Skip to content

Commit 10fa01f

Browse files
zohar7chzohar7ch
committed
Update docs
1 parent f398c4b commit 10fa01f

File tree

3 files changed

+11
-11
lines changed

3 files changed

+11
-11
lines changed

‎docs/features/network-mapping-network-policies/reference/Network-Policies-Deep-Dive.mdx

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -179,8 +179,8 @@ would block existing traffic like **loadgenerator** -> **frontend**.
179179
180180
181181
## Auto-generating network policies for Prometheus server
182-
When an intent generate a network policy that can block Prometheus server from querying metrics, the intents operator by default
183-
will automatically generates network policies for this workload to enable Prometheus.
182+
When an intent generates a network policy that can block Prometheus from querying metrics, the intents operator by default
183+
will automatically generate network policies to enable Prometheus to access the metrics port on this workload.
184184
185185
The way Otterize identifies that a workloads (pods, services) would be blocked from Prometheus is composed of 2 conditions:
186186
1. The workload has the `prometheus.io/scrape` annotation set to `true`

‎docs/reference/intents-operator/README.mdx

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -42,9 +42,9 @@ pod.
4242

4343
Learn more: [Network policies deep dive](/features/network-mapping-network-policies/reference/Network-Policies-Deep-Dive)
4444

45-
### Handling Third Party Network Policies
46-
Otterize automate network policies that enables third party traffic.
47-
Current supported thirds parties are [external traffic](#Handling external traffic) and [Prometheus traffic](#Handling Prometheus traffic).
45+
### Handling Third Party or Infrastructure traffic
46+
Otterize automates network policies that enables third party or infrastructure traffic.
47+
Otterize can currently automatically handle [external traffic](#Handling external traffic) as well as [Prometheus monitoring traffic](#Handling Prometheus traffic).
4848

4949
#### Handling external traffic
5050
The intents operator has automatic behavior for allowing external traffic for pods which have indicated that they are supposed to accept external traffic, such as by creating a `Service` of type `NodePort` or `LoadBalancer`, or an `Ingress` resource.
@@ -64,14 +64,14 @@ As the intents operator creates network policies, and the semantics of network p
6464
1. if no network policies apply to a pod, then all traffic is allowed.
6565
2. once any network policy applies to a pod, only the traffic explicitly allowed in the policy is allowed
6666

67-
This meant that if you had no network policies on a pod, and created ClientIntents for that pod, then Prometheus scraping would be blocked. To make it easy to enable Prometheus metrics scraping, the intents operator automatically detects resources with `prometheus.io/scrape: "true"` annotation, and if it creates the first network policy to affect those pods, it also creates a network policy that allows Prometheus scraping.
67+
This meant that if you had no network policies on a pod, and created ClientIntents for that pod, then Prometheus scraping would be blocked. To make it easy to enable traffic for Prometheus metrics scraping, the intents operator automatically detects resources with `prometheus.io/scrape: "true"` annotation, and if it creates the first network policy to affect those pods, it also creates a network policy that allows Prometheus scraping.
6868

6969
For this feature to work, you must set `prometheusServerConfigs` in the Helm chart, so Otterize would be able to identify the Prometheus server in the cluster.
7070

71-
This behavior can be disabled using the Helm chart's values - `automateThirdPartyNetworkPolicies` or not setting `prometheusServerConfigs`.
71+
This behavior can be disabled using the Helm chart's values - `automateThirdPartyNetworkPolicies`, or to only disable Prometheus, make sure `prometheusServerConfigs` is not set.
7272

73-
**Note**: If you haven't specified `prometheus.io/port` in the pod or service, Otterize will allow all the ports this workload expose.
74-
Consider specifying `prometheus.io/port` to allow only the port you want to expose.
73+
**Note**: If you haven't specified `prometheus.io/port` in the pod or service, Otterize will match Prometheus' behavior by allowing all ports.
74+
To improve security, specify `prometheus.io/port` to require Prometheus to only connect to that port. Otterize will the only allow access to that port.
7575

7676
### AWS IAM
7777
The intents operator enables automatic management of AWS IAM roles and policies according to the

‎docs/reference/otterize-chart/README.mdx

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -71,8 +71,8 @@ Further information about intents-operator parameters can be found [in the inten
7171
| `intentsOperator.operator.enableEgressNetworkPolicyCreation` | Whether the operator should create *egress* network policies according to `ClientIntents`. | `false` |
7272
| `intentsOperator.operator.enableKafkaACLCreation` | Whether the operator should create Kafka ACL rules according to `ClientIntents` of type Kafka. | `true` |
7373
| `intentsOperator.operator.enableIstioPolicyCreation` | Whether the operator should create Istio authorization policies according to `ClientIntents`. | `true` |
74-
| `operator.automateThirdPartyNetworkPolicies` | Automatically creates network policies to allow required traffic from load balancers, reverse proxies, and Prometheus by tracking Service and Ingress resources, as well as Prometheus scrape annotations. To enable Prometheus metrics scraping traffic, `prometheusServerConfigs` must be set as well | `ifBlockedByOtterize` |
75-
| `operator.prometheusServerConfigs` | Restricts the automatically created network policies for Prometheus metrics scraping to only originate from Prometheus server. A list of objects with keys `name`, `namespace` and `kind`, such as `Deployment`. | `(none)` |
74+
| `operator.automateThirdPartyNetworkPolicies` | Automatically creates network policies to allow required traffic from load balancers, reverse proxies, and Prometheus by tracking Service and Ingress resources, as well as `prometheus.io/scrape` annotations. To enable Prometheus metrics scraping traffic, `prometheusServerConfigs` must be set | `ifBlockedByOtterize` |
75+
| `operator.prometheusServerConfigs` | Specifies where the Prometheus pods are. Required for Otterize to automatically allow access for Prometheus to pods that request monitoring. A list of objects with keys `name`, `namespace` and `kind`, such as `Deployment`. | `(none)` |
7676
| `intentsOperator.operator.ingressControllerConfigs` | Restricts the automatically created external traffic network policies to only allow access to an ingress controller within the cluster. Only relevant if you use an in-cluster ingress controller, such as nginx or HAProxy. A list of objects with keys `name`, `namespace` and `kind`, such as `ingress-nginx-controller`, `nginx` and `Deployment`. | `(none)` |
7777
| `intentsOperator.operator.ingressControllerAWSALBExempt` | If set to true, the operator will allow all traffic if an Ingress is managed by the AWS ALB Ingress Controller. | `false` |
7878
| `intentsOperator.operator.resources` | Resources override. | |

0 commit comments

Comments
 (0)