https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/ Recent content on Antrea Hugo -- gohugo.io en-us https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/adopters/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/adopters/ Antrea Adopters                   Success Stories Below is a list of adopters of Antrea that have publicly shared the details of how they use it. Glasnostic Glasnostic makes modern cloud operations resilient. It does this by shaping how systems interact, automatically and in real-time. As a result, DevOps and SRE teams can deploy reliably, prevent failure and assure the customer experience. We use Antrea’s Open vSwitch support to tune how services interact in Kubernetes clusters. https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/changelog/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/changelog/ Changelogs have been moved to the CHANGELOG directory. https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/code_of_conduct/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/code_of_conduct/ Community Code of Conduct Project Antrea follows the CNCF Code of Conduct. https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/contributing/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/contributing/ Developer Guide Thank you for taking the time out to contribute to project Antrea! This guide will walk you through the process of making your first commit and how to effectively get it merged upstream. Getting Started Accounts Setup Contribute Git Client Hooks GitHub Workflow Getting reviewers Getting your PR verified by CI Cherry-picks to release branches Conventions for Writing Documentation Inclusive Naming Building and testing your change Reverting a commit Sign-off Your Work Issue and PR Management Filing An Issue Issue Triage Issue and PR Kinds Getting Started To get started, let’s ensure you have completed the following prerequisites for contributing to project Antrea: https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/admin-network-policy/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/admin-network-policy/ AdminNetworkPolicy API Support in Antrea Table of Contents Introduction Prerequisites Usage Sample specs for AdminNetworkPolicy and BaselineAdminNetworkPolicy Relationship with Antrea-native Policies Introduction Kubernetes provides the NetworkPolicy API as a simple way for developers to control traffic flows of their applications. While NetworkPolicy is embraced throughout the community, it was designed for developers instead of cluster admins. Therefore, traits such as the lack of explicit deny rules make securing workloads at the cluster level difficult. https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/aks-installation/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/aks-installation/ Deploying Antrea on AKS and AKS Engine This document describes steps to deploy Antrea to an AKS cluster or an AKS Engine cluster. Deploy Antrea to an AKS cluster Antrea can be deployed to an AKS cluster either in networkPolicyOnly mode or in encap mode. In networkPolicyOnly mode, Antrea enforces NetworkPolicies and implements other services for the AKS cluster, while the Azure CNI takes care of Pod IPAM and traffic routing across Nodes. https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/antctl/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/antctl/ Antctl antctl is the command-line tool for Antrea. At the moment, antctl supports running in three different modes: “controller mode”: when run out-of-cluster or from within the Antrea Controller Pod, antctl can connect to the Antrea Controller and query information from it (e.g. the set of computed NetworkPolicies). “agent mode”: when run from within an Antrea Agent Pod, antctl can connect to the Antrea Agent and query information local to that Agent (e. https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/antrea-agent-simulator/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/antrea-agent-simulator/ Run Antrea agent simulator This document describes how to run the Antrea agent simulator. The simulator is useful for Antrea scalability testing, without having to create a very large cluster. Build the images make build-scale-simulator Create the yaml file This demo uses 1 simulator, this command will create a yaml file build/yamls/antrea-scale.yml make manifest-scale The above yaml will create one simulated Node/Pod, to change the number of instances, you can modify spec. https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/antrea-ipam/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/antrea-ipam/ Antrea IPAM Capabilities Antrea IPAM Capabilities Running NodeIPAM within Antrea Controller Configuration Antrea Flexible IPAM Usage Enable AntreaIPAM feature gate and bridging mode Create IPPool CR IPPool Annotations on Namespace IPPool Annotations on Pod (available since Antrea 1.5) Persistent IP for StatefulSet Pod (available since Antrea 1.5) Data path behaviors Requirements for this Feature Flexible IPAM design On IPPool CR create/update event On StatefulSet create event On StatefulSet delete event On Pod create On Pod delete IPAM for Secondary Network Prerequisites CNI IPAM configuration Configuration with NetworkAttachmentDefinition CRD IPPool CRD Running NodeIPAM within Antrea Controller NodeIPAM is a Kubernetes component, which manages IP address pool allocation per each Node, when the Node initializes. https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/antrea-l7-network-policy/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/antrea-l7-network-policy/ Antrea Layer 7 NetworkPolicy Table of Contents Introduction Prerequisites Usage HTTP More examples TLS More examples Logs Limitations Introduction NetworkPolicy was initially used to restrict network access at layer 3 (Network) and 4 (Transport) in the OSI model, based on IP address, transport protocol, and port. Securing applications at IP and port level provides limited security capabilities, as the service an application provides is either entirely exposed to a client or not accessible by that client at all. https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/antrea-network-policy/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/antrea-network-policy/ Antrea Network Policy CRDs Table of Contents Summary Tier Tier CRDs Static tiers kubectl commands for Tier Antrea