CFP: Support AdminNetworkPolicy

[sathieu]

Cilium Feature Proposal

Is your feature request related to a problem?

No

Describe the feature you'd like

Support for AdminNetworkPolicy, as described in kubernetes/enhancements#2091

[pchaigno]

FYI, the difficult part here is the priority-based policies. It's generally difficult to build packet classification algorithms that take priorities into account while being efficient at scale.

[sathieu]

@pchaigno Thanks for the info. I don't know if Cilium was involved in defining the specs, and maybe something was missed at that time. I see that AdminNetworkPolicy (with BaselineAdminNetworkPolicy) is half of the future NPv2, the other being developper-focused policies (mabe by using current NetworkPolicies).

As cluster admins, we need cluster-scoped firewall rules (both baseline rules, overrridable ; and non-overridable rules). Current CiliumClusterwideNetworkPolicy lacks some of our needs:

• rules are overridable by namespace-scoped resources
• when a pod is matched by a rule, the pod goes to default deny

Also we prefer to use non vendor-specific CRDs.

AdminNetworkPolicy (with BaselineAdminNetworkPolicy) match our needs, but the priority field is a very complex way to fulfill our needs (as mentioned here).

[ysksuzuki]

I'm interested in the AdminNetworkPolicy support because we see the potential to make our policy setup simple and easy to maintain. I'm wondering if it would be possible to interpret the AdminNetworkPolicy manifests on the agent side and put the data in the policy map with the current data structure(or with some tweaks). Obviously, it's not that easy though. I think it's worth trying it.

[tssurya]

/cc

I work on the upstream ANP/BANP API: https://github.com/kubernetes-sigs/network-policy-api
I am interested in this issue as we are looking to unify the way CNIs do the NP API's to align with the upstream one. Let us know if there are any major "can't implement or translate this x part of the API in our plugin" kind of roadblocks and please feel free to give us feedback on use cases we might not have considered. We are currently on the alphav1 version and want to understand the challenges implementors are running into before graduation.

I can see there is a note #23380 (comment) on the difficultly of implementing the "priority" field.. Is that only from a point of view of efficiency or other aspects as well? Priority is actually a powerful way to classify the rules for the API specially since the scope is cluster-wide..

[github-actions]

This issue has been automatically marked as stale because it has not
had recent activity. It will be closed if no further activity occurs.

[sathieu]

not stale

NB: we are able to workaround the feature by using always Policy Enforcement Mode and Deny policies. However, this is Cilium-specific.

[aojea]

/cc

[danehans]

/cc