Applying Kubernetes network policies to containers with SR-IOV VF

[edgenfv]

I am using Kubernetes to create containers mapped with SR-IOV VF. For this purpose, I use Kubernetes SR-IOV network device plugin.
Now I need to apply Kubernetes network policies to the attached SR-IOV VF.
Can the SR-IOV network device plugin enforce the network policies to the SR-IOV VF.

[adrianchiris]

Hi @edgenfv , enforcing network policies is a k8s network plugin responsibility (CNI)

for secondary network there is:

https://github.com/k8snetworkplumbingwg/multi-networkpolicy
https://github.com/k8snetworkplumbingwg/multi-networkpolicy-iptables

[SchSeba]

Hi @edgenfv another comment on the project shared by @adrianchiris this will only work on sriov nics attached to kernel drivers, not DPDK drivers.

[SchSeba]

one more comment in the deployment (https://github.com/k8snetworkplumbingwg/multi-networkpolicy-iptables/blob/master/deploy.yml#L99) you need to add this line to support also sriov

- "--network-plugins=macvlan,sriov"

[adrianchiris]

@edgenfv is there any more input you require ?

[SchSeba]

no update in about 2 months closing this issue