Add Antrea NetworkPolicy documentation #1194

abhiraut · 2020-09-01T17:47:07Z

With the addition of namespaced Antrea NetworkPolicy, this PR adds relevant documentation.

antrea-bot · 2020-09-01T17:47:21Z

Thanks for your PR.
Unit tests and code linters are run automatically every time the PR is updated.
E2e, conformance and network policy tests can only be triggered by a member of the vmware-tanzu organization. Regular contributors to the project should join the org.

The following commands are available:

/test-e2e: to trigger e2e tests.
/skip-e2e: to skip e2e tests.
/test-conformance: to trigger conformance tests.
/skip-conformance: to skip conformance tests.
/test-whole-conformance: to trigger all conformance tests on linux.
/skip-whole-conformance: to skip all conformance tests on linux.
/test-networkpolicy: to trigger networkpolicy tests.
/skip-networkpolicy: to skip networkpolicy tests.
/test-windows-conformance: to trigger windows conformance tests.
/skip-windows-conformance: to skip windows conformance tests.
/test-windows-networkpolicy: to trigger windows networkpolicy tests.
/skip-windows-networkpolicy: to skip windows networkpolicy tests.
/test-hw-offload: to trigger ovs hardware offload test.
/skip-hw-offload: to skip ovs hardware offload test.
/test-all: to trigger all tests (except whole conformance).
/skip-all: to skip all tests (except whole conformance).

codecov-commenter · 2020-09-01T17:51:11Z

Codecov Report

Merging #1194 into master will decrease coverage by 0.01%.
The diff coverage is n/a.

@@            Coverage Diff             @@
##           master    #1194      +/-   ##
==========================================
- Coverage   56.23%   56.21%   -0.02%     
==========================================
  Files         106      106              
  Lines       11568    11568              
==========================================
- Hits         6505     6503       -2     
- Misses       4493     4494       +1     
- Partials      570      571       +1

Flag	Coverage Δ
#integration-tests	`47.33% <ø> (ø)`
#unit-tests	`41.70% <ø> (-0.02%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files	Coverage Δ
pkg/apiserver/storage/ram/store.go	`80.39% <0.00%> (-1.31%)`	⬇️

abhiraut · 2020-09-02T18:50:30Z

/skip-all

Dyanngg

LGTM

docs/network-policy.md

antoninbas · 2020-09-02T20:06:44Z

docs/network-policy.md

+
+Antrea NetworkPolicy is another Policy CRD, which is similar to the
+ClusterNetworkPolicy CRD, however its scope is limited to a Namespace.
+The purpose of introducing this CRD is to allow admins to take advantage of


is it still targeted at cluster admins specifically?

I'm asking because above you removed "admin-created" from this sentence:

Thus, admin created tiered policies have a higher precedence over developer-created K8s NetworkPolicies.

And I assumed it was because of the addition of the Antrea NetworkPolicy CRD.

yes i thought about it while adding the ANP.. but then since one can add a ANP with higher precedence over existing CNP.. it does not make sense to have ANP associated with devs.. i will restore the original statement above

Agreed that both CRDs should be admin oriented

docs/network-policy.md

antoninbas

one nit, otherwise LGTM

docs/network-policy.md

abhiraut · 2020-09-03T01:08:11Z

/skip-all

abhiraut · 2020-09-03T05:55:02Z

/skip-hw-offload

Dyanngg

re-approving since comments are resolved

abhiraut · 2020-09-08T19:21:37Z

@jianjuns any comments?

jianjuns

Sorry, did not get time for a detailed review. LGTM after a quick scan.

Added a question.

jianjuns · 2020-09-08T22:19:26Z

docs/network-policy.md

+            port: 5978
+```
+
+### Policy ordering based on priorities


This section should be moved to ClusterNetworkPolicy as it applies to both?

are you suggesting to move this out one level in the following way:

Antrea NetworkPolicy

The Antrea NetworkPolicy resource

Key differences from ClusterNetworkPolicy

Policy ordering based on priorities

Notes

I think we either move common contents to a separate common section, or put them in ClusterNetworkPolicy (as it is talked first). I saw sections like "Rule enforcement based on priorities" are similar to this one?

moved to CNP section ..

jianjuns · 2020-09-08T23:19:16Z

docs/network-policy.md

-enforced. Within a tier, rules belonging to Cluster NetworkPolicy CRDs are
+to the "Emergency" tier are enforced first, followed by policies associated
+with the "SecurityOps" tier and so on, until the "Application" tier policies
+are enforced. Within a tier, rules belonging to Cluster NetworkPolicy CRDs are


Do you feel these overlap with what you added? Should we just revise this section (or move some contents about tier and policy priority to your section, but keep rule priority here)?

revised it in its own section..

jianjuns · 2020-09-09T02:56:23Z

docs/network-policy.md

+### Ordering based on Tier priority
+
+With the introduction of tiers, Antrea Policies, like ClusterNetworkPolicies,
+are first enforced based on the tier to which they are associated with. i.e.


associated with -> associated (as already have "to which")?

jianjuns · 2020-09-09T02:57:09Z

docs/network-policy.md

+With the introduction of tiers, Antrea Policies, like ClusterNetworkPolicies,
+are first enforced based on the tier to which they are associated with. i.e.
+all policies belonging to the "Emergency" tier are enforced first, followed by
+policies associated with the "SecurityOps" tier and so on, until the


"associated with" -> "belonging to"?

