diff --git a/content/docs/main/docs/antrea-network-policy.md b/content/docs/main/docs/antrea-network-policy.md index af036c7e..3c7de27a 100644 --- a/content/docs/main/docs/antrea-network-policy.md +++ b/content/docs/main/docs/antrea-network-policy.md @@ -1366,6 +1366,13 @@ Antrea will only program datapath rules for actual egress traffic towards these on DNS results. It will not interfere with DNS packets, unless there is a separate policy dropping/rejecting communication between the DNS components and the Pods selected. +Antrea respects the TTL of DNS records, expiring stale IPs that are absent in more recent +records according to their TTL. Therefore, Pods employing FQDN based policies ought to refrain +from caching a DNS record for a duration exceeding its TTL. Otherwise, FQDN based policies may +intermittently fail to function as intended. Typically, the Java virtual machine (JVM) caches +DNS records for a fixed period of time, controlled by `networkaddress.cache.ttl`. In this +case, it’s crucial to set the JVM’s TTL to 0 so that FQDN based policies can work properly. + Note that FQDN based policies do not work for [Service DNS names created by Kubernetes](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#services) (e.g. `kubernetes.default.svc` or `antrea.kube-system.svc`), except for headless diff --git a/content/docs/main/docs/api-reference.html b/content/docs/main/docs/api-reference.html index 0eff700d..ca179c53 100644 --- a/content/docs/main/docs/api-reference.html +++ b/content/docs/main/docs/api-reference.html @@ -2787,168 +2787,10 @@

TLSProtocol

crd.antrea.io/v1alpha1

Resource Types: -

ClusterNetworkPolicy -

-

-

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
FieldDescription
-apiVersion
-string		 - -crd.antrea.io/v1alpha1 - -
-kind
-string -		ClusterNetworkPolicy
-metadata
- - -Kubernetes meta/v1.ObjectMeta - - -		 -

Standard metadata of the object.

-Refer to the Kubernetes API documentation for the fields of the -metadata field. -
-spec
- - -ClusterNetworkPolicySpec - - -		 -

Specification of the desired behavior of ClusterNetworkPolicy.

-
-
- - - - - - - - - - - - - - - - - - - - - -
-tier
- -string - -		 -

Tier specifies the tier to which this ClusterNetworkPolicy belongs to. -The ClusterNetworkPolicy order will be determined based on the -combination of the Tier’s Priority and the ClusterNetworkPolicy’s own -Priority. If not specified, this policy will be created in the Application -Tier right above the K8s NetworkPolicy which resides at the bottom.

-
-priority
- -float64 - -		 -

Priority specfies the order of the ClusterNetworkPolicy relative to -other AntreaClusterNetworkPolicies.

-
-appliedTo
- - -[]AppliedTo - - -		 -(Optional) -

Select workloads on which the rules will be applied to. Cannot be set in -conjunction with AppliedTo in each rule.

-
-ingress
- - -[]Rule - - -		 -(Optional) -

Set of ingress rules evaluated based on the order in which they are set. -Currently Ingress rule supports setting the From field but not the To -field within a Rule.

-
-egress
- - -[]Rule - - -		 -(Optional) -

Set of egress rules evaluated based on the order in which they are set. -Currently Egress rule supports setting the To field but not the From -field within a Rule.

-
-
-status
- - -NetworkPolicyStatus - - -		 -

Most recently observed status of the NetworkPolicy.

-

ExternalNode

@@ -3026,7 +2868,7 @@

ExternalNode -

NetworkPolicy +

SupportBundleCollection

@@ -3053,7 +2895,7 @@

NetworkPolicy kind
string -NetworkPolicy +SupportBundleCollection @@ -3074,88 +2916,87 @@

NetworkPolicy spec
- -NetworkPolicySpec + +SupportBundleCollectionSpec -

Specification of the desired behavior of NetworkPolicy.

+

Specification of the desired behavior of SupportBundleCollection.



+ + + +
-tier
+nodes
-string + +BundleNodes + 		-

Tier specifies the tier to which this NetworkPolicy belongs to. -The NetworkPolicy order will be determined based on the combination of the -Tier’s Priority and the NetworkPolicy’s own Priority. If not specified, -this policy will be created in the Application Tier right above the K8s -NetworkPolicy which resides at the bottom.
-priority
+externalNodes
-float64 + +BundleExternalNodes + 		-

Priority specfies the order of the NetworkPolicy relative to other -NetworkPolicies.
-appliedTo
+expirationMinutes
- -[]AppliedTo - +int32 		-(Optional) -

Select workloads on which the rules will be applied to. Cannot be set in -conjunction with AppliedTo in each rule.

+

ExpirationMinutes is the requested duration of validity of the SupportBundleCollection. +A SupportBundleCollection will be marked as Failed if it does not finish before expiration. +Default is 60.
-ingress
+sinceTime
- -[]Rule +string + +		 +

SinceTime specifies a relative time before the current time from which to collect logs +A valid value is like: 1d, 2h, 30m.

+
+fileServer
+ + +BundleFileServer 		-(Optional) -

Set of ingress rules evaluated based on the order in which they are set. -Currently Ingress rule supports setting the From field but not the To -field within a Rule.
-egress
+authentication
- -[]Rule + +BundleServerAuthConfiguration 		-(Optional) -

Set of egress rules evaluated based on the order in which they are set. -Currently Egress rule supports setting the To field but not the From -field within a Rule.
@@ -3165,20 +3006,24 @@

NetworkPolicy status
- -NetworkPolicyStatus + +SupportBundleCollectionStatus -

Most recently observed status of the NetworkPolicy.

+

Most recently observed status of the SupportBundleCollection.

-

SupportBundleCollection +

BundleExternalNodes

+(Appears on: +SupportBundleCollectionSpec) +

+

@@ -3190,2521 +3035,51 @@

SupportBundleCollection

- - - - - - - - - - - -
-apiVersion
-string		 - -crd.antrea.io/v1alpha1 - +namespace
+ +string +
-kind
-string 		SupportBundleCollection
-metadata
+nodeNames
- -Kubernetes meta/v1.ObjectMeta - +[]string 		-

Standard metadata of the object.

