Skip to content

Commit 9794a20

Browse files
bergerhofferbergerhoffer
authored
Merge pull request #51793 from kquinn1204/TELCODOCS-405
TELCODOCS-405 updating multi-network policy to address SR-IOV support
2 parents 9bfea52 + 69eebb7 commit 9794a20

13 files changed

+679
-9
lines changed

‎images/292_OpenShift_Configuring_multi-network_policy_1122.png

38.2 KB
Loading

‎images/292_OpenShift_Configuring_multiple-network_policy_1122.png

30.7 KB
Loading

‎modules/nw-multi-network-policy-differences.adoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ kind: MultiNetworkPolicy
1313

1414
* You must use the `multi-networkpolicy` resource name when using the CLI to interact with multi-network policies. For example, you can view a multi-network policy object with the `oc get multi-networkpolicy <name>` command where `<name>` is the name of a multi-network policy.
1515

16-
* You must specify an annotation with the name of the network attachment definition that defines the macvlan additional network:
16+
* You must specify an annotation with the name of the network attachment definition that defines the macvlan or SR-IOV additional network:
1717
+
1818
[source,yaml]
1919
----

‎modules/nw-networkpolicy-allow-application-all-namespaces.adoc

Lines changed: 148 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,148 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * networking/multiple_networks/configuring-multi-network-policy.adoc
4+
:name: network
5+
:role: admin
6+
ifeval::[{product-version} >= 4.6]
7+
:ovn:
8+
endif::[]
9+
ifeval::["{context}" == "configuring-multi-network-policy"]
10+
:multi:
11+
:name: multi-network
12+
:role: cluster-admin
13+
endif::[]
14+
15+
:_content-type: PROCEDURE
16+
[id="nw-networkpolicy-allow-traffic-from-all-applications_{context}"]
17+
= Creating a {name} policy allowing traffic to an application from all namespaces
18+
19+
20+
[NOTE]
21+
====
22+
If you log in with a user with the `cluster-admin` role, then you can create a network policy in any namespace in the cluster.
23+
====
24+
25+
Follow this procedure to configure a policy that allows traffic from all pods in all namespaces to a particular application.
26+
27+
.Prerequisites
28+
29+
* Your cluster uses a cluster network provider that supports `NetworkPolicy` objects, such as
30+
ifndef::ovn[]
31+
the OpenShift SDN network provider with `mode: NetworkPolicy` set.
32+
endif::ovn[]
33+
ifdef::ovn[]
34+
the OVN-Kubernetes network provider or the OpenShift SDN network provider with `mode: NetworkPolicy` set.
35+
endif::ovn[]
36+
This mode is the default for OpenShift SDN.
37+
* You installed the OpenShift CLI (`oc`).
38+
* You are logged in to the cluster with a user with `{role}` privileges.
39+
* You are working in the namespace that the {name} policy applies to.
40+
41+
.Procedure
42+
43+
. Create a policy that allows traffic from all pods in all namespaces to a particular application. Save the YAML in the `web-allow-all-namespaces.yaml` file:
44+
+
45+
[source,yaml]
46+
----
47+
ifndef::multi[]
48+
kind: NetworkPolicy
49+
apiVersion: networking.k8s.io/v1
50+
endif::multi[]
51+
ifdef::multi[]
52+
apiVersion: k8s.cni.cncf.io/v1beta1
53+
kind: MultiNetworkPolicy
54+
endif::multi[]
55+
metadata:
56+
name: web-allow-all-namespaces
57+
namespace: default
58+
ifdef::multi[]
59+
annotations:
60+
k8s.v1.cni.cncf.io/policy-for: <network_name>
61+
endif::multi[]
62+
spec:
63+
podSelector:
64+
matchLabels:
65+
app: web <1>
66+
policyTypes:
67+
- Ingress
68+
ingress:
69+
- from:
70+
- namespaceSelector: {} <2>
71+
----
72+
<1> Applies the policy only to `app:web` pods in default namespace.
73+
<2> Selects all pods in all namespaces.
74+
+
75+
[NOTE]
76+
====
77+
By default, if you omit specifying a `namespaceSelector` it does not select any namespaces, which means the policy allows traffic only from the namespace the network policy is deployed to.
78+
====
79+
80+
. Apply the policy by entering the following command:
81+
+
82+
[source,terminal]
83+
----
84+
$ oc apply -f web-allow-all-namespaces.yaml
85+
----
86+
+
87+
.Example output
88+
[source,terminal]
89+
----
90+
ifndef::multi[]
91+
networkpolicy.networking.k8s.io/web-allow-all-namespaces created
92+
endif::multi[]
93+
ifdef::multi[]
94+
multinetworkpolicy.k8s.cni.cncf.io/web-allow-all-namespaces created
95+
endif::multi[]
96+
----
97+
98+
.Verification
99+
100+
. Start a web service in the `default` namespace by entering the following command:
101+
+
102+
[source,terminal]
103+
----
104+
$ oc run web --namespace=default --image=nginx --labels="app=web" --expose --port=80
105+
----
106+
107+
. Run the following command to deploy an `alpine` image in the `secondary` namespace and to start a shell:
108+
+
109+
[source,terminal]
110+
----
111+
$ oc run test-$RANDOM --namespace=secondary --rm -i -t --image=alpine -- sh
112+
----
113+
114+
. Run the following command in the shell and observe that the request is allowed:
115+
+
116+
[source,terminal]
117+
----
118+
# wget -qO- --timeout=2 http://web.default
119+
----
120+
+
121+
.Expected output
122+
+
123+
[source,terminal]
124+
----
125+
<!DOCTYPE html>
126+
<html>
127+
<head>
128+
<title>Welcome to nginx!</title>
129+
<style>
130+
html { color-scheme: light dark; }
131+
body { width: 35em; margin: 0 auto;
132+
font-family: Tahoma, Verdana, Arial, sans-serif; }
133+
</style>
134+
</head>
135+
<body>
136+
<h1>Welcome to nginx!</h1>
137+
<p>If you see this page, the nginx web server is successfully installed and
138+
working. Further configuration is required.</p>
139+
140+
<p>For online documentation and support please refer to
141+
<a href="http://nginx.org/">nginx.org</a>.<br/>
142+
Commercial support is available at
143+
<a href="http://nginx.com/">nginx.com</a>.</p>
144+
145+
<p><em>Thank you for using nginx.</em></p>
146+
</body>
147+
</html>
148+
----

