Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update documents to replace AntreaProxy with Antrea Proxy #6515

Merged
merged 1 commit into from
Jul 18, 2024
Merged

Update documents to replace AntreaProxy with Antrea Proxy #6515

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion build/charts/antrea-windows/conf/antrea-agent.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -119,7 +119,7 @@ antreaProxy:
# To disable AntreaProxy, set this to false. It should be enabled on Windows, otherwise NetworkPolicy will
# not take effect on Service traffic.
enable: true
# ProxyAll tells antrea-agent to proxy ClusterIP Service traffic, regardless of where they come from.
# proxyAll tells antrea-agent to proxy ClusterIP Service traffic, regardless of where they come from.
# Therefore, running kube-proxy is no longer required. This requires the AntreaProxy feature to be enabled.
# Note that this option is experimental. If kube-proxy is removed, option kubeAPIServerOverride must be used to access
# apiserver directly.
Expand Down
4 changes: 2 additions & 2 deletions build/charts/antrea/conf/antrea-agent.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -342,7 +342,7 @@ antreaProxy:
{{- with .Values.antreaProxy }}
# To disable AntreaProxy, set this to false.
enable: {{.enable}}
# ProxyAll tells antrea-agent to proxy all Service traffic, including NodePort, LoadBalancer, and ClusterIP traffic,
# proxyAll tells antrea-agent to proxy all Service traffic, including NodePort, LoadBalancer, and ClusterIP traffic,
# regardless of where they come from. Therefore, running kube-proxy is no longer required.
# Note that this option is experimental. If kube-proxy is removed, option kubeAPIServerOverride must be used to access
# apiserver directly.
Expand All @@ -365,7 +365,7 @@ antreaProxy:
# External IPs of LoadBalancer Services. This is useful when the external LoadBalancer provides additional
# capabilities (e.g. TLS termination) and it is desirable for Pod-to-ExternalIP traffic to be sent to the
# external LoadBalancer instead of being load-balanced to an Endpoint directly by AntreaProxy.
# Note that setting ProxyLoadBalancerIPs to false usually only makes sense when ProxyAll is set to true and
# Note that setting ProxyLoadBalancerIPs to false usually only makes sense when proxyAll is set to true and
# kube-proxy is removed from the cluster, otherwise kube-proxy will still load-balance this traffic.
proxyLoadBalancerIPs: {{ .proxyLoadBalancerIPs }}
# The value of the "service.kubernetes.io/service-proxy-name" label for AntreaProxy to match. If it is set,
Expand Down
8 changes: 4 additions & 4 deletions build/yamls/antrea-aks.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4038,7 +4038,7 @@ data:
antreaProxy:
# To disable AntreaProxy, set this to false.
enable: true
# ProxyAll tells antrea-agent to proxy all Service traffic, including NodePort, LoadBalancer, and ClusterIP traffic,
# proxyAll tells antrea-agent to proxy all Service traffic, including NodePort, LoadBalancer, and ClusterIP traffic,
# regardless of where they come from. Therefore, running kube-proxy is no longer required.
# Note that this option is experimental. If kube-proxy is removed, option kubeAPIServerOverride must be used to access
# apiserver directly.
Expand All @@ -4055,7 +4055,7 @@ data:
