Chapter 3. Configure collector network policies

Procedure

1. Update the ClusterLogForwarder CR:

   apiVersion: observability.openshift.io/v1
   kind: ClusterLogForwarder
   metadata:
     name: my-forwarder
     namespace: openshift-logging
   spec:
     collector:
       networkPolicy:
         ruleSet: <RestrictIngressEgress_or_AllowAllIngressEgress>
     # ...

   Where the value for the ruleSet field can be either RestrictIngressEgress or AllowAllIngressEgress.

2. Apply the configuration by running the following command:

   $ oc apply -f <filename>.yaml

Procedure

1. Update the LogFileMetricExporter CR:

   apiVersion: logging.openshift.io/v1alpha1
   kind: LogFileMetricExporter
   metadata:
     name: my-lfme
     namespace: openshift-logging
   spec:
     networkPolicy:
       ruleSet: <AllowAllIngressEgress_or_AllowIngressMetrics>
   #...

   Where the value for the ruleSet field can be either AllowAllIngressEgress or AllowIngressMetrics.

2. Apply the configuration by running the following command:

   $ oc apply -f <filename>.yaml

Procedure

1. Create an AdminNetworkPolicy rule:

   apiVersion: policy.networking.k8s.io/v1alpha1
   kind: AdminNetworkPolicy
   metadata:
     name: allow-logging-collector-delegation
   spec:
     priority: 50 # Adjust based on your cluster's ANP priority scheme. Lower number means higher priority
     subject:
       pods: # Target the pods in openshift-logging namespace
         namespaceSelector:
           matchLabels:
             kubernetes.io/metadata.name: openshift-logging
         podSelector:
           matchLabels:
             app.kubernetes.io/name: <name>
             app.kubernetes.io/instance: <instance>
             app.kubernetes.io/managed-by: cluster-logging-operator
             app.kubernetes.io/part-of: cluster-logging
             app.kubernetes.io/component: <component>
     ingress:
       - name: "delegate-to-collector-ingress"
         action: "Pass"
         from:
           # Select all pods in all namespaces as the source.
           - pods:
               namespaceSelector: {}
               podSelector: {}
     egress:
       - name: "delegate-to-collector-egress"
         action: "Pass"
         to:
           # Select all pods in all namespaces for internal traffic.
           - pods:
               namespaceSelector: {}
               podSelector: {}
           # Select all external destinations for egress traffic.
           - networks:
             - "0.0.0.0/0"
             - "::/0"

   To apply this network policy to all the resources in a namespace, remove app.kubernetes.io/name, app.kubernetes.io/instance, and app.kubernetes.io/component fields. To apply the admin network policy to specific resources, define the fields as follows:

   • Replace <name> with the name of the collector or the LogFileMetricExporter resource.
   • Replace <instance> with the instance name of the collector or the LogFileMetricExporter resource.
   • Replace <component> with the value collector or logfilesmetricexporter.

2. Apply the AdminNetworkPolicy rule by running the following command:

   $ oc apply -f <filename>.yaml