Add blog post for PodHasNetwork condition

[ddebroy]

Blog post for PodHasNetwork condition feature [https://github.com/kubernetes/enhancements/issues/3085]

Supersedes #35645

[netlify]

✅ Pull request preview available for checking

Built without sensitive environment variables

Name	Link
🔨 Latest commit	2c0be33
🔍 Latest deploy log	https://app.netlify.com/sites/kubernetes-io-main-staging/deploys/6310df2cd4f52400093e3b92
😎 Deploy Preview	https://deploy-preview-36197--kubernetes-io-main-staging.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify site settings.

[sftim]

We could publish this if necessary. I see a couple of things I'd prefer to have fixed.

/lgtm

[k8s-ci-robot]

LGTM label has been added.

Git tree hash: 8b7ca860043ea81551160a40e885292995009efa

[sftim]

/retitle Add blog post for PodHasNetwork condition

[chrisnegus]

This reads very well. I have a couple of small suggestions.

[sftim]

/lgtm

Tweaks welcome (either before merge, or afterwards)

[k8s-ci-robot]

LGTM label has been added.

Git tree hash: a30ccee5f224329a523dd385d9dffaecc70722c3

[sftim]

/lgtm

[k8s-ci-robot]

LGTM label has been added.

Git tree hash: ffab27cc705a287edc4733dff0810ce611d2febe

[mikebrow]

some comments and suggestions.. cheers

[mikebrow]

Suggested change

	Additionally, some cloud providers may attach additional network interface(s) to the network namespace of a pod, via CNI, some time after the pod is up and running with a loopback interface. In this case the `PodHasNetwork` condition may not reflect whether all network interfaces of the pod are initialized.

[mikebrow]

if you think this needs more clarification in the general context for most pod lifecycles .. feel free to leave it out.. we can discuss further

[sftim]

Is this special behavior strictly something that happens in the cloud? (could an on-prem cluster do something similar?)

If we're adding text here, we could make it clear that PodHasNetwork means that for each configured address family, the kubelet sees that [the one IP address that a conformant network plugin should set up for that address family] is configured and up.

Would need better wording than mine, mind!

[ddebroy]

I had a brief sync about this with Mike yesterday. My understanding is what Mike described above could be possible if some other (privileged) node agent aside from the Kubelet is configuring things in the network namespace of the pod out-of-band from Kubelet's pod sandbox bring-up and network configuration through CRI (i.e. outside of the Kubelet runtime => CRI => Runtime (containerd/crio/etc) => CNI => CNI plugins flow). I will make a note of this.

[jellonek]

FYI: CRI (or wider - cloud providers, as suggested by @mikebrow) can do anything it/they want at any point of pod lifecycle. it can call a cni plugin, or multiple of them, or whatever it wants. but that's out of the scope of the description of "kubernetes contract".
i didn't yet red the mentioned KEP so i'm not touching the topic how the data should be explained, but looking on @mikebrow description i would expect that PodHasNetwork will be only describing status of the default network connectivity, ignoring all "whathever will cri call/setup" things which are not the default access to kubeapi network things (like e.g. what is hold in extensions under the https://github.com/k8snetworkplumbingwg/ meaning, or more precisely under the https://docs.google.com/document/d/1Ny03h6IDVy_e_vmElOqR7UdTPAG_RNydhVE1Kx54kFQ/edit#heading=h.hylsbqoj5fxd extension)

[ddebroy]

Thanks for the inputs and clarifications about this, @mikebrow, @sftim and @jellonek. I will summarize and call out the above point.

[ddebroy]

Clarified this. For reference, https://github.com/maiqueb/multus-dynamic-networks-controller appears to be a concrete PoC implementation of what was being referred to above.

[sftim]

@ddebroy would you have capacity to update this based on feedback so far?

[ddebroy]

Yes, I will be addressing all the outstanding feedback by EoD.

[aojea]

/assign

[ddebroy]

All comments and feedback above have been addressed.

[sftim]

@aojea did you want to check this further?

[aojea]

@aojea did you want to check this further?

I don't have enough knowledge of the feature to judge, but it seems to correctly match the KEP, sig-network and CNI implementors will follow up and try to give more feedback for the next stages

[sftim]

A nit about the title. I'm fine to have that fixed either

• never
• in a follow-up PR (by anyone)

/lgtm
/approve

Thanks and congratulations!

[sftim]

nit:

Suggested change

	title: 'Kubernetes 1.25: PodHasNetwork condition for pods'
	title: 'Kubernetes 1.25: PodHasNetwork Condition for Pods'

[k8s-ci-robot]

LGTM label has been added.

Git tree hash: 64187c5cb755f36fb7abbaa6fe008055df21f53c

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: sftim

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• content/en/blog/OWNERS [sftim]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[aojea]

per example, I just noticed that pod with hostNetwork true are not covered

[sftim]

pod with hostNetwork true are not covered

I think this is OK to publish as-is. We (blog team) could also accept a PR to tweak things, so long as @ddebroy doesn't object.

It's also OK to update after publication; for that situation, I like to mark that there's been an update.

[aojea]

ah, no, it was not directed to the blog post, I just realized that is a follow up on this feature, I didn't find it covered 😄

[sftim]

(nit)

Suggested change

	condition is set to `True`. Metrics collection services that report latency of
	condition is set to `"True"`. Metrics collection services that report latency of

Conditions are a string value used like a ternary enum.

[ddebroy]

ah, no, it was not directed to the blog post, I just realized that is a follow up on this feature, I didn't find it covered 😄

Thanks for pointing that out. I addressed it at kubernetes/kubernetes#111358 (comment) and will clarify this in followup PRs to the docs and blog.

[mikebrow]

ah, no, it was not directed to the blog post, I just realized that is a follow up on this feature, I didn't find it covered 😄

Thanks for pointing that out. I addressed it at kubernetes/kubernetes#111358 (comment) and will clarify this in followup PRs to the docs and blog.

SGTM