-Refer to the Kubernetes API documentation for the fields of the -metadata field. +(Optional) +

List the names of certain ExternalNodes which are expected to collect and upload +bundle files.
-spec
+nodeSelector
- -SupportBundleCollectionSpec - - -		 -

Specification of the desired behavior of SupportBundleCollection.

-
-
- - - - - - - - - - - - - - - - - - - - - - - - - -
-nodes
- - -BundleNodes - - -		 -
-externalNodes
- - -BundleExternalNodes - - -		 -
-expirationMinutes
- -int32 - -		 -

ExpirationMinutes is the requested duration of validity of the SupportBundleCollection. -A SupportBundleCollection will be marked as Failed if it does not finish before expiration. -Default is 60.

-
-sinceTime
- -string - -		 -

SinceTime specifies a relative time before the current time from which to collect logs -A valid value is like: 1d, 2h, 30m.

-
-fileServer
- - -BundleFileServer - - -		 -
-authentication
- - -BundleServerAuthConfiguration - - -		 -
-
-status
- - -SupportBundleCollectionStatus - - -		 -

Most recently observed status of the SupportBundleCollection.

-
-

Tier -

-

-

- - - - - - - - - - - - - - - - - - - - - - - - - -
FieldDescription
-apiVersion
-string		 - -crd.antrea.io/v1alpha1 - -
-kind
-string -		Tier
-metadata
- - -Kubernetes meta/v1.ObjectMeta - - -		 -

Standard metadata of the object.

-Refer to the Kubernetes API documentation for the fields of the -metadata field. -
-spec
- - -TierSpec - - -		 -

Specification of the desired behavior of Tier.

-
-
- - - - - - - - - -
-priority
- -int32 - -		 -

Priority specfies the order of the Tier relative to other Tiers.

-
-description
- -string - -		 -

Description is an optional field to add more information regarding -the purpose of this Tier.

-
-
-

Traceflow -

-

-

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
FieldDescription
-apiVersion
-string		 - -crd.antrea.io/v1alpha1 - -
-kind
-string -		Traceflow
-metadata
- - -Kubernetes meta/v1.ObjectMeta - - -		 -Refer to the Kubernetes API documentation for the fields of the -metadata field. -
-spec
- - -TraceflowSpec - - -		 -
-
- - - - - - - - - - - - - - - - - - - - - - - - - -
-source
- - -Source - - -		 -
-destination
- - -Destination - - -		 -
-packet
- - -Packet - - -		 -
-liveTraffic
- -bool - -		 -

LiveTraffic indicates the Traceflow is to trace the live traffic -rather than an injected packet, when set to true. The first packet of -the first connection that matches the packet spec will be traced.

-
-droppedOnly
- -bool - -		 -

DroppedOnly indicates only the dropped packet should be captured in a -live-traffic Traceflow.

-
-timeout
- -uint16 - -		 -

Timeout specifies the timeout of the Traceflow in seconds. Defaults -to 20 seconds if not set.

-
-
-status
- - -TraceflowStatus - - -		 -
-

AppliedTo -

-

-(Appears on: -ClusterNetworkPolicySpec, -NetworkPolicySpec, -Rule) -

-

-

AppliedTo describes the grouping selector of workloads in AppliedTo field.

-

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
FieldDescription
-podSelector
- - -Kubernetes meta/v1.LabelSelector - - -		 -(Optional) -

Select Pods from NetworkPolicy’s Namespace as workloads in -AppliedTo fields. If set with NamespaceSelector, Pods are -matched from Namespaces matched by the NamespaceSelector. -Cannot be set with any other selector except NamespaceSelector.

-
-namespaceSelector
- - -Kubernetes meta/v1.LabelSelector - - -		 -(Optional) -

Select all Pods from Namespaces matched by this selector, as -workloads in AppliedTo fields. If set with PodSelector, -Pods are matched from Namespaces matched by the NamespaceSelector. -Cannot be set with any other selector except PodSelector or -ExternalEntitySelector. Cannot be set with Namespaces.

-
-externalEntitySelector
- - -Kubernetes meta/v1.LabelSelector - - -		 -(Optional) -

Select ExternalEntities from NetworkPolicy’s Namespace as workloads -in AppliedTo fields. If set with NamespaceSelector, -ExternalEntities are matched from Namespaces matched by the -NamespaceSelector. -Cannot be set with any other selector except NamespaceSelector.

-
-group
- -string - -		 -(Optional) -

Group is the name of the ClusterGroup which can be set as an -AppliedTo in place of a stand-alone selector. A Group cannot -be set with any other selector.

-
-serviceAccount
- - -NamespacedName - - -		 -(Optional) -

Select all Pods with the ServiceAccount matched by this field, as -workloads in AppliedTo fields. -Cannot be set with any other selector.

-
-service
- - -NamespacedName - - -		 -(Optional) -

Select a certain Service which matches the NamespacedName. -A Service can only be set in either policy level AppliedTo field in a policy -that only has ingress rules or rule level AppliedTo field in an ingress rule. -Only a NodePort Service can be referred by this field. -Cannot be set with any other selector.

-
-

BundleExternalNodes -

-

-(Appears on: -SupportBundleCollectionSpec) -

-

-

- - - - - - - - - - - - - - - - - - - - - -
FieldDescription
-namespace
- -string - -		 -
-nodeNames
- -[]string - -		 -(Optional) -

List the names of certain ExternalNodes which are expected to collect and upload -bundle files.

-
-nodeSelector
- - -Kubernetes meta/v1.LabelSelector - - -		 -(Optional) -

Select certain ExternalNodes which match the label selector.

-
-

BundleFileServer -

-

-(Appears on: -SupportBundleCollectionSpec) -

-

-

BundleFileServer specifies the bundle file server information.

-

- - - - - - - - - - - - - -
FieldDescription
-url
- -string - -		 -

The URL of the bundle file server. It is set with format: scheme://host[:port][/path], -e.g, https://api.example.com:8443/v1/supportbundles/. If scheme is not set, https is used by default.

