Add tiered policies to Calico OSS #1699

mazdakn · 2024-10-03T17:16:05Z

Doc changes related to:

Supporting tiered policy in Calico OSS v3.29: Add tiered policy support projectcalico/calico#9085
Allowing users to specify tier's default action, i.e. defaultAction: Introduce default action in tiers projectcalico/calico#9232

Product Version(s): Calico v3.29, Calico Enterprise v3.20.2

Issue:

Link to docs preview:

SME review:

An SME has approved this change.

DOCS review:

A member of the docs team has approved this change.

Additional information:

Merge checklist:

Deploy preview inspected wherever changes were made
Build completed successfully
Test have passed

netlify · 2024-10-03T17:16:22Z

✅ Deploy Preview for calico-docs-preview-next ready!

Name	Link
🔨 Latest commit	`42203bf`
🔍 Latest deploy log	https://app.netlify.com/sites/calico-docs-preview-next/deploys/671297d9d39a84000777d4c7
😎 Deploy Preview	https://deploy-preview-1699--calico-docs-preview-next.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
Lighthouse	1 paths audited Performance: 50 (🟢 up 15 from production) Accessibility: 90 (no change from production) Best Practices: 83 (no change from production) SEO: 86 (no change from production) PWA: - View the detailed breakdown and full score reports

To edit notification comments on pull requests, go to your Netlify site configuration.

netlify · 2024-10-03T17:16:22Z

✅ Deploy Preview succeeded!

Built without sensitive environment variables

Name	Link
🔨 Latest commit	`42203bf`
🔍 Latest deploy log	https://app.netlify.com/sites/tigera/deploys/671297d9f367500008a4da4c
😎 Deploy Preview	https://deploy-preview-1699--tigera.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
Lighthouse	1 paths audited Performance: 47 (🟢 up 23 from production) Accessibility: 90 (no change from production) Best Practices: 75 (no change from production) SEO: 93 (no change from production) PWA: - View the detailed breakdown and full score reports

To edit notification comments on pull requests, go to your Netlify site configuration.

calico-cloud/network-policy/policy-tiers/tiered-policy.mdx

calico/network-policy/policy-tiers/tiered-policy.mdx

calico-enterprise/network-policy/policy-tiers/tiered-policy.mdx

tomastigera · 2024-10-04T19:51:57Z

calico-enterprise/network-policy/policy-tiers/tiered-policy.mdx

@@ -94,7 +102,7 @@ In the example above, tier priorities are as follows:

 - **security tier** - is higher priority than platform tier
 - **platform tier** - is higher priority than default tier
- **default tier** - is always the last tier and cannot be reordered
+- **default tier** - is the lowest priority than the rest


Suggested change

- **default tier** - is the lowest priority than the rest

- **default tier** - is the lowest priority.

Previously, is could not be reordered, now it has an order. Can it be reordered? If yes, it would be worth to say that "previously it could not be reordered. It can be now, but we advise against that" or something similar?

No, the default tier must have the order of 1M. It cannot be reordered. Previously, it had an order of nil, and now it is 1M and it cannot change. Also any tier with nil order will be treated as 1M.
We will add a release note to warn customers about the change.

calico-enterprise/network-policy/policy-tiers/tiered-policy.mdx

tomastigera · 2024-10-04T20:01:03Z

calico-enterprise/reference/resources/tier.mdx

@@ -28,7 +28,7 @@ Policies in each Tier are then processed in order.
 - If a [NetworkPolicy](networkpolicy.mdx) or [GlobalNetworkPolicy](globalnetworkpolicy.mdx) in the Tier `Allow`s or `Deny`s the packet, then evaluation is done: the packet is handled accordingly.
 - If a [NetworkPolicy](networkpolicy.mdx) or [GlobalNetworkPolicy](globalnetworkpolicy.mdx) in the Tier `Pass`es the packet, the next Tier containing a Policy that applies to the endpoint processes the packet.

-If the Tier applies to the endpoint, but takes no action on the packet the packet is dropped.
+If the Tier applies to the endpoint, but takes no action on the packet the packet is dropped by default. This behaviour can be changed by setting the `defaultAction` to `Pass` for a tier.


