Skip to content

Commit

Permalink
Update documents to replace AntreaProxy with Antrea Proxy (#6515)
Browse files Browse the repository at this point in the history
Signed-off-by: Hongliang Liu <[email protected]>
  • Loading branch information
hongliangl authored Jul 18, 2024
1 parent 288ce62 commit 63b8117
Show file tree
Hide file tree
Showing 22 changed files with 118 additions and 120 deletions.
2 changes: 1 addition & 1 deletion build/charts/antrea-windows/conf/antrea-agent.conf
Original file line number Diff line number Diff line change
Expand Up @@ -119,7 +119,7 @@ antreaProxy:
# To disable AntreaProxy, set this to false. It should be enabled on Windows, otherwise NetworkPolicy will
# not take effect on Service traffic.
enable: true
# ProxyAll tells antrea-agent to proxy ClusterIP Service traffic, regardless of where they come from.
# proxyAll tells antrea-agent to proxy ClusterIP Service traffic, regardless of where they come from.
# Therefore, running kube-proxy is no longer required. This requires the AntreaProxy feature to be enabled.
# Note that this option is experimental. If kube-proxy is removed, option kubeAPIServerOverride must be used to access
# apiserver directly.
Expand Down
4 changes: 2 additions & 2 deletions build/charts/antrea/conf/antrea-agent.conf
Original file line number Diff line number Diff line change
Expand Up @@ -342,7 +342,7 @@ antreaProxy:
{{- with .Values.antreaProxy }}
# To disable AntreaProxy, set this to false.
enable: {{.enable}}
# ProxyAll tells antrea-agent to proxy all Service traffic, including NodePort, LoadBalancer, and ClusterIP traffic,
# proxyAll tells antrea-agent to proxy all Service traffic, including NodePort, LoadBalancer, and ClusterIP traffic,
# regardless of where they come from. Therefore, running kube-proxy is no longer required.
# Note that this option is experimental. If kube-proxy is removed, option kubeAPIServerOverride must be used to access
# apiserver directly.
Expand All @@ -365,7 +365,7 @@ antreaProxy:
# External IPs of LoadBalancer Services. This is useful when the external LoadBalancer provides additional
# capabilities (e.g. TLS termination) and it is desirable for Pod-to-ExternalIP traffic to be sent to the
# external LoadBalancer instead of being load-balanced to an Endpoint directly by AntreaProxy.
# Note that setting ProxyLoadBalancerIPs to false usually only makes sense when ProxyAll is set to true and
# Note that setting ProxyLoadBalancerIPs to false usually only makes sense when proxyAll is set to true and
# kube-proxy is removed from the cluster, otherwise kube-proxy will still load-balance this traffic.
proxyLoadBalancerIPs: {{ .proxyLoadBalancerIPs }}
# The value of the "service.kubernetes.io/service-proxy-name" label for AntreaProxy to match. If it is set,
Expand Down
8 changes: 4 additions & 4 deletions build/yamls/antrea-aks.yml
Original file line number Diff line number Diff line change
Expand Up @@ -4038,7 +4038,7 @@ data:
antreaProxy:
# To disable AntreaProxy, set this to false.
enable: true
# ProxyAll tells antrea-agent to proxy all Service traffic, including NodePort, LoadBalancer, and ClusterIP traffic,
# proxyAll tells antrea-agent to proxy all Service traffic, including NodePort, LoadBalancer, and ClusterIP traffic,
# regardless of where they come from. Therefore, running kube-proxy is no longer required.
# Note that this option is experimental. If kube-proxy is removed, option kubeAPIServerOverride must be used to access
# apiserver directly.
Expand All @@ -4055,7 +4055,7 @@ data:
