Skip to content

Commit 9da0134

Browse files
jboxmanjboxman
authored
Merge pull request #32252 from jboxman/OSDOCS-1861
OSDOCS-1861: Add discussion of multi-network policy
2 parents a3c488c + 2cd8323 commit 9da0134

8 files changed

+266
-46
lines changed

‎_topic_map.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -892,6 +892,8 @@ Topics:
892892
File: understanding-multiple-networks
893893
- Name: About virtual routing and forwarding
894894
File: about-virtual-routing-and-forwarding
895+
- Name: Configuring multi-network policy
896+
File: configuring-multi-network-policy
895897
- Name: Attaching a pod to an additional network
896898
File: attaching-pod
897899
- Name: Removing a pod from an additional network

‎modules/nw-multi-network-policy-differences.adoc‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
[id="nw-multi-network-policy-differences_{context}"]
2+
= Differences between multi-network policy and network policy
3+
4+
Although the `MultiNetworkPolicy` API implements the `NetworkPolicy` API, there are several important differences:
5+
6+
* You must use the `MultiNetworkPolicy` API:
7+
+
8+
[source,yaml]
9+
----
10+
apiVersion: k8s.cni.cncf.io/v1beta1
11+
kind: MultiNetworkPolicy
12+
----
13+
14+
* You must use the `multi-networkpolicy` resource name when using the CLI to interact with multi-network policies. For example, you can view a multi-network policy object with the `oc get multi-networkpolicy <name>` command where `<name>` is the name of a multi-network policy.
15+
16+
* You must specify an annotation with the name of the network attachment definition that defines the macvlan additional network:
17+
+
18+
[source,yaml]
19+
----
20+
apiVersion: k8s.cni.cncf.io/v1beta1
21+
kind: MultiNetworkPolicy
22+
metadata:
23+
annotations:
24+
k8s.v1.cni.cncf.io/policy-for: <network_name>
25+
----
26+
+
27+
--
28+
where:
29+
30+
`<network_name>`:: Specifies the name of a network attachment definition.
31+
--

‎modules/nw-multi-network-policy-enable.adoc‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * networking/multiple_networks/configuring-multi-network-policy.adoc
4+
5+
[id="nw-multi-network-policy-enable_{context}"]
6+
= Enabling multi-network policy for the cluster
7+
8+
As a cluster administrator, you can enable multi-network policy support on your cluster.
9+
10+
.Prerequisites
11+
12+
* Install the OpenShift CLI (`oc`).
13+
* Log in to the cluster with a user with `cluster-admin` privileges.
14+
15+
.Procedure
16+
17+
. Create the `multinetwork-enable-patch.yaml` file with the following YAML:
18+
+
19+
[source,yaml]
20+
----
21+
apiVersion: operator.openshift.io/v1
22+
kind: Network
23+
metadata:
24+
name: cluster
25+
spec:
26+
useMultiNetworkPolicy: true
27+
----
28+
29+
. Configure the cluster to enable multi-network policy:
30+
+
31+
[source,terminal]
32+
----
33+
$ oc patch network.operator.openshift.io cluster --type=merge --patch-file=multinetwork-enable-patch.yaml
34+
----
35+
+
36+
.Example output
37+
[source,text]
38+
----
39+
network.operator.openshift.io/cluster patched
40+
----

‎modules/nw-networkpolicy-create.adoc‎

Lines changed: 66 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -3,19 +3,28 @@
33
// * networking/network_policy/creating-network-policy.adoc
44
// * post_installation_configuration/network-configuration.adoc
55

6+
:name: network
7+
:role: admin
68
ifeval::[{product-version} >= 4.6]
79
:ovn:
810
endif::[]
11+
ifeval::["{context}" == "configuring-multi-network-policy"]
12+
:multi:
13+
:name: multi-network
14+
:role: cluster-admin
15+
endif::[]
916

