Adds cudn docs

[stevsmit]

Version(s):
4.18+

Issue:
https://issues.redhat.com/browse/OSDOCS-12699

PR incorporates bug fixes from the following:

• UDN: Rename NetworkReady condition to NetworkCreated ovn-kubernetes/ovn-kubernetes#4884
• Enforce udn ns label ovn-kubernetes/ovn-kubernetes#4912

Link to docs preview:
https://85165--ocpdocs-pr.netlify.app/openshift-enterprise/latest/networking/multiple_networks/primary_networks/about-user-defined-networks.html

QE review:

• QE has approved this change.

Additional information:

[ocpdocs-previewbot]

🤖 Fri Feb 14 13:59:09 - Prow CI generated the docs preview:

https://85165--ocpdocs-pr.netlify.app/
https://85165--ocpdocs-pr.netlify.app/openshift-enterprise/latest/networking/multiple_networks/primary_networks/about-user-defined-networks.html

[tssurya]

/assign @ormergi

[ormergi]

Hi, thanks for adding these docs, please see my comments bellow and in-line ones 🙂

1. Regarding best practices
   I think we should add text saying the ClusterUserDefiendNetwork CRD is targeted for cluster-admins.
   And it should not be granted for non-admin users blindly because if used wrongly, it could result in security issues (e.g.: create CR in default namespace, connect multiple namespaces networks).
   Or, in with the future Localnet support, cause disruptions or break the cluster network.

In addition, the NamespaceSelector should not point to default or openshifrt-* namespaces, similar to UDN CRD, for the same reasones.

2. Regarding NamespaceSelector
   Note about the NamespaceSelector attribute, since its type is the standard k8s MatchLabel selector, it derive the exact behavior:
   In case matchExpression is used, given the following spec:

matchExpressions:
- key: kubernetes.io/metadata.name
  operator: In
  values: ["red", "blue"]

Result in provisioning namespaces who has kubernetes.io/metadata.name=red OR kubernetes.io/metadata.name=blue labels (i.e.: one of).

In contrast, the matchLabels acts diffrently in the sense the terms are "AND"'ed, for example:
Given the following spec:

matchLables: 
- "red":""
- "blue":""

Result in provisioning namespaces who has red="" AND blue="" labels.

Should we add some text for the above or keep it implicit as the current state?

3. Regarding other Layer2 & Layer3 optional fields, should we add some text for it ot add reference to the table we have in UserDefienenNetwork doc?

[ormergi]

Thanks for the changes, I likes the explanations on the namesapce selectors :)

Please see my inline comments.

Is there best-practices doc for CUDN objects?
If so, I suggest to add text for the following topics:

• CUDN targeted for admins (as in line 14
• namespace-selector should not specify default or openshift-* namespace.
  In addition, I think specifying empty label-selecor result in selecting all namespaces, we may need to say something about that.
  @tssurya @npinaeva WDYT about the empty selector part?

[ormergi]

Thanks for the changes, LGTM

[stevsmit]

/retest

[lpettyjo]

Otherwise, LGTM!

[maiqueb]

Caught some stuff.

[maiqueb]

Thank you !

[ormergi]

Thank you, LGTM

[openshift-ci]

@stevsmit: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[meinali566]

/lgtm

[stevsmit]

/cherry-pick enterprise-4.18

[openshift-cherrypick-robot]

@stevsmit: new pull request created: #88688

Details

In response to this:

/cherry-pick enterprise-4.18

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.