NetworkPolicy resources

[mathieu-benoit]

Fine granular NetworkPolicy resources for Online Boutique

Couple of thoughts and discussions about these new manifests:

• Not in vanilla/default kubernetes-manifests folder, that's extra manifests for now.

Not part of this PR, but future considerations:

• Use these NetworkPolicy resources CI process for each PR
• Deploy in our own Production environment hosting https://onlineboutique.dev/ (not yet done, let's chat about that before)
• Do the same approach for Bank of Anthos

[github-actions]

🚲 PR staged at http://35.193.239.45

[github-actions]

🚲 PR staged at http://35.193.239.45

[github-actions]

🚲 PR staged at http://35.193.239.45

[github-actions]

🚲 PR staged at http://35.193.239.45

[NimJay]

Note from 1-on-1 with Mathieu:

• I will need to test this on a cluster with Dataplane V2. See docs/network-policies.md.

[github-actions]

🚲 PR staged at http://35.193.239.45

[NimJay]

Thanks so much for adding these samples, @mathieu-benoit!

I've made a few comments.
I'm happy to apply these changes myself later today — if you'd like. :)

I've tested everything (in my own GKE cluster) except for step 5 of network-policies.md which I've proposed we shorten (i.e., just link to Exploring Anthos Service Mesh in the Cloud Console).

We'll talk further during our 1-on-1 today.

[github-actions]

🚲 PR staged at http://35.193.239.45

[mathieu-benoit]

Thanks @NimJay for your comments, review and suggestions. I think I took into account all your points, please let me know if you see anything else. Thanks!

[github-actions]

🚲 PR staged at http://35.193.239.45

[github-actions]

🚲 PR staged at http://35.193.239.45

[github-actions]

🚲 PR staged at http://35.193.239.45

[mathieu-benoit]

FYI: since we talked, I also took the initiative to prefix the files of these new resources by networkpolicy_. As a good practice by anticipating end-users having in same folder the kubernetes-manifests and these, and so, to avoid any conflict with file names. Also by anticipation of coming PRs with Sidecar, ServiceAccount, AuthorizationPolicy, etc. resources which will follow that same pattern. Hope that's ok with you and that makes sense?

[github-actions]

🚲 PR staged at http://35.193.239.45

[github-actions]

🚲 PR staged at http://35.193.239.45

[NimJay]

Thanks for addressing all my concerns!
The new changes look good.

I like the idea of prefixing the files with something like "networkpolicy_", but I've gone ahead and used dashes to be consistent with file naming conventions of this repo and other repos.
I have also made some minors adjustments to the README.md file (see commits).

Everything looks good!
I'm so happy about this additional. Thanks again, @mathieu-benoit, for all your hard work here!
Approved.

[NimJay]

Hi @askmeegs,

This is the pull-request that we decided (during our meeting yesterday) to revert.
Reasons for reverting:

• we want to keep the maintenance cost of this (Online Boutique) repo as low as possible.
• product-specific sample code should live in the repository associated with that product (i.e., in kubernetes-engine-samples, anthos-service-mesh-samples, anthos-config-management-samples, etc.).
• we expect users to discover sample manifests through their associated tutorials — not sample app source code.

However, I'm realizing that the samples from this pull-request:

1. are samples we were planning on applying to onlineboutique.dev.
2. will not be included in a tutorial (unlike the samples from pull/781). So after we revert this pull-request, these samples will not be included in kubernetes-engine-samples or any other repo.

So before I revert, I want to know what you think about applying these manifests to onlineboutique.dev and moving them to /.github/release-cluster. For instance, do you think it's even worth adding this to onlineboutique.dev?

Note: I talked with @mathieu-benoit and we're both totally okay with deleting these samples forever, so please don't feel pressured to preserve these samples. :)
If you'd like, we can chat about it during our 1-on-1 tomorrow.
Thank you.

CC: @bourgeoisor