CNP: update docs to use CNP instead of ANP and BANP #333

npinaeva · 2025-10-13T11:25:16Z

Add a blog post with short description of changes, some migration examples and future plans.
I have also added a new version of the CNP model made in drawio, and the source file should be import-able to make future changes, but lmk if you have better ideas to store images

Fixes a part of #312

netlify · 2025-10-13T11:25:22Z

✅ Deploy Preview for kubernetes-sigs-network-policy-api ready!

Name	Link
🔨 Latest commit	`e9a4362`
🔍 Latest deploy log	https://app.netlify.com/projects/kubernetes-sigs-network-policy-api/deploys/690c9f73c4feb800085b57aa
😎 Deploy Preview	https://deploy-preview-333--kubernetes-sigs-network-policy-api.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

bowei

Looks good to me.

Don't we write a new blog post vs update the old ones?

site-src/api-overview.md

bowei · 2025-10-14T00:00:02Z

site-src/api-overview.md

+cluster](user-stories.md#story-5-cluster-wide-default-guardrails).

-### AdminNetworkPolicy Actions
+### ClusterNetworkPolicy Actions


Suggest just leave this as ### Actions

I edited all headers to remote the CNP from it, it probably was only important when we had ANP vs BANP

site-src/api-overview.md

tssurya · 2025-10-14T07:27:06Z

#328 there is another blog post from @frozenprocess ?
maybe combining them is better? or do we want to go with both?

Ah I see comment on that one already: #328 (comment)

k8s-ci-robot · 2025-10-16T10:28:28Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: npinaeva

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [npinaeva]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

npinaeva · 2025-10-16T10:29:08Z

Don't we write a new blog post vs update the old ones?

I am not sure what you mean, I did write a new blog post

npinaeva · 2025-10-29T11:44:20Z

@bowei will you have some time this week to give it another look?

Dyanngg

Thanks for all the work put in this API evolution @npinaeva! Antrea is interested in picking up ClusterNetworkPolicy and implement it once the API is ready

Dyanngg · 2025-11-03T21:22:38Z

site-src/api-overview.md

+
+- **Pass**: Skips all further ClusterNetworkPolicy rules in the
+  current tier for the selected traffic, and passes
+  evaluation to the next tier.


Technically 'NetworkPolicy' is not the "next tier", not sure if we want to call it out here. I know that we have the diagram above which illustrates the policy evaluation model, but I don't want people to think that once we're done with "Admin" tier rules we move on to the "Baseline" tier.

I think it could be explained either way (it's based on the definition of terms etc), but we should be consistent across all the docs to avoid confusion. Either the notion of tiers is just a convenient way to refer 1) to Admin -> NP -> Baseline or 2) we are more strict and say only Admin and Baseline are tiers.

I think in the code comments, it is closer to 1)

good point, I think this part is confusing because I didn't update the tiers section properly, let me update it with the API doc

Dyanngg · 2025-11-03T21:23:41Z

site-src/api-overview.md

-BaselineAdminNetworkPolicies. 
+or Deny rules. For example, intra-namespace traffic management can be delegated to namespace
+admins explicitly with the use of `Pass` rules. More specifically traffic selected by a `Pass` rule
+will skip any lower precedence `Admin` tier rules and proceed to be evaluated by `NetworkPolicy` and


nit: this feels like a bit of a run-on sentence for me

Seems like chopping it at the i.e. and just making that another sentence would suffice?

bowei · 2025-11-04T00:17:55Z

site-src/blog/posts/ClusterNetworkPolicy.md

+  - npinaeva
+---
+
+# ClusterNetworkPolicy or what happened to the AdminNetworkPolicy and BaselineAdminNetworkPolicy?


Suggest to make it more direct so people understand the change.

# API update for v1alpha2: `ClusterNetworkPolicy` replaces `AdminNetworkPolicy` and `BaselineAdminNetworkPolicy` We have merged `v1alpha1.AdminNetworkPolicy` and `v1alpha1.BaselineAdminNetworkPolicy` into a single API in `v1alpha2.ClusterNetworkPolicy`.

(put the rest of your discussion below)

bowei

Just some specific comments.

Note the comment on the diagram.

Generally, looks ok

bowei · 2025-11-04T00:18:40Z

site-src/blog/posts/ClusterNetworkPolicy.md

+
+![image](/images/ANP-api-model.png)
+
+The model stays the same with the new API, the only difference is that evaluation order is now defined by the `priority` field


Do you mean tier instead of priority?

oh yes, good catch

bowei · 2025-11-04T00:19:41Z

site-src/blog/posts/ClusterNetworkPolicy.md

+Other changes bring the functionality of `BaselineAdminNetworkPolicy` to parity with `AdminNetworkPolicy`. This includes:
+- Allowing multiple `ClusterNetworkPolicy` resources with `tier=Baseline` by using the same `priority` field as for `tier=Admin`.
+- Supporting `Pass` action in `ClusterNetworkPolicy` with `tier=Baseline` to allow skipping all further rules in the `Baseline` tier.
+- Supporting `domainNames` matching for `egress` rules in `ClusterNetworkPolicy` with `tier=Baseline`.


