From 6d921802e2edbb1d2f61c58aa69b2bdb9fa11f19 Mon Sep 17 00:00:00 2001 From: Martynas Pumputis Date: Tue, 14 Aug 2018 11:59:12 +0200 Subject: [PATCH] Add recommendation to docs about ingress.ipBlock usage Also, update link to NetworkPolicy API object spec. --- site/kubernetes/kube-addon.md | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/site/kubernetes/kube-addon.md b/site/kubernetes/kube-addon.md index 1f13e0a9..46528440 100644 --- a/site/kubernetes/kube-addon.md +++ b/site/kubernetes/kube-addon.md @@ -154,7 +154,7 @@ labels. For more information on configuring network policies in Kubernetes see the [walkthrough](https://kubernetes.io/docs/tasks/administer-cluster/declare-network-policy/) and the [NetworkPolicy API object -definition](https://v1-7.docs.kubernetes.io/docs/api-reference/v1.7/#networkpolicy-v1-networking) +definition](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.11/#networkpolicy-v1-networking-k8s-io) **Note:** as of version 1.9 of Weave Net, the Network Policy Controller allows all multicast traffic. Since a single multicast @@ -163,6 +163,11 @@ definition](https://v1-7.docs.kubernetes.io/docs/api-reference/v1.7/#networkpoli all multicast traffic) by adding `--allow-mcast=false` as an argument to `weave-npc` in the YAML configuration. +**Note:** Since ingress traffic is masqueraded, it makes sense to use +`ipBlock` selector in an ingress rule only when limiting access to a Service +annotated with `externalTrafficPolicy=Local` or between Pods when `podIP` is used +to access a Pod. + ## Troubleshooting The first thing to check is whether Weave Net is up and