ClusterNetworkPolicy The Antrea ClusterNetworkPolicy resource ACNP with stand-alone selectors ACNP with ClusterGroup reference ACNP for complete Pod isolation in selected Namespaces ACNP for strict Namespace isolation ACNP for default zero-trust cluster security posture ACNP for toServices rule ACNP for ICMP traffic ACNP for IGMP traffic ACNP for multicast egress traffic ACNP for HTTP traffic ACNP for Kubernetes Node traffic ACNP with log settings Behavior of to and from selectors Key differences from K8s NetworkPolicy kubectl commands for Antrea ClusterNetworkPolicy Antrea NetworkPolicy The Antrea NetworkPolicy resource Key differences from Antrea ClusterNetworkPolicy Antrea NetworkPolicy with Group reference kubectl commands for Antrea NetworkPolicy Antrea-native Policy ordering based on priorities Ordering based on Tier priority Ordering based on policy priority Rule enforcement based on priorities Advanced peer selection mechanisms of Antrea-native Policies Selecting Namespace by Name K8s clusters with version 1. https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/antrea-node-network-policy/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/antrea-node-network-policy/ Antrea Node NetworkPolicy Table of Contents Introduction Prerequisites Usage Logs Limitations Introduction Node NetworkPolicy is designed to secure the Kubernetes Nodes traffic. It is supported by Antrea starting with Antrea v1.15. This guide demonstrates how to configure Node NetworkPolicy. Prerequisites Node NetworkPolicy was introduced in v1.15 as an alpha feature and is disabled by default. A feature gate, NodeNetworkPolicy, must be enabled in antrea-agent. https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/antrea-proxy/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/antrea-proxy/ Antrea Proxy Table of Contents Introduction Antrea Proxy with proxyAll Removing kube-proxy Windows Nodes Configuring load balancer mode for external traffic Special use cases When you are using NodeLocal DNSCache When you want your external LoadBalancer to handle Pod traffic Known issues or limitations Introduction Antrea Proxy was first introduced in Antrea v0. https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/api-reference/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/api-reference/ Packages: controlplane.antrea.io/v1beta2 crd.antrea.io/v1alpha1 crd.antrea.io/v1alpha2 crd.antrea.io/v1beta1 stats.antrea.io/v1alpha1 system.antrea.io/v1beta1 controlplane.antrea.io/v1beta2 Package v1beta2 is the v1beta2 version of the Antrea NetworkPolicy API messages. Resource Types: AddressGroup AppliedToGroup ClusterGroupMembers EgressGroup GroupAssociation GroupMembers IPGroupAssociation NetworkPolicy NetworkPolicyEvaluation NodeStatsSummary SupportBundleCollection AddressGroup AddressGroup is the message format of antrea/pkg/controller/types.AddressGroup in an API response. https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/api/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/api/ Antrea API This document lists all the API resource versions currently or previously supported by Antrea, along with information related to their deprecation and removal when appropriate. It is kept up-to-date as we evolve the Antrea API. Starting with the v1.0 release, we decided to group all the Custom Resource Definitions (CRDs) defined by Antrea in a single API group, crd.antrea.io, instead of grouping CRDs logically in different API groups based on their purposes. https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/assets/logo/readme/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/assets/logo/readme/ Antrea Logos We provide the following 2 logos (“regular” and “stacked”) in both SVG and PNG format. Use the one that works for you! Regular SVG Regular PNG Large Regular PNG Small Stacked SVG Stacked PNG Large Stacked PNG Small https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/assets/readme/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/assets/readme/ Assets SVG images The SVG images / diagrams in this directory have been created using Inkscape and exported as PNG files - which can be embedded in Markdown files. If you edit these images, please re-export them as PNG with a 300 dpi resolution. If you create new SVG images / diagrams for documentation, please check-in both the SVG source and the exported PNG file. https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/bgp-policy/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/bgp-policy/ BGPPolicy Table of Contents What is BGPPolicy? Prerequisites The BGPPolicy resource NodeSelector LocalASN ListenPort Confederation Advertisements BGPPeers BGP router ID BGP Authentication Example Usage Combined Advertisements of Service, Pod, and Egress IPs Advertise Egress IPs to external BGP peers with more than one hop Advertise Pod IPs through BGP Confederation Using antctl Limitations What is BGPPolicy? https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/configuration/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/configuration/ Configuration antrea-agent Command line options --config string The path to the configuration file --v Level number for the log level verbosity Use antrea-agent -h to see complete options. Configuration The antrea-agent configuration file specifies the agent configuration parameters. For all the agent configuration parameters of a Linux Node, refer to this base configuration file. For all the configuration parameters of a Windows Node, refer to this base configuration file. antrea-controller Command line options --config string The path to the configuration file --v Level number for the log level verbosity Use antrea-controller -h to see complete options. https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/contributors/cherry-picks/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/contributors/cherry-picks/ Cherry-picks to release branches Some Pull Requests (PRs) which fix bugs in the main branch of Antrea can be identified as good candidates for backporting to currently maintained release branches (using a Git cherry-pick), so that they can be included in subsequent patch releases. If you have authored such a PR (thank you!!!), one of the Antrea maintainers may comment on your PR to ask for your assistance with that process. https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/contributors/code-generation/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/contributors/code-generation/ Code and Documentation Generation CNI Antrea uses protoc, protoc-gen-go and protoc-gen-go-grpc to generate CNI gRPC service code. If you make any change to cni.proto, you can re-generate the code by invoking make codegen. Make sure that you commit your changes before running the script, and that you commit the generated code after running it. Extension API Resources and Custom Resource Definitions Antrea extends Kubernetes API with an extension APIServer and Custom Resource Definitions, and uses k8s. https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/contributors/docker-desktop-alternatives/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/contributors/docker-desktop-alternatives/ Docker Desktop Alternatives The Antrea build system relies on Docker to build container images, which can then be used to test Antrea locally. As an Antrea developer, if you run make, docker build will be invoked to build the antrea-ubuntu container image. On Linux, Docker Engine (based on moby) runs natively, but if you use macOS or Windows for Antrea development, Docker needs to run inside a Linux Virtual Machine (VM). https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/contributors/eks-terraform/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/contributors/eks-terraform/ Deploying EKS with Antrea Antrea may run in networkPolicyOnly mode in AKS and EKS clusters. This document describes the steps to create an EKS cluster with Antrea using terraform. Common Prerequisites To run EKS cluster, install and configure AWS cli(either version 1 or 2), see https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-install.html, and https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-configure.html Install aws-iam-authenticator, see https://docs.aws.amazon.com/eks/latest/userguide/install-aws-iam-authenticator.html Install terraform, see https://learn.hashicorp.com/tutorials/terraform/install-cli You must already have ssh key-pair created. This key pair will be used to access worker Node via ssh. https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/contributors/github-labels/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/contributors/github-labels/ GitHub Label List We use GitHub labels to perform issue triage, track and report on development progress, plan roadmaps, and automate issue grooming. To ensure that contributing new issues and PRs remains straight-forward, we would like to keep the labels required for submission to a minimum. The remaining labels will be added either by automation or manual grooming by other contributors and maintainers. The labels in this list originated within Kubernetes at https://github. https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/contributors/issue-management/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/contributors/issue-management/ Issue Management This document further describes the developer workflow and how issues are managed as introduced in CONTRIBUTING.md. Please read CONTRIBUTING.md first before proceeding. Developer Workflow Overview Creating New Issues and PRs Good First Issues and Help Wanted Issue and PR Triage Process Issue Triage PR Triage Working an Issue Issue and PR Labels Issue Kinds API Change Bug Cleanup Feature Deprecation Task Design Documentation Failing Test Support Area Size Triage Lifecycle Priority Developer Workflow Overview The purpose of this workflow is to formalize a lightweight set of processes that will optimize issue triage and management which will lead to better release predictability and community responsiveness for support and feature enhancements. https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/design/architecture/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/design/architecture/ Antrea Architecture Antrea is designed to be Kubernetes-centric and Kubernetes-native. It focuses on and is optimized for networking and security of a Kubernetes cluster. Its implementation leverages Kubernetes and Kubernetes native solutions as much as possible. Antrea leverages Open vSwitch as the networking data plane. Open vSwitch is a high-performance programmable virtual switch that supports both Linux and Windows. Open vSwitch enables Antrea to implement Kubernetes Network Policies in a high-performance and efficient manner. https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/design/ovs-pipeline/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/design/ovs-pipeline/ Antrea OVS Pipeline Table of Contents Introduction Terminology Dumping the Flows / Groups OVS Registers and Conntrack OVS Registers OVS Ct Mark OVS Ct Label OVS Ct Zone Antrea Features Kubernetes NetworkPolicy Implementation Kubernetes Service Implementation Antrea-native NetworkPolicy Implementation Antrea-native L7 NetworkPolicy Implementation TrafficControl Implementation Egress Implementation OVS Tables PipelineRootClassifier ARPSpoofGuard ARPResponder Classifier SpoofGuard UnSNAT ConntrackZone ConntrackState PreRoutingClassifier NodePortMark SessionAffinity ServiceLB EndpointDNAT AntreaPolicyEgressRule EgressRule EgressDefaultRule EgressMetric L3Forwarding EgressMark L3DecTTL SNATMark SNAT L2ForwardingCalc TrafficControl IngressSecurityClassifier AntreaPolicyIngressRule IngressRule IngressDefaultRule IngressMetric ConntrackCommit Output Introduction This document outlines the Open vSwitch (OVS) pipeline Antrea uses to implement its networking functionalities. https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/design/policy-only/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/design/policy-only/ Running Antrea in networkPolicyOnly Mode Antrea supports chaining with routed CNI implementations such as EKS CNI. In this mode, Antrea enforces Kubernetes NetworkPolicy, and delegates Pod IP management and network connectivity to the primary CNI. Design Antrea is designed to work as NetworkPolicy plug-in to work together with a routed CNIs. For as long as a CNI implementation fits into this model, Antrea may be inserted to enforce NetworkPolicy in that CNI’s environment using Open vSwitch(OVS). https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/design/windows-design/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/design/windows-design/ Running Antrea on Windows Antrea supports running on Windows worker Nodes. On