1017
[id="nw-networkpolicy-create_{context}"]
11-
= Creating a network policy
18+
= Creating a {name} policy
1219

13-
To define granular rules describing ingress or egress network traffic allowed for namespaces in your cluster, you can create a network policy.
20+
To define granular rules describing ingress or egress network traffic allowed for namespaces in your cluster, you can create a {name} policy.
1421

22+
ifndef::multi[]
1523
[NOTE]
1624
====
1725
If you log in with a user with the `cluster-admin` role, then you can create a network policy in any namespace in the cluster.
1826
====
27+
endif::multi[]
1928

2029
.Prerequisites
2130

@@ -28,8 +37,11 @@ the OVN-Kubernetes network provider or the OpenShift SDN network provider with `
2837
endif::ovn[]
2938
This mode is the default for OpenShift SDN.
3039
* You installed the OpenShift CLI (`oc`).
31-
* You are logged in to the cluster with a user with `admin` privileges.
32-
* You are working in the namespace that the network policy applies to.
40+
* You are logged in to the cluster with a user with `{role}` privileges.
41+
* You are working in the namespace that the {name} policy applies to.
42+
ifndef::multi[]
43+
* Your cluster is using a cluster network provider that supports `NetworkPolicy` objects, such as the OpenShift SDN network provider with `mode: NetworkPolicy` set. This mode is the default for OpenShift SDN.
44+
endif::multi[]
3345

3446
.Procedure
3547

@@ -44,39 +56,74 @@ $ touch <policy_name>.yaml
4456
--
4557
where:
4658

47-
`<policy_name>`:: Specifies the network policy file name.
59+
`<policy_name>`:: Specifies the {name} policy file name.
4860
--
4961

50-
.. Define a network policy in the file that you just created, such as in the following examples:
62+
.. Define a {name} policy in the file that you just created, such as in the following examples:
5163
+
5264
.Deny ingress from all pods in all namespaces
5365
[source,yaml]
5466
----
67+
ifndef::multi[]
5568
kind: NetworkPolicy
5669
apiVersion: networking.k8s.io/v1
70+
endif::multi[]
71+
ifdef::multi[]
72+
apiVersion: k8s.cni.cncf.io/v1beta1
73+
kind: MultiNetworkPolicy
74+
endif::multi[]
5775
metadata:
5876
name: deny-by-default
77+
ifdef::multi[]
78+
annotations:
79+
k8s.v1.cni.cncf.io/policy-for: <network_name>
80+
endif::multi[]
5981
spec:
6082
podSelector:
6183
ingress: []
6284
----
85+
ifdef::multi[]
86+
+
87+
--
88+
where
89+
90+
`<network_name>`:: Specifies the name of a network attachment definition.
91+
--
92+
endif::multi[]
6393
+
6494
.Allow ingress from all pods in the same namespace
6595
[source,yaml]
6696
----
97+
ifndef::multi[]
6798
kind: NetworkPolicy
6899
apiVersion: networking.k8s.io/v1
100+
endif::multi[]
101+
ifdef::multi[]
102+
apiVersion: k8s.cni.cncf.io/v1beta1
103+
kind: MultiNetworkPolicy
104+
endif::multi[]
69105
metadata:
70106
name: allow-same-namespace
107+
ifdef::multi[]
108+
annotations:
109+
k8s.v1.cni.cncf.io/policy-for: <network_name>
110+
endif::multi[]
71111
spec:
72112
podSelector:
73113
ingress:
74114
- from:
75115
- podSelector: {}
76116
----
117+
ifdef::multi[]
118+
+
119+
--
120+
where
77121

122+
`<network_name>`:: Specifies the name of a network attachment definition.
123+
--
124+
endif::multi[]
78125

79-
. To create the network policy object, enter the following command:
126+
. To create the {name} policy object, enter the following command:
80127
+
81128
[source,terminal]
82129
----
@@ -86,16 +133,26 @@ $ oc apply -f <policy_name>.yaml -n <namespace>
86133
--
87134
where:
88135

