DOCS-2334: Docs for L7 rearchitecture with Envoy as sidecar containers #1714

ctauchen · 2024-10-10T12:26:37Z

This PR is a continuation of #1648, which is now closed.

netlify · 2024-10-10T12:26:53Z

✅ Deploy Preview succeeded!

Built without sensitive environment variables

Name	Link
🔨 Latest commit	`1fcee71`
🔍 Latest deploy log	https://app.netlify.com/sites/tigera/deploys/670e4f4519890f000847b91d
😎 Deploy Preview	https://deploy-preview-1714--tigera.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
Lighthouse	1 paths audited Performance: 24 (no change from production) Accessibility: 90 (no change from production) Best Practices: 75 (no change from production) SEO: 93 (no change from production) PWA: - View the detailed breakdown and full score reports

To edit notification comments on pull requests, go to your Netlify site configuration.

netlify · 2024-10-10T12:26:54Z

✅ Deploy Preview for calico-docs-preview-next ready!

Name	Link
🔨 Latest commit	`1fcee71`
🔍 Latest deploy log	https://app.netlify.com/sites/calico-docs-preview-next/deploys/670e4f45cb58510008649a00
😎 Deploy Preview	https://deploy-preview-1714--calico-docs-preview-next.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
Lighthouse	1 paths audited Performance: 41 (🔴 down 13 from production) Accessibility: 90 (no change from production) Best Practices: 83 (no change from production) SEO: 86 (no change from production) PWA: - View the detailed breakdown and full score reports

To edit notification comments on pull requests, go to your Netlify site configuration.

ctauchen · 2024-10-10T12:29:12Z

calico-enterprise/threat/web-application-firewall.mdx

@@ -24,7 +24,7 @@ Historically, web application firewalls (WAFs) were deployed at the edge of your

 ### About {{prodname}} WAF

-WAF is deployed in your cluster along with Envoy DaemonSet. {{prodname}} proxies selected service traffic through Envoy, checking HTTP requests using the industry-standard
+WAF is deployed in your cluster with Envoy as a sidecar container on your pods. {{prodname}} proxies selected service traffic through Envoy, checking HTTP requests using the industry-standard


There seems to be a difference between the old and new concerning services vs deployments. With sidecars, it looks like you need to annotate deployments rather than services.

Is it fair to guess that we should review all instances of 'service' and consider replacing with 'deployment'?

We can swap from:
{{prodname}} proxies selected service traffic through Envoy,
to:
{{prodname}} proxies all traffic through Envoy sidecar,

Yes, we need to change service to deployment where it is talking about the enable of the feature.

@ctauchen yes that's right. In this case I think the sentence can be

"WAF is deployed in your cluster with Envoy as a sidecar container on your pods. {{prodname}} proxies traffic for the selected pods through Envoy, checking HTTP requests using the industry-standard..."

Got it, changing service to deployment throughout.

@peterkellydev @radixo The deployment/service question is more complex than I'd realized, particularly with the WAF doc. We have examples using services, a note talking about how you shouldn't apply WAF to system services, and so on.

I'm thinking that we may need someone who knows what they're doing here (not me) to look through and mark the s/service/deployment locations in the doc.

By my naive understanding, we shouldn't be talking about services much at all, now that we've switched the WAF delivery mechanism to deployments exclusively. What relevance do services have on this page?

ctauchen · 2024-10-10T12:30:20Z

calico-enterprise/visibility/elastic/l7/configure.mdx


-**Limitations**
+* L7 logging is not compatible with a service mesh such as Istio.


@peterkellydev In my notes I've got this limitation for all L7 features. In our current docs, it's mentioned only for ALP. I've added to all three, but let me know if I've got that wrong.

Yes adding to all 3 is good.

Thanks for confirming. Leaving these as they are.

ctauchen

@radixo @peterkellydev I've drafted changes as discussed. This changes the docs to be sidecar-only. Please pay special attention to limitations -- I suspect some remain that apply only to daemonset mode.

You can disregard formatting changes -- I'll see that that all gets sorted in my final review.

peterkellydev · 2024-10-11T14:09:25Z

calico-enterprise/network-policy/application-layer-policies/alp.mdx

+* Application layer policy is not compatible with a service mesh such as Istio.
+* Application layer policy can restrict only _ingress_ traffic.
+  It can not restrict egress traffic.
+* Support for L7 attributes is limited to HTTP method and URL exact/prefix path.


I'm not sure these two bullets about attributes and protocols are limitations - they're just what the feature currently supports. I know they're pre-existing as limitations so it's fine to leave them I guess, I just think the section is less about what the feature supports / was implemented so far vs. things like platform limitations etc

Limitations are loosely defined, but I'd characterize them as anything that describes a functionality that a user might reasonably expect the product to have, but that the product doesn't have. Whether and how we call those out is a judgement call. I'll leave this for now, as you suggest, but we can certainly reconsider these.

peterkellydev · 2024-10-11T14:14:37Z

calico-enterprise/threat/web-application-firewall.mdx

+* Host-networked client pods
+* TLS traffic
+* [LoadBalancer services](https://Kubernetes.io/docs/concepts/services-networking/service/#loadbalancer)
+* Egress gateways


Egress Gateway is no longer a limitation in the new mode.

