-
Notifications
You must be signed in to change notification settings - Fork 261
Update doc for PNI in GKE #2073
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
367e483 to
64b17a1
Compare
| _Mutable: yes_ | ||
|
|
||
| choose whether to enable or disable inter-project communication. Note that enabling Project Network Isolation will automatically enable Network Policy and Network Policy Config, but not vice versa. | ||
| choose whether to enable or disable inter-project communication. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
| choose whether to enable or disable inter-project communication. | |
| Choose whether to enable or disable inter-project communication. |
| :::note | ||
|
|
||
| For **imported GKE clusters**, Project Network Isolation (PNI) requires Kubernetes Network Policy to be enabled on the cluster beforehand. | ||
| - Rancher will enable Network Policy automatically when creating clusters in Rancher (downstream), so this step is only needed for imported clusters. | ||
| - In GKE, enable network policy (Calico) on **both master and worker nodes**: **Networking → Network security and observability → Enable Calico Kubernetes Network Policy**. | ||
| - After enabling, import the cluster into Rancher and enable PNI for project-level isolation. | ||
|
|
||
| ::: |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
| :::note | |
| For **imported GKE clusters**, Project Network Isolation (PNI) requires Kubernetes Network Policy to be enabled on the cluster beforehand. | |
| - Rancher will enable Network Policy automatically when creating clusters in Rancher (downstream), so this step is only needed for imported clusters. | |
| - In GKE, enable network policy (Calico) on **both master and worker nodes**: **Networking → Network security and observability → Enable Calico Kubernetes Network Policy**. | |
| - After enabling, import the cluster into Rancher and enable PNI for project-level isolation. | |
| ::: | |
| #### Imported Clusters | |
| For imported clusters, Project Network Isolation (PNI) requires enabling Kubernetes Network Policy on the cluster beforehand. For clusters created by Rancher, Rancher automatically enables Kubernetes Network Policy. | |
| 1. In GKE, enable network policy (Calico) on **both master and worker nodes** | |
| 1. Select the cluster to enable network policy on. | |
| 1. **Networking → Network security and observability → Enable Calico Kubernetes Network Policy**. | |
| 1. In Rancher, import the cluster and enable PNI for project-level isolation. |
Thoughts on converting it into a subsection so that it can be linked if needed?
Some questions:
- Is
**both master and worker nodes**a field that appears in the GKE console or is it intended to be text telling users they need to do it for both? - For the steps done in GKE, are we replicating these instructions? If so, maybe we could link to that to reduce maintenance if upstream changes anything.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Answering your questions
Both master and worker nodesis not a field in the GKE console. GKE only has one option to enable Network Policy, and when you turn it on, GKE applies it to the whole cluster automatically. I removed that wording to avoid confusion.- agree, we should link instead of duplicating exact UI steps
Fixes #<add_issue_number_if_any>
Description
Comments