{"action":"created","comment":{"url":"https://api.github.com/repos/jdob/ocp-onboard/pulls/comments/135333588","pull_request_review_id":58736161,"id":135333588,"diff_hunk":"@@ -618,3 +618,49 @@ curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, false);\n The API is run on HTTPS. For simplicity and portability of this example,\n verification of the SSL certificate is disabled. Extra steps may be\n necessary to provide the proper CA for the container.\n+\n+[[openshift-network-plugins]]\n+=== OpenShift Network plugins\n+\n+For instances where the default network behaviour does not meet the user's needs, OpenShift supports the \n+same plugin model as https://kubernetes.io/docs/concepts/cluster-administration/network-plugins[Kubernetes] \n+does for networking pods.\n+\n+==== Container Network Interfaces\n+\n+CNIs are the recommended method for usage of network plugins. Any external networking solution can \n+be used to plumb networking for OpenShift as long as it follows the CNI spec. Then, OpenShift \n+needs to be launched with `networkPluginName: \"cni\"` in the master/node config yaml files.\n+\n+When done through Ansible, provide `sdn_network_plugin_name=cni` as an option while installing \n+OpenShift. The default behavior of the OpenShift Ansible installation allows a firewall passthrough for \n+the VxLAN port (4789), so if a plugin needs other ports (for management/control/data) to be \n+open, then the installer needs to be changed suitably.\n+\n+More information about CNIs can be found http://kubernetes.io/docs/admin/network-plugins/#cni[here] and https://github.com/containernetworking/cni/blob/master/SPEC.md[here].\n+\n+==== Requirements\n+\n+OpenShift networking requires the following items to be kept in mind when writing CNI plugins in addition to the basic Kubernetes requirements found https://github.com/kubernetes/kubernetes/blob/release-1.3/docs/design/networking.md[here].\n+\n+[red]#Red# items are not necessary for a functional OpenShift cluster, but some things will need to be worked around for the administrator's benefit.\n+\n+. A plugin can follow the NetworkPolicy objects from Kubernetes and implement the user/admin \n+intent on multi-tenancy (see https://github.com/kubernetes/kubernetes/blob/master/docs/proposals/network-policy.md[here]). \n+Alternatively, plugins can ignore the multi-tenancy completely or implement a model where multi-tenancy is based on projects i.e. Kubernetes namespaces, where,\n+** Each namespace should be treated like a tenant where its pods and services are isolated from another project's pods/services\n+** [red]#Support exists for operations like merge/join networks even when they belong to different namespaces#\n+. Certain services in the cluster will be run as infrastructure services. e.g. Load balancer, registry, DNS server(skydns). \n+The plugin should allow for a 'global' tenant which is-accessible-by/can-access all pods of the cluster. For example, a load balancer \n+can run in two modes - private and global. The global load balancer should have access to all tenants/namespaces of the cluster. A \n+private load balancer is one that is launched as a pod by a particular namespace, and this should obey tenant isolation rules.\n+. [red]#Access to all pods from the host - particularly important if kube-proxy is used by the SDN solution to support Kubernetes services. \n+Please note that iptables based kube-proxy will be enabled by default in OpenShift. This will have to be overridden specially if the plugin \n+wants a different behaviour.#\n+. Access to external networks by pods whether through NAT or direct access.\n+. Build containers - as part of the developer workflow, OpenShift builds docker images. The build is run through 'docker build' api. \n+This means that docker's default networking will be invoked for this container (CNI/kube-plugin will not run as this is not a pod). \n+These containers still need a network and access to external network (the internet e.g.).