-
-

BundleNodes -

-

-(Appears on: -SupportBundleCollectionSpec) -

-

-

- - - - - - - - - - - - - - - - - -
FieldDescription
-nodeNames
- -[]string - -		 -(Optional) -

List the names of certain Nodes which are expected to collect and upload -bundle files.

-
-nodeSelector
- - -Kubernetes meta/v1.LabelSelector - - -		 -(Optional) -

Select certain Nodes which match the label selector.

-
-

BundleServerAuthConfiguration -

-

-(Appears on: -SupportBundleCollectionSpec) -

-

-

BundleServerAuthConfiguration defines the authentication parameters that Antrea uses to access -the BundleFileServer.

-

- - - - - - - - - - - - - - - - - -
FieldDescription
-authType
- - -BundleServerAuthType - - -		 -
-authSecret
- - -Kubernetes core/v1.SecretReference - - -		 -

AuthSecret is a Secret reference which stores the authentication value.

-
-

BundleServerAuthType -(string alias)

-

-(Appears on: -BundleServerAuthConfiguration) -

-

-

BundleServerAuthType defines the authentication type to access the BundleFileServer.

-

-

ClusterNetworkPolicySpec -

-

-(Appears on: -ClusterNetworkPolicy) -

-

-

ClusterNetworkPolicySpec defines the desired state for ClusterNetworkPolicy.

-

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
FieldDescription
-tier
- -string - -		 -

Tier specifies the tier to which this ClusterNetworkPolicy belongs to. -The ClusterNetworkPolicy order will be determined based on the -combination of the Tier’s Priority and the ClusterNetworkPolicy’s own -Priority. If not specified, this policy will be created in the Application -Tier right above the K8s NetworkPolicy which resides at the bottom.

-
-priority
- -float64 - -		 -

Priority specfies the order of the ClusterNetworkPolicy relative to -other AntreaClusterNetworkPolicies.

-
-appliedTo
- - -[]AppliedTo - - -		 -(Optional) -

Select workloads on which the rules will be applied to. Cannot be set in -conjunction with AppliedTo in each rule.

-
-ingress
- - -[]Rule - - -		 -(Optional) -

Set of ingress rules evaluated based on the order in which they are set. -Currently Ingress rule supports setting the From field but not the To -field within a Rule.

-
-egress
- - -[]Rule - - -		 -(Optional) -

Set of egress rules evaluated based on the order in which they are set. -Currently Egress rule supports setting the To field but not the From -field within a Rule.

-
-

Destination -

-

-(Appears on: -TraceflowSpec) -

-

-

Destination describes the destination spec of the traceflow.

-

- - - - - - - - - - - - - - - - - - - - - - - - - -
FieldDescription
-namespace
- -string - -		 -

Namespace is the destination namespace.

-
-pod
- -string - -		 -

Pod is the destination pod, exclusive with destination service.

-
-service
- -string - -		 -

Service is the destination service, exclusive with destination pod.

-
-ip
- -string - -		 -

IP is the destination IPv4 or IPv6 address.

-
-

ExternalNodeSpec -

-

-(Appears on: -ExternalNode) -

-

-

ExternalNodeSpec defines the desired state for ExternalNode.

-

- - - - - - - - - - - - - -
FieldDescription
-interfaces
- - -[]NetworkInterface - - -		 -

Only one network interface is supported now. -Other interfaces except interfaces[0] will be ignored if there are more than one interfaces.

-
-

HTTPProtocol -

-

-(Appears on: -L7Protocol) -

-

-

HTTPProtocol matches HTTP requests with specific host, method, and path. All fields could be used alone or together. -If all fields are not provided, it matches all HTTP requests.

-

- - - - - - - - - - - - - - - - - - - - - -
FieldDescription
-host
- -string - -		 -

Host represents the hostname present in the URI or the HTTP Host header to match. -It does not contain the port associated with the host.

-
-method
- -string - -		 -

Method represents the HTTP method to match. -It could be GET, POST, PUT, HEAD, DELETE, TRACE, OPTIONS, CONNECT and PATCH.

-
-path
- -string - -		 -

Path represents the URI path to match (Ex. “/index.html”, “/admin”).

-
-

ICMPEchoRequestHeader -

-

-(Appears on: -TransportHeader) -

-

-

ICMPEchoRequestHeader describes spec of an ICMP echo request header.

-

- - - - - - - - - - - - - - - - - -
FieldDescription
-id
- -int32 - -		 -

ID is the ICMPEchoRequestHeader ID.

-
-sequence
- -int32 - -		 -

Sequence is the ICMPEchoRequestHeader sequence.

-
-

ICMPProtocol -

-

-(Appears on: -NetworkPolicyProtocol) -

-

-

ICMPProtocol matches ICMP traffic with specific ICMPType and/or ICMPCode. All -fields could be used alone or together. If all fields are not provided, this -matches all ICMP traffic.

-

- - - - - - - - - - - - - - - - - -
FieldDescription
-icmpType
- -int32 - -		 -
-icmpCode
- -int32 - -		 -
-

IGMPProtocol -

-

-(Appears on: -NetworkPolicyProtocol) -

-

-

IGMPProtocol matches IGMP traffic with IGMPType and GroupAddress. IGMPType must -be filled with: -IGMPQuery int32 = 0x11 -IGMPReportV1 int32 = 0x12 -IGMPReportV2 int32 = 0x16 -IGMPReportV3 int32 = 0x22 -If groupAddress is empty, all groupAddresses will be matched.

-

- - - - - - - - - - - - - - - - - -
FieldDescription
-igmpType
- -int32 - -		 -
-groupAddress
- -string - -		 -
-

IPBlock -

-

-(Appears on: -NetworkPolicyPeer, -GroupSpec) -

-

-

IPBlock describes a particular CIDR (Ex. “192.168.1.1⁄24”) that is allowed -or denied to/from the workloads matched by a Spec.AppliedTo.

-

- - - - - - - - - - - - - -
FieldDescription
-cidr
- -string - -		 -

CIDR is a string representing the IP Block -Valid examples are “192.168.1.1⁄24”.

