istio
/
istio.io
mirror of https://github.com/istio/istio.io.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add warning for network policy enforcement (#7967) 

* Add warning for network policy enforcement

* Address review feedback
This commit is contained in:
Neeraj Poddar 2020-08-17 12:31:01 -06:00 committed by GitHub
parent df5ea809a6
commit 122ab65b1b
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 9 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
content/en/docs/tasks/traffic-management/egress/egress-gateway/index.md
View File

@ -474,6 +474,13 @@ external service.
EOF EOF
{{< /text >}} {{< /text >}}
{{< warning >}}
[Network policies](https://kubernetes.io/docs/concepts/services-networking/network-policies/)
are implemented by the network plugin in your Kubernetes cluster.
Depending on your test cluster, the traffic may not be blocked in the following
step.
{{< /warning >}}
1. Resend the previous HTTPS request to [https://edition.cnn.com/politics](https://edition.cnn.com/politics). Now it 1. Resend the previous HTTPS request to [https://edition.cnn.com/politics](https://edition.cnn.com/politics). Now it
should fail since the traffic is blocked by the network policy. Note that the `sleep` pod cannot bypass should fail since the traffic is blocked by the network policy. Note that the `sleep` pod cannot bypass
`istio-egressgateway`. The only way it can access `edition.cnn.com` is by using an Istio sidecar proxy and by `istio-egressgateway`. The only way it can access `edition.cnn.com` is by using an Istio sidecar proxy and by

3
content/en/docs/tasks/traffic-management/egress/egress-gateway/test.sh
View File

@ -92,7 +92,8 @@ snip_apply_kubernetes_network_policies_7
# Verify failure # Verify failure
#_verify_contains snip_apply_kubernetes_network_policies_8 "port 443 failed: Connection timed out" #_verify_contains snip_apply_kubernetes_network_policies_8 "port 443 failed: Connection timed out"
# TODO: ^^^ this check is not working - gets 200 repsonse # TODO: ^^^ this check fails as the test cluster doesn't have a network plugin
# installed which can enforce network policies.
# Enable sidecar injection # Enable sidecar injection
snip_apply_kubernetes_network_policies_9 snip_apply_kubernetes_network_policies_9