Documentation

GroupMembers is list of resources selected by this group.

GroupMembers is list of resources selected by this group.

AssociatedGroups is a list of GroupReferences that is associated with the Pod/ExternalEntity being queried.

Rules is a list of rules to be applied to the selected GroupMembers.

AppliedToGroups is a list of names of AppliedToGroups to which this policy applies. Cannot be set in conjunction with any NetworkPolicyRule.AppliedToGroups in Rules.

Priority represents the relative priority of this Network Policy as compared to other Network Policies. Priority will be unset (nil) for K8s NetworkPolicy.

TierPriority represents the priority of the Tier associated with this Network Policy. The TierPriority will remain nil for K8s NetworkPolicy.

Reference to the original NetworkPolicy that the internal NetworkPolicy is created for.

The TrafficStats of K8s NetworkPolicies collected from the Node.

The TrafficStats of Antrea ClusterNetworkPolicies collected from the Node.

The TrafficStats of Antrea NetworkPolicies collected from the Node.

Multicast group information collected from the Node.

The name of this ExternalEntity.

The Namespace of this ExternalEntity.

Pod maintains the reference to the Pod.

ExternalEntity maintains the reference to the ExternalEntity.

IP is the IP address of the Endpoints associated with the GroupMember.

Ports is the list NamedPort of the GroupMember.

Node maintains the reference to the Node.

Namespace of the Group. Empty for ClusterGroup.

Name of the Group.

UID of the Group.

CIDR is an IPNet represents the IP Block.

Except is a slice of IPNets that should not be included within an IP Block. Except values will be rejected if they are outside the CIDR range.

Group is the IP of the multicast group.

Pods is the list of Pods that have joined the multicast group.

Port represents the Port number.

Name represents the associated name with this Port number.

Protocol for port. Must be UDP, TCP, or SCTP.

The name of the Node that produces the status.

The generation realized by the Node.

A list of names of AddressGroups.

A list of IPBlock.

A list of exact FQDN names or FQDN wildcard expressions. This field can only be possibly set for NetworkPolicyPeer of egress rules.

A list of ServiceReference. This field can only be possibly set for NetworkPolicyPeer of egress rules.

Type of the NetworkPolicy.

Namespace of the NetworkPolicy. It’s empty for Antrea ClusterNetworkPolicy.

Name of the NetworkPolicy.

UID of the NetworkPolicy.

The direction of this rule. If it’s set to In, From must be set and To must not be set. If it’s set to Out, To must be set and From must not be set.

From represents sources which should be able to access the GroupMembers selected by the policy.

To represents destinations which should be able to be accessed by the GroupMembers selected by the policy.

Services is a list of services which should be matched.

Priority defines the priority of the Rule as compared to other rules in the NetworkPolicy.

Action specifies the action to be applied on the rule. i.e. Allow/Drop. An empty action “nil” defaults to Allow action, which would be the case for rules created for K8s Network Policy.

EnableLogging indicates whether or not to generate logs when rules are matched. Default to false.

AppliedToGroups is a list of names of AppliedToGroups to which this rule applies. Cannot be set in conjunction with NetworkPolicy.AppliedToGroups of the NetworkPolicy that this Rule is referred to.

Name describes the intention of this rule. Name should be unique within the policy.

The reference of the NetworkPolicy.

The stats of the NetworkPolicy.

The stats of the NetworkPolicy rules. It’s empty for K8s NetworkPolicies as they don’t have rule name to identify a rule.

Nodes contains statuses produced on a list of Nodes.

The name of this Node.

The name of this Pod.

The Namespace of this Pod.

The protocol (TCP, UDP, SCTP, or ICMP) which traffic must match. If not specified, this field defaults to TCP.

Port and EndPort can only be specified, when the Protocol is TCP, UDP, or SCTP. Port defines the port name or number on the given protocol. If not specified and the Protocol is TCP, UDP, or SCTP, this matches all port numbers.

EndPort defines the end of the port range, being the end included within the range. It can only be specified when a numerical port is specified.

ICMPType and ICMPCode can only be specified, when the Protocol is ICMP. If they both are not specified and the Protocol is ICMP, this matches all ICMP traffic.