-
-

IPHeader -

-

-(Appears on: -Packet) -

-

-

IPHeader describes spec of an IPv4 header.

-

- - - - - - - - - - - - - - - - - - - - - - - - - -
FieldDescription
-srcIP
- -string - -		 -

SrcIP is the source IP.

-
-protocol
- -int32 - -		 -

Protocol is the IP protocol.

-
-ttl
- -int32 - -		 -

TTL is the IP TTL.

-
-flags
- -int32 - -		 -

Flags is the flags for IP.

-
-

IPv6Header -

-

-(Appears on: -Packet) -

-

-

IPv6Header describes spec of an IPv6 header.

-

- - - - - - - - - - - - - - - - - - - - - -
FieldDescription
-srcIP
- -string - -		 -

SrcIP is the source IPv6.

-
-nextHeader
- -int32 - -		 -

NextHeader is the IPv6 protocol.

-
-hopLimit
- -int32 - -		 -

HopLimit is the IPv6 Hop Limit.

-
-

L7Protocol -

-

-(Appears on: -Rule) -

-

-

- - - - - - - - - - - - - - - - - -
FieldDescription
-http
- - -HTTPProtocol - - -		 -
-tls
- - -TLSProtocol - - -		 -
-

NamespaceMatchType -(string alias)

-

-(Appears on: -PeerNamespaces) -

-

-

NamespaceMatchType describes Namespace matching strategy.

-

-

NamespacedName -

-

-(Appears on: -AppliedTo, -NetworkPolicyPeer, -GroupSpec) -

-

-

NamespacedName refers to a Namespace scoped resource. -All fields must be used together.

-

- - - - - - - - - - - - - - - - - -
FieldDescription
-name
- -string - -		 -
-namespace
- -string - -		 -
-

NetworkInterface -

-

-(Appears on: -ExternalNodeSpec) -

-

-

- - - - - - - - - - - - - - - - - -
FieldDescription
-name
- -string - -		 -
-ips
- -[]string - -		 -
-

NetworkPolicyCondition -

-

-(Appears on: -NetworkPolicyStatus) -

-

-

NetworkPolicyCondition describes the state of a NetworkPolicy at a certain point.

-

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
FieldDescription
-type
- - -NetworkPolicyConditionType - - -		 -

Type of StatefulSet condition.

-
-status
- - -Kubernetes meta/v1.ConditionStatus - - -		 -

Status of the condition, one of True, False, Unknown.

-
-lastTransitionTime
- - -Kubernetes meta/v1.Time - - -		 -(Optional) -

Last time the condition transitioned from one status to another.

-
-reason
- -string - -		 -(Optional) -

The reason for the condition’s last transition.

-
-message
- -string - -		 -(Optional) -

A human-readable message indicating details about the transition.

-
-

NetworkPolicyConditionType -(string alias)

-

-(Appears on: -NetworkPolicyCondition) -

-

-

NetworkPolicyConditionType describes the condition types of NetworkPolicies.

-

-

NetworkPolicyPeer -

-

-(Appears on: -Rule) -

-

-

NetworkPolicyPeer describes the grouping selector of workloads.

-

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
FieldDescription
-ipBlock
- - -IPBlock - - -		 -(Optional) -

IPBlock describes the IPAddresses/IPBlocks that is matched in to/from. -IPBlock cannot be set as part of the AppliedTo field. -Cannot be set with any other selector.

-
-podSelector
- - -Kubernetes meta/v1.LabelSelector - - -		 -(Optional) -

Select Pods from NetworkPolicy’s Namespace as workloads in -To/From fields. If set with NamespaceSelector, Pods are -matched from Namespaces matched by the NamespaceSelector. -Cannot be set with any other selector except NamespaceSelector.

-
-namespaceSelector
- - -Kubernetes meta/v1.LabelSelector - - -		 -(Optional) -

Select all Pods from Namespaces matched by this selector, as -workloads in To/From fields. If set with PodSelector, -Pods are matched from Namespaces matched by the NamespaceSelector. -Cannot be set with any other selector except PodSelector or -ExternalEntitySelector. Cannot be set with Namespaces.

-
-namespaces
- - -PeerNamespaces - - -		 -(Optional) -

Select Pod/ExternalEntity from Namespaces matched by specific criteria. -Current supported criteria is match: Self, which selects from the same -Namespace of the appliedTo workloads. -Cannot be set with any other selector except PodSelector or -ExternalEntitySelector. This field can only be set when NetworkPolicyPeer -is created for ClusterNetworkPolicy ingress/egress rules. -Cannot be set with NamespaceSelector.

-
-externalEntitySelector
- - -Kubernetes meta/v1.LabelSelector - - -		 -(Optional) -

Select ExternalEntities from NetworkPolicy’s Namespace as workloads -in To/From fields. If set with NamespaceSelector, -ExternalEntities are matched from Namespaces matched by the -NamespaceSelector. -Cannot be set with any other selector except NamespaceSelector.

-
-group
- -string - -		 -

Group is the name of the ClusterGroup which can be set within -an Ingress or Egress rule in place of a stand-alone selector. -A Group cannot be set with any other selector.

-
-fqdn
- -string - -		 -

Restrict egress access to the Fully Qualified Domain Names prescribed -by name or by wildcard match patterns. This field can only be set for -NetworkPolicyPeer of egress rules. -Supported formats are: -Exact FQDNs, i.e. “google.com”, “db-svc.default.svc.cluster.local” -Wildcard expressions, i.e. “*wayfair.com”.

-
-serviceAccount
- - -NamespacedName - - -		 -(Optional) -

Select all Pods with the ServiceAccount matched by this field, as -workloads in To/From fields. -Cannot be set with any other selector.

-
-nodeSelector
- - -Kubernetes meta/v1.LabelSelector - - -		 -(Optional) -

Select certain Nodes which match the label selector. -A NodeSelector cannot be set in AppliedTo field or set with any other selector.

-
-scope
- - -PeerScope - - -		 -(Optional) -

Define scope of the Pod/NamespaceSelector(s) of this peer. -Can only be used in ingress NetworkPolicyPeers. -Defaults to “Cluster”.

