Skip to content

Commit b811e03

Browse files
paigecalvertmikhailswift
paigecalvert
authored and
mikhailswift
committed
docs edits
1 parent b7db719 commit b811e03

File tree

1 file changed

+107
-86
lines changed

1 file changed

+107
-86
lines changed

‎docs/vendor/testing-network-policy.md‎

Lines changed: 107 additions & 86 deletions
Original file line numberDiff line numberDiff line change
@@ -1,140 +1,161 @@
1-
# Network Policies (Beta)
1+
# Set Network Policies (Beta)
22

3-
This topic describes how to use network policies and Air Gap features for Replicated Compatibility Matrix Clusters and VMs.
3+
This topic describes how to change the network policy of a virtual machine (VM) or a VM-based cluster with Replicated Compatibility Matrix.
44

55
## About Network Policies
66

7-
Test and verify your application in an Air Gap environment. Particularly useful to test [Replicated Embedded Cluster](https://docs.replicated.com/enterprise/installing-embedded-air-gap) or [Helm CLI install](https://docs.replicated.com/vendor/helm-install-airgap) intended for install in an Air Gap environment.
7+
VMs and VM-based clusters created with Compatibility Matrix can use one of the following network policies:
88

9-
## Prerequisites
9+
| Network Policy | Description |
10+
| :---- | :---- |
11+
| `open` | No restrictions on network traffic. |
12+
| `airgap` | Restrict all network traffic. |
1013

11-
* You must be using Replicated CLI 0.109.0 or higher
12-
* You must have the Admin or Developer role. Read Only users cannot change network settings
14+
By default, all VMs and clusters are created with an `open` network policy. You can change the network policy to `airgap` to create an _air-gapped_ environment with no outbound internet access.
15+
16+
The `airgap` network policy is particularly useful for testing air gap installations for your application. For information about installing with Embedded Cluster in an air-gapped environment, see [Air Gap Installation with Embedded Cluster](/enterprise/installing-embedded-air-gap). For information about installing with the Helm CLI in an air-gapped environment, see [Install and Update with Helm in Air Gap Environments](/vendor/helm-install-airgap).
17+
18+
## Requirements
19+
20+
* Replicated CLI 0.109.0 or later
21+
* The user must have the Admin or Developer role. Read Only users cannot change network settings.
1322

1423
## Limitations
1524

16-
* Currently only open and air gapped policies are supported. For feedback, contact Replicated support.
17-
* Air Gap networks cannot yet be set within the Compatibility Matrix UI
25+
* Network policies are a beta feature. For feedback on this feature, including requests for additional types of network policies, contact Replicated support.
26+
* Setting network policies is only supported through the Replicated CLI. You cannot make changes to the network policy through the Compatibility Matrix UI in the Vendor Portal.
27+
* Network policies are supported only for VMs and VM-based clusters (K3s, RKE2, Embedded Cluster, kURL, Kind, OpenShift). Network policies are not supported for cloud-based clusters (EKS, GKE, AKE, OKE).
28+
29+
## Set the Network Policy to `airgap`
1830

19-
## For Clusters
31+
### For VM-Based Clusters
2032

21-
:::important
33+
To set the network policy of a VM-based cluster:
2234

23-
* Only for VM-base K8s clusters: K3s, RKE2, Embedded Cluster, kURL, Kind, OpenShift
24-
* Not yet for Cloud-based K8s clusters: EKS, GKE, AKE, OKE
35+
1. Create a cluster:
2536

26-
:::
37+
```bash
38+
replicated cluster create --distribution VM_BASED_DISTRIBUTION
39+
```
40+
Where `VM_BASED_DISTRIBUTION` is the target VM-based cluster distribution. For a list of supported distributions, see [VM Clusters](/vendor/testing-supported-clusters#vm-clusters).
2741

28-
### Create Cluster
42+
1. Watch until the cluster status is `running`:
2943

30-
```bash
31-
replicated cluster create --distribution [K8s DISTRIBUTION]
32-
```
44+
```bash
45+
replicated cluster ls --watch
46+
```
3347