# External IPs of LoadBalancer Services. This is useful when the external LoadBalancer provides additional
# capabilities (e.g. TLS termination) and it is desirable for Pod-to-ExternalIP traffic to be sent to the
# external LoadBalancer instead of being load-balanced to an Endpoint directly by AntreaProxy.
# Note that setting ProxyLoadBalancerIPs to false usually only makes sense when ProxyAll is set to true and
# Note that setting ProxyLoadBalancerIPs to false usually only makes sense when proxyAll is set to true and
# kube-proxy is removed from the cluster, otherwise kube-proxy will still load-balance this traffic.
proxyLoadBalancerIPs: true
# The value of the "service.kubernetes.io/service-proxy-name" label for AntreaProxy to match. If it is set,
Expand Down Expand Up @@ -5110,7 +5110,7 @@ spec:
kubectl.kubernetes.io/default-container: antrea-agent
# Automatically restart Pods with a RollingUpdate if the ConfigMap changes
# See https://helm.sh/docs/howto/charts_tips_and_tricks/#automatically-roll-deployments
checksum/config: f976029accf54258d01ad907fe19b50ac671eee014cd8aea968c6a0bc7e8f95a
checksum/config: 71bf05ff579aa9bea7b360669c5e2ce2830ca88dc4ab54480638ce006eaeaf11
labels:
app: antrea
component: antrea-agent
Expand Down Expand Up @@ -5348,7 +5348,7 @@ spec:
annotations:
# Automatically restart Pod if the ConfigMap changes
# See https://helm.sh/docs/howto/charts_tips_and_tricks/#automatically-roll-deployments
checksum/config: f976029accf54258d01ad907fe19b50ac671eee014cd8aea968c6a0bc7e8f95a
checksum/config: 71bf05ff579aa9bea7b360669c5e2ce2830ca88dc4ab54480638ce006eaeaf11
labels:
app: antrea
component: antrea-controller
Expand Down
8 changes: 4 additions & 4 deletions build/yamls/antrea-eks.yml
Original file line number Diff line number Diff line change
Expand Up @@ -4038,7 +4038,7 @@ data:
antreaProxy:
# To disable AntreaProxy, set this to false.
enable: true
# ProxyAll tells antrea-agent to proxy all Service traffic, including NodePort, LoadBalancer, and ClusterIP traffic,
# proxyAll tells antrea-agent to proxy all Service traffic, including NodePort, LoadBalancer, and ClusterIP traffic,
# regardless of where they come from. Therefore, running kube-proxy is no longer required.
# Note that this option is experimental. If kube-proxy is removed, option kubeAPIServerOverride must be used to access
# apiserver directly.
Expand All @@ -4055,7 +4055,7 @@ data:
# External IPs of LoadBalancer Services. This is useful when the external LoadBalancer provides additional
# capabilities (e.g. TLS termination) and it is desirable for Pod-to-ExternalIP traffic to be sent to the
# external LoadBalancer instead of being load-balanced to an Endpoint directly by AntreaProxy.
# Note that setting ProxyLoadBalancerIPs to false usually only makes sense when ProxyAll is set to true and
# Note that setting ProxyLoadBalancerIPs to false usually only makes sense when proxyAll is set to true and
# kube-proxy is removed from the cluster, otherwise kube-proxy will still load-balance this traffic.
proxyLoadBalancerIPs: true
# The value of the "service.kubernetes.io/service-proxy-name" label for AntreaProxy to match. If it is set,
Expand Down Expand Up @@ -5110,7 +5110,7 @@ spec:
kubectl.kubernetes.io/default-container: antrea-agent
# Automatically restart Pods with a RollingUpdate if the ConfigMap changes
# See https://helm.sh/docs/howto/charts_tips_and_tricks/#automatically-roll-deployments
checksum/config: f976029accf54258d01ad907fe19b50ac671eee014cd8aea968c6a0bc7e8f95a
checksum/config: 71bf05ff579aa9bea7b360669c5e2ce2830ca88dc4ab54480638ce006eaeaf11
labels:
app: antrea
component: antrea-agent
Expand Down Expand Up @@ -5349,7 +5349,7 @@ spec:
annotations:
# Automatically restart Pod if the ConfigMap changes
# See https://helm.sh/docs/howto/charts_tips_and_tricks/#automatically-roll-deployments
checksum/config: f976029accf54258d01ad907fe19b50ac671eee014cd8aea968c6a0bc7e8f95a
checksum/config: 71bf05ff579aa9bea7b360669c5e2ce2830ca88dc4ab54480638ce006eaeaf11
labels:
app: antrea
component: antrea-controller
Expand Down
8 changes: 4 additions & 4 deletions build/yamls/antrea-gke.yml
Original file line number Diff line number Diff line change
Expand Up @@ -4038,7 +4038,7 @@ data:
antreaProxy:
