Flannel network policies #12590
Draft
Flannel network policies #12590
+524
−92
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…twork policies with flannel Small changes before adding the feature Signed-off-by: Sébastien Masset <[email protected]>
Add boolean in cluster flannel CNI config to deploy extra resources to handle network policies. Inspired by flannel Helm chart handling of netpol.enabled value (cf. https://github.com/flannel-io/flannel/blob/master/Documentation/netpol.md) Signed-off-by: Sébastien Masset <[email protected]>
smasset-orange
force-pushed
the
feat/flannel-network-policies
branch
from
de629f6 to
fe2b3d8
Compare
Member
|
Thank you, this looks really interesting, couple of thoughts (not something that I would force on this PR, but some thoughts in general):
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Pull Request
What? (description)
Although not enabled by default, Flannel Helm chart enables NetworkPolicy support by setting the
netpol.enabledvalue (see documentation).This PR, adds an extra
kubeNetworkPoliciesEnabledfield inFlannelCNIConfigto mimic that.Why? (reasoning)
Even if it is not enabled by default, it should be possible to automatically deploy a cluster with the default CNI with support for NetworkPolicy.
Fixes #11707 without enabling NetworkPolicy by default and without adding CNI plugins in the default Talos image and only with customizing existing manifests depending on configuration.
Acceptance
Please use the following checklist:
make conformance)make fmt)make lint)make docs)make unit-tests)