-
-

NetworkPolicyPhase -(string alias)

-

-(Appears on: -NetworkPolicyStatus) -

-

-

NetworkPolicyPhase defines the phase in which a NetworkPolicy is.

-

-

NetworkPolicyPort -

-

-(Appears on: -Rule) -

-

-

NetworkPolicyPort describes the port and protocol to match in a rule.

-

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
FieldDescription
-protocol
- - -Kubernetes core/v1.Protocol - - -		 -(Optional) -

The protocol (TCP, UDP, or SCTP) which traffic must match. -If not specified, this field defaults to TCP.

-
-port
- - -k8s.io/apimachinery/pkg/util/intstr.IntOrString - - -		 -(Optional) -

The port on the given protocol. This can be either a numerical -or named port on a Pod. If this field is not provided, this -matches all port names and numbers.

-
-endPort
- -int32 - -		 -(Optional) -

EndPort defines the end of the port range, inclusive. -It can only be specified when a numerical port is specified.

-
-sourcePort
- -int32 - -		 -(Optional) -

The source port on the given protocol. This can only be a numerical port. -If this field is not provided, rule matches all source ports.

-
-sourceEndPort
- -int32 - -		 -(Optional) -

SourceEndPort defines the end of the source port range, inclusive. -It can only be specified when sourcePort is specified.

-
-

NetworkPolicyProtocol -

-

-(Appears on: -Rule) -

-

-

NetworkPolicyProtocol defines additional protocols that are not supported by -ports. All fields should be used as a standalone field.

-

- - - - - - - - - - - - - - - - - -
FieldDescription
-icmp
- - -ICMPProtocol - - -		 -
-igmp
- - -IGMPProtocol - - -		 -
-

NetworkPolicySpec -

-

-(Appears on: -NetworkPolicy) -

-

-

NetworkPolicySpec defines the desired state for NetworkPolicy.

-

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
FieldDescription
-tier
- -string - -		 -

Tier specifies the tier to which this NetworkPolicy belongs to. -The NetworkPolicy order will be determined based on the combination of the -Tier’s Priority and the NetworkPolicy’s own Priority. If not specified, -this policy will be created in the Application Tier right above the K8s -NetworkPolicy which resides at the bottom.

-
-priority
- -float64 - -		 -

Priority specfies the order of the NetworkPolicy relative to other -NetworkPolicies.

-
-appliedTo
- - -[]AppliedTo - - -		 -(Optional) -

Select workloads on which the rules will be applied to. Cannot be set in -conjunction with AppliedTo in each rule.

-
-ingress
- - -[]Rule - - -		 -(Optional) -

Set of ingress rules evaluated based on the order in which they are set. -Currently Ingress rule supports setting the From field but not the To -field within a Rule.

-
-egress
- - -[]Rule - - -		 -(Optional) -

Set of egress rules evaluated based on the order in which they are set. -Currently Egress rule supports setting the To field but not the From -field within a Rule.

-
-

NetworkPolicyStatus -

-

-(Appears on: -ClusterNetworkPolicy, -NetworkPolicy) -

-

-

NetworkPolicyStatus represents information about the status of a NetworkPolicy.

-

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
FieldDescription
-phase
- - -NetworkPolicyPhase - - -		 -

The phase of a NetworkPolicy is a simple, high-level summary of the NetworkPolicy’s status.

-
-observedGeneration
- -int64 - -		 -

The generation observed by Antrea.

-
-currentNodesRealized
- -int32 - -		 -

The number of nodes that have realized the NetworkPolicy.

-
-desiredNodesRealized
- -int32 - -		 -

The total number of nodes that should realize the NetworkPolicy.

-
-conditions
- - -[]NetworkPolicyCondition - - -		 -

Represents the latest available observations of a NetworkPolicy current state.

-
-

NodeResult -

-

-(Appears on: -TraceflowStatus) -

-

-

- - - - - - - - - - - - - - - - - - - - - - - - - -
FieldDescription
-node
- -string - -		 -

Node is the node of the observation.

-
-role
- -string - -		 -

Role of the node like sender, receiver, etc.

-
-timestamp
- -int64 - -		 -

Timestamp is the timestamp of the observations on the node.

-
-observations
- - -[]Observation - - -		 -

Observations includes all observations from sender nodes, receiver ones, etc.

-
-

Observation -

-

-(Appears on: -NodeResult) -

-

-

Observation describes those from sender nodes or receiver nodes.

-

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
FieldDescription
-component
- - -TraceflowComponent - - -		 -

Component is the observation component.

-
-componentInfo
- -string - -		 -

ComponentInfo is the extension of Component field.

-
-action
- - -TraceflowAction - - -		 -

Action is the action to the observation.

-
-pod
- -string - -		 -

Pod is the combination of Pod name and Pod Namespace.

-
-dstMAC
- -string - -		 -

DstMAC is the destination MAC.

-
-networkPolicy
- -string - -		 -

NetworkPolicy is the combination of Namespace and NetworkPolicyName.

-
-egress
- -string - -		 -

Egress is the name of the Egress.

-
-ttl
- -int32 - -		 -

TTL is the observation TTL.

-
-translatedSrcIP
- -string - -		 -

TranslatedSrcIP is the translated source IP.

-
-translatedDstIP
- -string - -		 -

TranslatedDstIP is the translated destination IP.

-
-tunnelDstIP
- -string - -		 -

TunnelDstIP is the tunnel destination IP.

-
-egressIP
- -string - -		 -
-

Packet -

-

-(Appears on: -TraceflowSpec, -TraceflowStatus) -

-

-

Packet includes header info.

-

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
FieldDescription
-srcIP
- -string - -		 -
-dstIP
- -string - -		 -
-length
- -uint16 - -		 -

Length is the IP packet length (includes the IPv4 or IPv6 header length).

