Warning:
Network Policy component is based on kube-router and performs full-table save/restore operations on iptables. This behavior may cause compatibility issues and exceptions (for example, kube-proxy also uses iptables) in environments where early and latest versions of iptables coexist. Installation is not recommended. If installation is required, install the recommended community open-source kube-router based on your cluster version. Below is the version compatibility table: |
1.12~1.30 | v1.8.7 (nft) | <= v1.5.1 | iptables are all early versions with no compatibility issues. |
1.32~1.34 | v1.8.9 (nft) | v1.5.2+ (recommended to use the latest version) | iptables are all latest versions with no compatibility issues. |
Overview
Add-on description
Network Policy is a resource provided by Kubernetes for defining pod-based network isolation policies. It describes whether a group of pods can communicate with other groups of pods and other network entities. This add-on provides a controller for implementing resources of this type. You can use this add-on if you want to control the network traffic of specific applications at the IP address or port layer (layer 3 or layer 4 of OSI).
Kubernetes objects deployed in a cluster
|
| | Each instance: CPU: 250m, Memory: 250Mi | |
| | | |
| | | |
| | | |
Component Permission Description
Permission Description
The permission of this component is the minimal dependency required for the current feature to operate.
Access to the namespaces, pods, services, nodes, endpoints, and networkpolicies within the cluster is required, thus necessitating list/get/watch permission.
Permission Definition
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: networkpolicy
rules:
- apiGroups:
- ""
resources:
- namespaces
- pods
- services
- nodes
- endpoints
verbs:
- list
- get
- watch
- apiGroups:
- "networking.k8s.io"
resources:
- networkpolicies
verbs:
- list
- get
- watch
- apiGroups:
- extensions
resources:
- networkpolicies
verbs:
- get
- list
- watch
Directions
1. Log in to the TKE console and select Cluster in the left sidebar. 2. On the “Cluster Management page, click the ID of the target cluster to go to the cluster details page.
3. In the left sidebar, click Add-on Management to go to the Add-on List page.
4. On the Add-on List page, click Create and select NetworkPolicy in the pop-up Create Add-on window. For details of NetworkPolicy configuration, see Best Practices for Network Policy. 5. Click Done.