Multus configuration add namespace isolation #11605
Conversation
k8s-ci-robot
added
release-note
|
Hi @Sispheor. Thanks for your PR. I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
k8s-ci-robot
added
needs-ok-to-test
| @@ -7,3 +7,4 @@ multus_cni_conf_dir: "{{ ('/host', multus_cni_conf_dir_host) | join }}" | |||
| multus_cni_bin_dir: "{{ ('/host', multus_cni_bin_dir_host) | join }}" | |||
| multus_cni_run_dir: "{{ ('/host', multus_cni_run_dir_host) | join }}" | |||
| multus_kubeconfig_file_host: "{{ (multus_cni_conf_dir_host, '/multus.d/multus.kubeconfig') | join }}" | |||
| multus_namespace_isolation: true | |||
There was a problem hiding this comment.
According to your provided docs, this default value is false not true.
There was a problem hiding this comment.
Indeed. It's weird because I've actually tested and without forcing the flag to false my network config placed in another NS was not taken in account.
I looked into the Mutlus code. The bool is created but never set so by default in Golang it should be false.
I've updated the default var and the doc accordingly in my PR.
docs/CNI/multus.md
Outdated
| By default, Multus operator only listen to `NetworkAttachmentDefinition` declared in the same namespace as the pods that are going to use it. To disable namespace isolation: | ||
| ```yml | ||
| multus_namespace_isolation: false | ||
| ``` | ||
|
|
There was a problem hiding this comment.
Please check the Kubespray CI - pre-commit job log and fix it.
| @@ -61,6 +61,7 @@ spec: | |||
| - "--cni-bin-dir={{ multus_cni_bin_dir }}" | |||
| - "--multus-conf-file={{ multus_conf_file }}" | |||
| - "--multus-kubeconfig-file-host={{ multus_kubeconfig_file_host }}" | |||
| - "--namespace-isolation={{ multus_namespace_isolation | default(true) | string | lower }}" | |||
There was a problem hiding this comment.
If already specified in roles/network_plugin/multus/defaults/main.yml, there is no need to add default here.
docs/CNI/multus.md
Outdated
| Namespace isolation enables a mode where Multus only allows pods to access custom resources (the `NetworkAttachmentDefinitions`) within the namespace where that pod resides. To enable namespace isolation: | ||
| ```yml | ||
| multus_namespace_isolation: true | ||
| ``` | ||
|
|
There was a problem hiding this comment.
Please check the Kubespray CI - pre-commit job log and fix it.
There was a problem hiding this comment.
Sorry but I get an error 500 when trying to access the logs.
There was a problem hiding this comment.
I guess that the linter is complaining about the missing blank line before the code block. It's fixed.
|
/ok-to-test |
k8s-ci-robot
added
ok-to-test
k8s-ci-robot
added
the
lgtm
|
Thanks @Sispheor |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: cyclinder, Sispheor, tico88612, yankay The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
k8s-ci-robot
added
the
approved
What type of PR is this?
/kind feature
What this PR does / why we need it:
Add the support of network isolation configuration in Multus.
Which issue(s) this PR fixes:
Fixes #11594
Special notes for your reviewer:
Does this PR introduce a user-facing change?:
NONE