34-
**Example:** `replicated cluster create --distribution k3s`
48+
1. (Optional) Verify the initial outbound network connectivity for the cluster:
3549

36-
### Option: Verify Initial Network Connectivity
50+
1. Access the cluster in a shell:
3751

38-
1. Check the cluster is running ( `replicated cluster ls --watch` )
52+
```
53+
replicated cluster shell CLUSTER_ID
54+
```
55+
Where `CLUSTER_ID` is the ID of the cluster that you created from the output of the `cluster ls` command.
3956

40-
2. Access the cluster ( `replicated cluster shell [CLUSTER ID] )`
57+
1. In the cluster, install a networking testing tool. For example, [netshoot](https://github.com/nicolaka/netshoot).
4158

42-
3. Optional: Install a networking testing tool like a [netshoot](https://github.com/nicolaka/netshoot) pod:
59+
**Example:**
4360

44-
```bash
45-
kubectl run tmp-shell --rm -i --tty --image nicolaka/netshoot
46-
```
61+
```bash
62+
kubectl run tmp-shell --rm -i --tty --image nicolaka/netshoot
63+
```
4764

48-
4. Curl an endpoint (e.g., `curl www.google.com` ), confirm success.
65+
1. Curl an endpoint to confirm a successful response. For example, `curl www.google.com`.
4966

50-
### Set Network Policy to Air Gap
67+
1. Open a new shell to access the cluster:
5168

52-
Using a different shell, update the network to `airgap`:
69+
```
70+
replicated cluster shell CLUSTER_ID
71+
```
72+
Where `CLUSTER_ID` is the ID of the cluster that you created from the output of the `cluster ls` command.
5373

54-
| Open | Air Gap | Custom / Allowlist |
55-
| :---- | :---- | :---- |
56-
| No restrictions on network traffic | Restrict all network traffic | Restrict all except Allowlist |
57-
| `open` | `airgap` | Coming Soon |
74+
1. Change the network policy to `airgap`:
5875

59-
```bash
60-
replicated network update [NETWORK ID] --policy airgap
61-
```
76+
```bash
77+
replicated network update NETWORK_ID --policy airgap
78+
```
79+
Where `NETWORK_ID` is the ID of the network from the output of the `cluster ls` command.
6280

