traffic that goes from a workload endpoint to the host itself (after
                  the traffic hits the endpoint egress policy). By default Calico
                  blocks traffic from workload endpoints to the host itself with an
                  iptables "DROP" action. If you want to allow some or all traffic

		})
	}
}

// TestExternalTrafficPolicyLocal tests that traffic to externally-facing IPs does not get
// masqueraded when using Local traffic policy. For traffic from external sources, that
// means it can also only be routed to local endpoints, but for traffic from internal
// sources, it gets routed to all endpoints.
func TestExternalTrafficPolicyLocal(t *testing.T) {

a list of ingress rules to be applied to the selected pods. Traffic is allowed to a pod if there are no NetworkPolicies selecting the pod (and cluster policy otherwise allows the traffic), OR if the traffic source is the pod's local node, OR if the traffic matches at least one ingress rule across all of the NetworkPolicy objects whose podSelector matches the pod. If this field is empty then this NetworkPolicy does not allow any traffic (and serves solely to ensure that the pods it selects are isolated...

// traffic sent to the ClusterIP.
type ServiceInternalTrafficPolicy string

const (
	// ServiceInternalTrafficPolicyCluster routes traffic to all endpoints.
	ServiceInternalTrafficPolicyCluster ServiceInternalTrafficPolicy = "Cluster"

	// ServiceInternalTrafficPolicyLocal routes traffic only to endpoints on the same
	// node as the traffic was received on (dropping the traffic if there are no

const (
	// ServiceExternalTrafficPolicyCluster routes traffic to all endpoints.
	ServiceExternalTrafficPolicyCluster ServiceExternalTrafficPolicy = "Cluster"

	// ServiceExternalTrafficPolicyLocal preserves the source IP of the traffic by
	// routing only to endpoints on the same node as the traffic was received on
	// (dropping the traffic if there are no local endpoints).

                  for the address(es) on the \"outside of the Gateway\", that traffic
                  bound for this Gateway will use. This could be the IP address or
                  hostname of an external load balancer or other networking infrastructure,
                  or some other address that traffic will be sent to. \n If no Addresses
                  are specified, the implementation MAY schedule the Gateway in an

	"ports":    "Ports is a list of records of service ports If used, every...

  // Setting this to "VIP" indicates that traffic is delivered to the node with
  // the destination set to the load-balancer's IP and port.
  // Setting this to "Proxy" indicates that traffic is delivered to the node or pod with
  // the destination set to the node's IP and node port or the pod's IP and port.
  // Service implementations may use this information to adjust traffic routing.
  // +optional
  optional string ipMode = 3;

  // receive on one of the Service's "externally-facing" addresses (NodePorts,
  // ExternalIPs, and LoadBalancer IPs). If set to "Local", the proxy will configure
  // the service in a way that assumes that external load balancers will take care
  // of balancing the service traffic between nodes, and so each node will deliver

been removed. Instead, isolation is now determined on a per-pod basis. A NetworkPolicy may target a pod for isolation by including the pod in its spec.podSelector. Targeted Pods accept the traffic specified in the respective NetworkPolicy (and nothing else). Pods not targeted by any NetworkPolicy accept all traffic by default. ([#39164](https://github.com/kubernetes/kubernetes/pull/39164), [@danwinship](https://github.com/danwinship))

	**Action Required:** When upgrading to Kubernetes 1.7...