starlingx/docs
Code Issues Proposed changes
docs/doc/source/system_configuration/modifying-oam-firewall-rules.rst
Drake Finlay 54ec38e256 Adding System Config Guide 
Incorporated patchset 8 review comments from Mary C.

Conditionalized vendor-specific terms and converted code-block to
parsed-literal as required
Reformatted bulleted lists to definition lists
Implemented abbreviation substitutions
Deleted duplicate content
Some minor edits for clarity
Merged new abbreviation definitions in strings.txt

Responding to Patch 5 comments.

Change-Id: If6dd7c4cb802036445cb65853d8de7652df351c0
Signed-off-by: Stone <ronald.stone@windriver.com>
2020-12-21 13:28:54 -05:00

2.4 KiB
Raw Blame History

Modify OAM Firewall Rules

supports custom firewall rules using Kubernetes Global Network Policies.

These policies are defined using yaml syntax. For example:

~(keystone_admin)$ kubectl get globalnetworkpolicies.crd.projectcalico.org -o yaml
apiVersion: v1
items:
- apiVersion: crd.projectcalico.org/v1
  kind: GlobalNetworkPolicy
  metadata:
    creationTimestamp: "2019-06-28T17:06:33Z"
    generation: 1
    name: controller-oam-if-gnp
    resourceVersion: "1916"
    selfLink: /apis/crd.projectcalico.org/v1/globalnetworkpolicies/controller-oam-if-gnp
    uid: 146ec9a4-99c7-11e9-b187-0800275484ef
  spec:
    applyOnForward: false
    egress:
    - action: Allow
      ipVersion: 4
      protocol: TCP
    - action: Allow
      ipVersion: 4
      protocol: UDP
    - action: Allow
      protocol: ICMP
    ingress:
    - action: Allow
      destination:
        ports:
        - 22
        - 18002
        - 4545
        - 15491
        - 6385
        - 7777
        - 6443
        - 7480
        - 9311
        - 5000
        - 8080
      ipVersion: 4
      protocol: TCP
    - action: Allow
      destination:
        ports:
        - 2222
        - 2223
        - 123
        - 161
        - 162
        - 319
        - 320
      ipVersion: 4
      protocol: UDP
    - action: Allow
      protocol: ICMP
    order: 100
    selector: has(iftype) && iftype == 'oam'
    types:
    - Ingress
    - Egress
kind: List
metadata:
  resourceVersion: ""
  selfLink: ""

For a full description of syntax, see https://docs.projectcalico.org/v3.6/reference/calicoctl/resources/globalnetworkpolicy.

Use the following command to edit the globalnetworkpolicy and modify the Firewall according to the above syntax:

kubectl edit globalnetworkpolicy