Uploaded image for project: 'Knative Serving'
  1. Knative Serving
  2. SRVKS-1192

[DOC] Document the option of not generating the default Serving networkpolicies

XMLWordPrintable

      User can set an annotation at the Serving CR level to disable generating the default Serving network policies when Istio is enabled.
      The default network policy names are: a) webhook, b) net-istio-webhook, c) allow-from-openshift-monitoring-ns
      The annotation is`serverless.openshift.io/disable-istio-net-policies-generation` and the values it can be set are: true, false.
      This is applicable when customer will set in OSSM:

        profiles:
        - default
        security:
          manageNetworkPolicy: false
      

      As part of this work we need to clean up the section here: https://access.redhat.com/documentation/en-us/red_hat_openshift_serverless/1.31/html-single/integrations/index#serverless-ossm-enabling-serving-metrics_serverless-ossm-setup
      Right now the second bullet is not needed because we automatically generate the "allow-from-openshift-monitoring-ns" network policy at the Serverless operator side. So the section starting with the following should be removed:
      "Apply the following network policy to allow traffic from the Prometheus namespace:..."

      Note: eng. work will be available in 1.32 to allow consumption from the RHAI team but docs will target 1.33.

              kaldesai Kalyani Desai
              skontopo@redhat.com Stavros Kontopoulos
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

                Created:
                Updated:
                Resolved: