
12
12
Some of these optional features provide vital functionality, such as the NetworkPolicy API and the Ingress API.
13
13
14
-
This standard specifies a minimal set of networking features that users can expect in clusters created by an SCS complient KaaS provider.
14
+
This standard specifies a minimal set of networking features that users can expect in clusters created by an SCS-compliant KaaS provider.
15
15
16
16
## Terminology
17
17
@@ -28,17 +28,17 @@ The following terms are used throughout this document:
28
28
## Motivation
29
29
30
30
KaaS providers will typically support aditional networking functionality beyond basic Kubernetes networking.
31
-
The specific range features depends on the used CNI plugin, but may also be extended by additional operators.
31
+
The specific range of features depends on the used CNI plugin, but may also be extended by additional operators.
32
32
Users may expect certain optional functionality, so we should define a baseline feature set that has to be available in an SCS-compliant KaaS cluster.
33
33
34
34
## Design Considerations
35
35
36
-
The Kubernetes API is arbitrary extensible.
36
+
The Kubernetes API can be extended arbitrarily.
37
37
Many CNI plugins will define custom resources to enable functionality that is not covered in the official [API specification](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/).
38
38
Sometimes they will even reuse names from different API groups, such as `NetworkPolicy`, which exists in the basic `networking.k8s.io/v1` API, but also in `projectcalico.org/v3`.
39
39
40
40
To avoid any ambiguity, we should therefore be explicit about the API groups and versions of resources.
41
-
We should also avoid mandating thirdparty API extensions, to avoid dependencies on specific thirdparty software and keep the standard as generic as possible.
41
+
We should also avoid mandating third-party API extensions, to avoid dependencies on specific third-party software and keep the standard as generic as possible.
42
42
43
43
### Options considered
44
44
@@ -49,7 +49,7 @@ The policy rules can filter based on port and address ranges, but also on Kubern
49
49
They must be implemented by the CNI plugin, and though they are widely supported, they are still technically optional, and there are some lightweight networking plugins, such as Flannel, that are not enforcing them.
50
50
51
51
Nonetheless, network policies are widely used and most users will expect them in a managed Kubernetes cluster.
52
-
The wide support among CNI plugins makes them a good target for SCS standardization.
52
+
The wide, but varying support among CNI plugins makes them a good target for SCS standardization.
53
53
54
54
#### Default Network Policies in Namespaces
55
55
@@ -67,7 +67,7 @@ CSP-provided network policies should thus only be viewed as a safety default, an
67
67
An alternative to automatically created default network policies are API extensions that allow cluster-wide networking rules.
68
68
Some CNI plugins have implemented such extensions, e.g. Calico's `GlobalNetworkPolicy` and Cilium's `CiliumClusterwideNetworkPolicy`.
69
69
70
-
The Kubernetes Network Policy Special Interest Group is currently working on an [official API extension](https://network-policy-api.sigs.k8s.io/api-overview/) to cover this functionality.
70
+
The Kubernetes Network Special Interest Group is currently working on an [official API extension](https://network-policy-api.sigs.k8s.io/api-overview/) to cover this functionality.
71
71
This API extension introduces the new `AdminNetworkPolicy` and `BaselineAdminNetworkPolicy` resources, which represent cluster-wide network policies with respectively higher or lower precedence than namespaced network policies.
72
72
73
73
This API is also a good candidate for standardization because it consolidates a number of vendor-specific workarounds to limitations of the NetworkPolicy API.
Copy file name to clipboardExpand all lines: Standards/scs-0219-w1-kaas-networking.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -8,8 +8,8 @@ supplements:
8
8
---
9
9
## List of compliant CNI Plugins
10
10
11
-
The Kubernetes Network Policy SIG maintains a [list of work-in-progress implementations](https://network-policy-api.sigs.k8s.io/implementations/) of the AdminNetworkPolicy and BaselineAdminNetworkPolicy resources.
12
-
Besides their own validation implementation of [kube-network-policies](https://github.com/kubernetes-sigs/kube-network-policies), at the time of writing they list the following CNI plugins:
11
+
The Kubernetes Network Policy API working group maintains a [list of work-in-progress implementations](https://network-policy-api.sigs.k8s.io/implementations/) of the AdminNetworkPolicy and BaselineAdminNetworkPolicy resources.
12
+
Besides their own proof-of-concept implementation of [kube-network-policies](https://github.com/kubernetes-sigs/kube-network-policies), at the time of writing they list the following CNI plugins:
0 commit comments