namespace and network policy handlers are not compatible

[Luis Tomas Bolivar]

Both namespace and network policy handler will need a different security group driver to properly ensure the isolation. This leads to them being incompatible as kuryr only supports to configure one security group driver at a time.

We need to ensure that the namespace handler can work without the need for ensuring isolation (i.e., without an special security group driver) as the network policy security group driver is able to create finer-grain isolation policies.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/611606
Committed: https://git.openstack.org/cgit/openstack/kuryr-kubernetes/commit/?id=651da66af1191053a96b283aa6d890fd8488438d
Submitter: Zuul
Branch: master

commit 651da66af1191053a96b283aa6d890fd8488438d
Author: Luis Tomas Bolivar <email address hidden>
Date: Thu Oct 18 14:29:19 2018 +0200

    Ensure namespace and network policy compatibility

    This patch ensures namespace handler does not depend on specific
    functions implemented on the security group driver for the namespace
    isolation. This way it will be possible to enable the namespace
    handler (to create a different network per namespace) together with
    the network policy that will perform the isolation between pods/svc
    in a different way.

    Partially Implements: blueprint k8s-network-policies
    Closes-Bug: #1799496
    Change-Id: Ied892e616075ce16fdc15ceb31219c100e011536

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/rocky
Review: https://review.openstack.org/613860

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/613860
Committed: https://git.openstack.org/cgit/openstack/kuryr-kubernetes/commit/?id=00c991be36ebee76c2e720e6fdc11bf06e0a33f8
Submitter: Zuul
Branch: stable/rocky

commit 00c991be36ebee76c2e720e6fdc11bf06e0a33f8
Author: Luis Tomas Bolivar <email address hidden>
Date: Thu Oct 18 14:29:19 2018 +0200

    Ensure namespace and network policy compatibility

    This patch ensures namespace handler does not depend on specific
    functions implemented on the security group driver for the namespace
    isolation. This way it will be possible to enable the namespace
    handler (to create a different network per namespace) together with
    the network policy that will perform the isolation between pods/svc
    in a different way.

    Partially Implements: blueprint k8s-network-policies
    Closes-Bug: #1799496
    Change-Id: Ied892e616075ce16fdc15ceb31219c100e011536
    (cherry picked from commit 651da66af1191053a96b283aa6d890fd8488438d)

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/kuryr-kubernetes 0.5.2 release.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/kuryr-kubernetes 0.6.0 release.