Skip to content

Commit 2a8e270

Browse files
JoeAldingerJoeAldinger
authored
Merge pull request #74006 from JoeAldinger/OSDOCS-10112
/lgtm merging OSDOCS-10112:nwt security restructring
2 parents 28db2f8 + 8bd2e78 commit 2a8e270

File tree

74 files changed

+263
-227
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

74 files changed

+263
-227
lines changed

‎_topic_maps/_topic_map.yml

Lines changed: 34 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -1273,6 +1273,40 @@ Topics:
12731273
File: networking-operators-overview
12741274
- Name: Networking dashboards
12751275
File: networking-dashboards
1276+
- Name: OpenShift network security
1277+
Dir: openshift_network_security
1278+
Distros: openshift-enterprise,openshift-origin
1279+
Topics:
1280+
- Name: About OVN-Kubernetes network policy
1281+
File: ovn-k-network-policy
1282+
- Name: AdminNetworkPolicy
1283+
File: ovn-k-anp
1284+
- Name: Network policy
1285+
Dir: network_policy
1286+
Distros: openshift-enterprise, openshift-origin
1287+
Topics:
1288+
- Name: About network policy
1289+
File: about-network-policy
1290+
- Name: Creating a network policy
1291+
File: creating-network-policy
1292+
- Name: Viewing a network policy
1293+
File: viewing-network-policy
1294+
- Name: Editing a network policy
1295+
File: editing-network-policy
1296+
- Name: Deleting a network policy
1297+
File: deleting-network-policy
1298+
- Name: Defining a default network policy for projects
1299+
File: default-network-policy
1300+
- Name: Configuring multitenant isolation with network policy
1301+
File: multitenant-network-policy
1302+
- Name: BaselineAdminNetworkPolicy
1303+
File: ovn-k-banp
1304+
- Name: Understanding the Ingress Node Firewall Operator
1305+
File: ingress-node-firewall-operator
1306+
- Name: Configuring an egress firewall for a project
1307+
File: configuring-egress-firewall-ovn
1308+
- Name: Configuring IPsec encryption
1309+
File: configuring-ipsec-ovn
12761310
- Name: Understanding the Cluster Network Operator
12771311
File: cluster-network-operator
12781312
Distros: openshift-enterprise,openshift-origin
@@ -1284,9 +1318,6 @@ Topics:
12841318
Distros: openshift-enterprise,openshift-origin
12851319
- Name: Ingress sharding
12861320
File: ingress-sharding
1287-
- Name: Understanding the Ingress Node Firewall Operator
1288-
File: ingress-node-firewall-operator
1289-
Distros: openshift-enterprise,openshift-origin
12901321
- Name: Configuring the Ingress Controller for manual DNS management
12911322
File: ingress-controller-dnsmgt
12921323
Distros: openshift-enterprise,openshift-origin
@@ -1340,23 +1371,6 @@ Topics:
13401371
File: nw-creating-dns-records-on-infoblox
13411372
- Name: Configuring the cluster-wide proxy on the External DNS Operator
13421373
File: nw-configuring-cluster-wide-egress-proxy
1343-
- Name: Network policy
1344-
Dir: network_policy
1345-
Topics:
1346-
- Name: About network policy
1347-
File: about-network-policy
1348-
- Name: Creating a network policy
1349-
File: creating-network-policy
1350-
- Name: Viewing a network policy
1351-
File: viewing-network-policy
1352-
- Name: Editing a network policy
1353-
File: editing-network-policy
1354-
- Name: Deleting a network policy
1355-
File: deleting-network-policy
1356-
- Name: Defining a default network policy for projects
1357-
File: default-network-policy
1358-
- Name: Configuring multitenant isolation with network policy
1359-
File: multitenant-network-policy
13601374
- Name: CIDR range definitions
13611375
File: cidr-range-definitions
13621376
- Name: AWS Load Balancer Operator
@@ -1442,8 +1456,6 @@ Topics:
14421456
File: ovn-kubernetes-architecture-assembly
14431457
- Name: OVN-Kubernetes troubleshooting
14441458
File: ovn-kubernetes-troubleshooting-sources
1445-
- Name: OVN-Kubernetes network policy
1446-
File: ovn-k-network-policy
14471459
- Name: OVN-Kubernetes traffic tracing
14481460
File: ovn-kubernetes-tracing-using-ovntrace
14491461
- Name: Migrating from the OpenShift SDN network plugin
@@ -1454,12 +1466,8 @@ Topics:
14541466
File: converting-to-dual-stack
14551467
- Name: Logging for egress firewall and network policy rules
14561468
File: logging-network-policy
1457-
- Name: Configuring IPsec encryption
1458-
File: configuring-ipsec-ovn
14591469
- Name: Configure an external gateway on the default network
14601470
File: configuring-secondary-external-gateway
1461-
- Name: Configuring an egress firewall for a project
1462-
File: configuring-egress-firewall-ovn
14631471
- Name: Viewing an egress firewall for a project
14641472
File: viewing-egress-firewall-ovn
14651473
- Name: Editing an egress firewall for a project