# External IPs of LoadBalancer Services. This is useful when the external LoadBalancer provides additional
# capabilities (e.g. TLS termination) and it is desirable for Pod-to-ExternalIP traffic to be sent to the
# external LoadBalancer instead of being load-balanced to an Endpoint directly by AntreaProxy.
# Note that setting ProxyLoadBalancerIPs to false usually only makes sense when ProxyAll is set to true and
# Note that setting ProxyLoadBalancerIPs to false usually only makes sense when proxyAll is set to true and
# kube-proxy is removed from the cluster, otherwise kube-proxy will still load-balance this traffic.
proxyLoadBalancerIPs: true
# The value of the "service.kubernetes.io/service-proxy-name" label for AntreaProxy to match. If it is set,
Expand Down Expand Up @@ -5110,7 +5110,7 @@ spec:
kubectl.kubernetes.io/default-container: antrea-agent
# Automatically restart Pods with a RollingUpdate if the ConfigMap changes
# See https://helm.sh/docs/howto/charts_tips_and_tricks/#automatically-roll-deployments
checksum/config: f976029accf54258d01ad907fe19b50ac671eee014cd8aea968c6a0bc7e8f95a
checksum/config: 71bf05ff579aa9bea7b360669c5e2ce2830ca88dc4ab54480638ce006eaeaf11
labels:
app: antrea
component: antrea-agent
Expand Down Expand Up @@ -5348,7 +5348,7 @@ spec:
annotations:
# Automatically restart Pod if the ConfigMap changes
# See https://helm.sh/docs/howto/charts_tips_and_tricks/#automatically-roll-deployments
checksum/config: f976029accf54258d01ad907fe19b50ac671eee014cd8aea968c6a0bc7e8f95a
checksum/config: 71bf05ff579aa9bea7b360669c5e2ce2830ca88dc4ab54480638ce006eaeaf11
labels:
app: antrea
component: antrea-controller
Expand Down
8 changes: 4 additions & 4 deletions build/yamls/antrea-eks.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4038,7 +4038,7 @@ data:
antreaProxy:
# To disable AntreaProxy, set this to false.
enable: true
# ProxyAll tells antrea-agent to proxy all Service traffic, including NodePort, LoadBalancer, and ClusterIP traffic,
# proxyAll tells antrea-agent to proxy all Service traffic, including NodePort, LoadBalancer, and ClusterIP traffic,
# regardless of where they come from. Therefore, running kube-proxy is no longer required.
# Note that this option is experimental. If kube-proxy is removed, option kubeAPIServerOverride must be used to access
# apiserver directly.
Expand All @@ -4055,7 +4055,7 @@ data:
# External IPs of LoadBalancer Services. This is useful when the external LoadBalancer provides additional
# capabilities (e.g. TLS termination) and it is desirable for Pod-to-ExternalIP traffic to be sent to the
# external LoadBalancer instead of being load-balanced to an Endpoint directly by AntreaProxy.
# Note that setting ProxyLoadBalancerIPs to false usually only makes sense when ProxyAll is set to true and
# Note that setting ProxyLoadBalancerIPs to false usually only makes sense when proxyAll is set to true and
# kube-proxy is removed from the cluster, otherwise kube-proxy will still load-balance this traffic.
proxyLoadBalancerIPs: true
# The value of the "service.kubernetes.io/service-proxy-name" label for AntreaProxy to match. If it is set,
Expand Down Expand Up @@ -5110,7 +5110,7 @@ spec:
kubectl.kubernetes.io/default-container: antrea-agent
# Automatically restart Pods with a RollingUpdate if the ConfigMap changes
# See https://helm.sh/docs/howto/charts_tips_and_tricks/#automatically-roll-deployments
checksum/config: f976029accf54258d01ad907fe19b50ac671eee014cd8aea968c6a0bc7e8f95a
checksum/config: 71bf05ff579aa9bea7b360669c5e2ce2830ca88dc4ab54480638ce006eaeaf11