# To disable AntreaProxy, set this to false.
enable: true
# ProxyAll tells antrea-agent to proxy all Service traffic, including NodePort, LoadBalancer, and ClusterIP traffic,
# proxyAll tells antrea-agent to proxy all Service traffic, including NodePort, LoadBalancer, and ClusterIP traffic,
# regardless of where they come from. Therefore, running kube-proxy is no longer required.
# Note that this option is experimental. If kube-proxy is removed, option kubeAPIServerOverride must be used to access
# apiserver directly.
Expand All @@ -4055,7 +4055,7 @@ data:
# External IPs of LoadBalancer Services. This is useful when the external LoadBalancer provides additional
# capabilities (e.g. TLS termination) and it is desirable for Pod-to-ExternalIP traffic to be sent to the
# external LoadBalancer instead of being load-balanced to an Endpoint directly by AntreaProxy.
# Note that setting ProxyLoadBalancerIPs to false usually only makes sense when ProxyAll is set to true and
# Note that setting ProxyLoadBalancerIPs to false usually only makes sense when proxyAll is set to true and
# kube-proxy is removed from the cluster, otherwise kube-proxy will still load-balance this traffic.
proxyLoadBalancerIPs: true
# The value of the "service.kubernetes.io/service-proxy-name" label for AntreaProxy to match. If it is set,
Expand Down Expand Up @@ -5110,7 +5110,7 @@ spec:
kubectl.kubernetes.io/default-container: antrea-agent
# Automatically restart Pods with a RollingUpdate if the ConfigMap changes
# See https://helm.sh/docs/howto/charts_tips_and_tricks/#automatically-roll-deployments
checksum/config: 5299e6235e262daf606758cf900766470fcb8dd21a0d707a3ae284548bd8c2b2
checksum/config: 91ff2b609519e4aaead6ab850252a49bbe674dec17f6f239c4d0fa6c7b5705f6
labels:
app: antrea
component: antrea-agent
Expand Down Expand Up @@ -5346,7 +5346,7 @@ spec:
annotations:
# Automatically restart Pod if the ConfigMap changes
# See https://helm.sh/docs/howto/charts_tips_and_tricks/#automatically-roll-deployments
checksum/config: 5299e6235e262daf606758cf900766470fcb8dd21a0d707a3ae284548bd8c2b2
checksum/config: 91ff2b609519e4aaead6ab850252a49bbe674dec17f6f239c4d0fa6c7b5705f6
labels:
app: antrea
component: antrea-controller
Expand Down
8 changes: 4 additions & 4 deletions build/yamls/antrea-ipsec.yml
Original file line number Diff line number Diff line change
Expand Up @@ -4051,7 +4051,7 @@ data:
antreaProxy:
# To disable AntreaProxy, set this to false.
enable: true
# ProxyAll tells antrea-agent to proxy all Service traffic, including NodePort, LoadBalancer, and ClusterIP traffic,
# proxyAll tells antrea-agent to proxy all Service traffic, including NodePort, LoadBalancer, and ClusterIP traffic,
# regardless of where they come from. Therefore, running kube-proxy is no longer required.
# Note that this option is experimental. If kube-proxy is removed, option kubeAPIServerOverride must be used to access
# apiserver directly.
Expand All @@ -4068,7 +4068,7 @@ data:
# External IPs of LoadBalancer Services. This is useful when the external LoadBalancer provides additional
# capabilities (e.g. TLS termination) and it is desirable for Pod-to-ExternalIP traffic to be sent to the
# external LoadBalancer instead of being load-balanced to an Endpoint directly by AntreaProxy.
# Note that setting ProxyLoadBalancerIPs to false usually only makes sense when ProxyAll is set to true and
# Note that setting ProxyLoadBalancerIPs to false usually only makes sense when proxyAll is set to true and
# kube-proxy is removed from the cluster, otherwise kube-proxy will still load-balance this traffic.
proxyLoadBalancerIPs: true
# The value of the "service.kubernetes.io/service-proxy-name" label for AntreaProxy to match. If it is set,
Expand Down Expand Up @@ -5123,7 +5123,7 @@ spec:
kubectl.kubernetes.io/default-container: antrea-agent
# Automatically restart Pods with a RollingUpdate if the ConfigMap changes
# See https://helm.sh/docs/howto/charts_tips_and_tricks/#automatically-roll-deployments
checksum/config: ba93df141f512a1f8483114b5994444c7231b298e7e9133483ddc1f4210ec395
checksum/config: 2d75956786eb552eaba94f89dfa5c6bab570bf662b82449e9af31a57ca138750
checksum/ipsec-secret: d0eb9c52d0cd4311b6d252a951126bf9bea27ec05590bed8a394f0f792dcb2a4
labels:
app: antrea
Expand Down Expand Up @@ -5405,7 +5405,7 @@ spec:
annotations:
# Automatically restart Pod if the ConfigMap changes
# See https://helm.sh/docs/howto/charts_tips_and_tricks/#automatically-roll-deployments
checksum/config: ba93df141f512a1f8483114b5994444c7231b298e7e9133483ddc1f4210ec395
checksum/config: 2d75956786eb552eaba94f89dfa5c6bab570bf662b82449e9af31a57ca138750
labels:
app: antrea
component: antrea-controller
Expand Down
4 changes: 2 additions & 2 deletions build/yamls/antrea-windows-with-ovs.yml
Original file line number Diff line number Diff line change
Expand Up @@ -246,7 +246,7 @@ data:
