Skip to content

Commit ee67a7d

Browse files
fasaxcfasaxc
committed
Clarify ICMP handling and improve action wording
Note that ICMP related packets (such as TOOBIG) are allowed when allowing the main protocol connection. Improve wording in various places.
1 parent 72895f2 commit ee67a7d

7 files changed

Lines changed: 78 additions & 61 deletions

File tree

‎apis/v1alpha2/clusternetworkpolicy_types.go‎

Lines changed: 24 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -188,11 +188,11 @@ type ClusterNetworkPolicyIngressRule struct {
188188
Name string `json:"name,omitempty"`
189189

190190
// Action specifies the effect this rule will have on matching
191-
// traffic. Currently the following actions are supported:
191+
// traffic. Currently, the following actions are supported:
192192
//
193-
// - Accept: Accepts the selected traffic, allowing it into
194-
// the destination. No further ClusterNetworkPolicy or
195-
// NetworkPolicy rules will be processed.
193+
// - Accept: Accepts the selected traffic, including replies to that
194+
// traffic and related ICMP traffic. No further ingress
195+
// ClusterNetworkPolicy or NetworkPolicy rules will be processed.
196196
//
197197
// Note: while Accept ensures traffic is accepted by
198198
// Kubernetes network policy, it is still possible that the
@@ -245,15 +245,15 @@ type ClusterNetworkPolicyEgressRule struct {
245245
Name string `json:"name,omitempty"`
246246

247247
// Action specifies the effect this rule will have on matching
248-
// traffic. Currently the following actions are supported:
248+
// traffic. Currently, the following actions are supported:
249249
//
250-
// - Accept: Accepts the selected traffic, allowing it to
251-
// egress. No further ClusterNetworkPolicy or NetworkPolicy
252-
// rules will be processed.
250+
// - Accept: Accepts the selected traffic, including replies to that
251+
// traffic and related ICMP traffic. No further egress
252+
// ClusterNetworkPolicy or NetworkPolicy rules will be processed
253+
// but any ingress rules at the destination do apply.
253254
//
254-
// - Deny: Drops the selected traffic. No further
255-
// ClusterNetworkPolicy or NetworkPolicy rules will be
256-
// processed.
255+
// - Deny: Drops the selected traffic. No further ClusterNetworkPolicy or
256+
// NetworkPolicy rules will be processed.
257257
//
258258
// - Pass: Skips all further ClusterNetworkPolicy rules in the
259259
// current tier for the selected traffic, and passes
@@ -288,20 +288,16 @@ type ClusterNetworkPolicyEgressRule struct {
288288
type ClusterNetworkPolicyRuleAction string
289289

290290
const (
291-
// ClusterNetworkPolicyRuleActionAccept indicates that
292-
// matching traffic will be accepted and no further policy
293-
// evaluation will be done. This is a final decision.
291+
// ClusterNetworkPolicyRuleActionAccept stops further rule processing of
292+
// this policy direction (Ingress/Egress) and accepts the traffic.
294293
ClusterNetworkPolicyRuleActionAccept ClusterNetworkPolicyRuleAction = "Accept"
295-
// ClusterNetworkPolicyRuleActionDeny indicates that matching traffic
296-
// will be denied and no further policy evaluation will be done.
297-
// This is a final decision.
294+
// ClusterNetworkPolicyRuleActionDeny stops further rule processing and
295+
// drops the traffic.
298296
ClusterNetworkPolicyRuleActionDeny ClusterNetworkPolicyRuleAction = "Deny"
299-
// ClusterNetworkPolicyRuleActionPass indicates that matching traffic
300-
// will jump to the next tier evaluation. That means that all the rules
301-
// with lower precedence at the same tier will be ignored,
302-
// but evaluation will continue at the next tier.
303-
// For example, if an Admin tier CNP uses Pass action,
304-
// NetworkPolicy evaluation will happen next.
297+
// ClusterNetworkPolicyRuleActionPass skips rules with lower precedence in
298+
// the current tier and continues processing in the next tier. For example,
299+
// if an Admin tier CNP uses Pass action, NetworkPolicy evaluation will
300+
// happen next.
305301
ClusterNetworkPolicyRuleActionPass ClusterNetworkPolicyRuleAction = "Pass"
306302
)
307303