Suggested change

If the Tier applies to the endpoint, but takes no action on the packet the packet is dropped by default. This behaviour can be changed by setting the `defaultAction` to `Pass` for a tier.

If the Tier applies to the endpoint, but takes no action on the packet the packet is dropped by. This behaviour can be changed by setting the `defaultAction` to `Pass` for a tier.

Perhaps chance to clarify If the Tier applies to the endpoint as I was confused what it mean myself. It means that that tier contains a rule that applies to an endpoint? How can it apply to an endpoint and not to take an action? Example?

This page is about documenting the resource itself. I believe it should be short and to the point. There is more description about this topic in the tiered policy page: https://docs.tigera.io/calico-enterprise/latest/network-policy/policy-tiers/tiered-policy#default-endpoint-behavior

tomastigera · 2024-10-04T20:05:24Z

calico/network-policy/policy-tiers/rbac-tiered-policies.mdx

+description: Configure RBAC to control access to policies and tiers.
+---
+
+# Configure RBAC for tiered policies


I suppose this is just a plain copy from EE, isn't it?

How does the RBAC play with ANP tier? Is there some RBAC created by default or do kubernetes handle it on their own? Idk how it works, just double checking here!

FYI @mazdakn

Yes, this is just a copy from EE.
ANP design states the API is for cluster administrators. This is not something we enforce though. We provide Tier's RBAC for users to configure the access, so in the end it's up to users to setup the access properly.

calico/network-policy/policy-tiers/tiered-policy.mdx

tomastigera · 2024-10-04T20:12:43Z

calico/network-policy/policy-tiers/tiered-policy.mdx

+
+## The default tier:
+
+The default tier is created during installation and has the order of 1,000,000.


Suggested change

The default tier is created during installation and has the order of 1,000,000.

The default tier is created during installation and has the order of 1,000,000. The desire is to evaluate policies in the default tier as last.

I meantioned it before, but worth spelling it out explicitly whether the order can by changed.

calico-cloud/network-policy/policy-tiers/tiered-policy.mdx

calico/network-policy/policy-tiers/tiered-policy.mdx

ctauchen · 2024-10-07T17:04:20Z

calico-cloud/reference/resources/tier.mdx

-<!--TODO-XREF-CC
-If the last Tier applying to the endpoint `Pass`es the packet, that endpoint's [Profiles](/reference/resources/profile) are evaluated.
-->
+If the last Tier applying to the endpoint `Pass`es the packet, that endpoint's [Profiles](profile.mdx) are evaluated.


This xref breaks the build. An example of a file from the CE docs that doesn't exist in CC.

Co-authored-by: Tomas Hruby <[email protected]>

Fixes link error and adds OSS tier docs to sidebars

tomastigera

a few tiny typos

calico-cloud/network-policy/policy-tiers/tiered-policy.mdx

tomastigera · 2024-10-17T19:02:31Z

calico-enterprise/network-policy/policy-tiers/tiered-policy.mdx

@@ -62,6 +62,10 @@ The default tier is where:
 - Network and global network policies are placed when you upgrade from Project Calico to {{prodname}}
 - Recommended policies are placed when you use the **Recommend a policy** feature

+## AdminNetworkPolicy tier:
+
+The AdminNetworkPolicy tier where all [Kubernetes admin network policies](https://network-policy-api.sigs.k8s.io/reference/examples/) reside. It is automatically created during installation and has the order of 1,000. This value is fixed, and cannot be changed.


Suggested change

The AdminNetworkPolicy tier where all [Kubernetes admin network policies](https://network-policy-api.sigs.k8s.io/reference/examples/) reside. It is automatically created during installation and has the order of 1,000. This value is fixed, and cannot be changed.

The AdminNetworkPolicy tier is where all [Kubernetes admin network policies](https://network-policy-api.sigs.k8s.io/reference/examples/) reside. It is automatically created during installation and has the order of 1,000. This value is fixed, and cannot be changed.

tomastigera · 2024-10-17T19:03:16Z

calico-enterprise/network-policy/policy-tiers/tiered-policy.mdx

@@ -86,21 +90,21 @@ Now you can reorder tiers by dragging and moving them.