-
-ipHeader
- - -IPHeader - - -		 -

TODO: change type IPHeader to *IPHeader and correct all internal references

-
-ipv6Header
- - -IPv6Header - - -		 -
-transportHeader
- - -TransportHeader - - -		 -
-

PeerNamespaces -

-

-(Appears on: -NetworkPolicyPeer) -

-

-

- - - - - - - - - - - - - -
FieldDescription
-match
- - -NamespaceMatchType - - -		 -
-

PeerScope -(string alias)

-

-(Appears on: -NetworkPolicyPeer, -PeerService) -

-

-

-

PeerService -

-

-(Appears on: -Rule) -

-

-

PeerService refers to a Service, which can be a in-cluster Service or -imported multi-cluster service.

-

- - - - - - - - - - - - - - - - - - - - - -
FieldDescription
-name
- -string - -		 -
-namespace
- -string - -		 -
-scope
- - -PeerScope - - -		 -
-

Rule -

-

-(Appears on: -ClusterNetworkPolicySpec, -NetworkPolicySpec) -

-

-

Rule describes the traffic allowed to/from the workloads selected by -Spec.AppliedTo. Based on the action specified in the rule, traffic is either -allowed or denied which exactly match the specified ports and protocol.

-

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
FieldDescription
-action
- - -RuleAction - - -		 -

Action specifies the action to be applied on the rule.

-
-ports
- - -[]NetworkPolicyPort - - -		 -(Optional) -

Set of ports and protocols matched by the rule. If this field and Protocols -are unset or empty, this rule matches all ports.

-
-protocols
- - -[]NetworkPolicyProtocol - - -		 -(Optional) -

Set of protocols matched by the rule. If this field and Ports are unset or -empty, this rule matches all protocols supported.

-
-l7Protocols
- - -[]L7Protocol - - -		 -

Set of layer 7 protocols matched by the rule. If this field is set, action can only be Allow. -When this field is used in a rule, any traffic matching the other layer 3⁄4 criteria of the rule (typically the -5-tuple) will be forwarded to an application-aware engine for protocol detection and rule enforcement, and the -traffic will be allowed if the layer 7 criteria is also matched, otherwise it will be dropped. Therefore, any -rules after a layer 7 rule will not be enforced for the traffic.

-
-from
- - -[]NetworkPolicyPeer - - -		 -(Optional) -

Rule is matched if traffic originates from workloads selected by -this field. If this field is empty, this rule matches all sources.

-
-to
- - -[]NetworkPolicyPeer - - -		 -(Optional) -

Rule is matched if traffic is intended for workloads selected by -this field. This field can’t be used with ToServices. If this field -and ToServices are both empty or missing this rule matches all destinations.

-
-toServices
- - -[]PeerService - - -		 -(Optional) -

Rule is matched if traffic is intended for a Service listed in this field. -Currently, only ClusterIP types Services are supported in this field. -When scope is set to ClusterSet, it matches traffic intended for a multi-cluster -Service listed in this field. Service name and Namespace provided should match -the original exported Service. -This field can only be used when AntreaProxy is enabled. This field can’t be used -with To or Ports. If this field and To are both empty or missing, this rule matches -all destinations.

-
-name
- -string - -		 -(Optional) -

Name describes the intention of this rule. -Name should be unique within the policy.

-
-enableLogging
- -bool - -		 -(Optional) -

EnableLogging is used to indicate if agent should generate logs -when rules are matched. Should be default to false.

-
-logLabel
- -string - -		 -(Optional) -

LogLabel is a user-defined arbitrary string which will be printed in the NetworkPolicy logs.

-
-appliedTo
- - -[]AppliedTo + +Kubernetes meta/v1.LabelSelector 		(Optional) -

Select workloads on which this rule will be applied to. Cannot be set in -conjunction with NetworkPolicySpec/ClusterNetworkPolicySpec.AppliedTo.

+

Select certain ExternalNodes which match the label selector.
-

RuleAction -(string alias)

-

-(Appears on: -Rule) -

-

-

RuleAction describes the action to be applied on traffic matching a rule.

-

-

Source +

BundleFileServer

(Appears on: -TraceflowSpec) +SupportBundleCollectionSpec)

-

Source describes the source spec of the traceflow.

+

BundleFileServer specifies the bundle file server information.

@@ -5716,48 +3091,25 @@

Source

- - - - - - - -
-namespace
- -string - -		 -

Namespace is the source namespace.

-
-pod
- -string - -		 -

Pod is the source pod.

-
-ip
+url
string 		-

IP is the source IPv4 or IPv6 address. IP as the source is supported -only for live-traffic Traceflow.

+

The URL of the bundle file server. It is set with format: scheme://host[:port][/path], +e.g, https://api.example.com:8443/v1/supportbundles/. If scheme is not set, https is used by default.
-

SupportBundleCollectionCondition +

BundleNodes

(Appears on: -SupportBundleCollectionStatus) +SupportBundleCollectionSpec)

-

SupportBundleCollectionCondition describes the state of a SupportBundleCollection at a certain point.

@@ -5769,85 +3121,95 @@

SupportBundleCo

+ +
-type
+nodeNames
- -SupportBundleCollectionConditionType - +[]string 		-

Type of StatefulSet condition.

+(Optional) +

List the names of certain Nodes which are expected to collect and upload +bundle files.
-status
+nodeSelector
- -Kubernetes meta/v1.ConditionStatus + +Kubernetes meta/v1.LabelSelector 		-

Status of the condition, one of True, False, Unknown.

+(Optional) +

Select certain Nodes which match the label selector.
+

BundleServerAuthConfiguration +

+

+(Appears on: +SupportBundleCollectionSpec) +

+

+

BundleServerAuthConfiguration defines the authentication parameters that Antrea uses to access +the BundleFileServer.

+

+ + - - + + + +
-lastTransitionTime
- - -Kubernetes meta/v1.Time - - -		 -(Optional) -

Last time the condition transitioned from one status to another.

-		FieldDescription
-reason
+authType
-string + +BundleServerAuthType + 		-(Optional) -

The reason for the condition’s last transition.
-message
+authSecret
-string + +Kubernetes core/v1.SecretReference + 		-(Optional) -

A human-readable message indicating details about the transition.

