AdminNetworkPolicy

An AdminNetworkPolicy (ANP) is a cluster-scoped custom resource definition (CRD) that you can define to establish ingress and egress rules before namespaces are created. You can use ANPs to ensure tenant NetworkPolicy objects cannot override your administrative controls.

The key difference between AdminNetworkPolicy and NetworkPolicy objects is that the former is for administrators and is cluster scoped, while the latter is for tenant owners and is namespace scoped.

An ANP allows administrators to specify the following:

  • A priority value that determines the order of its evaluation. The lower the value the higher the precedence.

  • A set of pods that consists of a set of namespaces or namespace on which the policy is applied.

  • A list of ingress rules to be applied for all ingress traffic towards the subject.

  • A list of egress rules to be applied for all egress traffic from the subject.

← Previous: Key differences between AdminNetworkPolicy and NetworkPolicy custom resources | ↑ Up: Enforce non-negotiable platform security baselines | ⌂ Home: Red Hat OpenShift Container Platform | Next: AdminNetworkPolicy example →