IGMPType and GroupAddress can only be specified when the Protocol is IGMP.

The name of this Service.

The Namespace of this Service.

Standard metadata of the object.

Specification of the desired behavior of ClusterNetworkPolicy.

Most recently observed status of the NetworkPolicy.

Standard metadata of the object.

Specification of the desired behavior of NetworkPolicy.

Most recently observed status of the NetworkPolicy.

Standard metadata of the object.

Specification of the desired behavior of Tier.

Tier specifies the tier to which this ClusterNetworkPolicy belongs to. The ClusterNetworkPolicy order will be determined based on the combination of the Tier’s Priority and the ClusterNetworkPolicy’s own Priority. If not specified, this policy will be created in the Application Tier right above the K8s NetworkPolicy which resides at the bottom.

Priority specfies the order of the ClusterNetworkPolicy relative to other AntreaClusterNetworkPolicies.

Select workloads on which the rules will be applied to. Cannot be set in conjunction with AppliedTo in each rule.

Set of ingress rules evaluated based on the order in which they are set. Currently Ingress rule supports setting the From field but not the To field within a Rule.

Set of egress rules evaluated based on the order in which they are set. Currently Egress rule supports setting the To field but not the From field within a Rule.

Namespace is the destination namespace.

Pod is the destination pod, exclusive with destination service.

Service is the destination service, exclusive with destination pod.

IP is the destination IPv4 or IPv6 address.

ID is the ICMPEchoRequestHeader ID.

Sequence is the ICMPEchoRequestHeader sequence.

CIDR is a string representing the IP Block Valid examples are “192.168.1.¹⁄₂₄”.

SrcIP is the source IP.

Protocol is the IP protocol.

TTL is the IP TTL.

Flags is the flags for IP.

SrcIP is the source IPv6.

NextHeader is the IPv6 protocol.

HopLimit is the IPv6 Hop Limit.

IPBlock describes the IPAddresses/IPBlocks that is matched in to/from. IPBlock cannot be set as part of the AppliedTo field. Cannot be set with any other selector.

Select Pods from NetworkPolicy’s Namespace as workloads in AppliedTo/To/From fields. If set with NamespaceSelector, Pods are matched from Namespaces matched by the NamespaceSelector. Cannot be set with any other selector except NamespaceSelector.

Select all Pods from Namespaces matched by this selector, as workloads in To/From fields. If set with PodSelector, Pods are matched from Namespaces matched by the NamespaceSelector. Cannot be set with any other selector except PodSelector or ExternalEntitySelector. Cannot be set with Namespaces.

Select Pod/ExternalEntity from Namespaces matched by specifc criteria. Current supported criteria is match: Self, which selects from the same Namespace of the appliedTo workloads. Cannot be set with any other selector except PodSelector or ExternalEntitySelector. This field can only be set when NetworkPolicyPeer is created for ClusterNetworkPolicy ingress/egress rules. Cannot be set with NamespaceSelector.

Select ExternalEntities from NetworkPolicy’s Namespace as workloads in AppliedTo/To/From fields. If set with NamespaceSelector, ExternalEntities are matched from Namespaces matched by the NamespaceSelector. Cannot be set with any other selector except NamespaceSelector.

Group is the name of the ClusterGroup which can be set as an AppliedTo or within an Ingress or Egress rule in place of a stand-alone selector. A Group cannot be set with any other selector.

Restrict egress access to the Fully Qualified Domain Names prescribed by name or by wildcard match patterns. This field can only be set for NetworkPolicyPeer of egress rules. Supported formats are: Exact FQDNs, i.e. “google.com”, “db-svc.default.svc.cluster.local” Wildcard expressions, i.e. “*wayfair.com”.

Select all Pods with the ServiceAccount matched by this field, as workloads in AppliedTo/To/From fields. Cannot be set with any other selector.

Select certain Nodes which match the label selector. A NodeSelector cannot be set in AppliedTo field or set with any other selector.

The protocol (TCP, UDP, or SCTP) which traffic must match. If not specified, this field defaults to TCP.

The port on the given protocol. This can be either a numerical or named port on a Pod. If this field is not provided, this matches all port names and numbers.

