Kindnet network policies

[aojea]

Fixes: #842

Alternative to #3611

In this case network policies is considerd as part of kindnetd, just is different daemonset.

Users can opt-out by disabling kindnetd

[aojea]

/assign @BenTheElder

I think I prefer this one, looks nicer simpler and is as if network policies is part of kindnet

[BenTheElder]

I'm still divided on if it's better to bundle with kindnetd or not but I'm leaning this way.

I think if users are sensitive to the base networking they can already disable kindnetd and it's not strictly CNI already.

Trying to think of good reasons this wouldn't be reasonable.

[BenTheElder]

I think this is the way. I haven't come up with good reasons against this one.

[aojea]

I need to cut a new release of network policies to make it a noop if no network policy is applied kubernetes-sigs/kube-network-policies#39 ... it is much safer

[aojea]

/hold

[aojea]

/hold cancel

waiting for the promotion kubernetes/kubernetes#125681

[aojea]

/retest

[BenTheElder]

I like where this is headed 👍

Started working on the go 1.22 bump in #3676, we have to also bump runc and should catch up the rest while we're at it.

[BenTheElder]

what's blocking? I am +1 in concept 👍

[aojea]

/retest

what's blocking? I am +1 in concept 👍

😎 vacationing

[aojea]

@BenTheElder this is ready

[aojea]

/test pull-kind-e2e-kubernetes-1-27

can't find the reason it failed

[aojea]

/hold

missing rbac permissions

[aojea]

/hold

missing rbac permissions

/hold cancel

added

[BenTheElder]

I assume that you've done the diligence on these and their licenses etc?

looks like most of these are not new but a few are

[aojea]

github.com/beorn7/perks, https://github.com/cespare/xxhash github.com/mdlayher/netlink and github.com/florianl/go-nfqueue are MIT

[BenTheElder]

/lgtm
/approve
/hold

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: aojea, BenTheElder

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [BenTheElder,aojea]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[aojea]

/hold cancel

go-licenses check ./cmd/kindnetd/ 
W0723 10:42:47.791287 2745051 library.go:101] "golang.org/x/sys/unix" contains non-Go code that can't be inspected for further dependencies:
/usr/local/google/home/aojea/go/pkg/mod/golang.org/x/sys@v0.22.0/unix/asm_linux_amd64.s
W0723 10:42:48.595319 2745051 library.go:101] "github.com/modern-go/reflect2" contains non-Go code that can't be inspected for further dependencies:
/usr/local/google/home/aojea/go/pkg/mod/github.com/modern-go/reflect2@v1.0.2/reflect2_amd64.s
/usr/local/google/home/aojea/go/pkg/mod/github.com/modern-go/reflect2@v1.0.2/relfect2_mips64x.s
/usr/local/google/home/aojea/go/pkg/mod/github.com/modern-go/reflect2@v1.0.2/relfect2_mipsx.s
/usr/local/google/home/aojea/go/pkg/mod/github.com/modern-go/reflect2@v1.0.2/relfect2_ppc64x.s
W0723 10:42:56.947129 2745051 library.go:101] "github.com/cespare/xxhash/v2" contains non-Go code that can't be inspected for further dependencies:
/usr/local/google/home/aojea/go/pkg/mod/github.com/cespare/xxhash/v2@v2.3.0/xxhash_amd64.s
$