[Documentation] Flannel supports network policies but the README doesn't say it

[zwindler]

I've been made aware that it's been some time now that Flannel supports netpols through the official implementation of the Kubernetes project.

This is described in https://github.com/flannel-io/flannel/blob/master/Documentation/netpol.md

But the README doesn't advertises this.

Also, even though it's technically accurate (flannel is focused on network, true), the following sentence in the README led me to believe that flannel doesn't support netpols while in fact it does (through the official implem of external manifests, but can be enabled easily with just an option)

Flannel is focused on networking. For network policy, other projects such as Calico can be used.

I'm sure that I'm not the only one that was convinced that flannel doesn't support netpols without the use of an additional CNI plugin, and maybe a small note or clarification in the README could help.

If need be, I can provide suggestions or even a PR.

[brandond]

This doesn't mean flannel itself supports netpol, it just means you can deploy a netpol controller alongside flannel using the flannel chart. K3s has done this for years with flannel for CNI and kube-router for netpol. Canal is flannel for CNI and calico for policy and predates k3s.

Running flannel alongside a netpol controller does not mean that it supports netpol. It remains completely unaware of policies. You can park your car in a hangar next to an airplane, but that doesn't mean it can fly.

[zwindler]

Yes I'm aware of that.

What I'm suggesting is to add that there are ways to add netpol capability when using flannel in the README.

While it is obvious for you, I have met a lot of Kubernetes users who don't know about CNI chaining nor the fact that flannel now has a netpol.enabled bool in the helm chart

[pgonin]

Let's take on your suggestion to improve the documentation. Interested in your proposition @zwindler

[zwindler]

Suggestion: this sentence

Flannel is focused on networking. For network policy, other projects such as Calico can be used.

Could be rephrased like this

---

Flannel is focused on networking. While the flanneld binary does not natively enforce Network Policies, the Flannel project provides integrated mechanisms to add policy support to your cluster.

Network Policy

For users requiring Network Policy enforcement, there are several options:

• Integrated Controller: The Flannel Helm chart includes a netpol.enabled option. This deploys the official Kubernetes SIGs network policy controller alongside Flannel.
• Third-Party Controllers: Flannel can be used as the CNI fabric while delegating policy to other projects like Calico or via CNI chaining with Cilium.

For more details on configuration, see Documentation/netpol.md.

---

Side note:

• we could also talk about kube-router (solution chosen by k3s if I'm not mistaken)
• I've voluntarily left out the "canal" name because the historical github project is archived https://github.com/projectcalico/canal and that the link provided in their readme is dead (so I don't want to confuse users by pointing them to canal, they'll end up in the wrong page). Instead I put Calico with the correct link to the documentation