EndPort defines the end of the port range, being the end included within the range. It can only be specified when a numerical port is specified.

Tier specifies the tier to which this NetworkPolicy belongs to. The NetworkPolicy order will be determined based on the combination of the Tier’s Priority and the NetworkPolicy’s own Priority. If not specified, this policy will be created in the Application Tier right above the K8s NetworkPolicy which resides at the bottom.

Priority specfies the order of the NetworkPolicy relative to other NetworkPolicies.

Select workloads on which the rules will be applied to. Cannot be set in conjunction with AppliedTo in each rule.

Set of ingress rules evaluated based on the order in which they are set. Currently Ingress rule supports setting the From field but not the To field within a Rule.

Set of egress rules evaluated based on the order in which they are set. Currently Egress rule supports setting the To field but not the From field within a Rule.

The phase of a NetworkPolicy is a simple, high-level summary of the NetworkPolicy’s status.

The generation observed by Antrea.

The number of nodes that have realized the NetworkPolicy.

The total number of nodes that should realize the NetworkPolicy.

Node is the node of the observation.

Role of the node like sender, receiver, etc.

Timestamp is the timestamp of the observations on the node.

Observations includes all observations from sender nodes, receiver ones, etc.

Component is the observation component.

ComponentInfo is the extension of Component field.

Action is the action to the observation.

Pod is the combination of Pod name and Pod Namespace.

DstMAC is the destination MAC.

NetworkPolicy is the combination of Namespace and NetworkPolicyName.

TTL is the observation TTL.

TranslatedSrcIP is the translated source IP.

TranslatedDstIP is the translated destination IP.

TunnelDstIP is the tunnel destination IP.

Length is the IP packet length (includes the IPv4 or IPv6 header length).

TODO: change type IPHeader to *IPHeader and correct all internal references

Action specifies the action to be applied on the rule.

Set of ports and protocols matched by the rule. If this field and Protocols are unset or empty, this rule matches all ports.

Set of protocols matched by the rule. If this field and Ports are unset or empty, this rule matches all protocols supported.

Rule is matched if traffic originates from workloads selected by this field. If this field is empty, this rule matches all sources.

Rule is matched if traffic is intended for workloads selected by this field. This field can’t be used with ToServices. If this field and ToServices are both empty or missing this rule matches all destinations.

Rule is matched if traffic is intended for a Service listed in this field. Currently only ClusterIP types Services are supported in this field. This field can only be used when AntreaProxy is enabled. This field can’t be used with To or Ports. If this field and To are both empty or missing, this rule matches all destinations.

Name describes the intention of this rule. Name should be unique within the policy.

EnableLogging is used to indicate if agent should generate logs when rules are matched. Should be default to false.

Select workloads on which this rule will be applied to. Cannot be set in conjunction with NetworkPolicySpec/ClusterNetworkPolicySpec.AppliedTo.

Namespace is the source namespace.

Pod is the source pod.

IP is the source IPv4 or IPv6 address. IP as the source is supported only for live-traffic Traceflow.

SrcPort is the source port.

DstPort is the destination port.

Flags are flags in the header.

Priority specfies the order of the Tier relative to other Tiers.

Description is an optional field to add more information regarding the purpose of this Tier.

LiveTraffic indicates the Traceflow is to trace the live traffic rather than an injected packet, when set to true. The first packet of the first connection that matches the packet spec will be traced.

DroppedOnly indicates only the dropped packet should be captured in a live-traffic Traceflow.

Timeout specifies the timeout of the Traceflow in seconds. Defaults to 20 seconds if not set.

Phase is the Traceflow phase.

Reason is a message indicating the reason of the traceflow’s current phase.

StartTime is the time at which the Traceflow as started by the Antrea Controller. Before K8s v1.20, null values (field not set) are not pruned, and a CR where a metav1.Time field is not set would fail OpenAPI validation (type string). The recommendation seems to be to use a pointer instead, and the field will be omitted when serializing. See https://github.com/kubernetes/kubernetes/issues/86811

DataplaneTag is a tag to identify a traceflow session across Nodes.

Results is the collection of all observations on different nodes.

CapturedPacket is the captured packet in live-traffic Traceflow.

