Reconsider using Canal CNI or document the reasoning behind it

[xmudrii]

Previously we used Flannel as a CNI plugin but later we switched to Canal as it provides NetworkPolicies. The switch to Canal was made in #123 and was proposed in the issue #122.

After discussion, it's decided that we should reconsider using Canal, as other CNIs are more feature complete and more secure. For example, WeaveNet includes encryption of the CNI network. If we decide to continue using Canal we should document our reasoning behind that.

[kron4eg]

https://itnext.io/benchmark-results-of-kubernetes-network-plugins-cni-over-10gbit-s-network-36475925a560

More or less all the CNI plugins are the same in terms of speed, expect weavenet+encryption.

Also weavenet since that post got support for Egress NetworkPolicies

[edernucci]

@kron4eg is it ready to use on 0.9?

[kron4eg]

Yes, absolutely.

[edernucci]

@kron4eg I have searched (https://github.com/kubermatic/kubeone/search?q=weave&unscoped_q=weave) but didn't find any docs on how to enable it.

Can you give me a briefing?

[kron4eg]

@edernucci using kubeone config print --full you could get full example config (template for it is here: https://github.com/kubermatic/kubeone/blob/master/pkg/cmd/config.go#L422) so to enable weave flag need to be specified.

Here is concrete example:

clusterNetwork:
  cni:
    provider: weave-net
    encrypted: true # this is optionally, can be omitted (which means disabled)