From 3250c0b1fff2282560ff160f9032e37915d04308 Mon Sep 17 00:00:00 2001 From: Catherine Luse Date: Sun, 11 Apr 2021 09:41:24 -0700 Subject: [PATCH] Document project network isolation on any cluster + CNI --- .../rke-clusters/options/_index.md | 22 +++++++++++++++---- 1 file changed, 18 insertions(+), 4 deletions(-) diff --git a/content/rancher/v2.5/en/cluster-provisioning/rke-clusters/options/_index.md b/content/rancher/v2.5/en/cluster-provisioning/rke-clusters/options/_index.md index 0e394858eb4..48ee201f057 100644 --- a/content/rancher/v2.5/en/cluster-provisioning/rke-clusters/options/_index.md +++ b/content/rancher/v2.5/en/cluster-provisioning/rke-clusters/options/_index.md @@ -19,6 +19,7 @@ This section is a cluster configuration reference, covering the following topics - [Rancher UI Options](#rancher-ui-options) - [Kubernetes version](#kubernetes-version) - [Network provider](#network-provider) + - [Project network isolation](#project-network-isolation) - [Kubernetes cloud providers](#kubernetes-cloud-providers) - [Private registries](#private-registries) - [Authorized cluster endpoint](#authorized-cluster-endpoint) @@ -58,15 +59,28 @@ Out of the box, Rancher is compatible with the following network providers: - [Calico](https://docs.projectcalico.org/v3.11/introduction/) - [Weave](https://github.com/weaveworks/weave) -**Notes on Canal:** - -If you use Canal, you also have the option of using **Project Network Isolation**, which will enable or disable communication between pods in different [projects]({{}}/rancher/v2.5/en/k8s-in-rancher/projects-and-namespaces/). - **Notes on Weave:** When Weave is selected as network provider, Rancher will automatically enable encryption by generating a random password. If you want to specify the password manually, please see how to configure your cluster using a [Config File]({{}}/rancher/v2.5/en/cluster-provisioning/rke-clusters/options/#cluster-config-file) and the [Weave Network Plug-in Options]({{}}/rke/latest/en/config-options/add-ons/network-plugins/#weave-network-plug-in-options). +### Project Network Isolation + +Project network isolation is used to enable or disable communication between pods in different projects. + +{{% tabs %}} +{{% tab "Rancher v2.5.8+" %}} + +To enable project network isolation as a cluster option, you will need to use any RKE network plugin that supports the enforcement of Kubernetes network policies, such as Canal or the Cisco ACI plugin. + +{{% /tab %}} +{{% tab "Rancher before v2.5.8" %}} + +To enable project network isolation as a cluster option, you will need to use Canal as the CNI. + +{{% /tab %}} +{{% /tabs %}} + ### Kubernetes Cloud Providers You can configure a [Kubernetes cloud provider]({{}}/rancher/v2.5/en/cluster-provisioning/rke-clusters/options/cloud-providers). If you want to use [volumes and storage]({{}}/rancher/v2.5/en/k8s-in-rancher/volumes-and-storage/) in Kubernetes, typically you must select the specific cloud provider in order to use it. For example, if you want to use Amazon EBS, you would need to select the `aws` cloud provider.