SrcPort is the source port.

DstPort is the destination port.

Standard metadata of the object.

Desired state of the group.

Most recently observed status of the group.

Standard metadata of the object.

Specification of the desired behavior of Egress.

EgressStatus represents the current status of an Egress.

Standard metadata of the object.

Desired state of the external entity.

Standard metadata of the object.

Specification of the ExternalIPPool.

The current status of the ExternalIPPool.

Standard metadata of the object.

Specification of the IPPool.

Most recently observed status of the pool.

Standard metadata of the object.

Specification of the desired behavior of TrafficControl.

Select Pods matched by this selector. If set with NamespaceSelector, Pods are matched from Namespaces matched by the NamespaceSelector; otherwise, Pods are matched from all Namespaces.

Select all Pods from Namespaces matched by this selector. If set with PodSelector, Pods are matched from Namespaces matched by the NamespaceSelector.

Groups is the set of ClusterGroup names.

The remote IP of the tunnel.

ERSPAN session ID.

ERSPAN version.

ERSPAN Index.

ERSPAN v2 mirrored traffic’s direction.

ERSPAN hardware ID.

AppliedTo selects Pods to which the Egress will be applied.

EgressIP specifies the SNAT IP address for the selected workloads. If ExternalIPPool is empty, it must be specified manually. If ExternalIPPool is non-empty, it can be empty and will be assigned by Antrea automatically. If both ExternalIPPool and EgressIP are non-empty, the IP must be in the pool.

ExternalIPPool specifies the IP Pool that the EgressIP should be allocated from. If it is empty, the specified EgressIP must be assigned to a Node manually. If it is non-empty, the EgressIP will be assigned to a Node specified by the pool automatically and will failover to a different Node when the Node becomes unreachable.

The name of the Node that holds the Egress IP.

IP associated with this endpoint.

Name identifies this endpoint. Could be the network interface name in case of VMs.

Endpoints is a list of external endpoints associated with this entity.

Ports maintain the list of named ports.

ExternalNode is the opaque identifier of the agent/controller responsible for additional processing or handling of this external entity.

The IP ranges of this IP pool, e.g. 10.10.0.0/24, 10.10.10.2-10.10.10.20, 10.10.10.30-10.10.10.30.

The Nodes that the external IPs can be assigned to. If empty, it means all Nodes.

Total number of IPs.

Number of allocated IPs.

The remote IP of the tunnel.

GRE key.

Select Pods matching the labels set in the PodSelector in AppliedTo/To/From fields. If set with NamespaceSelector, Pods are matched from Namespaces matched by the NamespaceSelector. Cannot be set with any other selector except NamespaceSelector.

Select all Pods from Namespaces matched by this selector, as workloads in AppliedTo/To/From fields. If set with PodSelector, Pods are matched from Namespaces matched by the NamespaceSelector. Cannot be set with any other selector except PodSelector.

IPBlock describes the IPAddresses/IPBlocks that is matched in to/from. IPBlock cannot be set as part of the AppliedTo field. Cannot be set with any other selector or ServiceReference. Cannot be set with IPBlocks.

IPBlocks is a list of IPAddresses/IPBlocks that is matched in to/from. IPBlock cannot be set as part of the AppliedTo field. Cannot be set with any other selector or ServiceReference. Cannot be set with IPBlock.

Select backend Pods of the referred Service. Cannot be set with any other selector or ipBlock.

Select ExternalEntities from all Namespaces as workloads in AppliedTo/To/From fields. If set with NamespaceSelector, ExternalEntities are matched from Namespaces matched by the NamespaceSelector. Cannot be set with any other selector except NamespaceSelector.

Select other ClusterGroups by name. The ClusterGroups must already exist and must not contain ChildGroups themselves. Cannot be set with any selector/IPBlock/ServiceReference.

IP Address this entry is tracking

Allocation state - either Allocated or Preallocated

Owner this IP Address is allocated to

IP Version for this IP pool - either 4 or 6

List IP ranges, along with subnet definition.

The CIDR of this range, e.g. 10.10.10.0/24.

The start IP of the range, e.g. 10.10.20.5, inclusive.

