Skip to content

Commit

Permalink
PR Comments.
Browse files Browse the repository at this point in the history
-Added redirect links for new tutorials
-Fixed broken includes for new tutorial
-examples of the otterize OSS CLI
-consistency of tutorial placement for feature overview pages
-Added ClientIntent reference link (looked for any similar issues, but didn't see any)
  • Loading branch information
bglynn committed Feb 16, 2024
1 parent ac4470e commit ebbde39
Show file tree
Hide file tree
Showing 4 changed files with 55 additions and 19 deletions.
60 changes: 44 additions & 16 deletions docs/features/network-mapping-network-policies/index.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -29,28 +29,62 @@ export const network_access_tutorials = [

Otterize's open-source [Network Mapper](/reference/configuration/network-mapper) and [Intents Operator](/reference/configuration/intents-operator) can map your cluster, with zero configuration, low privileges and low resource usage, and automate the management of network policies.

### Tutorials

View the tutorials below to learn more about how to get started:

<DocsLinkCard items={network_access_tutorials} colSize={"sm"}/>


### Mapping & visualizing

Otterize's [Network Mapper](/reference/configuration/network-mapper) is a zero-config, open-source and non-invasive tool to map your cluster. Deploy it on your cluster to get a graphical, textual or JSON representation of your cluster, and optionally use it to generate ClientIntents, which are declarations of the access each service in your cluster requires.

By connecting your cluster to Otterize Cloud, you'll immediately be presented with an interactive, historic and filterable map of your cluster.
You can access the same information in different formats by using the open-source Otterize CLI, with the commands `otterize mapper export`, `otterize mapper list` and `otterize mapper visualize`.

:::danger
TODO
Brian, please add screenshots of the access graph and network mapper visual and textual output here.
:::
**visualize example:**:
![visualize example](/img/examples/example-visualize.png)

**list example:**
```
client in namespace otterize-tutorial-npol calls:
- server in namespace otterize-tutorial-npol
client-other in namespace otterize-tutorial-npol calls:
- server in namespace otterize-tutorial-npol
```
**export example:**
```yaml
apiVersion: k8s.otterize.com/v1alpha3
kind: ClientIntents
metadata:
name: client
namespace: otterize-tutorial-npol
spec:
service:
name: client
calls:
- name: server
---
apiVersion: k8s.otterize.com/v1alpha3
kind: ClientIntents
metadata:
name: client-other
namespace: otterize-tutorial-npol
spec:
service:
name: client-other
calls:
- name: server
```


### Access control

By default, Kubernetes pods permit all outgoing and incoming traffic, posing potential security risks.

Kubernetes [NetworkPolicies](/reference/terminology#network-policies) can be employed to limit either egress or ingress traffic, thereby enhancing security and compliance.
Having deployed Otterize, you can then apply the ClientIntents generated by the network mapper, or declared by you, to your cluster. The [Intents Operator](/reference/configuration/intents-operator) calculates which [Network Policies](/reference/terminology#network-policies) are required to allow the traffic declared by the ClientIntents, enforcing access on your cluster so that only intentional access is allowed.
:::danger
TODO
Brian, please add links to ClientIntents reference here whenever it's mentioned.
:::
Having deployed Otterize, you can then apply the [ClientIntents](/reference/IBAC-Overview) generated by the network mapper, or declared by you, to your cluster. The [Intents Operator](/reference/configuration/intents-operator) calculates which [Network Policies](/reference/terminology#network-policies) are required to allow the traffic declared by the ClientIntents, enforcing access on your cluster so that only intentional access is allowed.

Read more in the [Network Policies Deep Dive](/features/network-mapping-network-policies/Reference/Network-Policies-Deep-Dive).

Expand All @@ -65,10 +99,4 @@ spec:
name: client
calls:
- name: nginx
```

### Tutorials

View the tutorials below to learn more about how to get started:

<DocsLinkCard items={network_access_tutorials} colSize={"sm"}/>
```
6 changes: 3 additions & 3 deletions docs/features/postgresql/tutorials/postgres-mapping.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -30,19 +30,19 @@ Already have Otterize deployed with the database integration configured on your

<details>
<summary>Prepare a Kubernetes cluster</summary>
{@include: ../../_common/cluster-setup.md}
{@include: ../../../_common/cluster-setup.md}
</details>

<details>
<summary>Install Otterize in your cluster, <b>with</b> Otterize Cloud</summary>

#### Create an Otterize Cloud account

{@include: ../../_common/create-account.md}
{@include: ../../../_common/create-account.md}

#### Install Otterize OSS, connected to Otterize Cloud

{@include: ../../_common/install-otterize-from-cloud-with-enforcement.md}
{@include: ../../../_common/install-otterize-from-cloud-with-enforcement.md}

</details>

Expand Down
8 changes: 8 additions & 0 deletions docusaurus.config.js
Original file line number Diff line number Diff line change
Expand Up @@ -204,6 +204,14 @@ const config = {
from: ['/quick-visual-tutorials/visual-ibac-kafka-k8s'],
to: '/features/kafka/tutorials/k8s-kafka-mapping',
},
{
from: ['/quickstart/visualization/postgresql'],
to: '/features/postgresql/tutorials/postgres-mapping'
},
{
from: ['/quickstart/access-control/postgresql'],
to: '/features/postgresql/tutorials/postgres'
},
{
from: ['/quick-visual-tutorials/visual-ibac-network-policies', '/quick-tutorials/k8s-network-policies', '/quickstart/access-control/k8s-network-policies'],
to: '/features/network-mapping-network-policies/tutorials/k8s-network-policies',
Expand Down
Binary file added static/img/examples/example-visualize.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.

0 comments on commit ebbde39

Please sign in to comment.