‎_topic_maps/_topic_map_osd.yml

Lines changed: 19 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -771,19 +771,26 @@ Topics:
771771
File: configuring-cluster-wide-proxy
772772
- Name: CIDR range definitions
773773
File: cidr-range-definitions
774-
- Name: Network policy
775-
Dir: network_policy
774+
- Name: OpenShift network security
775+
Dir: openshift_network_security
776+
Distros: openshift-dedicated
776777
Topics:
777-
- Name: About network policy
778-
File: about-network-policy
779-
- Name: Creating a network policy
780-
File: creating-network-policy
781-
- Name: Viewing a network policy
782-
File: viewing-network-policy
783-
- Name: Deleting a network policy
784-
File: deleting-network-policy
785-
- Name: Configuring multitenant isolation with network policy
786-
File: multitenant-network-policy
778+
- Name: About OVN-Kubernetes network policy
779+
File: ovn-k-network-policy
780+
- Name: Network policy
781+
Dir: network_policy
782+
Distros: openshift-dedicated
783+
Topics:
784+
- Name: About network policy
785+
File: about-network-policy
786+
- Name: Creating a network policy
787+
File: creating-network-policy
788+
- Name: Viewing a network policy
789+
File: viewing-network-policy
790+
- Name: Deleting a network policy
791+
File: deleting-network-policy
792+
- Name: Configuring multitenant isolation with network policy
793+
File: multitenant-network-policy
787794
- Name: Configuring Routes
788795
Dir: routes
789796
Topics:

‎_topic_maps/_topic_map_rosa.yml

Lines changed: 26 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -997,19 +997,33 @@ Topics:
997997
File: configuring-cluster-wide-proxy
998998
- Name: CIDR range definitions
999999
File: cidr-range-definitions
1000-
- Name: Network policy
1001-
Dir: network_policy
1000+
- Name: OpenShift network security
1001+
Dir: openshift_network_security
10021002
Topics:
1003-
- Name: About network policy
1004-
File: about-network-policy
1005-
- Name: Creating a network policy
1006-
File: creating-network-policy
1007-
- Name: Viewing a network policy
1008-
File: viewing-network-policy
1009-
- Name: Deleting a network policy
1010-
File: deleting-network-policy
1011-
- Name: Configuring multitenant isolation with network policy
1012-
File: multitenant-network-policy
1003+
- Name: About OVN-Kubernetes network policy
1004+
File: ovn-k-network-policy
1005+
- Name: AdminNetworkPolicy
1006+
File: ovn-k-anp
1007+
- Name: Network policy
1008+
Dir: network_policy
1009+
Distros: openshift-rosa
1010+
Topics:
1011+
- Name: About network policy
1012+
File: about-network-policy
1013+
- Name: Creating a network policy
1014+
File: creating-network-policy
1015+
- Name: Viewing a network policy
1016+
File: viewing-network-policy
1017+
- Name: Editing a network policy
1018+
File: editing-network-policy
1019+
- Name: Deleting a network policy
1020+
File: deleting-network-policy
1021+
- Name: Defining a default network policy for projects
1022+
File: default-network-policy
1023+
- Name: Configuring multitenant isolation with network policy
1024+
File: multitenant-network-policy
1025+
- Name: BaselineAdminNetworkPolicy
1026+
File: ovn-k-banp
10131027
- Name: OVN-Kubernetes network plugin
10141028
Dir: ovn_kubernetes_network_provider
10151029
Topics:

‎cloud_experts_tutorials/cloud-experts-getting-started/cloud-experts-getting-started-what-is-rosa.adoc

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ Visit the link:https://github.com/openshift-cs/managed-openshift/projects/2[ROSA
3838
Refer to the xref:../../rosa_architecture/rosa_policy_service_definition/rosa-service-definition.adoc#rosa-sdpolicy-regions-az_rosa-service-definition[product regional availability] page for an up-to-date view of where ROSA is available.
3939