# To disable AntreaProxy, set this to false. It should be enabled on Windows, otherwise NetworkPolicy will
# not take effect on Service traffic.
enable: true
# ProxyAll tells antrea-agent to proxy ClusterIP Service traffic, regardless of where they come from.
# proxyAll tells antrea-agent to proxy ClusterIP Service traffic, regardless of where they come from.
# Therefore, running kube-proxy is no longer required. This requires the AntreaProxy feature to be enabled.
# Note that this option is experimental. If kube-proxy is removed, option kubeAPIServerOverride must be used to access
# apiserver directly.
Expand Down Expand Up @@ -306,7 +306,7 @@ spec:
metadata:
annotations:
checksum/agent-windows: 86f999cb18501659a52d982f20b3df5cdf666ffd849f50ed183c366e75d01ac5
checksum/windows-config: 10ad2be0a04b1752abc224fed0124f7b1da36efc5e7323e193eb38e11b25e798
checksum/windows-config: 4f07164f32afc61e20b4aef984a8781142e5d99f7c58f7581e4ccfeabb34855f
microsoft.com/hostprocess-inherit-user: "true"
labels:
app: antrea
Expand Down
4 changes: 2 additions & 2 deletions build/yamls/antrea-windows.yml
Original file line number Diff line number Diff line change
Expand Up @@ -174,7 +174,7 @@ data:
# To disable AntreaProxy, set this to false. It should be enabled on Windows, otherwise NetworkPolicy will
# not take effect on Service traffic.
enable: true
# ProxyAll tells antrea-agent to proxy ClusterIP Service traffic, regardless of where they come from.
# proxyAll tells antrea-agent to proxy ClusterIP Service traffic, regardless of where they come from.
# Therefore, running kube-proxy is no longer required. This requires the AntreaProxy feature to be enabled.
# Note that this option is experimental. If kube-proxy is removed, option kubeAPIServerOverride must be used to access
# apiserver directly.
Expand Down Expand Up @@ -234,7 +234,7 @@ spec:
metadata:
annotations:
checksum/agent-windows: 63f16e1fadb6b1354efda21c73702b4290400181136d4d47d4b1cd6a5f82d037
checksum/windows-config: 10ad2be0a04b1752abc224fed0124f7b1da36efc5e7323e193eb38e11b25e798
checksum/windows-config: 4f07164f32afc61e20b4aef984a8781142e5d99f7c58f7581e4ccfeabb34855f
microsoft.com/hostprocess-inherit-user: "true"
labels:
app: antrea
Expand Down
8 changes: 4 additions & 4 deletions build/yamls/antrea.yml
Original file line number Diff line number Diff line change
Expand Up @@ -4038,7 +4038,7 @@ data:
antreaProxy:
# To disable AntreaProxy, set this to false.
enable: true
# ProxyAll tells antrea-agent to proxy all Service traffic, including NodePort, LoadBalancer, and ClusterIP traffic,
# proxyAll tells antrea-agent to proxy all Service traffic, including NodePort, LoadBalancer, and ClusterIP traffic,
# regardless of where they come from. Therefore, running kube-proxy is no longer required.
# Note that this option is experimental. If kube-proxy is removed, option kubeAPIServerOverride must be used to access
# apiserver directly.
Expand All @@ -4055,7 +4055,7 @@ data:
