admin-cluster/network-policy-provider: update Cilium documentation (#11214)

Signed-off-by: André Martins <aanm90@gmail.com>
This commit is contained in:
André Martins 2018-11-24 17:17:45 +01:00 committed by k8s-ci-robot
parent 2cd64045ba
commit 41a042feef
1 changed files with 26 additions and 20 deletions

View File

@ -1,6 +1,7 @@
--- ---
reviewers: reviewers:
- danwent - danwent
- aanm
title: Use Cilium for NetworkPolicy title: Use Cilium for NetworkPolicy
content_template: templates/task content_template: templates/task
weight: 20 weight: 20
@ -9,7 +10,7 @@ weight: 20
{{% capture overview %}} {{% capture overview %}}
This page shows how to use Cilium for NetworkPolicy. This page shows how to use Cilium for NetworkPolicy.
For background on Cilium, read the [Introduction to Cilium](https://cilium.readthedocs.io/en/latest/intro). For background on Cilium, read the [Introduction to Cilium](https://cilium.readthedocs.io/en/stable/intro).
{{% /capture %}} {{% /capture %}}
{{% capture prerequisites %}} {{% capture prerequisites %}}
@ -22,21 +23,28 @@ For background on Cilium, read the [Introduction to Cilium](https://cilium.readt
## Deploying Cilium on Minikube for Basic Testing ## Deploying Cilium on Minikube for Basic Testing
To get familiar with Cilium easily you can follow the To get familiar with Cilium easily you can follow the
[Cilium Kubernetes Getting Started Guide](https://docs.cilium.io/en/latest/gettingstarted/minikube/) [Cilium Kubernetes Getting Started Guide](https://cilium.readthedocs.io/en/stable/gettingstarted/minikube/)
to perform a basic DaemonSet installation of Cilium in minikube. to perform a basic DaemonSet installation of Cilium in minikube.
Installation in a minikube setup uses a simple ''all-in-one'' YAML As Cilium requires a standalone etcd instance, for minikube you can deploy it
file that includes DaemonSet configurations for Cilium, to connect by running:
to the minikube's etcd instance as well as appropriate RBAC settings:
```shell ```shell
$ kubectl create -f https://raw.githubusercontent.com/cilium/cilium/master/examples/kubernetes/cilium.yaml kubectl create -n kube-system -f https://raw.githubusercontent.com/cilium/cilium/v1.3/examples/kubernetes/addons/etcd/standalone-etcd.yaml
configmap "cilium-config" created ```
secret "cilium-etcd-secrets" created
serviceaccount "cilium" created After etcd is up and running you can deploy Cilium Kubernetes descriptor which
clusterrolebinding "cilium" created is a simple ''all-in-one'' YAML file that includes DaemonSet configurations for
daemonset "cilium" created Cilium, to connect to the etcd instance previously deployed as well as
clusterrole "cilium" created appropriate RBAC settings:
```shell
$ kubectl create -f https://raw.githubusercontent.com/cilium/cilium/v1.3/examples/kubernetes/1.12/cilium.yaml
configmap/cilium-config created
daemonset.apps/cilium created
clusterrolebinding.rbac.authorization.k8s.io/cilium created
clusterrole.rbac.authorization.k8s.io/cilium created
serviceaccount/cilium created
``` ```
The remainder of the Getting Started Guide explains how to enforce both L3/L4 The remainder of the Getting Started Guide explains how to enforce both L3/L4
@ -65,8 +73,8 @@ kubectl get pods --namespace=kube-system
You'll see a list of Pods similar to this: You'll see a list of Pods similar to this:
```console ```console
NAME DESIRED CURRENT READY NODE-SELECTOR AGE NAME READY STATUS RESTARTS AGE
cilium 1 1 1 <none> 2m cilium-6rxbd 1/1 Running 0 1m
... ...
``` ```
@ -74,12 +82,10 @@ There are two main components to be aware of:
- One `cilium` Pod runs on each node in your cluster and enforces network policy - One `cilium` Pod runs on each node in your cluster and enforces network policy
on the traffic to/from Pods on that node using Linux BPF. on the traffic to/from Pods on that node using Linux BPF.
- For production deployments, Cilium should leverage the key-value store cluster - For production deployments, Cilium should leverage a key-value store
(e.g., etcd) used by Kubernetes, which typically runs on the Kubernetes master nodes. (e.g., etcd). The [Cilium Kubernetes Installation Guide](https://cilium.readthedocs.io/en/latest/kubernetes/install/)
The [Cilium Kubernetes Installation Guide](https://cilium.readthedocs.io/en/latest/kubernetes/install/) will provide the necessary steps on how to install this required key-value
includes an example DaemonSet which can be customized to point to this key-value store as well how to configure it in Cilium.
store cluster. The simple ''all-in-one'' DaemonSet for minikube requires no such
configuration because it automatically connects to the minikube's etcd instance.
{{% /capture %}} {{% /capture %}}