Creating a network policy

• Creating a network policy
• Example NetworkPolicy object
• Additional resources

As a user with the admin role, you can create a network policy for a namespace.

Creating a network policy

To define granular rules describing ingress or egress network traffic allowed for namespaces in your cluster, you can create a network policy.

Prerequisites

• Your cluster uses a cluster network provider that supports NetworkPolicy objects, such as the OVN-Kubernetes network provider or the OpenShift SDN network provider with mode: NetworkPolicy set. This mode is the default for OpenShift SDN.

• You installed the OpenShift CLI (oc).

• You are logged in to the cluster with a user with admin privileges.

• You are working in the namespace that the network policy applies to.

• Your cluster is using a cluster network provider that supports NetworkPolicy objects, such as the OpenShift SDN network provider with mode: NetworkPolicy set. This mode is the default for OpenShift SDN.

Procedure

1. Create a policy rule:

   1. Create a <policy_name>.yaml file:

      $ touch <policy_name>.yaml

      where:

      <policy_name>

      Specifies the network policy file name.

   2. Define a network policy in the file that you just created, such as in the following examples:

      Deny ingress from all pods in all namespaces

      kind: NetworkPolicy
      apiVersion: networking.k8s.io/v1
      metadata:
        name: deny-by-default
      spec:
        podSelector:
        ingress: []

   Allow ingress from all pods in the same namespace

   kind: NetworkPolicy
   apiVersion: networking.k8s.io/v1
   metadata:
     name: allow-same-namespace
   spec:
     podSelector:
     ingress:
     - from:
       - podSelector: {}

2. To create the network policy object, enter the following command:

   $ oc apply -f <policy_name>.yaml -n <namespace>

   where:

   <policy_name>

   Specifies the network policy file name.

   <namespace>

   Optional: Specifies the namespace if the object is defined in a different namespace than the current namespace.

   Example output

   networkpolicy.networking.k8s.io/default-deny created

Example NetworkPolicy object

The following annotates an example NetworkPolicy object:

kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
  name: allow-27107 (1)
spec:
  podSelector: (2)
    matchLabels:
      app: mongodb
  ingress:
  - from:
    - podSelector: (3)
        matchLabels:
          app: app
    ports: (4)
    - protocol: TCP
      port: 27017

Additional resources

• Accessing the web console