4040
== Compliance certifications
41-
ROSA is currently compliant with SOC-2 type 2, SOC 3, ISO-27001, ISO 27017, ISO 27018, HIPAA, GDPR, and PCI-DSS. We are also currently working towards FedRAMP High.
41+
ROSA is currently compliant with SOC-2 type 2, SOC 3, ISO-27001, ISO 27017, ISO 27018, HIPAA, GDPR, and PCI-DSS. We are also currently working towards FedRAMP High.
4242

4343
== Nodes
4444
=== Worker nodes across multiple AWS regions
@@ -92,11 +92,11 @@ Refer to the xref:../../rosa_architecture/rosa_policy_service_definition/rosa-se
9292
== Notifications and communication
9393
Red Hat will provide notifications regarding new Red Hat and AWS features, updates, and scheduled maintenance through email and the {hybrid-console-second} service log.
9494

95-
== Open Service Broker for AWS (OBSA)
95+
== Open Service Broker for AWS (OBSA)
9696
You can use OSBA with ROSA. However, the preferred method is the more recent link:https://github.com/aws-controllers-k8s/community[AWS Controller for Kubernetes]. See link:https://aws.amazon.com/partners/servicebroker/[Open Service Broker for AWS] for more information on OSBA.
9797

98-
== Offboarding
99-
Customers can stop using ROSA at any time and move their applications to on-premise, a private cloud, or other cloud providers. Standard reserved instances (RI) policy applies for unused RI.
98+
== Offboarding
99+
Customers can stop using ROSA at any time and move their applications to on-premise, a private cloud, or other cloud providers. Standard reserved instances (RI) policy applies for unused RI.
100100

101101
== Authentication
102102
ROSA supports the following authentication mechanisms: OpenID Connect (a profile of OAuth2), Google OAuth, GitHub OAuth, GitLab, and LDAP.
@@ -155,7 +155,7 @@ ROSA allows multiple clusters to share the same VPC. The number of clusters on o
155155
ROSA uses the OpenShift OVN-Kubernetes default CNI network provider.
156156

157157
== Cross-namespace networking
158-
Cluster admins can customize, and deny, cross-namespace on a project basis using NetworkPolicy objects. Refer to xref:../../networking/network_policy/multitenant-network-policy.adoc[Configuring multitenant isolation with network policy] for more information.
158+
Cluster admins can customize, and deny, cross-namespace on a project basis using NetworkPolicy objects. Refer to xref:../../networking/openshift_network_security/network_policy/multitenant-network-policy.adoc#nw-networkpolicy-multitenant-isolation_multitenant-network-policy[Configuring multitenant isolation with network policy] for more information.
159159

160160
== Using Prometheus and Grafana
161161
You can use Prometheus and Grafana to monitor containers and manage capacity using OpenShift User Workload Monitoring. This is a check-box option in the {cluster-manager-url}.
@@ -178,8 +178,8 @@ You can define a custom domain for your applications. See xref:../../application
178178
== ROSA domain certificates
179179
Red Hat infrastructure (Hive) manages certificate rotation for default application ingress.
180180

181-
== Disconnected environments
182-
ROSA does not support an air-gapped, disconnected environment. The ROSA cluster must have egress to the internet to access our registry, S3, and send metrics. The service requires a number of egress endpoints.
181+
== Disconnected environments
182+
ROSA does not support an air-gapped, disconnected environment. The ROSA cluster must have egress to the internet to access our registry, S3, and send metrics. The service requires a number of egress endpoints.
183183
Ingress can be limited to a PrivateLink for Red Hat SREs and a VPN for customer access.
184184

185185
//== Creating your first ROSA cluster

‎getting_started/openshift-overview.adoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -91,7 +91,7 @@ of the {product-title} {product-version} control plane. See how {product-title}
9191
works in {product-title}. {product-title} supports multiple identity providers.
9292

9393
* **xref:../networking/understanding-networking.adoc#understanding-networking[Manage networking]**: The cluster network in {product-title} is managed by the xref:../networking/cluster-network-operator.adoc#cluster-network-operator[Cluster Network Operator] (CNO). The CNO uses iptables rules in xref:../networking/openshift_sdn/configuring-kube-proxy.adoc#configuring-kube-proxy[kube-proxy] to direct traffic between nodes and pods running on those nodes. The Multus Container Network Interface adds the capability to attach xref:../networking/multiple_networks/understanding-multiple-networks.adoc#understanding-multiple-networks[multiple network interfaces] to a pod. Using
94-
xref:../networking/network_policy/about-network-policy.adoc#about-network-policy[network policy] features, you can isolate your pods or permit selected traffic.
94+
xref:../networking/openshift_network_security/network_policy/about-network-policy.adoc#about-network-policy[network policy] features, you can isolate your pods or permit selected traffic.
9595

9696
* **xref:../storage/understanding-persistent-storage.adoc#understanding-persistent-storage[Manage storage]**: {product-title} allows cluster administrators to configure persistent storage.
9797

‎migrating_from_ocp_3_to_4/planning-migration-3-4.adoc

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -155,9 +155,9 @@ Review the following networking changes to consider when transitioning from {pro
155155

156156
The default network isolation mode for {product-title} 3.11 was `ovs-subnet`, though users frequently switched to use `ovn-multitenant`. The default network isolation mode for {product-title} {product-version} is controlled by a network policy.
157157

158-
If your {product-title} 3.11 cluster used the `ovs-subnet` or `ovs-multitenant` mode, it is recommended to switch to a network policy for your {product-title} {product-version} cluster. Network policies are supported upstream, are more flexible, and they provide the functionality that `ovs-multitenant` does. If you want to maintain the `ovs-multitenant` behavior while using a network policy in {product-title} {product-version}, follow the steps to xref:../networking/network_policy/multitenant-network-policy.adoc#multitenant-network-policy[configure multitenant isolation using network policy].
158+
If your {product-title} 3.11 cluster used the `ovs-subnet` or `ovs-multitenant` mode, it is recommended to switch to a network policy for your {product-title} {product-version} cluster. Network policies are supported upstream, are more flexible, and they provide the functionality that `ovs-multitenant` does. If you want to maintain the `ovs-multitenant` behavior while using a network policy in {product-title} {product-version}, follow the steps to xref:../networking/openshift_network_security/network_policy/multitenant-network-policy.adoc#multitenant-network-policy[configure multitenant isolation using network policy].
159159

160-
For more information, see xref:../networking/network_policy/about-network-policy.adoc#about-network-policy[About network policy].
160+
For more information, see xref:../networking/openshift_network_security/network_policy/about-network-policy.adoc#about-network-policy[About network policy].
161161

162162
[discrete]
163163
==== OVN-Kubernetes as the default networking plugin in Red Hat OpenShift Networking

‎modules/nw-egressnetworkpolicy-about.adoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
// Module included in the following assemblies:
22
//
33
// * networking/openshift_sdn/configuring-egress-firewall.adoc
4-
// * networking/ovn_kubernetes_network_provider/configuring-egress-firewall-ovn.adoc
4+
// * networking/openshift_network_security/configuring-egress-firewall-ovn.adoc
55

66
ifeval::["{context}" == "configuring-egress-firewall-ovn"]
77
:ovn:

‎modules/nw-egressnetworkpolicy-create.adoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
// Module included in the following assemblies:
22
//
33
// * networking/openshift_sdn/configuring-egress-firewall.adoc
4-
// * networking/ovn_kubernetes_network_provider/configuring-egress-firewall-ovn.adoc
4+
// * networking/openshift_network_security/configuring-egress-firewall-ovn.adoc
55

66
ifeval::["{context}" == "openshift-sdn-egress-firewall"]
77
:kind: EgressNetworkPolicy

‎modules/nw-egressnetworkpolicy-object.adoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
// Module included in the following assemblies:
22
//
33
// * networking/openshift_sdn/configuring-egress-firewall.adoc
4-
// * networking/ovn_kubernetes_network_provider/configuring-egress-firewall-ovn.adoc
4+
// * networking/openshift_network_security/configuring-egress-firewall-ovn.adoc
55

66
ifeval::["{context}" == "openshift-sdn-egress-firewall"]
77
:kind: EgressNetworkPolicy

‎modules/nw-egressnetworkpolicy-view.adoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
// Module included in the following assemblies:
22
//
33
// * networking/openshift_sdn/configuring-egress-firewall.adoc
4-
// * networking/ovn_kubernetes_network_provider/configuring-egress-firewall-ovn.adoc
4+
// * networking/openshift_network_security/configuring-egress-firewall-ovn.adoc
55

66
ifeval::["{context}" == "openshift-sdn-viewing-egress-firewall"]
77
:kind: EgressNetworkPolicy

0 commit comments

Comments
 (0)