From 08b566111d7a9736dd2fc5fb3c5febbaf72a3c0b Mon Sep 17 00:00:00 2001 From: Arhell Date: Tue, 3 Nov 2020 10:54:58 +0200 Subject: [PATCH 1/3] fix heading level --- .../docs/concepts/services-networking/network-policies.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/content/en/docs/concepts/services-networking/network-policies.md b/content/en/docs/concepts/services-networking/network-policies.md index 8110996397f2d..7d417e4df1586 100644 --- a/content/en/docs/concepts/services-networking/network-policies.md +++ b/content/en/docs/concepts/services-networking/network-policies.md @@ -10,12 +10,12 @@ weight: 50 -If you want to control traffic flow at the IP address or port level (OSI layer 3 or 4), then you might consider using Kubernetes NetworkPolicies for particular applications in your cluster. NetworkPolicies are an application-centric construct which allow you to specify how a {{< glossary_tooltip text="pod" term_id="pod">}} is allowed to communicate with various network "entities" (we use the word "entity" here to avoid overloading the more common terms such as "endpoints" and "services", which have specific Kubernetes connotations) over the network. +If you want to control traffic flow at the IP address or port level (OSI layer 3 or 4), then you might consider using Kubernetes NetworkPolicies for particular applications in your cluster. NetworkPolicies are an application-centric construct which allow you to specify how a {{< glossary_tooltip text="pod" term_id="pod">}} is allowed to communicate with various network "entities" (we use the word "entity" here to avoid overloading the more common terms such as "endpoints" and "services", which have specific Kubernetes connotations) over the network. The entities that a Pod can communicate with are identified through a combination of the following 3 identifiers: 1. Other pods that are allowed (exception: a pod cannot block access to itself) -2. Namespaces that are allowed +2. Namespaces that are allowed 3. IP blocks (exception: traffic to and from the node where a Pod is running is always allowed, regardless of the IP address of the Pod or the node) When defining a pod- or namespace- based NetworkPolicy, you use a {{< glossary_tooltip text="selector" term_id="selector">}} to specify what traffic is allowed to and from the Pod(s) that match the selector. @@ -219,7 +219,7 @@ When the feature gate is enabled, you can set the `protocol` field of a NetworkP You must be using a {{< glossary_tooltip text="CNI" term_id="cni" >}} plugin that supports SCTP protocol NetworkPolicies. {{< /note >}} -# What you CAN'T do with network policies (at least, not yet) +## What you can't do with network policies (at least, not yet) As of Kubernetes 1.20, the following functionality does not exist in the NetworkPolicy API, but you might be able to implement workarounds using Operating System components (such as SELinux, OpenVSwitch, IPTables, and so on) or Layer 7 technologies (Ingress controllers, Service Mesh implementations) or admission controllers. In case you are new to network security in Kubernetes, its worth noting that the following User Stories cannot (yet) be implemented using the NetworkPolicy API. Some (but not all) of these user stories are actively being discussed for future releases of the NetworkPolicy API. From ace3ea8d1aef7a91ae2ab010eebadec06ab0a193 Mon Sep 17 00:00:00 2001 From: inductor Date: Wed, 4 Nov 2020 20:38:16 +0900 Subject: [PATCH 2/3] Add link to KubeCon Virtual EU 2021 --- content/en/_index.html | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/content/en/_index.html b/content/en/_index.html index c2ec627065fde..b738a915ef416 100644 --- a/content/en/_index.html +++ b/content/en/_index.html @@ -44,6 +44,11 @@

The Challenges of Migrating 150+ Microservices to Kubernetes



Attend KubeCon NA virtually on November 17-20, 2020 +
+
+
+
+ Attend KubeCon EU virtually on May 4 – 7, 2021
From 6fdb3e10d7f6b7857924f708ecc18f0d205989df Mon Sep 17 00:00:00 2001 From: Tim Hockin Date: Wed, 4 Nov 2020 08:59:16 -0800 Subject: [PATCH 3/3] Revert storage-related topology changes --- content/en/docs/concepts/storage/storage-classes.md | 2 +- content/en/docs/concepts/storage/volumes.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/content/en/docs/concepts/storage/storage-classes.md b/content/en/docs/concepts/storage/storage-classes.md index 9729913dde4f2..587cc8a501443 100644 --- a/content/en/docs/concepts/storage/storage-classes.md +++ b/content/en/docs/concepts/storage/storage-classes.md @@ -209,7 +209,7 @@ parameters: volumeBindingMode: WaitForFirstConsumer allowedTopologies: - matchLabelExpressions: - - key: topology.kubernetes.io/zone + - key: failure-domain.beta.kubernetes.io/zone values: - us-central1-a - us-central1-b diff --git a/content/en/docs/concepts/storage/volumes.md b/content/en/docs/concepts/storage/volumes.md index 0a8a34bb400ff..39410ec2e5319 100644 --- a/content/en/docs/concepts/storage/volumes.md +++ b/content/en/docs/concepts/storage/volumes.md @@ -449,7 +449,7 @@ spec: required: nodeSelectorTerms: - matchExpressions: - - key: topology.kubernetes.io/zone + - key: failure-domain.beta.kubernetes.io/zone operator: In values: - us-central1-a