@@ -380,6 +376,11 @@ type ClusterNetworkPolicyEgressPeer struct {
380376
// or deny all IPv4 pod-to-pod traffic as well. If you don't want that,
381377
// add a rule that Passes all pod traffic before the Networks rule.
382378
//
379+
// Networks matches both regular IP traffic and ICMP traffic to/from
380+
// the specified CIDRs. For example, a Networks entry of "0.0.0.0/0"
381+
// will match both IPv4 and ICMP traffic, while "::/0" will match
382+
// both IPv6 and ICMPv6 traffic.
383+
//
383384
// Each item in Networks should be provided in the CIDR format and should be
384385
// IPv4 or IPv6, for example "10.0.0.0/8" or "fd00::/8".
385386
//

‎config/crd/experimental/policy.networking.k8s.io_clusternetworkpolicies.yaml‎

Lines changed: 16 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -75,15 +75,15 @@ spec:
7575
action:
7676
description: |-
7777
Action specifies the effect this rule will have on matching
78-
traffic. Currently the following actions are supported:
78+
traffic. Currently, the following actions are supported:
7979
80-
- Accept: Accepts the selected traffic, allowing it to
81-
egress. No further ClusterNetworkPolicy or NetworkPolicy
82-
rules will be processed.
80+
- Accept: Accepts the selected traffic, including replies to that
81+
traffic and related ICMP traffic. No further egress
82+
ClusterNetworkPolicy or NetworkPolicy rules will be processed
83+
but any ingress rules at the destination do apply.
8384
84-
- Deny: Drops the selected traffic. No further
85-
ClusterNetworkPolicy or NetworkPolicy rules will be
86-
processed.
85+
- Deny: Drops the selected traffic. No further ClusterNetworkPolicy or
86+
NetworkPolicy rules will be processed.
8787
8888
- Pass: Skips all further ClusterNetworkPolicy rules in the
8989
current tier for the selected traffic, and passes
@@ -373,6 +373,11 @@ spec:
373373
or deny all IPv4 pod-to-pod traffic as well. If you don't want that,
374374
add a rule that Passes all pod traffic before the Networks rule.
375375
376+
Networks matches both regular IP traffic and ICMP traffic to/from
377+
the specified CIDRs. For example, a Networks entry of "0.0.0.0/0"
378+
will match both IPv4 and ICMP traffic, while "::/0" will match
379+
both IPv6 and ICMPv6 traffic.
380+
376381
Each item in Networks should be provided in the CIDR format and should be
377382
IPv4 or IPv6, for example "10.0.0.0/8" or "fd00::/8".
378383
@@ -588,11 +593,11 @@ spec:
588593
action:
589594
description: |-
590595
Action specifies the effect this rule will have on matching
591-
traffic. Currently the following actions are supported:
596+
traffic. Currently, the following actions are supported:
592597
593-
- Accept: Accepts the selected traffic, allowing it into
594-
the destination. No further ClusterNetworkPolicy or
595-
NetworkPolicy rules will be processed.
598+
- Accept: Accepts the selected traffic, including replies to that
599+
traffic and related ICMP traffic. No further ingress
600+
ClusterNetworkPolicy or NetworkPolicy rules will be processed.
596601
597602
Note: while Accept ensures traffic is accepted by
598603
Kubernetes network policy, it is still possible that the