 ## Tier order

-Tiers are ordered from left to right, starting with the highest priority (also called highest precedence) tiers.
+Tiers are ordered based on their orders (from left to right), starting from the lowest order (the highest priority) tiers.


Suggested change

Tiers are ordered based on their orders (from left to right), starting from the lowest order (the highest priority) tiers.

Tiers are sorted by their orders (from left to right), starting from the lowest order (the highest priority) tiers.

tomastigera · 2024-10-17T19:07:09Z

calico/network-policy/policy-tiers/tiered-policy.mdx

+
+## AdminNetworkPolicy tier:
+
+The AdminNetworkPolicy tier where all [Kubernetes admin network policies](https://network-policy-api.sigs.k8s.io/reference/examples/) reside. It is automatically created during installation and has the order of 1,000. This value is fixed, and cannot be changed.


Suggested change

The AdminNetworkPolicy tier where all [Kubernetes admin network policies](https://network-policy-api.sigs.k8s.io/reference/examples/) reside. It is automatically created during installation and has the order of 1,000. This value is fixed, and cannot be changed.

The AdminNetworkPolicy tier is where all [Kubernetes admin network policies](https://network-policy-api.sigs.k8s.io/reference/examples/) reside. It is automatically created during installation and has the order of 1,000. This value is fixed, and cannot be changed.

ctauchen · 2024-10-18T14:38:43Z

@tmjd There are some changes here to the CC tiers docs. They appear to be removing innocuous diffs between the CE and CC versions. But might be a good idea for you do take a quick pass at the changes here to see if anything is wrong for CC.

ctauchen · 2024-10-18T14:42:43Z

calico/network-policy/policy-tiers/rbac-tiered-policies.mdx

+    --user=<USER\>
+```
+
+### Create minimum permissions for all non-Admin users


This section discusses the UI. Not sure how much needs removing. What do you think?

Right. Removed it.

I believe we can remove the whole section.

ctauchen · 2024-10-18T15:11:01Z

calico/network-policy/policy-tiers/rbac-tiered-policies.mdx

+description: Configure RBAC to control access to policies and tiers.
+---
+
+# Configure RBAC for tiered policies


FYI @mazdakn

tmjd · 2024-10-18T18:12:48Z

@ctauchen I don't see anything that should be different for Calico Cloud.

ctauchen · 2024-10-21T16:15:41Z

LGTM

mazdakn requested a review from a team as a code owner October 3, 2024 17:16

This was referenced Oct 3, 2024

Add tiered policy support projectcalico/calico#9085

Merged

Introduce default action in tiers projectcalico/calico#9232

Merged

Add docs for tier support in Calico OSS

edc8f1f

mazdakn force-pushed the calico-tiers branch from 1e58f2a to edc8f1f Compare October 4, 2024 18:43

mazdakn commented Oct 4, 2024

View reviewed changes

calico-cloud/network-policy/policy-tiers/tiered-policy.mdx Show resolved Hide resolved

mazdakn commented Oct 4, 2024

View reviewed changes

calico/network-policy/policy-tiers/tiered-policy.mdx Show resolved Hide resolved

tomastigera reviewed Oct 4, 2024

View reviewed changes

calico-enterprise/network-policy/policy-tiers/tiered-policy.mdx Outdated Show resolved Hide resolved

