Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add NPEP for new CIDRGroup object peer #183

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Add NPEP for new CIDRGroup object peer #183

wants to merge 1 commit into from

Conversation

tssurya
Copy link
Contributor

@tssurya tssurya commented Dec 7, 2023 •
edited
Loading

This NPEP captures the use cases for having a better CIDRGrouper for easier management of CIDR peers in addition to inline CIDR peers
Closes #182

@k8s-ci-robot k8s-ci-robot added do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Dec 7, 2023
@netlify Netlify
Copy link

netlify bot commented Dec 7, 2023 •
edited
Loading

✅ Deploy Preview for kubernetes-sigs-network-policy-api ready!

Name Link
🔨 Latest commit b6673d7
🔍 Latest deploy log https://app.netlify.com/sites/kubernetes-sigs-network-policy-api/deploys/65e49ffa657ec60008c5bfd1
😎 Deploy Preview https://deploy-preview-183--kubernetes-sigs-network-policy-api.netlify.app/npeps/npep-182-cidr-object-peer
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: tssurya
Once this PR has been reviewed and has the lgtm label, please assign dyanngg for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label Dec 7, 2023
@tssurya tssurya mentioned this pull request Dec 31, 2023
Merged
@k8s-ci-robot k8s-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Mar 3, 2024
@tssurya tssurya changed the title [WIP] Add NPEP for new CIDR object peer Add NPEP for new CIDRGroup object peer Mar 3, 2024
@k8s-ci-robot k8s-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Mar 3, 2024
@tssurya
Add NPEP for new CIDR object peer
b6673d7 
Signed-off-by: Surya Seetharaman <[email protected]>
@tssurya
Copy link
Contributor Author

tssurya commented Mar 3, 2024

@joestringer and @networkop PTAL, I have tried to include the uses cases you had proposed to see if we can also have this way of expressing CIDR peers.

rahulkjoshi
rahulkjoshi reviewed Mar 4, 2024
View reviewed changes
npeps/npep-182-cidr-object-peer.md
The speed of IP churn is bounded by the BGP advertisement interval and can be
further reduced by the BGP controller implementation.

* As a cluster administrator I want to to ensure that pods can reach
Copy link
Contributor

@rahulkjoshi rahulkjoshi Mar 4, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just playing devil's advocate with maybe a really bad idea:

What if we try to use the EndpointSlice API to solve this set of problems?

Pros:

  • Fewer network policy objects CRDS
  • Make headway into defining the Service selector API

Cons:

  • Abusing(?) the EndpointSlice idiom

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@rahulkjoshi can you specify IP prefixes or only IP addresses in EndpointSlice?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

😦 yeah you're right only individual addresses in EndpointSlice

My underlying thought with this situation was whether there's overlap with a more general service discovery problem. My thinking was that whatever application the rule protects also needs to discover the IPs it's talking to.

I was hoping that plugging into that system might be more ergonomic? But it's more likely to just be incredibly complicated and not easily generalizable.

@astoycos astoycos mentioned this pull request Mar 5, 2024
Merged
@k8s-triage-robot
Copy link

The Kubernetes project currently lacks enough contributors to adequately respond to all PRs.

This bot triages PRs according to the following rules:

  • After 90d of inactivity, lifecycle/stale is applied
  • After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
  • After 30d of inactivity since lifecycle/rotten was applied, the PR is closed

You can:

  • Mark this PR as fresh with /remove-lifecycle stale
  • Close this PR with /close
  • Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

@k8s-ci-robot k8s-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Jun 3, 2024
@astoycos
Copy link
Member

astoycos commented Jun 4, 2024

/remove-lifecycle stale

@k8s-ci-robot k8s-ci-robot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Jun 4, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@joestringer joestringer joestringer left review comments

@rahulkjoshi rahulkjoshi rahulkjoshi left review comments

@astoycos astoycos Awaiting requested review from astoycos

@Dyanngg Dyanngg Awaiting requested review from Dyanngg

Assignees
No one assigned
Labels
cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. size/L Denotes a PR that changes 100-499 lines, ignoring generated files.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

[ENHANCEMENT] Use Cases for wanting Egress CIDR Peers as an external object
6 participants
@tssurya @k8s-ci-robot @k8s-triage-robot @astoycos @joestringer @rahulkjoshi