Editing a network policy

As a user with the admin role, you can edit an existing network policy for a namespace.

Editing a network policy

You can edit a network policy in a namespace.

If you log in with a user with the cluster-admin role, then you can edit a network policy in any namespace in the cluster.

Prerequisites

  • Your cluster uses a cluster network provider that supports NetworkPolicy objects, such as the OVN-Kubernetes network provider or the OpenShift SDN network provider with mode: NetworkPolicy set. This mode is the default for OpenShift SDN.

  • You installed the OpenShift CLI (oc).

  • You are logged in to the cluster with a user with admin privileges.

  • You are working in the namespace where the network policy exists.

Procedure

  1. Optional: To list the network policy objects in a namespace, enter the following command:

    1. $ oc get networkpolicy -n <namespace>

    where:

    <namespace>

    Optional: Specifies the namespace if the object is defined in a different namespace than the current namespace.

  2. Edit the NetworkPolicy object.

    • If you saved the network policy definition in a file, edit the file and make any necessary changes, and then enter the following command.

      1. $ oc apply -n <namespace> -f <policy_file>.yaml

      where:

      <namespace>

      Optional: Specifies the namespace if the object is defined in a different namespace than the current namespace.

      <policy_file>

      Specifies the name of the file containing the network policy.

    • If you need to update the NetworkPolicy object directly, enter the following command:

      1. $ oc edit networkpolicy <policy_name> -n <namespace>

      where:

      <policy_name>

      Specifies the name of the network policy.

      <namespace>

      Optional: Specifies the namespace if the object is defined in a different namespace than the current namespace.

  3. Confirm that the NetworkPolicy object is updated.

    1. $ oc describe networkpolicy <policy_name> -n <namespace>

    where:

    <policy_name>

    Specifies the name of the network policy.

    <namespace>

    Optional: Specifies the namespace if the object is defined in a different namespace than the current namespace.

Example NetworkPolicy object

The following annotates an example NetworkPolicy object:

  1. kind: NetworkPolicy
  2. apiVersion: networking.k8s.io/v1
  3. metadata:
  4. name: allow-27107 (1)
  5. spec:
  6. podSelector: (2)
  7. matchLabels:
  8. app: mongodb
  9. ingress:
  10. - from:
  11. - podSelector: (3)
  12. matchLabels:
  13. app: app
  14. ports: (4)
  15. - protocol: TCP
  16. port: 27017
1The name of the NetworkPolicy object.
2A selector describing the pods the policy applies to. The policy object can only select pods in the project that the NetworkPolicy object is defined.
3A selector matching the pods that the policy object allows ingress traffic from. The selector will match pods in any project.
4A list of one or more destination ports to accept traffic on.

Additional resources