\n+. [red]#Respect the PodSecurityContext::HostNetwork=true for infra pods. Or provide an externally routable IP address to the pod. This is \n+used for the load balancer pods which are the entry point for all external traffic funneling into the cluster.#\n+** Note that the HostPort<->ContainerPort mapping will not be available by default if the CNI plugin is enabled (as the default docker networking is turned off). The plugin will have to implement this functionality by itself.","path":"integration.adoc","position":49,"original_position":49,"commit_id":"635e812a9fb957f015be86935dc94acdb168927a","original_commit_id":"635e812a9fb957f015be86935dc94acdb168927a","user":{"login":"jdob","id":128268,"avatar_url":"https://avatars3.githubusercontent.com/u/128268?v=4","gravatar_id":"","url":"https://api.github.com/users/jdob","html_url":"https://github.com/jdob","followers_url":"https://api.github.com/users/jdob/followers","following_url":"https://api.github.com/users/jdob/following{/other_user}","gists_url":"https://api.github.com/users/jdob/gists{/gist_id}","starred_url":"https://api.github.com/users/jdob/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jdob/subscriptions","organizations_url":"https://api.github.com/users/jdob/orgs","repos_url":"https://api.github.com/users/jdob/repos","events_url":"https://api.github.com/users/jdob/events{/privacy}","received_events_url":"https://api.github.com/users/jdob/received_events","type":"User","site_admin":false},"body":"For some reason, the <-> got rendered as an awkward ASCII arrow. Not sure how to best resolve this, but see what you can do.","created_at":"2017-08-25T19:12:32Z","updated_at":"2017-08-25T19:12:45Z","html_url":"https://github.com/jdob/ocp-onboard/pull/9#discussion_r135333588","pull_request_url":"https://api.github.com/repos/jdob/ocp-onboard/pulls/9","_links":{"self":{"href":"https://api.github.com/repos/jdob/ocp-onboard/pulls/comments/135333588"},"html":{"href":"https://github.com/jdob/ocp-onboard/pull/9#discussion_r135333588"},"pull_request":{"href":"https://api.github.com/repos/jdob/ocp-onboard/pulls/9"}}},"pull_request":{"url":"https://api.github.com/repos/jdob/ocp-onboard/pulls/9","id":137517647,"html_url":"https://github.com/jdob/ocp-onboard/pull/9","diff_url":"https://github.com/jdob/ocp-onboard/pull/9.diff","patch_url":"https://github.com/jdob/ocp-onboard/pull/9.patch","issue_url":"https://api.github.com/repos/jdob/ocp-onboard/issues/9","number":9,"state":"open","locked":false,"title":"Added Network policies","user":{"login":"anishasthana","id":6526150,"avatar_url":"https://avatars2.githubusercontent.com/u/6526150?v=4","gravatar_id":"","url":"https://api.github.com/users/anishasthana","html_url":"https://github.com/anishasthana","followers_url":"https://api.github.com/users/anishasthana/followers","following_url":"https://api.github.com/users/anishasthana/following{/other_user}","gists_url":"https://api.github.com/users/anishasthana/gists{/gist_id}","starred_url":"https://api.github.com/users/anishasthana/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/anishasthana/subscriptions","organizations_url":"https://api.github.com/users/anishasthana/orgs","repos_url":"https://api.github.com/users/anishasthana/repos","events_url":"https://api.github.com/users/anishasthana/events{/privacy}","received_events_url":"https://api.github.com/users/anishasthana/received_events","type":"User","site_admin":false},"body":"","created_at":"2017-08-24T18:11:56Z","updated_at":"2017-08-25T19:12:45Z","closed_at":null,"merged_at":null,"merge_commit_sha":"79ead54af193eb823bec80c2d605258273edb726","assignee":null,"assignees":[],"requested_reviewers":[],"milestone":null,"commits_url":"https://api.github.com/repos/jdob/ocp-onboard/pulls/9/commits","review_comments_url":"https://api.github.com/repos/jdob/ocp-onboard/pulls/9/comments","review_comment_url":"https