labels:
app: antrea
component: antrea-agent
Expand Down Expand Up @@ -5349,7 +5349,7 @@ spec:
annotations:
# Automatically restart Pod if the ConfigMap changes
# See https://helm.sh/docs/howto/charts_tips_and_tricks/#automatically-roll-deployments
checksum/config: f976029accf54258d01ad907fe19b50ac671eee014cd8aea968c6a0bc7e8f95a
checksum/config: 71bf05ff579aa9bea7b360669c5e2ce2830ca88dc4ab54480638ce006eaeaf11
labels:
app: antrea
component: antrea-controller
Expand Down
8 changes: 4 additions & 4 deletions build/yamls/antrea-gke.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4038,7 +4038,7 @@ data:
antreaProxy:
# To disable AntreaProxy, set this to false.
enable: true
# ProxyAll tells antrea-agent to proxy all Service traffic, including NodePort, LoadBalancer, and ClusterIP traffic,
# proxyAll tells antrea-agent to proxy all Service traffic, including NodePort, LoadBalancer, and ClusterIP traffic,
# regardless of where they come from. Therefore, running kube-proxy is no longer required.
# Note that this option is experimental. If kube-proxy is removed, option kubeAPIServerOverride must be used to access
# apiserver directly.
Expand All @@ -4055,7 +4055,7 @@ data:
# External IPs of LoadBalancer Services. This is useful when the external LoadBalancer provides additional
# capabilities (e.g. TLS termination) and it is desirable for Pod-to-ExternalIP traffic to be sent to the
# external LoadBalancer instead of being load-balanced to an Endpoint directly by AntreaProxy.
# Note that setting ProxyLoadBalancerIPs to false usually only makes sense when ProxyAll is set to true and
# Note that setting ProxyLoadBalancerIPs to false usually only makes sense when proxyAll is set to true and
# kube-proxy is removed from the cluster, otherwise kube-proxy will still load-balance this traffic.
proxyLoadBalancerIPs: true
# The value of the "service.kubernetes.io/service-proxy-name" label for AntreaProxy to match. If it is set,
Expand Down Expand Up @@ -5110,7 +5110,7 @@ spec:
kubectl.kubernetes.io/default-container: antrea-agent
# Automatically restart Pods with a RollingUpdate if the ConfigMap changes
# See https://helm.sh/docs/howto/charts_tips_and_tricks/#automatically-roll-deployments
checksum/config: 5299e6235e262daf606758cf900766470fcb8dd21a0d707a3ae284548bd8c2b2
checksum/config: 91ff2b609519e4aaead6ab850252a49bbe674dec17f6f239c4d0fa6c7b5705f6
labels:
app: antrea
component: antrea-agent
Expand Down Expand Up @@ -5346,7 +5346,7 @@ spec:
annotations:
# Automatically restart Pod if the ConfigMap changes
# See https://helm.sh/docs/howto/charts_tips_and_tricks/#automatically-roll-deployments
checksum/config: 5299e6235e262daf606758cf900766470fcb8dd21a0d707a3ae284548bd8c2b2
checksum/config: 91ff2b609519e4aaead6ab850252a49bbe674dec17f6f239c4d0fa6c7b5705f6
labels:
app: antrea
component: antrea-controller
Expand Down
8 changes: 4 additions & 4 deletions build/yamls/antrea-ipsec.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4051,7 +4051,7 @@ data:
antreaProxy:
# To disable AntreaProxy, set this to false.
enable: true
# ProxyAll tells antrea-agent to proxy all Service traffic, including NodePort, LoadBalancer, and ClusterIP traffic,
# proxyAll tells antrea-agent to proxy all Service traffic, including NodePort, LoadBalancer, and ClusterIP traffic,
# regardless of where they come from. Therefore, running kube-proxy is no longer required.
# Note that this option is experimental. If kube-proxy is removed, option kubeAPIServerOverride must be used to access
# apiserver directly.
Expand All @@ -4068,7 +4068,7 @@ data:
