Red Hat OpenShift Container Platform

AdminNetworkPolicy example

Example YAML file for an ANP

apiVersion: policy.networking.k8s.io/v1alpha1
kind: AdminNetworkPolicy
metadata:
  name: sample-anp-deny-pass-rules
spec:
  priority: 50
  subject:
    namespaces:
      matchLabels:
          kubernetes.io/metadata.name: example.name
  ingress:
  - name: "deny-all-ingress-tenant-1"
    action: "Deny"
    from:
    - pods:
        namespaceSelector:
          matchLabels:
            custom-anp: tenant-1
        podSelector:
          matchLabels:
            custom-anp: tenant-1
  egress:
  - name: "pass-all-egress-to-tenant-1"
    action: "Pass"
    to:
    - pods:
        namespaceSelector:
          matchLabels:
            custom-anp: tenant-1
        podSelector:
          matchLabels:
            custom-anp: tenant-1

where:

metadata.name: Specifies a name for your ANP.
spec.priority: Specifies the priority of the ANP. Supports a maximum of 100 ANPs in the range of values 0-99 in a cluster. The lower the value, the higher the precedence because the range is read in order from the lowest to highest value. Because there is no guarantee which policy takes precedence when ANPs are created at the same priority, set ANPs at different priorities so that precedence is deliberate.
spec.subject.namespaces.matchLabels: Specifies the namespace to apply the ANP resource.
spec.ingress.name: Specifies a name for the ingress.name.
spec.ingress.action: Specifies an ingress rule for the ANP. ANP have both ingress and egress rules. Accepts values of Pass, Deny, and Allow.
spec.ingress.from.pods.namespaceSelector.matchLabels: Specifies podSelector.matchLabels to select pods within the namespaces selected by namespaceSelector.matchLabels as ingress peers.
spec.egress.action: Specifies an egress rule for the ANP. Accepts values of Pass, Deny, and Allow.