://api.github.com/repos/jdob/ocp-onboard/pulls/comments{/number}","comments_url":"https://api.github.com/repos/jdob/ocp-onboard/issues/9/comments","statuses_url":"https://api.github.com/repos/jdob/ocp-onboard/statuses/635e812a9fb957f015be86935dc94acdb168927a","head":{"label":"anishasthana:networking","ref":"networking","sha":"635e812a9fb957f015be86935dc94acdb168927a","user":{"login":"anishasthana","id":6526150,"avatar_url":"https://avatars2.githubusercontent.com/u/6526150?v=4","gravatar_id":"","url":"https://api.github.com/users/anishasthana","html_url":"https://github.com/anishasthana","followers_url":"https://api.github.com/users/anishasthana/followers","following_url":"https://api.github.com/users/anishasthana/following{/other_user}","gists_url":"https://api.github.com/users/anishasthana/gists{/gist_id}","starred_url":"https://api.github.com/users/anishasthana/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/anishasthana/subscriptions","organizations_url":"https://api.github.com/users/anishasthana/orgs","repos_url":"https://api.github.com/users/anishasthana/repos","events_url":"https://api.github.com/users/anishasthana/events{/privacy}","received_events_url":"https://api.github.com/users/anishasthana/received_events","type":"User","site_admin":false},"repo":{"id":99027148,"name":"ocp-onboard","full_name":"anishasthana/ocp-onboard","owner":{"login":"anishasthana","id":6526150,"avatar_url":"https://avatars2.githubusercontent.com/u/6526150?v=4","gravatar_id":"","url":"https://api.github.com/users/anishasthana","html_url":"https://github.com/anishasthana","followers_url":"https://api.github.com/users/anishasthana/followers","following_url":"https://api.github.com/users/anishasthana/following{/other_user}","gists_url":"https://api.github.com/users/anishasthana/gists{/gist_id}","starred_url":"https://api.github.com/users/anishasthana/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/anishasthana/subscriptions","organizations_url":"https://api.github.com/users/anishasthana/orgs","repos_url":"https://api.github.com/users/anishasthana/repos","events_url":"https://api.github.com/users/anishasthana/events{/privacy}","received_events_url":"https://api.github.com/users/anishasthana/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/anishasthana/ocp-onboard","description":null,"fork":true,"url":"https://api.github.com/repos/anishasthana/ocp-onboard","forks_url":"https://api.github.com/repos/anishasthana/ocp-onboard/forks","keys_url":"https://api.github.com/repos/anishasthana/ocp-onboard/keys{/key_id}","collaborators_url":"https://api.github.com/repos/anishasthana/ocp-onboard/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/anishasthana/ocp-onboard/teams","hooks_url":"https://api.github.com/repos/anishasthana/ocp-onboard/hooks","issue_events_url":"https://api.github.com/repos/anishasthana/ocp-onboard/issues/events{/number}","events_url":"https://api.github.com/repos/anishasthana/ocp-onboard/events","assignees_url":"https://api.github.com/repos/anishasthana/ocp-onboard/assignees{/user}","branches_url":"https://api.github.com/repos/anishasthana/ocp-onboard/branches{/branch}","tags_url":"https://api.github.com/repos/anishasthana/ocp-onboard/tags","blobs_url":"https://api.github.com/repos/anishasthana/ocp-onboard/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/anishasthana/ocp-onboard/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/anishasthana/ocp-onboard/git/refs{/sha}","trees_url":"https://api.github.com/repos/anishasthana/ocp-onboard/git/trees{/sha}","statuses_url":"https://api.github.com/repos/anishasthana/ocp-onboard/statuses/{sha}","languages_url":"https://api.github.com/repos/anishasthana/ocp-onboard/languages","stargazers_url":"https://api.github.com/repos/anishasthana/ocp-onboard/stargazers","contributors_url":"https://api.github.com/repos/anishasthana/ocp-onboard/contributors","subscribers_url":"https://api.github.com/repos/anishasthana/ocp-onboard/subscribers","subscription_url":"https://api.github.com/repos/anishasthana/ocp-onboard/subscription","commits_url":"https://api.github.com/repos/anishasthana/ocp-onboard/commits{/sha}","git_commits_url":"https://api.github.com/repos/anishasthana/ocp-onboard/git/commits{/sha}","comments_url":"https://api.github.com/repos/anishasthana/ocp-onboard/comments{/number}","issue_comment_url":"https://api.github.com/repos/anishasthana/ocp-onboard/issues/comments{/number}","contents_url":"https://api.github.com/repos/anishasthana/ocp-onboard/contents/{+path}","compare_url":"https://api.github.com/repos/anishasthana/ocp-onboard/compare/{base}...{head}","merges_url":"https://api.github.com/repos/anishasthana/ocp-onboard/merges","archive_url":"https://api.github.com/repos/anishasthana/ocp-onboard/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/anishasthana/ocp-onboard/downloads","issues_url":"https://api.github.com/repos/anishasthana/ocp-onboard/issues{/number}","pulls_url":"https://api.github.com/repos/anishasthana/ocp-onboard/pulls{/number}","milestones_url":"https://api.github.com/repos/anishasthana/ocp-onboard/milestones{/number}","notifications_url":"https://api.github.com/repos/anishasthana/ocp-onboard/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/anishasthana/ocp-onboard/labels{/name}","releases_url":"https://api.github.com/repos/anishasthana/ocp-onboard/releases{/id}","deployments_url":"https://api.github.com/repos/anishasthana/ocp-onboard/deployments","created_at":"2017-08-01T17:35:32Z","updated_at":"2017-07-20T18:15:14Z","pushed_at":"2017-08-24T18:11:37Z","git_url":"git://github.com/anishasthana/ocp-onboard.git","ssh_url":"git@github.com:anishasthana/ocp-onboard.git","clone_url":"https://github.com/anishasthana/ocp-onboard.git","svn_url":"https://github.com/anishasthana/ocp-onboard","homepage":null,"size":290,"stargazers_count":0,"watchers_count":0,"language":null,"has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"jdob:master","ref":"master","sha":"4d70e0c0324ba0933a1f2a585bdbc07cbaeb9b81","user":{"login":"jdob","id":128268,"avatar_url":"https://avatars3.githubusercontent.com/u/128268?v=4","gravatar_id":"","url":"https://api.github.com/users/jdob","html_url":"https://github.com/jdob","followers_url":"https://api.github.com/users/jdob/followers","following_url":"https://api.github.com/users/jdob/following{/other_user}","gists_url":"https://api.github.com/users/jdob/gists{/gist_id}","starred_url":"https://api.github.com/users/jdob/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jdob/subscriptions","organizations_url":"https://api.github.com/users/jdob/orgs","repos_url":"https://api.github.com/users/jdob/repos","events_url":"https://api.github.com/users/jdob/events{/privacy}","received_events_url":"https://api.github.com/users/jdob/received_events","type":"User","site_admin":false},"repo":{"id":70521609,"name":"ocp-onboard","full_name":"jdob/ocp-onboard","owner":{"login":"jdob","id":128268,"avatar_url":"https://avatars3.githubusercontent.com/u/128268?v=4","gravatar_id":"","url":"https://api.github.com/users/jdob","html_url":"https://github.com/jdob","followers_url":"https://api.github.com/users/jdob/followers","following_url":"https://api.github.com/users/jdob/following{/other_user}","gists_url":"https://api.github.com/users/jdob/gists{/gist_id}","starred_url":"https://api.github.com/users/jdob/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jdob/subscriptions","organizations_url":"https://api.github.com/users/jdob/orgs","repos_url":"https://api.github.com/users/jdob/repos","events_url":"https://api.github.com/users/jdob/events{/privacy}","received_events_url":"https://api.github.com/users/jdob/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/jdob/ocp-onboard","description":null,"fork":false,"url":"https://api.github.com/repos/jdob/ocp-onboard","forks_url":"https://api.github.com/repos/jdob/ocp-onboard/forks","keys_url":"https://api.github.com/repos/jdob/ocp-onboard/keys{/key_id}","collaborators_url":"https://api.github.com/repos/jdob/ocp-onboard/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/jdob/ocp-onboard/teams","hooks_url":"https://api.github.com/repos/jdob/ocp-onboard/hooks","issue_events_url":"https://api.github.com/repos/jdob/ocp-onboard/issues/events{/number}","events_url":"https://api.github.com/repos/jdob/ocp-onboard/events","assignees_url":"https://api.github.com/repos/jdob/ocp-onboard/assignees{/user}","branches_url":"https://api.github.com/repos/jdob/ocp-onboard/branches{/branch}","tags_url":"https://api.github.com/repos/jdob/ocp-onboard/tags","blobs_url":"https://api.github.com/repos/jdob/ocp-onboard/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/jdob/ocp-onboard/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/jdob/ocp-onboard/git/refs{/sha}","trees_url":"https://api.github.com/repos/jdob/ocp-onboard/git/trees{/sha}","statuses_url":"https://api.github.com/repos/jdob/ocp-onboard/statuses/{sha}","languages_url":"https://api.github.com/repos/jdob/ocp-onboard/languages","stargazers_url":"https://api.github.com/repos/jdob/ocp-onboard/stargazers","contributors_url":"https://api.github.com/repos/jdob/ocp-onboard/contributors","subscribers_url":"https://api.github.com/repos/jdob/ocp-onboard/subscribers","subscription_url":"https://api.github.com/repos/jdob/ocp-onboard/subscription","commits_url":"https://api.github.com/repos/jdob/ocp-onboard/commits{/sha}","git_commits_url":"https://api.github.com/repos/jdob/ocp-onboard/git/commits{/sha}","comments_url":"https://api.github.com/repos/jdob/ocp-onboard/comments{/number}","issue_comment_url":"https://api.github.com/repos/jdob/ocp-onboard/issues/comments{/number}","contents_url":"https://api.github.com/repos/jdob/ocp-onboard/contents/{+path}","compare_url":"https://api.github.com/repos/jdob/ocp-onboard/compare/{base}...{head}","merges_url":"https://api.github.com/repos/jdob/ocp-onboard/merges","archive_url":"https://api.github.com/repos/jdob/ocp-onboard/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/jdob/ocp-onboard/downloads","issues_url":"https://api.github.com/repos/jdob/ocp-onboard/issues{/number}","pulls_url":"https://api.github.com/repos/jdob/ocp-onboard/pulls{/number}","milestones_url":"https://api.github.com/repos/jdob/ocp-onboard/milestones{/number}","notifications_url":"https://api.github.com/repos/jdob/ocp-onboard/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/jdob/ocp-onboard/labels{/name}","releases_url":"https://api.github.com/repos/jdob/ocp-onboard/releases{/id}","deployments_url":"https://api.github.com/repos/jdob/ocp-onboard/deployments","created_at":"2016-10-10T19:32:26Z","updated_at":"2017-08-25T18:50:12Z","pushed_at":"2017-08-25T18:51:54Z","git_url":"git://github.com/jdob/ocp-onboard.git","ssh_url":"git@github.com:jdob/ocp-onboard.git","clone_url":"https://github.com/jdob/ocp-onboard.git","svn_url":"https://github.com/jdob/ocp-onboard","homepage":null,"size":276,"stargazers_count":0,"watchers_count":0,"language":"HTML","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":3,"mirror_url":null,"open_issues_count":1,"forks":3,"open_issues":1,"watchers":0,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/jdob/ocp-onboard/pulls/9"},"html":{"href":"https://github.com/jdob/ocp-onboard/pull/9"},"issue":{"href":"https://api.github.com/repos/jdob/ocp-onboard/issues/9"},"comments":{"href":"https://api.github.com/repos/jdob/ocp-onboard/issues/9/comments"},"review_comments":{"href":"https://api.github.com/repos/jdob/ocp-onboard/pulls/9/comments"},"review_comment":{"href":"https://api.github.com/repos/jdob/ocp-onboard/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/jdob/ocp-onboard/pulls/9/commits"},"statuses":{"href":"https://api.github.com/repos/jdob/ocp-onboard/statuses/635e812a9fb957f015be86935dc94acdb168927a"}}}}
{"actor":{"display_login":"jdob"}}