Windows Nodes, Antrea sets up an overlay network to forward packets between Nodes and implements NetworkPolicies. Design On Windows, the Host Networking Service (HNS) is a necessary component to support container networking. For Antrea on Windows, “Transparent” mode is chosen for the HNS network. In this mode, containers will be directly connected to the physical network through an external Hyper-V switch. https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/egress/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/egress/ Egress Table of Contents What is Egress? Prerequisites The Egress resource AppliedTo EgressIP ExternalIPPool Bandwidth The ExternalIPPool resource IPRanges SubnetInfo NodeSelector Usage examples Configuring High-Availability Egress Configuring static Egress Configuration options Egress on Cloud AWS Limitations Known issues What is Egress? https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/eks-installation/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/eks-installation/ Deploying Antrea in AWS EKS This document describes steps to deploy Antrea in networkPolicyOnly mode or encap mode to an AWS EKS cluster. Deploying Antrea in networkPolicyOnly mode In networkPolicyOnly mode, Antrea implements NetworkPolicy and other services for an EKS cluster, while Amazon VPC CNI takes care of IPAM and Pod traffic routing across Nodes. Refer to the design document for more information about networkPolicyOnly mode. This document assumes you already have an EKS cluster, and have the KUBECONFIG environment variable point to the kubeconfig file of that cluster. https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/external-node/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/external-node/ External Node Table of Contents What is ExternalNode? Prerequisites The ExternalNode resource Name and Namespace Interfaces Install Antrea Agent on VM Prerequisites on Kubernetes cluster Installation on Linux VM Prerequisites on Linux VM Installation steps on Linux VM Service Installation Container Installation Installation on Windows VM Prerequisites on Windows VM Installation steps on Windows VM VM network configuration RBAC for antrea-agent Apply Antrea NetworkPolicy to ExternalNode Antrea NetworkPolicy configuration Bypass Antrea NetworkPolicy OpenFlow pipeline Non-IP packet IP packet Limitations What is ExternalNode? https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/feature-gates/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/feature-gates/ Antrea Feature Gates This page contains an overview of the various features an administrator can turn on or off for Antrea components. We follow the same convention as the Kubernetes feature gates. In particular: a feature in the Alpha stage will be disabled by default but can be enabled by editing the appropriate .conf entry in the Antrea manifest. a feature in the Beta stage will be enabled by default but can be disabled by editing the appropriate . https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/getting-started/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/getting-started/ Getting Started Antrea is super easy to install. All the Antrea components are containerized and can be installed using the Kubernetes deployment manifest. Ensuring requirements are satisfied NodeIPAM Antrea relies on NodeIPAM for per-Node CIDR allocation. NodeIPAM can run within the Kubernetes kube-controller-manager, or within the Antrea Controller. NodeIPAM within kube-controller-manager When using kubeadm to create the Kubernetes cluster, passing --pod-network-cidr=<CIDR Range for Pods> to kubeadm init will enable NodeIpamController. https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/gke-installation/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/gke-installation/ Deploying Antrea on a GKE cluster We support running Antrea inside of GKE clusters on Ubuntu Node. Antrea would operate in NetworkPolicy only mode, in which no encapsulation is required for any kind of traffic (Intra Node, Inter Node, etc) and NetworkPolicies are enforced using OVS. Antrea is supported on both VPC-native Enable/Disable modes. GKE Prerequisites Install the Google Cloud SDK (gcloud). Refer to Google Cloud SDK installation guide https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/helm/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/helm/ Installing Antrea with Helm Table of Contents Prerequisites Charts Antrea chart Installation Upgrade An important note on CRDs Flow Aggregator chart Installation Upgrade Theia chart Starting with Antrea v1.8, Antrea can be installed and updated using Helm. We provide the following Helm charts: antrea/antrea: the Antrea network plugin. antrea/flow-aggregator: the Antrea Flow Aggregator; see here for more details. https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/kind/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/kind/ Deploying Antrea on a Kind cluster Create a Kind cluster and deploy Antrea in a few seconds Using the kind-setup.sh script As an Antrea developer Create a Kind cluster manually Deploy Antrea to your Kind cluster Deploy a local build of Antrea to your Kind cluster (for developers) Check that everything is working Run the Antrea e2e tests FAQ Antrea Agents are not starting on macOS, what could it be? https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/kubernetes-installers/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/kubernetes-installers/ K8s Installers and Distributions Tested installers and distributions The table below is not comprehensive. Antrea should work with most K8s installers and distributions. The table refers to specific version combinations which are known to work and have been tested, but support is not limited to that list. Each Antrea version supports multiple K8s minor versions, and installers / distributions based on any one of these K8s versions should work with that Antrea version. https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/maintainers/build-kubemark/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/maintainers/build-kubemark/ Build the kubemark image This documentation simply describes how to build the kubemark image used in Antrea scale testing cd $KUBERNETES_PATH git checkout v1.29.0 make WHAT=cmd/kubemark KUBE_BUILD_PLATFORMS=linux/amd64 cp ./_output/local/bin/linux/amd64/kubemark cluster/images/kubemark