Line removed, thanks.

peterkellydev · 2024-10-11T14:15:57Z

calico-enterprise/threat/web-application-firewall.mdx


 ```bash
-kubectl annotate svc <service-name> -n <service-namespace> projectcalico.org/l7-logging-
+   kubectl patch deployment <deployment-name> -n <deployment-namespace> --type='json' -p '[{"op":"remove","path":"/spec/template/metadata/labels/applicationlayer.projectcalico.org~1sidecar"},{"op":"remove","path":"/spec/template/metadata/annotations/applicationlayer.projectcalico.org~1waf"}]'


@radixo does this look right for the disable command for WAF?

Actually it is, the bad thing I left behind were the unnecessary spaces on the left, you can trim them. But about the ~1 string, is how you can scape the / on json paths.

Will remove leading spaces and leave the rest as is.

peterkellydev · 2024-10-11T14:17:38Z

calico-enterprise/visibility/elastic/l7/configure.mdx

-**Limitations**
+* L7 logging is not compatible with a service mesh such as Istio.
+* L7 log collection is not supported for host-networked client pods.
+* When selecting and deselecting traffic for L7 log collection, active connections may be disrupted.


This is true for all 3 L7 features too. Although pods will be recycled and rolled out after being selected for L7, there can be existing HTTP connections that get dropped and reconnected. So we haven't changed that, it was true in old model and new model. But it is true for all L7 docs and not just this one. (I wish we had a single doc :) )

Ok, adding this to all L7 pages. Fits better as a note.

radixo

Just some small changes but the docs looks very good now.

radixo · 2024-10-11T09:40:53Z

calico-enterprise/threat/web-application-firewall.mdx

@@ -24,7 +24,7 @@ Historically, web application firewalls (WAFs) were deployed at the edge of your

 ### About {{prodname}} WAF

-WAF is deployed in your cluster along with Envoy DaemonSet. {{prodname}} proxies selected service traffic through Envoy, checking HTTP requests using the industry-standard
+WAF is deployed in your cluster with Envoy as a sidecar container on your pods. {{prodname}} proxies selected service traffic through Envoy, checking HTTP requests using the industry-standard


We can swap from:
{{prodname}} proxies selected service traffic through Envoy,
to:
{{prodname}} proxies all traffic through Envoy sidecar,

radixo · 2024-10-11T09:42:47Z

calico-enterprise/threat/web-application-firewall.mdx

@@ -24,7 +24,7 @@ Historically, web application firewalls (WAFs) were deployed at the edge of your

 ### About {{prodname}} WAF

-WAF is deployed in your cluster along with Envoy DaemonSet. {{prodname}} proxies selected service traffic through Envoy, checking HTTP requests using the industry-standard
+WAF is deployed in your cluster with Envoy as a sidecar container on your pods. {{prodname}} proxies selected service traffic through Envoy, checking HTTP requests using the industry-standard


Yes, we need to change service to deployment where it is talking about the enable of the feature.

radixo · 2024-10-11T15:17:45Z

calico-enterprise/threat/web-application-firewall.mdx

 ```bash
 kubectl apply -f - <<EOF


Suggested change

```bash

kubectl apply -f - <<EOF

```yaml

Got it. I'll un-kubectl all of these EOF to discourage overwriting existing CRDs.

radixo · 2024-10-11T15:17:59Z

calico-enterprise/threat/web-application-firewall.mdx

@@ -115,32 +97,43 @@ kind: ApplicationLayer
 metadata:
  name: tigera-secure
 spec:
-  webApplicationFirewall: Enabled
+  sidecarInjection: Enabled
 EOF


Suggested change

EOF

radixo · 2024-10-11T15:19:48Z

calico-enterprise/threat/web-application-firewall.mdx

+kubectl apply -f https://raw.githubusercontent.com/GoogleCloudPlatform/microservices-demo/main/release/kubernetes-manifests.yaml
+```
+
+## Apply WAF to services


Suggested change

## Apply WAF to services

## Apply WAF to deployments

radixo · 2024-10-11T15:25:22Z

calico-enterprise/threat/web-application-firewall.mdx


 ```bash
-kubectl annotate svc <service-name> -n <service-namespace> projectcalico.org/l7-logging-
+   kubectl patch deployment <deployment-name> -n <deployment-namespace> --type='json' -p '[{"op":"remove","path":"/spec/template/metadata/labels/applicationlayer.projectcalico.org~1sidecar"},{"op":"remove","path":"/spec/template/metadata/annotations/applicationlayer.projectcalico.org~1waf"}]'


Actually it is, the bad thing I left behind were the unnecessary spaces on the left, you can trim them. But about the ~1 string, is how you can scape the / on json paths.

radixo · 2024-10-11T15:25:41Z

calico-enterprise/threat/web-application-firewall.mdx