89-
`<policy_name>`:: Specifies the network policy file name.
136+
`<policy_name>`:: Specifies the {name} policy file name.
90137
`<namespace>`:: Optional: Specifies the namespace if the object is defined in a different namespace than the current namespace.
91138
--
92139
+
93140
.Example output
94141
[source,terminal]
95142
----
96-
networkpolicy "default-deny" created
143+
ifndef::multi[]
144+
networkpolicy.networking.k8s.io/default-deny created
145+
endif::multi[]
146+
ifdef::multi[]
147+
multinetworkpolicy.k8s.cni.cncf.io/default-deny created
148+
endif::multi[]
97149
----
98150

99151
ifdef::ovn[]
100152
:!ovn:
101153
endif::ovn[]
154+
ifdef::multi[]
155+
:!multi:
156+
endif::multi[]
157+
:!name:
158+
:!role:

‎modules/nw-networkpolicy-delete.adoc‎

Lines changed: 28 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -3,19 +3,28 @@
33
// * networking/network_policy/deleting-network-policy.adoc
44
// * post_installation_configuration/network-configuration.adoc
55

6+
:name: network
7+
:role: admin
68
ifeval::[{product-version} >= 4.6]
79
:ovn:
810
endif::[]
11+
ifeval::["{context}" == "configuring-multi-network-policy"]
12+
:multi:
13+
:name: multi-network
14+
:role: cluster-admin
15+
endif::[]
916

1017
[id="nw-networkpolicy-delete_{context}"]
11-
= Deleting a network policy
18+
= Deleting a {name} policy
1219

13-
You can delete a network policy in a namespace.
20+
You can delete a {name} policy in a namespace.
1421

22+
ifndef::multi[]
1523
[NOTE]
1624
====
1725
If you log in with a user with the `cluster-admin` role, then you can delete any network policy in the cluster.
1826
====
27+
endif::multi[]
1928

2029
.Prerequisites
2130

@@ -28,31 +37,41 @@ the OVN-Kubernetes network provider or the OpenShift SDN network provider with `
2837
endif::ovn[]
2938
This mode is the default for OpenShift SDN.
3039
* You installed the OpenShift CLI (`oc`).
31-
* You are logged in to the cluster with a user with `admin` privileges.
32-
* You are working in the namespace where the network policy exists.
40+
* You are logged in to the cluster with a user with `{role}` privileges.
41+
* You are working in the namespace where the {name} policy exists.
3342

3443
.Procedure
3544

36-
* To delete a `NetworkPolicy` object, enter the following command:
45+
* To delete a {name} policy object, enter the following command:
3746
+
38-
[source,terminal]
47+
[source,terminal,subs="attributes+"]
3948
----
40-
$ oc delete networkpolicy <policy_name> -n <namespace>
49+
$ oc delete {name}policy <policy_name> -n <namespace>
4150
----
4251
+
4352
--
4453
where:
4554

46-
`<policy_name>`:: Specifies the name of the network policy.
55+
`<policy_name>`:: Specifies the name of the {name} policy.
4756
`<namespace>`:: Optional: Specifies the namespace if the object is defined in a different namespace than the current namespace.
4857
--
4958
+
5059
.Example output
5160
[source,text]
5261
----
53-
networkpolicy.networking.k8s.io/allow-same-namespace deleted
62+
ifndef::multi[]
63+
networkpolicy.networking.k8s.io/default-deny deleted
64+
endif::multi[]
65+
ifdef::multi[]
66+
multinetworkpolicy.k8s.cni.cncf.io/default-deny deleted
67+
endif::multi[]
5468
----
5569

5670
ifdef::ovn[]
5771
:!ovn:
5872
endif::ovn[]
73+
ifdef::multi[]
74+
:!multi:
75+
endif::multi[]
76+
:!name:
77+
:!role:

0 commit comments

Comments
 (0)