‎modules/nw-networkpolicy-allow-application-particular-namespace.adoc

Lines changed: 198 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,198 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * networking/multiple_networks/configuring-multi-network-policy.adoc
4+
:name: network
5+
:role: admin
6+
ifeval::[{product-version} >= 4.6]
7+
:ovn:
8+
endif::[]
9+
ifeval::["{context}" == "configuring-multi-network-policy"]
10+
:multi:
11+
:name: multi-network
12+
:role: cluster-admin
13+
endif::[]
14+
15+
:_content-type: PROCEDURE
16+
[id="nw-networkpolicy-allow-traffic-from-a-namespace_{context}"]
17+
= Creating a {name} policy allowing traffic to an application from a namespace
18+
19+
[NOTE]
20+
====
21+
If you log in with a user with the `cluster-admin` role, then you can create a network policy in any namespace in the cluster.
22+
====
23+
24+
Follow this procedure to configure a policy that allows traffic to a pod with the label `app=web` from a particular namespace. You might want to do this to:
25+
26+
* Restrict traffic to a production database only to namespaces where production workloads are deployed.
27+
* Enable monitoring tools deployed to a particular namespace to scrape metrics from the current namespace.
28+
29+
.Prerequisites
30+
31+
* Your cluster uses a cluster network provider that supports `NetworkPolicy` objects, such as
32+
ifndef::ovn[]
33+
the OpenShift SDN network provider with `mode: NetworkPolicy` set.
34+
endif::ovn[]
35+
ifdef::ovn[]
36+
the OVN-Kubernetes network provider or the OpenShift SDN network provider with `mode: NetworkPolicy` set.
37+
endif::ovn[]
38+
This mode is the default for OpenShift SDN.
39+
* You installed the OpenShift CLI (`oc`).
40+
* You are logged in to the cluster with a user with `{role}` privileges.
41+
* You are working in the namespace that the {name} policy applies to.
42+
43+
.Procedure
44+
45+
. Create a policy that allows traffic from all pods in a particular namespaces with a label `purpose=production`. Save the YAML in the `web-allow-prod.yaml` file:
46+
+
47+
[source,yaml]
48+
----
49+
ifndef::multi[]
50+
kind: NetworkPolicy
51+
apiVersion: networking.k8s.io/v1
52+
endif::multi[]
53+
ifdef::multi[]
54+
apiVersion: k8s.cni.cncf.io/v1beta1
55+
kind: MultiNetworkPolicy
56+
endif::multi[]
57+
metadata:
58+
name: web-allow-prod
59+
namespace: default
60+
ifdef::multi[]
61+
annotations:
62+
k8s.v1.cni.cncf.io/policy-for: <network_name>
63+
endif::multi[]
64+
spec:
65+
podSelector:
66+
matchLabels:
67+
app: web <1>
68+
policyTypes:
69+
- Ingress
70+
ingress:
71+
- from:
72+
- namespaceSelector:
73+
matchLabels:
74+
purpose: production <2>
75+
----
76+
<1> Applies the policy only to `app:web` pods in the default namespace.
77+
<2> Restricts traffic to only pods in namespaces that have the label `purpose=production`.
78+
79+
. Apply the policy by entering the following command:
80+
+
81+
[source,terminal]
82+
----
83+
$ oc apply -f web-allow-prod.yaml
84+