cd cluster/images/kubemark docker build -t antrea/kubemark:v1.29.0 . https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/maintainers/getting-started-gif/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/maintainers/getting-started-gif/ Getting-started GIF To refresh the gif image included in getting-started.md, follow these steps: install asciinema set PS1="> " in your bash profile file (e.g. .bashrc, zshrc, …) to simplify the prompt record the cast with the correct shell, e.g. SHELL=zsh asciinema rec my.cast convert the cast file to a gif file: docker run --rm -v $PWD:/data -w /data asciinema/asciicast2gif -s 3 -w 120 -h 20 my.cast my.gif upload the gif file to Github’s CDN by following these instructions update the link in getting-started. https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/maintainers/release/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/maintainers/release/ Antrea Release Process This file documents the list of steps to perform to create a new Antrea release. We use <TAG> as a placeholder for the release tag (e.g. v1.4.0). For a minor release On the code freeze date (typically one week before the actual scheduled release date), create a release branch for the new minor release (e.g release-1.4). after that time, only bug fixes should be merged into the release branch, by cherry-picking the fix after it has been merged into main. https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/maintainers/updating-ovs-windows/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/maintainers/updating-ovs-windows/ Updating the OVS Windows Binaries Antrea ships a zip archive with OVS binaries for Windows. The binaries are hosted on the antrea.io website and updated as needed. This file documents the procedure to upload a new version of the OVS binaries. The archive is served from AWS S3, and therefore access to the Antrea S3 account is required for this procedure. We assume that you have already built the OVS binaries (if a custom built is required), or retrieved them from the official OVS build pipelines. https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/migrate-to-antrea/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/migrate-to-antrea/ Migrate from another CNI to Antrea This document provides guidance on migrating from other CNIs to Antrea starting from version v1.15.0 onwards. NOTE: The following is a reference list of CNIs and versions for which we have verified the migration process. CNIs and versions that are not listed here might also work. Please create an issue if you run into problems during the migration to Antrea. During the migration process, no Kubernetes resources should be created or deleted, otherwise the migration process might fail or some unexpected problems might occur. https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/minikube/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/minikube/ Deploying Antrea on Minikube Install Minikube Deploy Antrea Deploy Antrea to Minikube cluster Deploy a local build of Antrea to Minikube cluster (for developers) Verification Install Minikube Follow these steps to install minikube and set its development environment. Deploy Antrea Deploy Antrea to Minikube cluster # curl is required because --cni flag does not accept URL as a parameter curl -Lo https://github. https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/multicast-guide/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/multicast-guide/ Multicast User Guide Antrea supports multicast traffic in the following scenarios: Pod to Pod - a Pod that has joined a multicast group will receive the multicast traffic to that group from the Pod senders. Pod to External - external hosts can receive the multicast traffic sent from Pods, when the Node network supports multicast forwarding / routing to the external hosts. External to Pod - Pods can receive the multicast traffic from external hosts. https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/multicluster/antctl/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/multicluster/antctl/ Antctl Multi-cluster commands Starting from version 1.6.0, Antrea supports the antctl mc commands, which can collect information from a leader cluster for troubleshooting Antrea Multi-cluster issues, deploy Antrea Multi-cluster and set up ClusterSets in both leader and member clusters. The antctl mc get command is supported since Antrea v1.6.0, while other commands are supported since v1.8.0. These commands cannot run inside the antrea-controller, antrea-agent or antrea-mc-controller Pods. antctl needs a kubeconfig file to access the target cluster’s API server, and it will look for the kubeconfig file at $HOME/. https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/multicluster/api/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/multicluster/api/ Antrea Multi-cluster API This document lists all the API resource versions currently supported by Antrea Mulit-cluster. Antrea Multi-cluster is supported since v1.5.0. Most Custom Resource Definitions (CRDs) used by Antrea Multi-cluster are in the API group multicluster.crd.antrea.io, and two CRDs from mcs-api are in group multicluster.x-k8s.io which is defined by Kubernetes upstream KEP-1645. Currently-supported CRDs in multicluster.crd.antrea.io CRD CRD version Introduced in Deprecated in / Planned Deprecation Planned Removal ClusterSets v1alpha2 v1. https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/multicluster/architecture/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/multicluster/architecture/ Antrea Multi-cluster Architecture Antrea Multi-cluster implements Multi-cluster Service API, which allows users to create multi-cluster Services that can be accessed cross clusters in a ClusterSet. Antrea Multi-cluster also supports Antrea ClusterNetworkPolicy replication. Multi-cluster admins can define ClusterNetworkPolicies to be replicated across the entire ClusterSet, and enforced in all member clusters. An Antrea Multi-cluster ClusterSet includes a leader cluster and multiple member clusters. Antrea Multi-cluster Controller needs to be deployed in the leader and all member clusters. https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/multicluster/policy-only-mode/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/multicluster/policy-only-mode/ Antrea Multi-cluster with NetworkPolicy Only Mode Multi-cluster Gateway works with Antrea networkPolicyOnly mode, in which cross-cluster traffic is routed by Multi-cluster Gateways of member clusters, and the traffic goes through Antrea overlay tunnels between Gateways and local cluster Pods. Pod traffic within a cluster is still handled by the primary CNI, not Antrea. Deploying Antrea in networkPolicyOnly mode with Multi-cluster feature This section describes steps to deploy Antrea in networkPolicyOnly mode with the Multi-cluster feature enabled on an EKS cluster. https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/multicluster/quick-start/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/multicluster/quick-start/ Antrea Multi-cluster Quick Start In this quick start guide, we will set up an Antrea Multi-cluster ClusterSet with two clusters. One cluster will serve as the leader of the ClusterSet, and meanwhile also join as a member cluster; another cluster will be a member only. Antrea Multi-cluster supports two types of IP addresses as multi-cluster Service endpoints - exported Services' ClusterIPs or backend Pod IPs. We use the default ClusterIP endpoint type for multi-cluster Services in this guide. https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/multicluster/upgrade/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/multicluster/upgrade/ Antrea Multi-cluster Upgrade Guide The Antrea Multi-cluster feature is introduced from v1.5.0. There is no data-plane related changes from release v1.5.0, so Antrea deployment and Antrea Multi-cluster deployment are indenpendent. However, we suggest to keep Antrea and Antrea Multi-cluster in the same version considering there will be data-plane change involved in the future. Please refer to Antrea upgrade and supported version skew to learn the requirement of Antrea upgrade. This doc focuses on Multi-cluster deployment only. https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/multicluster/user-guide/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/multicluster/user-guide/ Antrea Multi-cluster User Guide Table of Contents Quick Start Installation Preparation Deploy Antrea Multi-cluster Controller Deploy in a Dedicated Leader Cluster Deploy in a Member Cluster Deploy Leader and Member in One Cluster Create ClusterSet Set up Access to Leader Cluster Initialize ClusterSet Initialize ClusterSet for a Dual-role Cluster Multi-cluster Gateway Configuration Multi-cluster WireGuard Encryption Multi-cluster Service Multi-cluster Pod-to-Pod Connectivity Multi-cluster NetworkPolicy Egress Rule to Multi-cluster Service Ingress Rule ClusterNetworkPolicy Replication Build Antrea Multi-cluster Controller Image Uninstallation Remove a Member Cluster Remove a Leader Cluster Known Issue Antrea Multi-cluster implements Multi-cluster Service API, which allows users to create multi-cluster Services that can be accessed cross clusters in a ClusterSet. https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/network-flow-visibility/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/network-flow-visibility/ Network Flow Visibility in Antrea Table of Contents Overview Flow Exporter Configuration Configuration pre Antrea v1.13 IPFIX Information Elements (IEs) in a Flow Record IEs from IANA-assigned IE Registry IEs from Reverse IANA-assigned IE Registry IEs from Antrea IE Registry Supported Capabilities Types of Flows and Associated Information Connection Metrics Flow Aggregator Deciding which mode to use Aggregate Mode Installation Configuring secure connections to the ClickHouse database Example of flow-aggregator. https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/network-requirements/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/network-requirements/ Network Requirements Antrea has a few network requirements to get started, ensure that your hosts and firewalls allow the necessary traffic based on your configuration. Configuration Host(s) Protocols/Ports Configurable Other Antrea with VXLAN enabled All UDP 4789 Yes Antrea with Geneve enabled All UDP 6081 Yes Antrea with STT enabled All TCP 7471 Yes Antrea with GRE enabled All IP Protocol ID 47 No No support for IPv6 clusters Antrea with IPsec ESP enabled All IP protocol ID 50 and 51, UDP 500 and 4500 No Antrea with WireGuard enabled All UDP 51820[3] Yes Antrea Multi-cluster with WireGuard encryption Multi-cluster Gateway Node UDP 51821 Yes Antrea with feature BGPPolicy enabled Selected by user-provided BGPPolicies TCP 179[1] Yes All Kube-apiserver host TCP 443 or 6443[2] Yes All All TCP 10349, 10350, 10351, UDP 10351 Yes [1] The default value is 179, but a user created BGPPolicy can assign a different port number. https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/node-port-local/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/node-port-local/ NodePortLocal (NPL) Table of Contents What is NodePortLocal? Prerequisites Usage Usage pre Antrea v1.7 Usage pre Antrea v1.4 Usage pre Antrea v1.2 Limitations Integrations with External Load Balancers AVI What is NodePortLocal? NodePortLocal (NPL) is a feature that runs as part of the Antrea Agent, through which each port of a Service backend Pod can be reached from the external network using a port of the Node on which the Pod is running. https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/noencap-hybrid-modes/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/noencap-hybrid-modes/ NoEncap and Hybrid Traffic Modes of Antrea Besides the default Encap mode, in which Pod traffic across Nodes will be encapsulated and sent over tunnels, Antrea also supports NoEncap and Hybrid traffic modes. In NoEncap mode, Antrea does not encapsulate Pod traffic, but relies on the Node network to route the traffic across Nodes. In Hybrid mode, Antrea encapsulates Pod traffic when the source Node and the destination Node are in different subnets, but does not encapsulate when the source and the destination Nodes are in the same subnet. https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/octant-plugin-installation/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/octant-plugin-installation/ Octant and antrea-octant-plugin installation Octant is no longer maintained and the antrea-octant-plugin has been removed as of Antrea v1.13. Please refer to #4640 for more information, and check out the Antrea web UI for an alternative. https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/os-issues/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/os-issues/ OS-specific known issues The following issues were encountered when testing Antrea on different OSes, or reported by Antrea users. When possible we try to provide a workaround. CoreOS Issues #626 CoreOS Container Linux has reached its end-of-life on May 26, 2020 and no longer receives updates. It is recommended to migrate to another Operating System as soon as possible. https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/ovs-offload/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/ovs-offload/ OVS Hardware Offload The OVS software based solution is CPU intensive, affecting system performance and preventing fully utilizing available bandwidth. OVS 2.8 and above support a feature called OVS Hardware Offload which improves performance significantly. This feature allows offloading the OVS data-plane to the NIC while maintaining OVS control-plane unmodified. It is using SR-IOV technology with VF representor host net-device. The VF representor plays the same role as TAP devices in Para-Virtual (PV) setup. https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/packetcapture-guide/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/packetcapture-guide/ Packet Capture User Guide Starting with Antrea v2.2, Antrea supports PacketCapture for network diagnosis. It can capture specified number of packets from real traffic and upload them to a supported storage location. Users can create a PacketCapture CR to trigger packet capture on the target traffic flow. Prerequisites PacketCapture is disabled by default. If you want to enable this feature, you need to set feature gate PacketCapture to true in the antrea-config ConfigMap for antrea-agent. https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/prometheus-integration/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/prometheus-integration/ Prometheus Integration Purpose Prometheus server can monitor various metrics and provide an observation of the Antrea Controller and Agent components. The doc provides general guidelines to the configuration of Prometheus server to operate with the Antrea components. About Prometheus Prometheus is an open source monitoring and alerting server. Prometheus is capable of collecting metrics from various Kubernetes components, storing and providing alerts. Prometheus can provide visibility by integrating with other products such as Grafana. https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/secondary-network/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/secondary-network/ Antrea Secondary Network Support Table of Contents Introduction Prerequisites Configurations VLAN OVS bridge configuration Secondary VLAN network configuration Pod secondary interface configuration SR-IOV Creating network functions Installing SR-IOV Network Device Plugin Secondary SR-IOV network configuration Pod secondary interface configuration Limitations Introduction Antrea can work with Multus, in which case Antrea is the primary CNI of the Kubernetes cluster and provisions the “primary” network interfaces of Pods; while Multus manages secondary networks and executes other CNIs to create secondary network interfaces of Pods. https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/securing-control-plane/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/securing-control-plane/ Securing Control Plane All API communication between Antrea control plane components is encrypted with TLS. The TLS certificates that Antrea requires can be automatically generated. You can also provide your own certificates. This page explains the certificates that Antrea requires and how to configure and rotate them for Antrea. Table of Contents What certificates are required by Antrea How certificates are used by Antrea Providing your own certificates Using kubectl Using cert-manager Certificate rotation What certificates are required by Antrea Currently Antrea only requires a single server certificate for the antrea-controller API server endpoint, which is for the following communication: https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/security/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/security/ Security Recommendations This document describes some security recommendations when deploying Antrea in a cluster, and in particular a multi-tenancy cluster. To report a vulnerability in Antrea, please refer to SECURITY.md. For information about securing Antrea control-plane communications, refer to this document. Protecting Your Cluster Against Privilege Escalations Antrea Agent Like all other K8s Network Plugins, Antrea runs an agent (the Antrea Agent) on every Node on the cluster, using a K8s DaemonSet. https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/service-loadbalancer/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/service-loadbalancer/ Service of type LoadBalancer Table of Contents Service external IP management by Antrea Preparation Configuration Enable Service external IP management feature Create an ExternalIPPool custom resource Create a Service of type LoadBalancer Validate Service external IP Limitations Using MetalLB with Antrea Install MetalLB Configure MetalLB with layer 2 mode Configure MetalLB with BGP mode Interoperability with kube-proxy IPVS mode Issue with Antrea Egress In Kubernetes, implementing Services of type LoadBalancer usually requires an external load balancer. https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/support-bundle-guide/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/support-bundle-guide/ Support Bundle User Guide What is Support Bundle Antrea supports collecting support bundle tarballs, which include the information from Antrea Controller and Antrea Agent. The collected information can help debugging issues in the Kubernetes cluster. Be aware that the generated support bundle includes a lot of information, including logs, so please review the contents before sharing it on Github and ensure that you do not share any sensitive information. There are two ways of generating support bundles. https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/traceflow-guide/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/traceflow-guide/ Traceflow User Guide Antrea supports using Traceflow for network diagnosis. It can inject a packet into OVS on a Node and trace the forwarding path