 ```bash
-kubectl annotate svc <service-name> -n <service-namespace> projectcalico.org/l7-logging-
+   kubectl patch deployment <deployment-name> -n <deployment-namespace> --type='json' -p '[{"op":"remove","path":"/spec/template/metadata/labels/applicationlayer.projectcalico.org~1sidecar"},{"op":"remove","path":"/spec/template/metadata/annotations/applicationlayer.projectcalico.org~1waf"}]'


Suggested change

kubectl patch deployment <deployment-name> -n <deployment-namespace> --type='json' -p '[{"op":"remove","path":"/spec/template/metadata/labels/applicationlayer.projectcalico.org~1sidecar"},{"op":"remove","path":"/spec/template/metadata/annotations/applicationlayer.projectcalico.org~1waf"}]'

kubectl patch deployment <deployment-name> -n <deployment-namespace> --type='json' -p '[{"op":"remove","path":"/spec/template/metadata/labels/applicationlayer.projectcalico.org~1sidecar"},{"op":"remove","path":"/spec/template/metadata/annotations/applicationlayer.projectcalico.org~1waf"}]'

radixo and others added 4 commits October 10, 2024 12:34

Introduces documentation about L7 features over sidecar mode

165a35c

Fix phrase

f33c77e

L7 stuff

2ed0def

Edits and changes for L7 with Envoy sidecars

9304353

ctauchen requested a review from a team as a code owner October 10, 2024 12:26

ctauchen changed the title ~~DOCS-2334: Docs for L7 rearchitecture with Envoy as sidecar containers"~~ DOCS-2334: Docs for L7 rearchitecture with Envoy as sidecar containers Oct 10, 2024

ctauchen commented Oct 10, 2024

View reviewed changes

ctauchen mentioned this pull request Oct 10, 2024

Introduces documentation about L7 features over sidecar mode #1648

Closed

5 tasks

peterkellydev reviewed Oct 11, 2024

View reviewed changes

radixo suggested changes Oct 11, 2024

View reviewed changes

Updates from feedback

3da0136

ctauchen added this to the Release | Calico Enterprise 3.20 EP2 milestone Oct 15, 2024

Changes WAF services to deployments

1fcee71

peterkellydev approved these changes Oct 15, 2024

View reviewed changes

ctauchen merged commit e21801f into tigera:main Oct 15, 2024
9 of 10 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

DOCS-2334: Docs for L7 rearchitecture with Envoy as sidecar containers #1714

DOCS-2334: Docs for L7 rearchitecture with Envoy as sidecar containers #1714

ctauchen commented Oct 10, 2024 •

edited

Loading

netlify bot commented Oct 10, 2024 •

edited

Loading

netlify bot commented Oct 10, 2024 •

edited

Loading

ctauchen Oct 10, 2024

radixo Oct 11, 2024

radixo Oct 11, 2024

peterkellydev Oct 11, 2024

ctauchen Oct 14, 2024

ctauchen Oct 14, 2024

ctauchen Oct 10, 2024

peterkellydev Oct 11, 2024

ctauchen Oct 14, 2024

ctauchen left a comment

peterkellydev Oct 11, 2024

ctauchen Oct 14, 2024

peterkellydev Oct 11, 2024 •

edited

Loading

ctauchen Oct 14, 2024

peterkellydev Oct 11, 2024

radixo Oct 11, 2024

ctauchen Oct 14, 2024

peterkellydev Oct 11, 2024

ctauchen Oct 14, 2024

radixo left a comment

radixo Oct 11, 2024

radixo Oct 11, 2024

radixo Oct 11, 2024

ctauchen Oct 14, 2024

radixo Oct 11, 2024

radixo Oct 11, 2024

radixo Oct 11, 2024

radixo Oct 11, 2024


		Limitations
		* L7 logging is not compatible with a service mesh such as Istio.

	kubectl patch deployment <deployment-name> -n <deployment-namespace> --type='json' -p '[{"op":"remove","path":"/spec/template/metadata/labels/applicationlayer.projectcalico.org~1sidecar"},{"op":"remove","path":"/spec/template/metadata/annotations/applicationlayer.projectcalico.org~1waf"}]'
	kubectl patch deployment <deployment-name> -n <deployment-namespace> --type='json' -p '[{"op":"remove","path":"/spec/template/metadata/labels/applicationlayer.projectcalico.org~1sidecar"},{"op":"remove","path":"/spec/template/metadata/annotations/applicationlayer.projectcalico.org~1waf"}]'

DOCS-2334: Docs for L7 rearchitecture with Envoy as sidecar containers #1714

DOCS-2334: Docs for L7 rearchitecture with Envoy as sidecar containers #1714

Conversation

ctauchen commented Oct 10, 2024 • edited Loading

netlify bot commented Oct 10, 2024 • edited Loading

✅ Deploy Preview succeeded!

netlify bot commented Oct 10, 2024 • edited Loading

✅ Deploy Preview for calico-docs-preview-next ready!

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ctauchen left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

peterkellydev Oct 11, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

radixo left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ctauchen commented Oct 10, 2024 •

edited

Loading

netlify bot commented Oct 10, 2024 •

edited

Loading

netlify bot commented Oct 10, 2024 •

edited

Loading

peterkellydev Oct 11, 2024 •

edited

Loading