This is experimental channel

do you mean I should add a note saying that domainNames is an experimental feature?

bowei · 2025-11-04T00:21:25Z

site-src/images/CNP.drawio.svg

I think you should have two priority arrows and number 1 - 1000 on each. This diagram makes it seem like the priority # extends across all of the tiers, which it does not. Also, the NetworkPolicy tier does not have priority numbers

good point, I am thinking if just leaving Evaluated first and Evaluated last is good enough? Or maybe replace Priority with "evaluation order"?
I don't think adding detail on the actual priority field was a point of this picture

bowei · 2025-11-04T00:24:55Z

site-src/api-overview.md

+
+- **Pass**: Skips all further ClusterNetworkPolicy rules in the
+  current tier for the selected traffic, and passes
+  evaluation to the next tier.


I think it could be explained either way (it's based on the definition of terms etc), but we should be consistent across all the docs to avoid confusion. Either the notion of tiers is just a convenient way to refer 1) to Admin -> NP -> Baseline or 2) we are more strict and say only Admin and Baseline are tiers.

I think in the code comments, it is closer to 1)

bowei · 2025-11-04T00:25:33Z

site-src/api-overview.md

-BaselineAdminNetworkPolicies. 
+or Deny rules. For example, intra-namespace traffic management can be delegated to namespace
+admins explicitly with the use of `Pass` rules. More specifically traffic selected by a `Pass` rule
+will skip any lower precedence `Admin` tier rules and proceed to be evaluated by `NetworkPolicy` and


Seems like chopping it at the i.e. and just making that another sentence would suffice?

npinaeva · 2025-11-05T10:34:10Z

I updated install docs as discussed in the last meeting, see the last commit

Add a blog post with short description of changes, some migration examples and future plans. Signed-off-by: Nadia Pinaeva <[email protected]>

We don't release install.yaml artifact anymore, simply use `crd/standard` files from the right tag/main branch. Add mkdocs feature that enables "copy to clipboard" button on the bash commands. Signed-off-by: Nadia Pinaeva <[email protected]>

bowei · 2025-11-07T06:52:31Z

/lgtm

(I don't know why but I can't seem to resolve any comment threads)

k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label Oct 13, 2025

k8s-ci-robot requested review from Dyanngg and danwinship October 13, 2025 11:25

k8s-ci-robot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label Oct 13, 2025

npinaeva mentioned this pull request Oct 13, 2025

Docs: a blog about v1alpha2 changes #328

Open

bowei reviewed Oct 14, 2025

View reviewed changes

npinaeva force-pushed the cnp-docs branch from d433fdf to ef5ce7e Compare October 16, 2025 10:28

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Oct 16, 2025

npinaeva force-pushed the cnp-docs branch from ef5ce7e to 8f0cf6b Compare October 16, 2025 10:34

npinaeva added this to the v1alpha2 milestone Oct 16, 2025

Dyanngg reviewed Nov 3, 2025

View reviewed changes

bowei reviewed Nov 4, 2025

View reviewed changes

npinaeva force-pushed the cnp-docs branch from 8f0cf6b to 7cff4e0 Compare November 4, 2025 10:25

npinaeva force-pushed the cnp-docs branch from 02737d1 to 429e99f Compare November 6, 2025 12:56

npinaeva added 2 commits November 6, 2025 14:15

CNP: update docs to use CNP instead of ANP and BANP

fcb596b

Add a blog post with short description of changes, some migration examples and future plans. Signed-off-by: Nadia Pinaeva <[email protected]>

npinaeva force-pushed the cnp-docs branch from 429e99f to e9a4362 Compare November 6, 2025 13:15

k8s-ci-robot assigned bowei Nov 7, 2025

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Nov 7, 2025

k8s-ci-robot merged commit deabb1d into kubernetes-sigs:main Nov 7, 2025
10 checks passed


		![image](/images/ANP-api-model.png)

		The model stays the same with the new API, the only difference is that evaluation order is now defined by the `priority` field

CNP: update docs to use CNP instead of ANP and BANP #333

CNP: update docs to use CNP instead of ANP and BANP #333

Conversation

npinaeva commented Oct 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

netlify bot commented Oct 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for kubernetes-sigs-network-policy-api ready!

Uh oh!

bowei left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

tssurya commented Oct 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

k8s-ci-robot commented Oct 16, 2025

Uh oh!

npinaeva commented Oct 16, 2025

Uh oh!

npinaeva commented Oct 29, 2025

Uh oh!

Dyanngg left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

bowei Nov 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

bowei left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

npinaeva commented Nov 5, 2025

Uh oh!

bowei commented Nov 7, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

npinaeva commented Oct 13, 2025 •

edited

Loading

netlify bot commented Oct 13, 2025 •

edited

Loading

tssurya commented Oct 14, 2025 •

edited

Loading

bowei Nov 4, 2025 •

edited

Loading