+

AuthSecret is a Secret reference which stores the authentication value.
-

SupportBundleCollectionConditionType +

BundleServerAuthType (string alias)

(Appears on: -SupportBundleCollectionCondition) +BundleServerAuthConfiguration)

+

BundleServerAuthType defines the authentication type to access the BundleFileServer.

-

SupportBundleCollectionSpec +

ExternalNodeSpec

(Appears on: -SupportBundleCollection) +ExternalNode)

+

ExternalNodeSpec defines the desired state for ExternalNode.

@@ -5859,86 +3221,84 @@

SupportBundleCollect

- - - - + +
-nodes
- - -BundleNodes - - -		 -
-externalNodes
+interfaces
- -BundleExternalNodes + +[]NetworkInterface 		+

Only one network interface is supported now. +Other interfaces except interfaces[0] will be ignored if there are more than one interfaces.
+

HTTPProtocol +

+

+(Appears on: +L7Protocol) +

+

+

HTTPProtocol matches HTTP requests with specific host, method, and path. All fields could be used alone or together. +If all fields are not provided, it matches all HTTP requests.

+

+ + - - + + + +
-expirationMinutes
- -int32 - -		 -

ExpirationMinutes is the requested duration of validity of the SupportBundleCollection. -A SupportBundleCollection will be marked as Failed if it does not finish before expiration. -Default is 60.

-		FieldDescription
-sinceTime
+host
string 		-

SinceTime specifies a relative time before the current time from which to collect logs -A valid value is like: 1d, 2h, 30m.

+

Host represents the hostname present in the URI or the HTTP Host header to match. +It does not contain the port associated with the host.
-fileServer
+method
- -BundleFileServer - +string 		+

Method represents the HTTP method to match. +It could be GET, POST, PUT, HEAD, DELETE, TRACE, OPTIONS, CONNECT and PATCH.
-authentication
+path
- -BundleServerAuthConfiguration - +string 		+

Path represents the URI path to match (Ex. “/index.html”, “/admin”).
-

SupportBundleCollectionStatus +

IPBlock

(Appears on: -SupportBundleCollection) +GroupSpec)

+

IPBlock describes a particular CIDR (Ex. “192.168.1.1⁄24”) that is allowed +or denied to/from the workloads matched by a Spec.AppliedTo.

@@ -5950,49 +3310,21 @@

SupportBundleColle

- - - - - - - -
-collectedNodes
- -int32 - -		 -

The number of Nodes and ExternalNodes that have completed the SupportBundleCollection.

-
-desiredNodes
- -int32 - -		 -

The total number of Nodes and ExternalNodes that should process the SupportBundleCollection.

-
-conditions
- - -[]SupportBundleCollectionCondition - +cidr
+ +string 		-

Represents the latest available observations of a SupportBundleCollection current state.

+

CIDR is a string representing the IP Block +Valid examples are “192.168.1.1⁄24”.
-

TCPHeader +

L7Protocol

-(Appears on: -TransportHeader) -

-

-

TCPHeader describes spec of a TCP header.

@@ -6004,48 +3336,39 @@

TCPHeader

- - - -
-srcPort
- -int32 - -		 -

SrcPort is the source port.

-
-dstPort
+http
-int32 + +HTTPProtocol + 		-

DstPort is the destination port.
-flags
+tls
-int32 + +TLSProtocol + 		-

Flags are flags in the header.
-

TLSProtocol +

NamespacedName

(Appears on: -L7Protocol) +GroupSpec)

-

TLSProtocol matches TLS handshake packets with specific SNI. If the field is not provided, this -matches all TLS handshake packets.

+

NamespacedName refers to a Namespace scoped resource. +All fields must be used together.

@@ -6057,25 +3380,33 @@

TLSProtocol

+ + + +
-sni
+name
+ +string + +		 +
+namespace
string 		-

SNI (Server Name Indication) indicates the server domain name in the TLS/SSL hello message.
-

TierSpec +

NetworkInterface

(Appears on: -Tier) +ExternalNodeSpec)

-

TierSpec defines the desired state for Tier.

@@ -6087,61 +3418,34 @@

TierSpec

-priority
+name
-int32 +string 		-

Priority specfies the order of the Tier relative to other Tiers.
-description
+ips
-string +[]string 		-

Description is an optional field to add more information regarding -the purpose of this Tier.
-

TraceflowAction -(string alias)

-

-(Appears on: -Observation) -

-

-

-

TraceflowComponent -(string alias)

-

-(Appears on: -Observation) -

-

-

-

TraceflowPhase -(string alias)

-

-(Appears on: -TraceflowStatus) -

-

-

-

TraceflowSpec +

SupportBundleCollectionCondition

(Appears on: -Traceflow) +SupportBundleCollectionStatus)

-

TraceflowSpec describes the spec of the traceflow.

+

SupportBundleCollectionCondition describes the state of a SupportBundleCollection at a certain point.

@@ -6153,87 +3457,85 @@

TraceflowSpec

- - - -
-source
+type
- -Source + +SupportBundleCollectionConditionType 		+

Type of StatefulSet condition.
-destination
+status
- -Destination + +Kubernetes meta/v1.ConditionStatus 		+

Status of the condition, one of True, False, Unknown.
-packet
+lastTransitionTime
- -Packet + +Kubernetes meta/v1.Time 		+(Optional) +

Last time the condition transitioned from one status to another.
-liveTraffic
- -bool - -		 -

LiveTraffic indicates the Traceflow is to trace the live traffic -rather than an injected packet, when set to true. The first packet of -the first connection that matches the packet spec will be traced.

-
-droppedOnly
+reason
-bool +string 		-

DroppedOnly indicates only the dropped packet should be captured in a -live-traffic Traceflow.

+(Optional) +

The reason for the condition’s last transition.
-timeout
+message
-uint16 +string 		-

Timeout specifies the timeout of the Traceflow in seconds. Defaults -to 20 seconds if not set.

+(Optional) +

A human-readable message indicating details about the transition.
-

TraceflowStatus +

SupportBundleCollectionConditionType +(string alias)

+

+(Appears on: +SupportBundleCollectionCondition) +

+

+

+

SupportBundleCollectionSpec

(Appears on: -Traceflow) +SupportBundleCollection)

-

TraceflowStatus describes current status of the traceflow.