# External IPs of LoadBalancer Services. This is useful when the external LoadBalancer provides additional
# capabilities (e.g. TLS termination) and it is desirable for Pod-to-ExternalIP traffic to be sent to the
# external LoadBalancer instead of being load-balanced to an Endpoint directly by AntreaProxy.
# Note that setting ProxyLoadBalancerIPs to false usually only makes sense when ProxyAll is set to true and
# Note that setting ProxyLoadBalancerIPs to false usually only makes sense when proxyAll is set to true and
# kube-proxy is removed from the cluster, otherwise kube-proxy will still load-balance this traffic.
proxyLoadBalancerIPs: true
# The value of the "service.kubernetes.io/service-proxy-name" label for AntreaProxy to match. If it is set,
Expand Down Expand Up @@ -5110,7 +5110,7 @@ spec:
kubectl.kubernetes.io/default-container: antrea-agent
# Automatically restart Pods with a RollingUpdate if the ConfigMap changes
# See https://helm.sh/docs/howto/charts_tips_and_tricks/#automatically-roll-deployments
checksum/config: aca23e21519e0fc112647f23d3ce6f92a3dea0bc7ebf1c6d7a7eed2dbe80f0a3
checksum/config: ebc0be79b0fc65db51609f5c9185ca8a0533e265811d14c687f577cf93497a58
labels:
app: antrea
component: antrea-agent
Expand Down Expand Up @@ -5346,7 +5346,7 @@ spec:
annotations:
# Automatically restart Pod if the ConfigMap changes
# See https://helm.sh/docs/howto/charts_tips_and_tricks/#automatically-roll-deployments
checksum/config: aca23e21519e0fc112647f23d3ce6f92a3dea0bc7ebf1c6d7a7eed2dbe80f0a3
checksum/config: ebc0be79b0fc65db51609f5c9185ca8a0533e265811d14c687f577cf93497a58
labels:
app: antrea
component: antrea-controller
Expand Down
4 changes: 2 additions & 2 deletions docs/antrea-ipam.md
Original file line number Diff line number Diff line change
Expand Up @@ -278,8 +278,8 @@ where the underlay router will route the traffic to the destination VLAN.
### Requirements for this Feature

As of now, this feature is supported on Linux Nodes, with IPv4, `system` OVS datapath
type, `noEncap`, `noSNAT` traffic mode, and `AntreaProxy` feature enabled. Configuration
with `ProxyAll` feature enabled is not verified.
type, `noEncap`, `noSNAT` traffic mode, and Antrea Proxy enabled. Configuration
with `proxyAll` enabled is not verified.

The IPs in the `IPPools` without VLAN must be in the same underlay subnet as the Node
IP, because inter-Node traffic of AntreaIPAM Pods is forwarded by the Node network.
Expand Down
10 changes: 5 additions & 5 deletions docs/antrea-network-policy.md
Original file line number Diff line number Diff line change
Expand Up @@ -1490,7 +1490,7 @@ Kubernetes](https://kubernetes.io/docs/concepts/services-networking/dns-pod-serv
Services. The reason is that Antrea will use the information included in A or
AAAA DNS records to implement FQDN based policies. In the case of "normal" (not
headless) Services, the DNS name resolves to the ClusterIP for the Service, but
policy rules are enforced after AntreaProxy Service Load-Balancing and at that
policy rules are enforced after Antrea Proxy Service Load-Balancing and at that
stage the destination IP address has already been rewritten to the address of an
endpoint backing the Service. For headless Services, a ClusterIP is not
allocated and, assuming the Service has a selector, the DNS server returns A /
Expand Down Expand Up @@ -1571,8 +1571,8 @@ A combination of Service name and Service Namespace can be used in `toServices`
by this field. A sample policy can be found [here](#acnp-for-toservices-rule).

Since `toServices` represents a combination of IP+port, it cannot be used with `to` or `ports` within the same egress rule.
Also, since the matching process relies on the groupID assigned to Service by AntreaProxy, this field can only be used when
AntreaProxy is enabled.
Also, since the matching process relies on the groupID assigned to Service by Antrea Proxy, this field can only be used when
Antrea Proxy is enabled.

This clusterIP-based match has one caveat: direct access to the Endpoints of this Service is not affected by
`toServices` rules. To restrict access towards backend Endpoints of a Service, define a `ClusterGroup` with `ServiceReference`
Expand Down Expand Up @@ -1952,11 +1952,11 @@ Similar RBAC is applied to the ClusterGroup resource.
won't be blocked by new rules.
- For hairpin Service traffic, when a Pod initiates traffic towards the Service it
provides, and the same Pod is selected as the Endpoint, NetworkPolicies will
consistently permit this traffic during ingress enforcement if AntreaProxy is enabled,
consistently permit this traffic during ingress enforcement if Antrea Proxy is enabled,
irrespective of the ingress rules defined by the user. In the presence of ingress rules
preventing access to the Service from Pods providing the Service, accessing the Service
from one of these Pods will succeed if traffic is hairpinned back to the source Pod, and
will fail if a different Endpoint is selected by AntreaProxy. However, when AntreaProxy
will fail if a different Endpoint is selected by Antrea Proxy. However, when Antrea Proxy
is disabled, NetworkPolicies may not function as expected for hairpin Service traffic.
This is due to kube-proxy performing SNAT, which conceals the original source IP from
Antrea. Consequently, NetworkPolicies are unable to differentiate between hairpin
Expand Down
Loading

0 comments on commit 63b8117

Please sign in to comment.