tomastigera reviewed Oct 4, 2024

View reviewed changes

tomastigera suggested changes Oct 4, 2024

View reviewed changes

ctauchen reviewed Oct 7, 2024

View reviewed changes

mazdakn and others added 5 commits October 7, 2024 15:44

Update calico-enterprise/network-policy/policy-tiers/tiered-policy.mdx

3eb9ead

Co-authored-by: Tomas Hruby <[email protected]>

Fixes link error and adds OSS tier docs to sidebars

cd206f9

Merge pull request #1 from ctauchen/calico-tiers

ebc788a

Fixes link error and adds OSS tier docs to sidebars

fix

dfeae86

address comments

39c7512

mazdakn requested review from ctauchen and tomastigera October 15, 2024 22:24

tomastigera reviewed Oct 17, 2024

View reviewed changes

Address comments

55dae98

mazdakn requested a review from tomastigera October 17, 2024 21:47

ctauchen reviewed Oct 18, 2024

View reviewed changes

Remove UI section in RBAC page

42203bf

mazdakn requested a review from ctauchen October 18, 2024 23:07

ctauchen merged commit 918ec0c into tigera:main Oct 21, 2024
10 checks passed

mazdakn deleted the calico-tiers branch October 21, 2024 16:23

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add tiered policies to Calico OSS #1699

Add tiered policies to Calico OSS #1699

mazdakn commented Oct 3, 2024 •

edited

Loading

netlify bot commented Oct 3, 2024 •

edited

Loading

netlify bot commented Oct 3, 2024 •

edited

Loading

tomastigera Oct 4, 2024

mazdakn Oct 7, 2024 •

edited

Loading

tomastigera Oct 4, 2024

mazdakn Oct 15, 2024

tomastigera Oct 4, 2024

ctauchen Oct 18, 2024

mazdakn Oct 18, 2024

tomastigera Oct 4, 2024

ctauchen Oct 7, 2024

tomastigera left a comment

tomastigera Oct 17, 2024

mazdakn Oct 17, 2024

tomastigera Oct 17, 2024

mazdakn Oct 17, 2024

tomastigera Oct 17, 2024

mazdakn Oct 17, 2024

ctauchen commented Oct 18, 2024

ctauchen Oct 18, 2024

mazdakn Oct 18, 2024

mazdakn Oct 18, 2024

ctauchen Oct 18, 2024

tmjd commented Oct 18, 2024

ctauchen commented Oct 21, 2024

	- default tier - is the lowest priority than the rest
	- default tier - is the lowest priority.

	If the Tier applies to the endpoint, but takes no action on the packet the packet is dropped by default. This behaviour can be changed by setting the `defaultAction` to `Pass` for a tier.
	If the Tier applies to the endpoint, but takes no action on the packet the packet is dropped by. This behaviour can be changed by setting the `defaultAction` to `Pass` for a tier.


		## The default tier:

		The default tier is created during installation and has the order of 1,000,000.

	The AdminNetworkPolicy tier where all [Kubernetes admin network policies](https://network-policy-api.sigs.k8s.io/reference/examples/) reside. It is automatically created during installation and has the order of 1,000. This value is fixed, and cannot be changed.
	The AdminNetworkPolicy tier is where all [Kubernetes admin network policies](https://network-policy-api.sigs.k8s.io/reference/examples/) reside. It is automatically created during installation and has the order of 1,000. This value is fixed, and cannot be changed.

	Tiers are ordered based on their orders (from left to right), starting from the lowest order (the highest priority) tiers.
	Tiers are sorted by their orders (from left to right), starting from the lowest order (the highest priority) tiers.


		## AdminNetworkPolicy tier:

		The AdminNetworkPolicy tier where all [Kubernetes admin network policies](https://network-policy-api.sigs.k8s.io/reference/examples/) reside. It is automatically created during installation and has the order of 1,000. This value is fixed, and cannot be changed.

Add tiered policies to Calico OSS #1699

Add tiered policies to Calico OSS #1699

Conversation

mazdakn commented Oct 3, 2024 • edited Loading

netlify bot commented Oct 3, 2024 • edited Loading

✅ Deploy Preview for calico-docs-preview-next ready!

netlify bot commented Oct 3, 2024 • edited Loading

✅ Deploy Preview succeeded!

Choose a reason for hiding this comment

mazdakn Oct 7, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

tomastigera left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ctauchen commented Oct 18, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

tmjd commented Oct 18, 2024

ctauchen commented Oct 21, 2024

mazdakn commented Oct 3, 2024 •

edited

Loading

netlify bot commented Oct 3, 2024 •

edited

Loading

netlify bot commented Oct 3, 2024 •

edited

Loading

mazdakn Oct 7, 2024 •

edited

Loading