Antrea Community, 5 Dec 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Antrea Community Meeting 12/05/2022

Description

Antrea Community Meeting, December 5th 2022

A

Perfect uh good morning, good afternoon, good evening, welcome to the assistance of the Andrea community meeting today is Tuesday December the 6th. Well, if you live in the United States, it will be still December the 5th for you and uh for uh today uh we only have one topic booked on the agenda, which is a demo of the layer. 7 Metropolitan feature from Hong Yang, and then you know it will be open. Discussion feel free to bring up every topic that you might have on your mind.

A

I will stop talking now and I will and hand it over to Hong Liang. For this demo.

B

C

Let's see, let's.

C

B

A

C

B

They're wrong: oh this one um before the live demo I'll share um quickly, quick review of all the data pass. Oh.

C

B

Could you see the windows please.

D

B

Okay, thanks, oh I, didn't see. um I saw that I have started the wrong spring. Okay, let's take some I'll, take a utumble over the cell network policy for this one, and so it's just a very simple: there are seven Network policy and I.

E

Don't know a very confusion: I don't want to mention this is the old style of apri? Oh, oh, oh sorry, my fault I saw you are you are showing a separator API forget it. Oh.

B

Oh okay, uh this is the this is an example. uh As we know, we only extend this. This part. We have a new, we have new, we have new new value for letter, seven like this and as we know for last seven traffic policy and they will follow the true sucata. We are untrue, type of zero and it will be returned. It will be returned from it's Ricardo via controller type, one for new for new and attract packet.

B

um How Adam you flow for that um I just um either if Branch for the layer 7 flow- and we can see this is the or this is the ordinary. This is the normal and flow we can see the piece and this system, this is flow, form or policy, which has the network policy options and, like this, this option is to use to set a city mark um and um I know.

B

This is also a new flow for to master City Market and it will be out and under the packet which has the city market will be outputted to enter tap zero. This is the process of how to processing new and tracked packet before redirecting to sakata.

B

Then we need to process the returned packet from cartoon for the class PR table I also added the flow like this. This flow is used to set.

B

And then the packet will be forwarded to lesson forwarding directly to skip CT and it was related flows.

B

Why why the package should be Volume, 2 level, 7 volume table, you turn you earned, packages to be set to source and the destination is the max um according to its original destination IP, and also the r on the output OS port number in Virtual founding calculate table.

B

After passing of the goals going through these two tables, it will be that um set a mark set a rag Mark in traffic control table um and then output it to to this table the layers. Therefore, there are two following alternative directly to skip a city and ingression related flows directly um in summer. In summary, to return the packet don't go through any flaws related to city and network policy, and it has um the task goes goes through this, this tables for non-new and attracted attacking them.

B

um We can- and this is also this is not a new flow. This is the, and now we can see that we have. We have a lot of loader City packet in this drone or this one. We also we can recover the city market from this flow. Then this city market will be recovered and then.

B

We also add we can see, we added, we add a new flow to master marker and output, it to control type zero. Yes, then, foreign.

B

Routinely from swathan, this is the same like like this one.

B

This is the quickly overview of how that is a pattern in OS.

E

Record zero match mean here.

B

uh Rock, zero, sorry yeah.

E

Zero equals to 100.

B

Oh, oh, that's, that's one is the we also for this, for we also have this red mark for the normal normal flow to Output. The package I I. Remember that it was used to Mark the package, which should be output from oh from.

E

Something yeah so I I, remember it's. It means the test. Animation Mac is known, so it could.

B

Be on the port yeah.

E

B

Okay, but then we take an example about the the mod about the stigato rules, and this is um is also an example. You know some policy. uh Of course this is universal. We can see it's applied through and for um after, after converting the Network policy, the the generated rule will be like this. We use them. We use a variable to to define the IP address since the since the Horizon group can be used by multiple rules. We can, then we can sales, we can save a little memory Maybe.

B

You can see that for the for this. For this part, it will be converted like this, and this is the time for the in, for the Ingress rule, just attack it and the for the for the forearm part for this. This part, you will be connected to this for them for the protocol patch. It will be these options and http.

B

Okay, that's done! That's that's the next! We all I'll see! Oh now we can see the demo okay.

B

The demo, um how created the three agent host portal? One two four clients, one for Server, um algorithm, R7 Network policy, which will select that the client and the server.

B

um This is the increase. This is the Ingress rule. We can see sorry Let's test them. Let's start to apply to it.