of the packet across Nodes, and it can also trace a matched packet of real traffic from or to a Pod. In either case, a Traceflow operation is triggered by a Traceflow CRD which specifies the type of Traceflow, the source and destination of the packet to trace, and the headers of the packet. https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/traffic-control/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/traffic-control/ Traffic Control With Antrea Table of Contents What is TrafficControl? Prerequisites The TrafficControl resource AppliedTo Direction Action TargetPort ReturnPort Examples Mirroring all traffic to remote analyzer Redirecting specific traffic to local receiver What’s next What is TrafficControl? TrafficControl is a CRD API that manages and manipulates the transmission of Pod traffic. https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/traffic-encryption/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/traffic-encryption/ Traffic Encryption with Antrea Antrea supports encrypting traffic across Linux Nodes with IPsec ESP or WireGuard. Traffic encryption is not supported on Windows Nodes yet. IPsec IPsec encryption works for all tunnel types supported by OVS including Geneve, GRE, VXLAN, and STT tunnel. Note that GRE is not supported for IPv6 clusters (IPv6-only or dual-stack clusters). For such clusters, please choose a different tunnel type such as Geneve or VXLAN. https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/troubleshooting/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/troubleshooting/ Troubleshooting Table of Contents Looking at the Antrea logs Accessing the antrea-controller API Using antctl Using kubectl proxy Using antctl proxy Directly accessing the antrea-controller API Accessing the antrea-agent API Using antctl Using antctl proxy Directly accessing the antrea-agent API Accessing the flow-aggregator API Using antctl Directly accessing the flow-aggregator API Troubleshooting Open vSwitch Troubleshooting with antctl Profiling Antrea components Ask your questions to the Antrea community Looking at the Antrea logs You can inspect the antrea-controller logs in the antrea-controller Pod by running this kubectl command: https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/versioning/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/versioning/ Antrea Versioning Table of Contents Versioning scheme Minor releases and patch releases Feature stability Release cycle Antrea upgrade and supported version skew Supported K8s versions Deprecation policies Prometheus metrics deprecation policy APIs deprecation policy Introducing new API resources Introducing new CRDs Upgrading from Antrea v1 to Antrea v2 Required upgrade steps because of API removal Case 1: upgrading from Antrea v1. https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/windows/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/docs/windows/ Deploying Antrea on Windows Table of Contents Overview Components that run on Windows Antrea Windows demo Deploying Antrea on Windows worker Nodes Prerequisites Installation as a Pod Download & Configure Antrea for Linux Add Windows antrea-agent DaemonSet Join Windows worker Nodes 1. (Optional) Install OVS (provided by Antrea or your own) 2. Disable Windows Firewall 3. https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/governance/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/governance/ Antrea Governance This document defines the project governance for Antrea. Overview Antrea is committed to building an open, inclusive, productive and self-governing open source community focused on building a high-quality Kubernetes Network Plugin. The community is governed by this document which defines how all members should work together to achieve this goal. Code of Conduct The Antrea community abides by this code of conduct. Community Roles Users: Members that engage with the Antrea community via any medium (Slack, GitHub, mailing lists, etc. https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/maintainers/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/maintainers/ Antrea Maintainers This is the current list of maintainers for the Antrea project. The maintainer role is described in GOVERNANCE.md. Maintainer GitHub ID Affiliation Antonin Bas antoninbas Broadcom Jianjun Shen jianjuns Broadcom Lan Luo luolanzone Broadcom Quan Tian tnqn Broadcom Salvatore Orlando salv-orlando Broadcom https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/readme/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/readme/ Antrea Overview Antrea is a Kubernetes networking solution intended to be Kubernetes native. It operates at Layer 3/4 to provide networking and security services for a Kubernetes cluster, leveraging Open vSwitch as the networking data plane. Open vSwitch is a widely adopted high-performance programmable virtual switch; Antrea leverages it to implement Pod networking and security features. For instance, Open vSwitch enables Antrea to implement Kubernetes Network Policies in a very efficient manner. https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/roadmap/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/roadmap/ Antrea Roadmap This document lists the new features being considered for the future. The intention is for Antrea contributors and users to know what features could come in the near future, and to share feedback and ideas. Priorities for the project may change over time and so this roadmap is likely to evolve. A feature that is not listed now does not mean it will not be considered for Antrea. We definitely welcome suggestions and ideas from everyone about the roadmap and Antrea features. https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/security/ Mon, 01 Jan 0001 00:00:00 +0000 https://deploy-preview-62--gracious-lamport-f690a0.netlify.app/docs/v2.4.4/security/ Security Procedures The Antrea community holds security in the highest regard. The community adopted this security disclosure policy to ensure vulnerabilities are responsibly handled. Reporting a Vulnerability If you believe you have identified a vulnerability, please work with the Antrea maintainers to fix it and disclose the issue responsibly. All security issues, confirmed or suspected, should be reported privately. Please avoid using github issues, and instead report the vulnerability to cncf-antrea-maintainers@lists.