@@ -141,7 +141,7 @@ and also to the range 49152-65535 without allowing any other ports.
141
141
142
142
### Notes/Constraints/Caveats
143
143
144
- * The technology used by the CNI provider might not support port range in a
144
+ * The technology used by the CNI provider might not support port range in a
145
145
trivial way as described in [ #drawbacks]
146
146
147
147
### Risks and Mitigations
@@ -154,25 +154,25 @@ of the new field.
154
154
155
155
API changes to NetworkPolicy:
156
156
* Add a new field called ` EndPort ` inside ` NetworkPolicyPort ` as the following:
157
- ```
157
+ ``` go
158
158
// NetworkPolicyPort describes a port to allow traffic on
159
159
type NetworkPolicyPort struct {
160
- // The protocol (TCP, UDP, or SCTP) which traffic must match. If not specified, this
161
- // field defaults to TCP.
162
- // +optional
163
- Protocol *v1.Protocol `json:"protocol,omitempty" protobuf:"bytes,1,opt,name=protocol,casttype=k8s.io/api/core/v1.Protocol"`
164
-
165
- // The port on the given protocol. This can either be a numerical or named
160
+ // The protocol (TCP, UDP, or SCTP) which traffic must match. If not specified, this
161
+ // field defaults to TCP.
162
+ // +optional
163
+ Protocol *v1.Protocol ` json:"protocol,omitempty" protobuf:"bytes,1,opt,name=protocol,casttype=k8s.io/api/core/v1.Protocol"`
164
+
165
+ // The port on the given protocol. This can either be a numerical or named
166
166
// port on a pod. If this field is not provided, this matches all port names and
167
167
// numbers, whether an endPort is defined or not.
168
- // +optional
169
- Port *intstr.IntOrString `json:"port,omitempty" protobuf:"bytes,2,opt,name=port"`
170
-
171
- // EndPort defines the last port included in the port range.
172
- // Example:
173
- // endPort: 12345
174
- // +optional
175
- EndPort int32 `json:"port,omitempty" protobuf:"bytes,2,opt,name=endPort"`
168
+ // +optional
169
+ Port *intstr.IntOrString ` json:"port,omitempty" protobuf:"bytes,2,opt,name=port"`
170
+
171
+ // EndPort defines the last port included in the port range.
172
+ // Example:
173
+ // endPort: 12345
174
+ // +optional
175
+ EndPort int32 ` json:"port,omitempty" protobuf:"bytes,2,opt,name=endPort"`
176
176
}
177
177
```
178
178
@@ -205,8 +205,9 @@ validation should be done by CNIs.
205
205
206
206
##### e2e tests
207
207
208
- - test/e2e/network/netpol/network_policy_api.go: Test is optional as per the whole Network Policy suite
208
+ - Feature:NetworkPolicyEndPort: https://storage.googleapis.com/k8s-triage/index.html?text=EndPort#eaa4b8cdb7b461dccfa9
209
209
210
+ The flakes shown here are not related to this feature, per the tests logs
210
211
211
212
### Graduation Criteria
212
213
@@ -226,6 +227,12 @@ with generally positive feedback on its usage.
226
227
- At least ** four** NetworkPolicy providers (or CNI providers) support the ` EndPort ` field
227
228
- ` EndPort ` has been enabled by default for at least 1 minor release
228
229
230
+ The following are the CNIs that implement this feature:
231
+ - Calico
232
+ - Antrea
233
+ - Openshift SDN
234
+ - Kuberouter
235
+
229
236
### Upgrade / Downgrade Strategy
230
237
231
238
If upgraded no impact should happen as this is a new field.
@@ -249,7 +256,6 @@ start working incorrectly. This is a fail-closed failure, so it is acceptable.
249
256
250
257
###### Can the feature be disabled once it has been enabled (i.e. can we roll back the enablement)?
251
258
252
-
253
259
Yes. One caveat here is that NetworkPolicies created with EndPort field set
254
260
when the feature was enabled will continue to have that field set when the
255
261
feature is disabled unless user removes it from the object.
@@ -341,7 +347,6 @@ of this feature?**
341
347
342
348
Yes, a CNI supporting the new feature
343
349
344
-
345
350
### Scalability
346
351
347
352
###### Will enabling / using this feature result in any new API calls?
0 commit comments