1. Documentation
    2. history bug_report picture_as_pdf
×

Network Policy

As a user with the admin role, you can create a network policy for the netobserv namespace to secure inbound access to the Network Observability Operator.

Creating a network policy for Network Observability

You might need to create a network policy to secure ingress traffic to the netobserv namespace. In the web console, you can create a network policy using the form view.

Procedure

  1. Navigate to Networking → NetworkPolicies.

  2. Select the netobserv project from the Project dropdown menu.

  3. Name the policy. For this example, the policy name is allow-ingress.

  4. Click Add ingress rule three times to create three ingress rules.

  5. Specify the following in the form:

    1. Make the following specifications for the first Ingress rule:

      1. From the Add allowed source dropdown menu, select Allow pods from the same namespace.

    2. Make the following specifications for the second Ingress rule:

      1. From the Add allowed source dropdown menu, select Allow pods from inside the cluster.

      2. Click + Add namespace selector.

      3. Add the label, kubernetes.io/metadata.name, and the selector, openshift-console.

    3. Make the following specifications for the third Ingress rule:

      1. From the Add allowed source dropdown menu, select Allow pods from inside the cluster.

      2. Click + Add namespace selector.

      3. Add the label, kubernetes.io/metadata.name, and the selector, openshift-monitoring.

Verification

  1. Navigate to Observe → Network Traffic.

  2. View the Traffic Flows tab, or any tab, to verify that the data is displayed.

  3. Navigate to Observe → Dashboards. In the NetObserv/Health selection, verify that the flows are being ingested and sent to Loki, which is represented in the first graph.

Example network policy

The following annotates an example NetworkPolicy object for the netobserv namespace:

Sample network policy
kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
  name: allow-ingress
  namespace: netobserv
spec:
  podSelector: {}            (1)
  ingress:
    - from:
        - podSelector: {}    (2)
          namespaceSelector: (3)
            matchLabels:
              kubernetes.io/metadata.name: openshift-console
        - podSelector: {}
          namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: openshift-monitoring
  policyTypes:
    - Ingress
status: {}
1 A selector that describes the pods to which the policy applies. The policy object can only select pods in the project that defines the NetworkPolicy object. In this documentation, it would be the project in which the Network Observability Operator is installed, which is the netobserv project.
2 A selector that matches the pods from which the policy object allows ingress traffic. The default is that the selector matches pods in the same namespace as the NetworkPolicy.
3 When the namespaceSelector is specified, the selector matches pods in the specified namespace.
Additional resources

Creating a network policy using the CLI