About network policy

To control traffic between workloads and improve network isolation, configure NetworkPolicy objects for your projects. Network policies define the allowed ingress and egress connections for selected pods and help secure applications in your cluster.

By default, all pods in a project are accessible from other pods and network endpoints. To isolate one or more pods in a project, you can create NetworkPolicy objects in that project to indicate the allowed incoming connections. Project administrators can create and delete NetworkPolicy objects within their own project.

Important

From Red Hat OpenShift Container Platform 4.22, Red Hat OpenShift Container Platform now includes NetworkPolicy objects in some of its own namespaces by default. This inclusion improves overall security and better protects control plane components. Do not modify the NetworkPolicy objects that Red Hat OpenShift Container Platform includes in its own namespaces by default. To check the namespaces that include the objects by default, you can run the following command:

$ oc get networkpolicies --all-namespaces

The Red Hat OpenShift Container Platform 4.22 release does not include these objects in all Red Hat OpenShift Container Platform namespaces; later Red Hat OpenShift Container Platform releases might include the objects in additional namespaces.

By default, all pods in a project are accessible from any network endpoint.

If a pod is matched by selectors in one or more NetworkPolicy objects, then the pod accepts only connections that are allowed by at least one of those NetworkPolicy objects. A pod that is not selected by any NetworkPolicy objects remains fully accessible.

← Previous: Policy additivity | ↑ Up: Secure individual workloads and manage namespace policy lifecycle | ⌂ Home: Red Hat OpenShift Container Platform | Next: Policy additivity →