----
85+
+
86+
.Example output
87+
[source,terminal]
88+
----
89+
ifndef::multi[]
90+
networkpolicy.networking.k8s.io/web-allow-prod created
91+
endif::multi[]
92+
ifdef::multi[]
93+
multinetworkpolicy.k8s.cni.cncf.io/web-allow-prod created
94+
endif::multi[]
95+
----
96+
97+
.Verification
98+
99+
. Start a web service in the `default` namespace by entering the following command:
100+
+
101+
[source,terminal]
102+
----
103+
$ oc run web --namespace=default --image=nginx --labels="app=web" --expose --port=80
104+
----
105+
106+
. Run the following command to create the `prod` namespace:
107+
+
108+
[source,terminal]
109+
----
110+
$ oc create namespace prod
111+
----
112+
113+
. Run the following command to label the `prod` namespace:
114+
+
115+
[source,terminal]
116+
----
117+
$ oc label namespace/prod purpose=production
118+
----
119+
120+
. Run the following command to create the `dev` namespace:
121+
+
122+
[source,terminal]
123+
----
124+
$ oc create namespace dev
125+
----
126+
127+
. Run the following command to label the `dev` namespace:
128+
+
129+
[source,terminal]
130+
----
131+
$ oc label namespace/dev purpose=testing
132+
----
133+
134+
. Run the following command to deploy an `alpine` image in the `dev` namespace and to start a shell:
135+
+
136+
[source,terminal]
137+
----
138+
$ oc run test-$RANDOM --namespace=dev --rm -i -t --image=alpine -- sh
139+
----
140+
141+
. Run the following command in the shell and observe that the request is blocked:
142+
+
143+
[source,terminal]
144+
----
145+
# wget -qO- --timeout=2 http://web.default
146+
----
147+
+
148+
.Expected output
149+
+
150+
[source,terminal]
151+
----
152+
wget: download timed out
153+
----
154+
155+
. Run the following command to deploy an `alpine` image in the `prod` namespace and start a shell:
156+
+
157+
[source,terminal]
158+
----
159+
$ oc run test-$RANDOM --namespace=prod --rm -i -t --image=alpine -- sh
160+
----
161+
162+
. Run the following command in the shell and observe that the request is allowed:
163+
+
164+
[source,terminal]
165+
----
166+
# wget -qO- --timeout=2 http://web.default
167+
----
168+
+
169+
.Expected output
170+
+
171+
[source,terminal]
172+
----
173+
<!DOCTYPE html>
174+
<html>
175+
<head>
176+
<title>Welcome to nginx!</title>
177+
<style>
178+
html { color-scheme: light dark; }
179+
body { width: 35em; margin: 0 auto;
180+
font-family: Tahoma, Verdana, Arial, sans-serif; }
181+
</style>
182+
</head>
183+
<body>
184+
<h1>Welcome to nginx!</h1>
185+
<p>If you see this page, the nginx web server is successfully installed and
186+
working. Further configuration is required.</p>
187+
188+
<p>For online documentation and support please refer to
189+
<a href="http://nginx.org/">nginx.org</a>.<br/>
190+
Commercial support is available at
191+
<a href="http://nginx.com/">nginx.com</a>.</p>
192+
193+
<p><em>Thank you for using nginx.</em></p>
194+
</body>
195+
</html>
196+
----
197+
198+

0 commit comments

Comments
 (0)