Skip to content

Commit

Permalink
Add note regarding feature gate status
Browse files Browse the repository at this point in the history
  • Loading branch information
abhiraut committed Jul 2, 2020
1 parent d97155c commit 13d8e30
Showing 1 changed file with 12 additions and 5 deletions.
17 changes: 12 additions & 5 deletions docs/network-policy.md
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,13 @@ aimed towards developers to secure their apps and affects Pods within the
Namespace in which the K8s NetworkPolicy is created.
Rules belonging to ClusterNetworkPolicies are evaluated before any rule
belonging to a K8s NetworkPolicy.
**Note**: ClusterNetworkPolicy is currently in "Alpha" stage. In order to
enable them, edit the Controller configuration in the `antrea` ConfigMap
as follows:
```yaml
antrea-controller.conf: |
ClusterNetworkPolicy: true
```
## The ClusterNetworkPolicy resource
Expand Down Expand Up @@ -115,18 +122,18 @@ Hence, CNP take precedence over K8s NP.
There are four kinds of selectors that can be specified in an ingress `from`
section or egress `to` section:

**podSelector**: This selects particular Pods from all Namespaces as `sources`,
if set in `ingress` section, or as `destinations`, if set in `egress` section.
**podSelector**: This selects particular Pods from all Namespaces as "sources",
if set in `ingress` section, or as "destinations", if set in `egress` section.

**namespaceSelector**: This selects particular Namespaces for which all Pods are
grouped as `ingress` `sources` or `egress` `destinations`.
grouped as `ingress` "sources" or `egress` "destinations".

**podSelector** and **namespaceSelector**: A single to/from entry that specifies
both namespaceSelector and podSelector selects particular Pods within
particular Namespaces.

**ipBlock**: This selects particular IP CIDR ranges to allow as `ingress` `sources`
or `egress` `destinations`. These should be cluster-external IPs, since Pod IPs are
**ipBlock**: This selects particular IP CIDR ranges to allow as `ingress` "sources"
or `egress` "destinations". These should be cluster-external IPs, since Pod IPs are
ephemeral and unpredictable.

## Key differences from K8s NetworkPolicy
Expand Down

0 comments on commit 13d8e30

Please sign in to comment.