‎config/crd/standard/policy.networking.k8s.io_clusternetworkpolicies.yaml‎

Lines changed: 16 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -75,15 +75,15 @@ spec:
7575
action:
7676
description: |-
7777
Action specifies the effect this rule will have on matching
78-
traffic. Currently the following actions are supported:
78+
traffic. Currently, the following actions are supported:
7979
80-
- Accept: Accepts the selected traffic, allowing it to
81-
egress. No further ClusterNetworkPolicy or NetworkPolicy
82-
rules will be processed.
80+
- Accept: Accepts the selected traffic, including replies to that
81+
traffic and related ICMP traffic. No further egress
82+
ClusterNetworkPolicy or NetworkPolicy rules will be processed
83+
but any ingress rules at the destination do apply.
8384
84-
- Deny: Drops the selected traffic. No further
85-
ClusterNetworkPolicy or NetworkPolicy rules will be
86-
processed.
85+
- Deny: Drops the selected traffic. No further ClusterNetworkPolicy or
86+
NetworkPolicy rules will be processed.
8787
8888
- Pass: Skips all further ClusterNetworkPolicy rules in the
8989
current tier for the selected traffic, and passes
@@ -335,6 +335,11 @@ spec:
335335
or deny all IPv4 pod-to-pod traffic as well. If you don't want that,
336336
add a rule that Passes all pod traffic before the Networks rule.
337337
338+
Networks matches both regular IP traffic and ICMP traffic to/from
339+
the specified CIDRs. For example, a Networks entry of "0.0.0.0/0"
340+
will match both IPv4 and ICMP traffic, while "::/0" will match
341+
both IPv6 and ICMPv6 traffic.
342+
338343
Each item in Networks should be provided in the CIDR format and should be
339344
IPv4 or IPv6, for example "10.0.0.0/8" or "fd00::/8".
340345
@@ -490,11 +495,11 @@ spec:
490495
action:
491496
description: |-
492497
Action specifies the effect this rule will have on matching
493-
traffic. Currently the following actions are supported:
498+
traffic. Currently, the following actions are supported:
494499
495-
- Accept: Accepts the selected traffic, allowing it into
496-
the destination. No further ClusterNetworkPolicy or
497-
NetworkPolicy rules will be processed.
500+
- Accept: Accepts the selected traffic, including replies to that
501+
traffic and related ICMP traffic. No further ingress
502+
ClusterNetworkPolicy or NetworkPolicy rules will be processed.
498503
499504
Note: while Accept ensures traffic is accepted by
500505
Kubernetes network policy, it is still possible that the

‎pkg/client/applyconfiguration/apis/v1alpha2/clusternetworkpolicyegresspeer.go‎

Lines changed: 5 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎pkg/client/applyconfiguration/apis/v1alpha2/clusternetworkpolicyegressrule.go‎

Lines changed: 7 additions & 7 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎pkg/client/applyconfiguration/apis/v1alpha2/clusternetworkpolicyingressrule.go‎

Lines changed: 4 additions & 4 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎site-src/api-overview.md‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -78,9 +78,10 @@ traffic, ClusterNetworkPolicy will enable administrators to set `Pass`,
7878
be read as-is, i.e. there will not be any implicit isolation effects for the Pods
7979
selected by the ClusterNetworkPolicy, as opposed to implicit deny NetworkPolicy rules imply.
8080

81-
- **Accept**: Accepts the selected traffic, allowing it into
82-
the destination. No further ClusterNetworkPolicy or
83-
NetworkPolicy rules will be processed.
81+
- **Accept**: Accepts the selected traffic, including replies to that
82+
traffic and related ICMP traffic (e.g. ICMP errors such as
83+
"destination unreachable" or "packet too big"). No further
84+
ClusterNetworkPolicy or NetworkPolicy rules will be processed.
8485

8586
- **Deny**: Drops the selected traffic. No further
8687
ClusterNetworkPolicy or NetworkPolicy rules will be
@@ -119,8 +120,8 @@ before policies with higher priority values in the same tier.
119120
### Rules
120121

121122
Each CNP should define at least one `Ingress` or `Egress` relevant in-cluster traffic flow
122-
along with the associated Action that should occur. In each `gress` rule the user
123-
should AT THE MINIMUM define an `Action`, and at least one `ClusterNetworkPolicyPeer`.
123+
along with the associated Action that should occur. In each rule the user
124+
should *at a minimum* define an `Action`, and at least one peer (`To` or `From` entry).
124125
Optionally the user may also define select `Protocols` to filter traffic on and also
125126
a name for each rule to make management and reporting easier for Admins.
126127

0 commit comments

Comments
 (0)