adamant-kite-43734
06/07/2022, 11:22 AMmelodic-market-42092
06/07/2022, 11:23 AMIf you want to use NetworkPolicy you can use Calico in k3s instead of Flannel.Which implies that when I don't use calico then network policies don't work. Is that correct?
wide-garage-9465
06/07/2022, 11:24 AMmelodic-market-42092
06/07/2022, 11:25 AMwide-garage-9465
06/07/2022, 11:29 AMmelodic-market-42092
06/07/2022, 11:31 AMmelodic-market-42092
06/07/2022, 11:52 AMwide-garage-9465
06/07/2022, 11:53 AMmelodic-market-42092
06/07/2022, 11:53 AMwide-garage-9465
06/07/2022, 11:54 AMwide-garage-9465
06/07/2022, 11:56 AMMost CNI plugins come with their own network policy engine, so it is recommended to set --disable-network-policy as well to avoid conflicts
wide-garage-9465
06/07/2022, 11:57 AM--disable-network-policy (components) Disable k3s default network policy controller
wide-garage-9465
06/07/2022, 11:57 AMmelodic-market-42092
06/07/2022, 11:58 AMclient
) logs this:
FetchError: request to <http://api.api.svc.cluster.local:8000/organizations> failed, reason: connect ECONNREFUSED 10.42.0.13:8000
My api (running in namespace api
) has this network policy right now:
apiVersion: <http://networking.k8s.io/v1|networking.k8s.io/v1>
kind: NetworkPolicy
metadata:
name: api-network-policy
namespace: api
spec:
podSelector:
matchLabels:
app: api
policyTypes:
- Ingress
- Egress
ingress: []
# - ports:
# - protocol: TCP
# port: 8000
My test here is to see what happened when I commented out the ingress
-part of my network policy. With those lines commented out, the frontend gets a connect ECONNREFUSED
then trying to talk with my api.
---
When I have those lines not commented out (I'm recreating the local cluster just to be sure), my frontend is indeed able to communicate with the api. (i.e. it does not log that connect econnrefused-thing)melodic-market-42092
06/07/2022, 11:59 AMwide-garage-9465
06/07/2022, 12:00 PMmelodic-market-42092
06/07/2022, 12:00 PMwide-garage-9465
06/07/2022, 12:00 PMmelodic-market-42092
06/07/2022, 12:01 PMwide-garage-9465
06/07/2022, 12:01 PMwide-garage-9465
06/07/2022, 12:13 PMcreamy-pencil-82913
06/07/2022, 3:20 PMmelodic-market-42092
06/07/2022, 5:47 PMIf you want to use NetworkPolicy you can use Calico in k3s instead of Flannel.Confusing when network policies are actually enforced by default. Want me to submit a pr to change the wording?
wide-garage-9465
06/07/2022, 5:53 PM--disable-network-policy
which is required to use Calico's NetworkPolicy functionality and disable the K3s' built-in one.
I'll happily accept a PRπmelodic-market-42092
06/07/2022, 6:04 PMmelodic-market-42092
06/07/2022, 6:23 PMwide-garage-9465
06/07/2022, 6:28 PMmelodic-market-42092
06/07/2022, 6:30 PMwide-garage-9465
06/07/2022, 6:30 PMmelodic-market-42092
06/07/2022, 6:31 PMmelodic-market-42092
06/07/2022, 6:31 PMwide-garage-9465
06/07/2022, 6:31 PMwide-garage-9465
06/07/2022, 6:31 PMmelodic-market-42092
06/07/2022, 6:32 PMwide-garage-9465
06/07/2022, 8:35 PMmike
to re-deploy that version of the docs.
Then rebase all the commits after that onto the newly inserted one.wide-garage-9465
06/07/2022, 8:35 PMmike
is used for that πwide-garage-9465
06/07/2022, 8:36 PMmelodic-market-42092
06/08/2022, 9:06 AM