@@ -6245,93 +3547,86 @@

TraceflowStatus

-phase
+nodes
- -TraceflowPhase + +BundleNodes 		-

Phase is the Traceflow phase.
-reason
+externalNodes
-string + +BundleExternalNodes + 		-

Reason is a message indicating the reason of the traceflow’s current phase.
-startTime
+expirationMinutes
- -Kubernetes meta/v1.Time - +int32 		-

StartTime is the time at which the Traceflow as started by the Antrea Controller. -Before K8s v1.20, null values (field not set) are not pruned, and a CR where a -metav1.Time field is not set would fail OpenAPI validation (type string). The -recommendation seems to be to use a pointer instead, and the field will be omitted when -serializing. -See https://github.com/kubernetes/kubernetes/issues/86811

+

ExpirationMinutes is the requested duration of validity of the SupportBundleCollection. +A SupportBundleCollection will be marked as Failed if it does not finish before expiration. +Default is 60.
-dataplaneTag
+sinceTime
-byte +string 		-

DataplaneTag is a tag to identify a traceflow session across Nodes.

+

SinceTime specifies a relative time before the current time from which to collect logs +A valid value is like: 1d, 2h, 30m.
-results
+fileServer
- -[]NodeResult + +BundleFileServer 		-

Results is the collection of all observations on different nodes.
-capturedPacket
+authentication
- -Packet + +BundleServerAuthConfiguration 		-

CapturedPacket is the captured packet in live-traffic Traceflow.
-

TransportHeader +

SupportBundleCollectionStatus

(Appears on: -Packet) +SupportBundleCollection)

-

TransportHeader describes spec of a TransportHeader.

@@ -6343,50 +3638,50 @@

TransportHeader

-icmp
+collectedNodes
- -ICMPEchoRequestHeader - +int32 		+

The number of Nodes and ExternalNodes that have completed the SupportBundleCollection.
-udp
+desiredNodes
- -UDPHeader - +int32 		+

The total number of Nodes and ExternalNodes that should process the SupportBundleCollection.
-tcp
+conditions
- -TCPHeader + +[]SupportBundleCollectionCondition 		+

Represents the latest available observations of a SupportBundleCollection current state.
-

UDPHeader +

TLSProtocol

(Appears on: -TransportHeader) +L7Protocol)

-

UDPHeader describes spec of a UDP header.

+

TLSProtocol matches TLS handshake packets with specific SNI. If the field is not provided, this +matches all TLS handshake packets.

@@ -6398,28 +3693,29 @@

UDPHeader

- - - -
-srcPort
- -int32 - -		 -

SrcPort is the source port.

-
-dstPort
+sni
-int32 +string 		-

DstPort is the destination port.

+

SNI (Server Name Indication) indicates the server domain name in the TLS/SSL hello message.
+

TraceflowAction +(string alias)

+

+

+

TraceflowComponent +(string alias)

+

+

+

TraceflowPhase +(string alias)

+

+

crd.antrea.io/v1alpha2

Resource Types: @@ -14511,5 +11807,5 @@

BundleStatus

Generated with gen-crd-api-reference-docs -on git commit ab234c5. +on git commit fc2b6ae.

diff --git a/content/docs/main/docs/api.md b/content/docs/main/docs/api.md index ba9226f6..2f061b4b 100644 --- a/content/docs/main/docs/api.md +++ b/content/docs/main/docs/api.md @@ -30,7 +30,6 @@ These are the CRDs currently available in `crd.antrea.io`. | `AntreaControllerInfo` | v1beta1 | v1.0.0 | N/A | N/A | | `ClusterGroup` | v1alpha3 | v1.1.0 | v1.13.0 | N/A | | `ClusterGroup` | v1beta1 | v1.13.0 | N/A | N/A | -| `ClusterNetworkPolicy` | v1alpha1 | v1.0.0 | v1.13.0 | N/A | | `ClusterNetworkPolicy` | v1beta1 | v1.13.0 | N/A | N/A | | `Egress` | v1alpha2 | v1.0.0 | N/A | N/A | | `Egress` | v1beta1 | v1.13.0 | N/A | N/A | @@ -41,12 +40,9 @@ These are the CRDs currently available in `crd.antrea.io`. | `IPPool`| v1alpha2 | v1.4.0 | N/A | N/A | | `Group` | v1alpha3 | v1.8.0 | v1.13.0 | N/A | | `Group` | v1beta1 | v1.13.0 | N/A | N/A | -| `NetworkPolicy` | v1alpha1 | v1.0.0 | v1.13.0 | N/A | | `NetworkPolicy` | v1beta1 | v1.13.0 | N/A | N/A | | `SupportBundleCollection` | v1alpha1 | v1.10.0 | N/A | N/A | -| `Tier` | v1alpha1 | v1.0.0 | v1.13.0 | v2.0.0 | | `Tier` | v1beta1 | v1.13.0 | N/A | N/A | -| `Traceflow` | v1alpha1 | v1.0.0 | v1.13.0 | N/A | | `Traceflow` | v1beta1 | v1.13.0 | N/A | N/A | ### Other API groups @@ -81,4 +77,8 @@ These are the API group versions which are currently available when using Antrea | CRD | CRD version | Introduced in | Deprecated in | Removed in | |---|---|---|---|---| | `ClusterGroup` | v1alpha2 | v1.0.0 | v1.1.0 | v2.0.0 | +| `ClusterNetworkPolicy` | v1alpha1 | v1.0.0 | v1.13.0 | v2.0.0 | | `ExternalEntity` | v1alpha1 | v0.10.0 | v0.11.0 | v2.0.0 | +| `NetworkPolicy` | v1alpha1 | v1.0.0 | v1.13.0 | v2.0.0 | +| `Tier` | v1alpha1 | v1.0.0 | v1.13.0 | v2.0.0 | +| `Traceflow` | v1alpha1 | v1.0.0 | v1.13.0 | v2.0.0 |