How an egress firewall works in a project
As a cluster administrator, you can use an egress firewall to limit the external hosts that some or all pods can access from within the cluster.
An egress firewall supports the following scenarios:
-
A pod can only connect to internal hosts and cannot initiate connections to the public internet.
-
A pod can only connect to the public internet and cannot initiate connections to internal hosts that are outside the Red Hat OpenShift Container Platform cluster.
-
A pod cannot reach specified internal subnets or hosts outside the Red Hat OpenShift Container Platform cluster.
-
A pod can only connect to specific external hosts.
For example, you can allow one project access to a specified IP range but deny the same access to a different project. Or, you can restrict application developers from updating from Python pip mirrors, and force updates to come only from approved sources.
You configure an egress firewall policy by creating an EgressFirewall custom resource (CR). The egress firewall matches network traffic that meets any of the following criteria:
-
An IP address range in CIDR format
-
A DNS name that resolves to an IP address
-
A port number
-
A protocol that is one of the following protocols: TCP, UDP, and SCTP