abhiraut · 2020-09-09T04:00:46Z

/skip-all

abhiraut · 2020-09-09T04:01:31Z

/skip-hw-offload

abhiraut · 2020-09-09T19:30:38Z

/skip-all

abhiraut · 2020-09-09T19:32:18Z

/skip-hw-offload

abhiraut · 2020-09-09T19:41:48Z

rebased to get rid of kind testing on doc pr

antoninbas

Approving again

Add documentation regarding the namespaced Antrea NetworkPolicy CRD

vmwclabot added the cla-not-required label Sep 1, 2020

abhiraut added this to the Antrea v0.10.0 release milestone Sep 1, 2020

abhiraut force-pushed the anp-doc branch from 97fd6fa to ce0e267 Compare September 1, 2020 17:53

abhiraut requested review from antoninbas, tnqn, Dyanngg, McCodeman and jianjuns September 1, 2020 18:32

abhiraut force-pushed the anp-doc branch from ce0e267 to c4e944c Compare September 2, 2020 18:18

Dyanngg previously approved these changes Sep 2, 2020

View reviewed changes

antoninbas reviewed Sep 2, 2020

View reviewed changes

abhiraut dismissed Dyanngg’s stale review via 85f4494 September 3, 2020 00:43

abhiraut requested a review from antoninbas September 3, 2020 00:43

antoninbas previously approved these changes Sep 3, 2020

View reviewed changes

docs/network-policy.md Outdated Show resolved Hide resolved

abhiraut dismissed antoninbas’s stale review via c12ae0f September 3, 2020 01:07

abhiraut force-pushed the anp-doc branch from 85f4494 to c12ae0f Compare September 3, 2020 01:07

antoninbas previously approved these changes Sep 3, 2020

View reviewed changes

Dyanngg previously approved these changes Sep 3, 2020

View reviewed changes

jianjuns reviewed Sep 8, 2020

View reviewed changes

abhiraut dismissed stale reviews from Dyanngg and antoninbas via d4cf46c September 8, 2020 22:35

jianjuns reviewed Sep 8, 2020

View reviewed changes

abhiraut requested review from jianjuns and antoninbas September 9, 2020 00:08

jianjuns reviewed Sep 9, 2020

View reviewed changes

jianjuns approved these changes Sep 9, 2020

View reviewed changes

jianjuns previously approved these changes Sep 9, 2020

View reviewed changes

Dyanngg previously approved these changes Sep 9, 2020

View reviewed changes

antoninbas previously approved these changes Sep 9, 2020

View reviewed changes

abhiraut added 7 commits September 9, 2020 19:30

Add Antrea NetworkPolicy documentation

8e5f002

Address comments 1

a11f883

Address comment 2

ce85f6d

Move policy ordering to common section

dca5886

Move policy ordering to CNP section

e565f5f

Move ordering to a new section

2fc3c44

Address comments

4521640

abhiraut dismissed stale reviews from antoninbas, Dyanngg, and jianjuns via 4521640 September 9, 2020 19:30

abhiraut force-pushed the anp-doc branch from fb20db0 to 4521640 Compare September 9, 2020 19:30

abhiraut requested review from antoninbas and Dyanngg September 9, 2020 19:42

antoninbas approved these changes Sep 9, 2020

View reviewed changes

abhiraut merged commit e159995 into antrea-io:master Sep 9, 2020

abhiraut deleted the anp-doc branch September 9, 2020 20:07

abhiraut mentioned this pull request Sep 11, 2020

Support Namespaced Antrea NetworkPolicy CRD #615

Closed

5 tasks

GraysonWu pushed a commit to GraysonWu/antrea that referenced this pull request Sep 22, 2020

Add Antrea NetworkPolicy documentation (antrea-io#1194)

6f86da0

Add documentation regarding the namespaced Antrea NetworkPolicy CRD

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add Antrea NetworkPolicy documentation #1194

Add Antrea NetworkPolicy documentation #1194

abhiraut commented Sep 1, 2020

antrea-bot commented Sep 1, 2020

codecov-commenter commented Sep 1, 2020 •

edited

Loading

abhiraut commented Sep 2, 2020

Dyanngg left a comment

antoninbas Sep 2, 2020

abhiraut Sep 3, 2020

Dyanngg Sep 3, 2020

antoninbas left a comment

abhiraut commented Sep 3, 2020

abhiraut commented Sep 3, 2020

Dyanngg left a comment

abhiraut commented Sep 8, 2020

jianjuns left a comment

jianjuns Sep 8, 2020

abhiraut Sep 8, 2020

jianjuns Sep 8, 2020

abhiraut Sep 8, 2020

jianjuns Sep 8, 2020

abhiraut Sep 9, 2020

jianjuns Sep 9, 2020

abhiraut Sep 9, 2020

jianjuns Sep 9, 2020

abhiraut Sep 9, 2020

abhiraut commented Sep 9, 2020

abhiraut commented Sep 9, 2020

abhiraut commented Sep 9, 2020

abhiraut commented Sep 9, 2020

abhiraut commented Sep 9, 2020

antoninbas left a comment

Add Antrea NetworkPolicy documentation #1194

Add Antrea NetworkPolicy documentation #1194

Conversation

abhiraut commented Sep 1, 2020

antrea-bot commented Sep 1, 2020

codecov-commenter commented Sep 1, 2020 • edited Loading

Codecov Report

abhiraut commented Sep 2, 2020

Dyanngg left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

antoninbas left a comment

Choose a reason for hiding this comment

abhiraut commented Sep 3, 2020

abhiraut commented Sep 3, 2020

Dyanngg left a comment

Choose a reason for hiding this comment

abhiraut commented Sep 8, 2020

jianjuns left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

abhiraut commented Sep 9, 2020

abhiraut commented Sep 9, 2020

abhiraut commented Sep 9, 2020

abhiraut commented Sep 9, 2020

abhiraut commented Sep 9, 2020

antoninbas left a comment

Choose a reason for hiding this comment

codecov-commenter commented Sep 1, 2020 •

edited

Loading