OpenShift docs are moving and will soon only be available at docs.redhat.com, the home of all Red Hat product documentation. Explore the new docs experience today.
  1. Documentation
    2. history
×

Creating a network policy

As a cluster administrator, you can create a network policy for a namespace.

Creating a network policy

To define granular rules describing ingress network traffic allowed for projects in your cluster, you can create a network policy.

Prerequisites

  • Your cluster is using a default CNI network provider that supports NetworkPolicy objects, such as the OpenShift SDN network provider with mode: NetworkPolicy set. This mode is the default for OpenShift SDN.

  • You installed the OpenShift CLI (oc).

  • You are logged in to the cluster with a user with cluster-admin privileges.

Procedure

  1. Create a policy rule:

    1. Create a <policy-name>.yaml file where <policy-name> describes the policy rule.

    2. In the file you just created define a policy object, such as in the following example:

      kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
  name: <policy-name> (1)
spec:
  podSelector:
  ingress: []
      1 Specify a name for the policy object.

  2. Run the following command to create the policy object:

    $ oc create -f <policy-name>.yaml -n <project>

    In the following example, a new NetworkPolicy object is created in a project named project1:

    $ oc create -f default-deny.yaml -n project1
    Example output
    networkpolicy "default-deny" created

Example NetworkPolicy object

The following annotates an example NetworkPolicy object:

kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
  name: allow-27107 (1)
spec:
  podSelector: (2)
    matchLabels:
      app: mongodb
  ingress:
  - from:
    - podSelector: (3)
        matchLabels:
          app: app
    ports: (4)
    - protocol: TCP
      port: 27017
1 The name of the NetworkPolicy object.
2 A selector describing the pods the policy applies to. The policy object can only select pods in the project that the NetworkPolicy object is defined.
3 A selector matching the pods that the policy object allows ingress traffic from. The selector will match pods in any project.
4 A list of one or more destination ports to accept traffic on.