B

Okay and then we can see corresponding flows. The um have been created yeah for this one.

B

Also, the signal the signal has been created, the instructor you can see like this, and these are also the address group.

B

Okay, then we need to test them. We need to test the signature.

B

Let's exercise the First Pawn.

C

B

Zero. Okay: let's start um we can see that we only allow to get myself and host name.

B

Okay, we can see it was restarted by the by the pure and the restart packet is, is used from ricotta.

C

We have something wrong, which is the part inside the mega.

B

Then we can test the host name. Okay, this was okay, also attached or something other tasks like a cross, IP client IP. It was also understand we can entice. Also another client who is not selected, the bedroom Network policy with this one and it can access to any parts.

C

Oh okay, the name you saw at least one costumes, yeah.

B

Machine, it's okay, okay,.

B

We also have Samsung because um has the protocol like DS, let's dig.

C

Something like Google all right so.

C

B

Yes, we can see it was connection with the set, but um we we did this in this part. It's not selected about the level seven. We can see it's it's different from this one. It's this response is from the agent Houston is under the file. It's not the connection reset.

B

um We can, we can pull that um and you can drop to not HTTP protocols, okay and that's the demo well.

E

Now- and this is um egress rule.

B

B

E

But why the second client could access This Server if it's the.

C

E

What what does the lure looks like.

B

uh The second, the second, the second part, is not selected. The better rule.

C

B

We can see the yellow.

E

Okay, yeah I wonder why it could access the server if it's not selected.

C

E

C

E

Yeah is that the right, the right side, I, remember you access the server successfully right.

E

To walk, no, no I'm, not a DNS I mean the HTTP request.

B

Oh yes, um it's not if this client is not effective, the bad level Network policy, so it can look sense to the https on.

E

But it said the the policy is of is for the Ingress traffic of the server line.

C

E

Could you share the screen of the nail policy again.

B

E

I think this means the server only allows the uh the first client to access the servers uh uh host, the name and using Jose name parts and using get method only and no other request should be or no okay, I I think I understand the problem. Maybe.

E

The the phone the phone field had to scope. The traffic to oh, should only come from the uh the first client only, and only that traffic will be redirected to sarikata for further evaluation.

D

So the second kind.

E

Of traffic is not even passed by surikata.

B

You start we expected.

B

B

F

Yeah, that's a chance, so I think this is the question. I was asking on the on the pr. If you still remember um um what you know, we are actually using to enforce the sort of like quote unquoting places. Isolation behavior of this semantics, so I was I, was expecting something in the lens of you know. If there's uh such rule present, it will have some sort of like implicit isolation.

F

Rule um installed on the default tables, just like the kubernetes network policies to basically block out other um requests for any other um incoming traffic, but I I, don't know. If that's uh you know a quick solution to the problem here.

E

Yeah, no, no I get it as a single women needed to consider how.

E

How this, uh how how this failed, or what does the field means when phones and the port is specified.

D

E

I feel in current implementation is not it's not friendly to sit to support a case that you don't want to allow. Only specific Network appear to access their application.

B

Okay um and then we expected that um we stood only allow the client which has this label, and then this destination is done. Is this one? It's not this level, others like this client, others.

B

It should be and blocked from other clients.

C

Is that is that right.

E

Yeah, yes, that that's the only way we can limit the source right, otherwise, there's no other way to to specify the source.

B

Okay, then I need to reconsider how to change the date pass kind of the things.

B

Okay, I got that.

B

When we may, we may think about that offline for multitude.

E

B

Okay, um that's all of the demo.

A

Cool uh thanks a lot only on and uh do we have questions comments. Curiosity from from the attendees I'll be waiting uh a few seconds for your comments.

A

A

For preparing it, and also many thanks to the old development team that brought us this feature, Sean, hollyang and xiaue, uh there will be. This will be probably a huge, not huge level, it's surely a major Improvement for anterior Network policies, and so that's great that we are finally doing this. But now, let's move on to open discussion. So if you have any other topic that you would like to bring up, this is your moment to speak up.

A

And I know that maybe you're shy, so I'll wait for a few seconds or topics to be proposed.

A

Okay, it seems that uh probably it's all for today, so I would like to thank again our presenters thanks again, all the attendees for showing up for this meeting and uh I wish everyone a great day a great afternoon or if you are in the United States I, wish you a good night and let's talk again in two weeks time, the next community meeting will be on Tuesday December, the 20th thanks again for attending and have a good one.

C

But we're gonna.