The end IP of the range, e.g. 10.10.20.20, inclusive.

The protocol (TCP, UDP, or SCTP) which traffic must match. If not specified, this field defaults to TCP.

The port on the given protocol.

Name associated with the Port.

The name of the network device.

The name of the OVS internal port.

Network interface name. Used when the IP is allocated for a secondary network interface of the Pod.

(Members of IPRange are embedded into this type.)

(Members of SubnetInfo are embedded into this type.)

Gateway IP for this subnet, eg. 10.10.1.1

Prefix length for the subnet, eg. 24

VLAN ID for this subnet. Default is 0. Valid value is 0~4094.

OVSInternal represents an OVS internal port.

Device represents a network device.

GENEVE represents a GENEVE tunnel.

VXLAN represents a VXLAN tunnel.

GRE represents a GRE tunnel.

ERSPAN represents a ERSPAN tunnel.

AppliedTo selects Pods to which the traffic control configuration will be applied.

The direction of traffic that should be matched. It can be Ingress, Egress, or Both.

The action that should be taken for the traffic. It can be Redirect or Mirror.

The port to which the traffic should be redirected or mirrored.

The port from which the traffic will be sent back to OVS. It should only be set for Redirect action.

The remote IP of the tunnel.

The ID of the tunnel.

The transport layer destination port of the tunnel. If not specified, the assigned IANA port will be used, i.e., 4789 for VXLAN, 6081 for GENEVE.

Standard metadata of the object.

Desired state of the group.

Most recently observed status of the group.

Select Pods matching the labels set in the PodSelector in AppliedTo/To/From fields. If set with NamespaceSelector, Pods are matched from Namespaces matched by the NamespaceSelector. Cannot be set with any other selector except NamespaceSelector.

Select all Pods from Namespaces matched by this selector, as workloads in AppliedTo/To/From fields. If set with PodSelector, Pods are matched from Namespaces matched by the NamespaceSelector. Cannot be set with any other selector except PodSelector.

IPBlocks describe the IPAddresses/IPBlocks that are matched in to/from. IPBlocks cannot be set as part of the AppliedTo field. Cannot be set with any other selector or ServiceReference.

Select backend Pods of the referred Service. Cannot be set with any other selector or ipBlock.

Select ExternalEntities from all Namespaces as workloads in AppliedTo/To/From fields. If set with NamespaceSelector, ExternalEntities are matched from Namespaces matched by the NamespaceSelector. Cannot be set with any other selector except NamespaceSelector.

Select other ClusterGroups by name. The ClusterGroups must already exist and must not contain ChildGroups themselves. Cannot be set with any selector/IPBlock/ServiceReference.

Antrea binary version

The Pod that Antrea Agent is running in

The Node that Antrea Agent is running in

Node subnets

OVS Information

Antrea Agent NetworkPolicy information

The number of Pods which the agent is in charge of

Agent condition contains types like AgentHealthy

Antrea binary version

The Pod that Antrea Controller is running in

The Node that Antrea Controller is running in

Antrea Controller Service

Antrea Controller NetworkPolicy information

Number of agents which are connected to this controller

Controller condition contains types like ControllerHealthy

One of the AgentConditionType listed above

Mark certain type status, one of True, False, Unknown

The timestamp when AntreaAgentInfo is created/updated, ideally heartbeat interval is 60s

Brief reason

One of the ControllerConditionType listed above, controllerHealthy

Mark certain type status, one of True, False, Unknown

The timestamp when AntreaControllerInfo is created/updated, ideally heartbeat interval is 60s

Brief reason

The traffic stats of the Antrea ClusterNetworkPolicy.

The traffic stats of the Antrea ClusterNetworkPolicy, from rule perspective.

The traffic stats of the Antrea NetworkPolicy.

The traffic stats of the Antrea NetworkPolicy, from rule perspective.

Group is the IP of the multicast group.

Pods is the list of Pods that have joined the multicast group.

The traffic stats of the K8s NetworkPolicy.

The name of this Pod.

The namespace of this Pod.

Packets is the packets count hit by the NetworkPolicy.

Bytes is the bytes count hit by the NetworkPolicy.

Sessions is the sessions count hit by the NetworkPolicy.