# External IPs of LoadBalancer Services. This is useful when the external LoadBalancer provides additional
# capabilities (e.g. TLS termination) and it is desirable for Pod-to-ExternalIP traffic to be sent to the
# external LoadBalancer instead of being load-balanced to an Endpoint directly by AntreaProxy.
# Note that setting ProxyLoadBalancerIPs to false usually only makes sense when ProxyAll is set to true and
# Note that setting ProxyLoadBalancerIPs to false usually only makes sense when proxyAll is set to true and
# kube-proxy is removed from the cluster, otherwise kube-proxy will still load-balance this traffic.
proxyLoadBalancerIPs: true
# The value of the "service.kubernetes.io/service-proxy-name" label for AntreaProxy to match. If it is set,
Expand Down Expand Up @@ -5123,7 +5123,7 @@ spec:
kubectl.kubernetes.io/default-container: antrea-agent
# Automatically restart Pods with a RollingUpdate if the ConfigMap changes
# See https://helm.sh/docs/howto/charts_tips_and_tricks/#automatically-roll-deployments
checksum/config: ba93df141f512a1f8483114b5994444c7231b298e7e9133483ddc1f4210ec395
checksum/config: 2d75956786eb552eaba94f89dfa5c6bab570bf662b82449e9af31a57ca138750
checksum/ipsec-secret: d0eb9c52d0cd4311b6d252a951126bf9bea27ec05590bed8a394f0f792dcb2a4
labels:
app: antrea
Expand Down Expand Up @@ -5405,7 +5405,7 @@ spec:
annotations:
# Automatically restart Pod if the ConfigMap changes
# See https://helm.sh/docs/howto/charts_tips_and_tricks/#automatically-roll-deployments
checksum/config: ba93df141f512a1f8483114b5994444c7231b298e7e9133483ddc1f4210ec395
checksum/config: 2d75956786eb552eaba94f89dfa5c6bab570bf662b82449e9af31a57ca138750
labels:
app: antrea
component: antrea-controller
Expand Down
4 changes: 2 additions & 2 deletions build/yamls/antrea-windows-with-ovs.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -246,7 +246,7 @@ data:
# To disable AntreaProxy, set this to false. It should be enabled on Windows, otherwise NetworkPolicy will
# not take effect on Service traffic.
enable: true
# ProxyAll tells antrea-agent to proxy ClusterIP Service traffic, regardless of where they come from.
# proxyAll tells antrea-agent to proxy ClusterIP Service traffic, regardless of where they come from.
# Therefore, running kube-proxy is no longer required. This requires the AntreaProxy feature to be enabled.
# Note that this option is experimental. If kube-proxy is removed, option kubeAPIServerOverride must be used to access
# apiserver directly.
Expand Down Expand Up @@ -306,7 +306,7 @@ spec:
metadata:
annotations:
checksum/agent-windows: 86f999cb18501659a52d982f20b3df5cdf666ffd849f50ed183c366e75d01ac5
checksum/windows-config: 10ad2be0a04b1752abc224fed0124f7b1da36efc5e7323e193eb38e11b25e798
checksum/windows-config: 4f07164f32afc61e20b4aef984a8781142e5d99f7c58f7581e4ccfeabb34855f
microsoft.com/hostprocess-inherit-user: "true"
labels:
app: antrea
Expand Down
4 changes: 2 additions & 2 deletions build/yamls/antrea-windows.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -174,7 +174,7 @@ data:
# To disable AntreaProxy, set this to false. It should be enabled on Windows, otherwise NetworkPolicy will
# not take effect on Service traffic.
enable: true
# ProxyAll tells antrea-agent to proxy ClusterIP Service traffic, regardless of where they come from.
# proxyAll tells antrea-agent to proxy ClusterIP Service traffic, regardless of where they come from.
# Therefore, running kube-proxy is no longer required. This requires the AntreaProxy feature to be enabled.
# Note that this option is experimental. If kube-proxy is removed, option kubeAPIServerOverride must be used to access
# apiserver directly.
Expand Down Expand Up @@ -234,7 +234,7 @@ spec:
metadata:
annotations:
checksum/agent-windows: 63f16e1fadb6b1354efda21c73702b4290400181136d4d47d4b1cd6a5f82d037
checksum/windows-config: 10ad2be0a04b1752abc224fed0124f7b1da36efc5e7323e193eb38e11b25e798
checksum/windows-config: 4f07164f32afc61e20b4aef984a8781142e5d99f7c58f7581e4ccfeabb34855f
microsoft.com/hostprocess-inherit-user: "true"
labels:
app: antrea
Expand Down
8 changes: 4 additions & 4 deletions build/yamls/antrea.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4038,7 +4038,7 @@ data:
antreaProxy:
# To disable AntreaProxy, set this to false.
enable: true
# ProxyAll tells antrea-agent to proxy all Service traffic, including NodePort, LoadBalancer, and ClusterIP traffic,
hongliangl marked this conversation as resolved.
Show resolved Hide resolved
# proxyAll tells antrea-agent to proxy all Service traffic, including NodePort, LoadBalancer, and ClusterIP traffic,
# regardless of where they come from. Therefore, running kube-proxy is no longer required.
# Note that this option is experimental. If kube-proxy is removed, option kubeAPIServerOverride must be used to access
# apiserver directly.
Expand All @@ -4055,7 +4055,7 @@ data:
# External IPs of LoadBalancer Services. This is useful when the external LoadBalancer provides additional
# capabilities (e.g. TLS termination) and it is desirable for Pod-to-ExternalIP traffic to be sent to the
# external LoadBalancer instead of being load-balanced to an Endpoint directly by AntreaProxy.
# Note that setting ProxyLoadBalancerIPs to false usually only makes sense when ProxyAll is set to true and
# Note that setting ProxyLoadBalancerIPs to false usually only makes sense when proxyAll is set to true and
# kube-proxy is removed from the cluster, otherwise kube-proxy will still load-balance this traffic.
proxyLoadBalancerIPs: true
# The value of the "service.kubernetes.io/service-proxy-name" label for AntreaProxy to match. If it is set,
Expand Down Expand Up @@ -5110,7 +5110,7 @@ spec:
kubectl.kubernetes.io/default-container: antrea-agent
# Automatically restart Pods with a RollingUpdate if the ConfigMap changes
# See https://helm.sh/docs/howto/charts_tips_and_tricks/#automatically-roll-deployments
checksum/config: aca23e21519e0fc112647f23d3ce6f92a3dea0bc7ebf1c6d7a7eed2dbe80f0a3
checksum/config: ebc0be79b0fc65db51609f5c9185ca8a0533e265811d14c687f577cf93497a58
labels:
app: antrea
component: antrea-agent
Expand Down Expand Up @@ -5346,7 +5346,7 @@ spec:
annotations:
# Automatically restart Pod if the ConfigMap changes
# See https://helm.sh/docs/howto/charts_tips_and_tricks/#automatically-roll-deployments
checksum/config: aca23e21519e0fc112647f23d3ce6f92a3dea0bc7ebf1c6d7a7eed2dbe80f0a3
checksum/config: ebc0be79b0fc65db51609f5c9185ca8a0533e265811d14c687f577cf93497a58
labels:
app: antrea
component: antrea-controller
Expand Down
4 changes: 2 additions & 2 deletions docs/antrea-ipam.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -278,8 +278,8 @@ where the underlay router will route the traffic to the destination VLAN.
### Requirements for this Feature

