[RFC] Network policies #3611

aojea · 2024-05-14T11:20:00Z

Add support for network policies in KIND

/hold

Fixes: #842

Build kind

make
go build -v -o "/usr/local/google/home/aojea/src/kind/bin/kind" -trimpath -ldflags="-buildid= -w -X=sigs.k8s.io/kind/pkg/cmd/kind/version.gitCommit=d3c7631e37eed1714a7a1ea923a7393842a384d3 -X=sigs.k8s.io/kind/pkg/cmd/kind/version.gitCommitCount=6"

Create node image

bin/kind build node-image ~/src/kubernetes/
Starting to build Kubernetes
+++ [0514 11:25:11] Verifying Prerequisites....
+++ [0514 11:25:11] Building Docker image kube-build:build-300e2a667e-5-v1.31.0-go1.22.3-bullseye.0
+++ [0514 11:26:57] Creating data container kube-build-data-300e2a667e-5-v1.31.0-go1.22.3-bullseye.0
+++ [0514 11:27:02] Syncing sources to container
+++ [0514 11:27:21] Running build command...
+++ [0514 11:27:28] Building go targets for linux/amd64
    k8s.io/kubernetes/cmd/kube-apiserver (static)
    k8s.io/kubernetes/cmd/kube-controller-manager (static)
    k8s.io/kubernetes/cmd/kube-proxy (static)
    k8s.io/kubernetes/cmd/kube-scheduler (static)
    k8s.io/kubernetes/cmd/kubeadm (static)
    k8s.io/kubernetes/cmd/kubectl (static)
    k8s.io/kubernetes/cmd/kubelet (non-static)
+++ [0514 11:28:37] Syncing out of container
+++ [0514 11:28:45] Building images: linux-amd64
+++ [0514 11:28:45] Starting docker build for image: kube-apiserver-amd64
+++ [0514 11:28:45] Starting docker build for image: kube-controller-manager-amd64
+++ [0514 11:28:45] Starting docker build for image: kube-scheduler-amd64
+++ [0514 11:28:45] Starting docker build for image: kube-proxy-amd64
+++ [0514 11:28:45] Starting docker build for image: kubectl-amd64
+++ [0514 11:28:51] Deleting docker image registry.k8s.io/kubectl-amd64:v1.31.0-alpha.0.740_caafc211407c66-dirty
+++ [0514 11:28:51] Deleting docker image registry.k8s.io/kube-scheduler-amd64:v1.31.0-alpha.0.740_caafc211407c66-dirty
+++ [0514 11:28:51] Deleting docker image registry.k8s.io/kube-proxy-amd64:v1.31.0-alpha.0.740_caafc211407c66-dirty
+++ [0514 11:28:52] Deleting docker image registry.k8s.io/kube-controller-manager-amd64:v1.31.0-alpha.0.740_caafc211407c66-dirty
+++ [0514 11:28:53] Deleting docker image registry.k8s.io/kube-apiserver-amd64:v1.31.0-alpha.0.740_caafc211407c66-dirty
+++ [0514 11:28:53] Docker builds done
Finished building Kubernetes
Building node image ...
Building in container: kind-build-1715686140-869641220
Image "kindest/node:latest" build completed.

Create cluster

bin/kind create cluster --config kind-config.yaml --name netpol --image kindest/node:latest
Creating cluster "netpol" ...
 ✓ Ensuring node image (kindest/node:latest) 🖼
 ✓ Preparing nodes 📦  
 ✓ Writing configuration 📜 
 ✓ Starting control-plane 🕹️ 
 ✓ Installing CNI 🔌 
 ✓ Installing Network Policies 🔒 
 ✓ Installing StorageClass 💾 
Set kubectl context to "kind-netpol"
You can now use your cluster with:

kubectl cluster-info --context kind-netpol

Have a nice day! 👋

Check network policies pods are running

 kubectl -n kube-system get pods | grep network-policies
kube-network-policies-lvmvz                    1/1     Running   0          3m7s

k8s-ci-robot · 2024-05-14T11:20:05Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: aojea

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [aojea]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

aojea · 2024-05-14T11:20:10Z

/assign @BenTheElder

neolit123 · 2024-05-16T12:29:03Z

pkg/build/nodeimage/const_network_policy.go

+          privileged: true
+          capabilities:
+            add: ["NET_ADMIN"]


doesn't privileged=true make the NET_ADMIN cap redundant, i think it should be privileged=false and only the required caps should be added.

i guess this is from the original repo manifest;
https://github.com/kubernetes-sigs/kube-network-policies/blob/main/install.yaml#L85-L88

yeah, I think I started to get granularity and gave up :)

i think, it's fine to leave it privileged and remove the NET_ADMIN cap. maybe leave a TODO comment if someone wishes to experiment with caps and limit the access scope.

neolit123 · 2024-05-16T12:31:04Z

pkg/cluster/internal/create/actions/installnetworkpolicies/networkpolicies.go

@@ -0,0 +1,75 @@
+/*
+Copyright 2019 The Kubernetes Authors.


