To Support Antrea Host Network Policy

[rajnkamr]

Describe the problem/challenge you have

Antrea Cluster network policy can be only applied to pod level,
Scope of the work involves
1.Support this feature on Node Interface in Encap mode by introducing new configuration toggle.
2.To handle non IP Packet in datapath
3.To handle IP Packet in datapath
4.To allow management connection to host when network policy is enforced

Describe the solution you'd like

This feature proposes to apply Antrea Cluster Network Policy to K8s Nodes. User can apply ACNP on K8s Node by using nodeSelector in appliedTo field and provide matching Node label(s).

Anything else you would like to add?

To support network policy application on host having multiple interface

[antoninbas]

This is a duplicate of #4213, so please close one of them

[rajnkamr]

@antoninbas ,
It is created to track additional use-cases related to Antrea Host network policy, apart from the use case which is mentioned in scope of #4213 , In 4213, we will not be supporting multiple interfaces use-case and few other use-cases.

[tnqn]

@rajnkamr it seems the use cases mentioned in the issue is not very different from 4213. "To handle non IP Packet in datapath" doesn't seem a valid requirement, I don't know in which case users want to use NetworkPolicy to manage non IP packets.
Please also note that the proposal I made in #4213 (comment) didn't get agreement in the community meeting. So if your proposal is based on it, please consider the mentioned risks and complexity. I want to also mention that we are reconsidering other approaches that are less disruptive. To avoid duplicate efforts, please discuss your proposal first before making code change.

[rajnkamr]

@tnqn
With non ip packet i meant packets which are not destined for pod network, for example for Host-level communication the node on which Antrea is running is a regular host in the network. As such, it may still receive and process non-IP packets destined for the node itself, unrelated to pod networking.
also the underlying network infrastructure that connects the nodes may carry non-IP traffic. For example, communication between network switches, routing protocols, or other specialized networking functions might utilize non-IP packets.

Although this issue is created based on #4213 proposal, we might not want to cover all use-cases under 4213,
Currently, proposal is in discussion only and demo solution is only partially ready, we will have design and final proposal discussion before going for final implementation.

[github-actions]

This issue is stale because it has been open 90 days with no activity. Remove stale label or comment, or this will be closed in 90 days

[rajnkamr]

closing , refer #4213 & #5671