From bf7ba6964b335d3966b2345578c40daad67c68cd Mon Sep 17 00:00:00 2001
From: Alessandro Boch <aboch@docker.com>
Date: Thu, 9 Mar 2017 11:52:25 -0800
Subject: [PATCH] Allow user to modify ingress network

Signed-off-by: Alessandro Boch <aboch@docker.com>
---
 docs/reference/commandline/network_create.md | 18 ++++++++++++++++++
 man/src/network/create.md                    | 17 +++++++++++++++++
 man/src/network/inspect.md                   |  2 ++
 3 files changed, 37 insertions(+)

diff --git a/docs/reference/commandline/network_create.md b/docs/reference/commandline/network_create.md
index 4540d530c6..4b95c5e50b 100644
--- a/docs/reference/commandline/network_create.md
+++ b/docs/reference/commandline/network_create.md
@@ -22,6 +22,7 @@ Create a network
 
 Options:
       --attachable           Enable manual container attachment
+      --ingress              Specify the network provides the routing-mesh
       --aux-address value    Auxiliary IPv4 or IPv6 addresses used by Network
                              driver (default map[])
   -d, --driver string        Driver to manage the Network (default "bridge")
@@ -195,6 +196,23 @@ connects a bridge network to it to provide external connectivity. If you want
 to create an externally isolated `overlay` network, you can specify the
 `--internal` option.
 
+### Network ingress mode
+
+You can create the network which will be used to provide the routing-mesh in the
+swarm cluster. You do so by specifying `--ingress` when creating the network. Only
+one ingress network can be created at the time. The network can be removed only
+if no services depend on it. Any option available when creating a overlay network
+is also available when creating the ingress network, besides the `--attachable` option.
+
+```bash
+$ docker network create -d overlay \
+  --subnet=10.11.0.0/16 \
+  --ingress \
+  --opt com.docker.network.mtu=9216 \
+  --opt encrypted=true \
+  my-ingress-network
+```
+
 ## Related commands
 
 * [network inspect](network_inspect.md)
diff --git a/man/src/network/create.md b/man/src/network/create.md
index 115a41846f..efbf0d5d46 100644
--- a/man/src/network/create.md
+++ b/man/src/network/create.md
@@ -117,3 +117,20 @@ By default, when you connect a container to an `overlay` network, Docker also
 connects a bridge network to it to provide external connectivity. If you want
 to create an externally isolated `overlay` network, you can specify the
 `--internal` option.
+
+### Network ingress mode
+
+You can create the network which will be used to provide the routing-mesh in the
+swarm cluster. You do so by specifying `--ingress` when creating the network. Only
+one ingress network can be created at the time. The network can be removed only
+if no services depend on it. Any option available when creating a overlay network
+is also available when creating the ingress network, besides the `--attachable` option.
+
+```bash
+$ docker network create -d overlay \
+  --subnet=10.11.0.0/16 \
+  --ingress \
+  --opt com.docker.network.mtu=9216 \
+  --opt encrypted=true \
+  my-ingress-network
+```
diff --git a/man/src/network/inspect.md b/man/src/network/inspect.md
index a61dfd8c10..91cb2dae32 100644
--- a/man/src/network/inspect.md
+++ b/man/src/network/inspect.md
@@ -32,6 +32,7 @@ $ sudo docker network inspect bridge
             ]
         },
         "Internal": false,
+        "Ingress": false,
         "Containers": {
             "bda12f8922785d1f160be70736f26c1e331ab8aaf8ed8d56728508f2e2fd4727": {
                 "Name": "container2",
@@ -116,6 +117,7 @@ $ docker network inspect --verbose ov1
         },
         "Internal": false,
         "Attachable": false,
+        "Ingress": false,
         "Containers": {
             "020403bd88a15f60747fd25d1ad5fa1272eb740e8a97fc547d8ad07b2f721c5e": {
                 "Name": "s1.1.pjn2ik0sfgkfzed3h0s00gs9o",