63-
If successful, you’ll see network status transition from `updating` to `running`:
81+
1. Verify that the cluster's policy is `airgap` and the status is `running`:
6482
65-
```bash
66-
ID NAME STATUS CREATED EXPIRES POLICY REPORTING
67-
bdeb3515 gifted_antonelli running 2025-01-28 18:45 PST 2025-01-28 19:45 PST airgap off
68-
```
83+
```bash
84+
replicated cluster ls
85+
```
6986
70-
### Option: Verify Air Gap
87+
```bash
88+
ID NAME STATUS CREATED EXPIRES POLICY REPORTING
89+
bdeb3515 gifted_antonelli running 2025-01-28 18:45 PST 2025-01-28 19:45 PST airgap off
90+
```
7191
72-
1. In the netshoot container, check outbound connectivity. (e.g., `curl www.google.com` )
92+
The air gap network is enabled when the status is `running`.
7393
74-
2. Request will eventually time out:
94+
1. (Optional) Use a networking testing tool such as [netshoot](https://github.com/nicolaka/netshoot) to curl an endpoint and verify that there is no outbound connectivity from the cluster.
7595
76-
```bash
77-
curl: (28) Failed to connect to www.google.com port 80 after 129976 ms: Couldn't connect to server
78-
```
96+
If the air gap was successful, a request to curl an endpoint will time out. For example:
7997
80-
## For Virtual Machines (VMs)
98+
```bash
99+
curl: (28) Failed to connect to www.google.com port 80 after 129976 ms: Couldn't connect to server
100+
```
81101
82-
### Create VM
102+
1. (Optional) Test an air gap installation of your application in the cluster. See [Install and Update with Helm in Air Gap Environments](/vendor/helm-install-airgap).
83103
84-
```bash
85-
replicated vm create --distribution ubuntu
86-
```
104+
### For VMs
87105
88-
If successful, you’ll see something like. When ready, STATUS will change queued → running
106+
To set the network policy of a VM-based cluster:
89107
90-
```bash
91-
ID NAME DISTRIBUTION VERSION STATUS NETWORK CREATED EXPIRES COST
92-
067ddbd3 eloquent_sal ubuntu 24.04 queued 85eb50a8 2025-01-28 16:18 PST - $0.60
93-
```
108+
1. Create a VM:
94109
95-
### Option: Verify Initial Network Connectivity
110+
```bash
111+
replicated vm create --distribution ubuntu
112+
```
96113
97-
1. SSH into the VM ( `ssh [VMID]@replicatedvm.com` )
98-
More options: [Connect to a VM](https://docs.replicated.com/vendor/testing-vm-create#connect-to-a-vm)
114+
1. Wait until the VM status is running:
99115
100-
2. Curl an endpoint (e.g., `curl www.google.com` )
116+
```bash
117+
replicated vm ls
118+
```
101119
102-
### Set Network Policy to Air Gap
120+
1. SSH onto the VM:
103121
104-
Optional: Confirm the VM is running (`replicated vm ls`)
122+
```bash
123+
ssh [email protected]
124+
```
125+
Where `VM_ID` is the ID of the VM from the output of the `vm ls` command.
105126
106-
Then, set the network policy to `airgap`
127+
For more information and additional options, see [Connect to a VM](/vendor/testing-vm-create#connect-to-a-vm).
107128
108-
| Open | Air Gap | Custom / Allowlist |
109-
| :---- | :---- | :---- |
110-
| No restrictions on network traffic | Restrict all network traffic | Restrict all except Allowlist |
111-
| `open` | `airgap` | Coming Soon |
129+
1. (Optional) Curl an endpoint to verify the network connectivity of the VM. For example, `curl www.google.com`.
112130
113-
```bash
114-
replicated network update [NETWORK ID] --policy airgap
115-
```
131+
1. Set the network policy to `airgap`:
116132
117-
**Example:** `replicated network update 85eb50a8 --policy airgap`
133+
```bash
134+
replicated network update NETWORK_ID --policy airgap
135+
```
136+
Where `NETWORK_ID` is the ID of the network from the output of the `vm ls` command.
118137
119-
If successful, you’ll see the network STATUS change from `updating` → `running`
120-
Note: it may take a few seconds for the setting to apply.
138+
**Example:**
121139
122-
```bash
123-
ID NAME STATUS CREATED EXPIRES POLICY REPORTING
124-
85eb50a8 silly_rosalind updating 2025-01-28 16:16 PST 2025-01-28 17:18 PST airgap off
125-
```
140+
```bash
141+
replicated network update 85eb50a8 --policy airgap
142+
```
126143
127-
### Option: Verify Air Gap
144+
:::note
145+
It can take a few seconds for the setting to apply.
146+
:::
128147
129-
Confirm there is no outbound connectivity on your VM.
148+
```bash
149+
ID NAME STATUS CREATED EXPIRES POLICY REPORTING
150+
85eb50a8 silly_rosalind updating 2025-01-28 16:16 PST 2025-01-28 17:18 PST airgap off
151+
```
130152
131-
1. SSH into the VM ( `ssh [VMID]@replicatedvm.com` )
132-
More options: [Connect to a VM](https://docs.replicated.com/vendor/testing-vm-create#connect-to-a-vm)
153+
1. (Optional) Curl an endpoint to verify that there is no outbound connectivity from the VM. For example, `curl www.google.com`.
133154
134-
2. Curl an endpoint (e.g., `curl www.google.com` )
155+
If the air gap was successful, a request to curl an endpoint will time out. For example:
135156
136-
The connection will eventually time out:
157+
```bash
158+
curl: (28) Failed to connect to www.google.com port 80 after 129976 ms: Couldn't connect to server
159+
```
137160
138-
```bash
139-
curl: (28) Failed to connect to www.google.com port 80 after 129976 ms: Couldn't connect to server
140-
```
161+
1. (Optional) Test an air gap installation of your application on the VM. See [Air Gap Installation with Embedded Cluster](/enterprise/installing-embedded-air-gap).

0 commit comments

Comments
 (0)