Red Hat build of MicroShift

Create a network policy using the CLI

To define granular rules describing ingress or egress network traffic allowed for namespaces in your cluster, you can create a network policy.

If you log in with a user with the cluster-admin role, then you can create a network policy in any namespace in the cluster.

Prerequisites

Your cluster uses a network plugin that supports NetworkPolicy objects, such as the OVN-Kubernetes network plugin, with mode: NetworkPolicy set.
You installed the OpenShift CLI (oc).
You logged in to the cluster with a user with admin privileges.
You are working in the namespace that the network policy applies to.

Procedure

Create a policy rule.
1. Create a <policy_name>.yaml file:
  $ touch <policy_name>.yaml
  where:
  
  <policy_name>
  
  Specifies the network policy file name.
2. Define a network policy in the created file. The following example denies ingress traffic from all pods in all namespaces. This is a fundamental policy, blocking all cross-pod networking other than cross-pod traffic allowed by the configuration of other Network Policies.
  kind: NetworkPolicy apiVersion: networking.k8s.io/v1 spec: podSelector: {} policyTypes: - Ingress ingress: []
  The following example configuration allows ingress traffic from all pods in the same namespace:
  kind: NetworkPolicy apiVersion: networking.k8s.io/v1 metadata: name: allow-same-namespace spec: podSelector: ingress: - from: - podSelector: {} # ...
  The following example allows ingress traffic to one pod from a particular namespace. This policy allows traffic to pods that have the pod-a label from pods running in namespace-y.
  kind: NetworkPolicy apiVersion: networking.k8s.io/v1 metadata: name: allow-traffic-pod spec: podSelector: matchLabels: pod: pod-a policyTypes: - Ingress ingress: - from: - namespaceSelector: matchLabels: kubernetes.io/metadata.name: namespace-y # ...
  The following example configuration restricts traffic to a service. This policy when applied ensures every pod with both labels app=bookstore and role=api can only be accessed by pods with label app=bookstore. In this example the application could be a REST API server, marked with labels app=bookstore and role=api.
  
  This example configuration addresses the following use cases:
  - Restricting the traffic to a service to only the other microservices that need to use it.
  - Restricting the connections to a database to only permit the application using it.
    
    kind: NetworkPolicy apiVersion: networking.k8s.io/v1 metadata: name: api-allow spec: podSelector: matchLabels: app: bookstore role: api ingress: - from: - podSelector: matchLabels: app: bookstore # ...

To create the network policy object, enter the following command. Successful output lists the name of the policy object and the created status.

$ oc apply -f <policy_name>.yaml -n <namespace>

where:

<policy_name>: Specifies the network policy file name.
<namespace>: Optional parameter. If you defined the object in a different namespace than the current namespace, the parameter specifices the namespace.

Successful output lists the name of the policy object and the created status.

If you log in to the web console with cluster-admin privileges, you have a choice of creating a network policy in any namespace in the cluster directly in YAML or from a form in the web console.