As of now, this feature is supported on Linux Nodes, with IPv4, `system` OVS datapath
type, `noEncap`, `noSNAT` traffic mode, and `AntreaProxy` feature enabled. Configuration
with `ProxyAll` feature enabled is not verified.
type, `noEncap`, `noSNAT` traffic mode, and Antrea Proxy enabled. Configuration
with `proxyAll` enabled is not verified.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Worthy to check all ProxyAll and update ProxyAll to proxyAll if necessary.
I can see there are inconsistent in some docs.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Will check.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I found that every ProxyAll (Without quotting) is at the beginning of sentences. I don't think we need to update them.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Only when it refers to the proxyAll field in the YAML, we should we use proxyAll.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Only when it refers to the proxyAll field in the YAML, we should we use proxyAll.

I may not get what you mean. Do you mean that we should use proxyAll in the YAML comments, even if the word is at the beginning of sentences?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

'proxyAllhere should refer to theproxyAllfield inantrea-agent.confright? In this case, we should useproxyAllas Lan suggested, notProxyAll, as the field is named proxyAll`. It does not matter whether it begins a sentence or not.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, got that. If so, how about this: Option proxyAll?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think the current version here "Configuration
with proxyAll enabled is not verified" is fine.

Copy link
Contributor Author

@hongliangl hongliangl Jul 11, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, got that. If so, how about this: Option proxyAll?

I meant that how about changing the ProxyAll tells antrea-agent ..... at the beginning of sentences in YAML files to Option proxyAll tells antrea-agent.

I think the current version here "Configuration
with proxyAll enabled is not verified" is fine.

I didn't change this one where proxyAll is not at the beginning of sentences. @jianjuns

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

OK. I think we can say "proxyAll tells..."


The IPs in the `IPPools` without VLAN must be in the same underlay subnet as the Node
IP, because inter-Node traffic of AntreaIPAM Pods is forwarded by the Node network.
Expand Down
10 changes: 5 additions & 5 deletions docs/antrea-network-policy.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1490,7 +1490,7 @@ Kubernetes](https://kubernetes.io/docs/concepts/services-networking/dns-pod-serv
Services. The reason is that Antrea will use the information included in A or
AAAA DNS records to implement FQDN based policies. In the case of "normal" (not
headless) Services, the DNS name resolves to the ClusterIP for the Service, but
policy rules are enforced after AntreaProxy Service Load-Balancing and at that
policy rules are enforced after Antrea Proxy Service Load-Balancing and at that
stage the destination IP address has already been rewritten to the address of an
endpoint backing the Service. For headless Services, a ClusterIP is not
allocated and, assuming the Service has a selector, the DNS server returns A /
Expand Down Expand Up @@ -1571,8 +1571,8 @@ A combination of Service name and Service Namespace can be used in `toServices`
by this field. A sample policy can be found [here](#acnp-for-toservices-rule).

Since `toServices` represents a combination of IP+port, it cannot be used with `to` or `ports` within the same egress rule.
Also, since the matching process relies on the groupID assigned to Service by AntreaProxy, this field can only be used when
AntreaProxy is enabled.
Also, since the matching process relies on the groupID assigned to Service by Antrea Proxy, this field can only be used when
Antrea Proxy is enabled.

This clusterIP-based match has one caveat: direct access to the Endpoints of this Service is not affected by
`toServices` rules. To restrict access towards backend Endpoints of a Service, define a `ClusterGroup` with `ServiceReference`
Expand Down Expand Up @@ -1952,11 +1952,11 @@ Similar RBAC is applied to the ClusterGroup resource.
won't be blocked by new rules.
- For hairpin Service traffic, when a Pod initiates traffic towards the Service it
provides, and the same Pod is selected as the Endpoint, NetworkPolicies will
consistently permit this traffic during ingress enforcement if AntreaProxy is enabled,
consistently permit this traffic during ingress enforcement if Antrea Proxy is enabled,
irrespective of the ingress rules defined by the user. In the presence of ingress rules
preventing access to the Service from Pods providing the Service, accessing the Service
from one of these Pods will succeed if traffic is hairpinned back to the source Pod, and
will fail if a different Endpoint is selected by AntreaProxy. However, when AntreaProxy
will fail if a different Endpoint is selected by Antrea Proxy. However, when Antrea Proxy
is disabled, NetworkPolicies may not function as expected for hairpin Service traffic.
This is due to kube-proxy performing SNAT, which conceals the original source IP from
Antrea. Consequently, NetworkPolicies are unable to differentiate between hairpin
Expand Down
Loading
Loading