Suggested change

Copyright 2019 The Kubernetes Authors.

Copyright 2024 The Kubernetes Authors.

neolit123 · 2024-05-16T12:34:26Z

pkg/cluster/internal/create/actions/installnetworkpolicies/networkpolicies.go

+	// get the target node for this task
+	controlPlanes, err := nodeutils.ControlPlaneNodes(allNodes)
+	if err != nil {
+		return err
+	}
+	node := controlPlanes[0] // kind expects at least one always


Suggested change

// get the target node for this task

controlPlanes, err := nodeutils.ControlPlaneNodes(allNodes)

if err != nil {

return err

}

node := controlPlanes[0] // kind expects at least one always

// get the target node for this task

node, err := nodeutils.BootstrapControlPlaneNode(allNodes)

if err != nil {

return err

}

neolit123 · 2024-05-16T12:39:49Z

pkg/apis/config/v1alpha4/types.go

@@ -186,6 +186,8 @@ type Networking struct {
 	// If DisableDefaultCNI is true, kind will not install the default CNI setup.
 	// Instead the user should install their own CNI after creating the cluster.
 	DisableDefaultCNI bool `yaml:"disableDefaultCNI,omitempty" json:"disableDefaultCNI,omitempty"`
+	// If NetworkPolicies is true, kind will install the default Network Policy setup.
+	NetworkPolicies bool `yaml:"networkPolicies,omitempty" json:"networkPolicies,omitempty"`


given this is a bool i would put a verb in front of it, same as DisasbleDefaultCNI above.
e.g. InstallNetworkPolicies

aojea · 2024-05-16T13:02:45Z

@neolit123 the alternative is to ship it with kindnet #3612 and no API required

neolit123 · 2024-05-16T13:11:36Z

@neolit123 the alternative is to ship it with kindnet #3612 and no API required

i think making it not part of kindnet seems better to me.
2c

BenTheElder · 2024-06-20T21:51:17Z

Making it part of kindnetd would make it easier for projects that are swapping out kindnet to exclude it, and for projects that aren't swapping out kindet ... I'm not sure why it would be a problem to include it in kindnet?

I think that's the simpler approach, and consistent with e.g. ip masquerade just being built in to kindnet.

In the future we may also look into if we can ship it in a single image / container by importing the controller or something like that (to share resources & patching better).

k8s-ci-robot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label May 14, 2024

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. approved Indicates a PR has been approved by an approver from all required OWNERS files. labels May 14, 2024

k8s-ci-robot requested a review from neolit123 May 14, 2024 11:20

k8s-ci-robot assigned BenTheElder May 14, 2024

k8s-ci-robot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label May 14, 2024

aojea force-pushed the network_policies branch from ad61b1e to 76de999 Compare May 14, 2024 11:22

aojea added 4 commits May 14, 2024 11:36

add APIs to enable network policies

c5709ff

embed kube-network-policy image and manifest on the node image

2b256c4

install network policies if enabled

4d7dac5

document network policy option

d3c7631

aojea force-pushed the network_policies branch from 76de999 to d3c7631 Compare May 14, 2024 11:40

This was referenced May 14, 2024

NetworkPolicy support #842

Closed

Kindnet network policies #3612

Merged

neolit123 reviewed May 16, 2024

View reviewed changes

aojea closed this Jun 24, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[RFC] Network policies #3611

[RFC] Network policies #3611

aojea commented May 14, 2024 •

edited

Loading

k8s-ci-robot commented May 14, 2024

aojea commented May 14, 2024

neolit123 May 16, 2024

neolit123 May 16, 2024

aojea May 16, 2024

neolit123 May 16, 2024

neolit123 May 16, 2024

neolit123 May 16, 2024

neolit123 May 16, 2024

aojea commented May 16, 2024

neolit123 commented May 16, 2024

BenTheElder commented Jun 20, 2024

	Copyright 2019 The Kubernetes Authors.
	Copyright 2024 The Kubernetes Authors.

[RFC] Network policies #3611

[RFC] Network policies #3611

Conversation

aojea commented May 14, 2024 • edited Loading

k8s-ci-robot commented May 14, 2024

aojea commented May 14, 2024

neolit123 May 16, 2024

Choose a reason for hiding this comment

neolit123 May 16, 2024

Choose a reason for hiding this comment

aojea May 16, 2024

Choose a reason for hiding this comment

neolit123 May 16, 2024

Choose a reason for hiding this comment

neolit123 May 16, 2024

Choose a reason for hiding this comment

neolit123 May 16, 2024

Choose a reason for hiding this comment

neolit123 May 16, 2024

Choose a reason for hiding this comment

aojea commented May 16, 2024

neolit123 commented May 16, 2024

BenTheElder commented Jun 20, 2024

aojea commented May 14, 2024 •

edited

Loading