$ oc adm create-bootstrap-project-template -o yaml > template.yaml
As a cluster administrator, you can modify the new project template to automatically include network policies when you create a new project. If you do not yet have a customized template for new projects, you must first create one.
As a cluster administrator, you can modify the default project template so that new projects are created using your custom requirements.
To create your own custom project template:
You have access to an Red Hat OpenShift Service on AWS cluster using an account with dedicated-admin
permissions.
Log in as a user with cluster-admin
privileges.
Generate the default project template:
$ oc adm create-bootstrap-project-template -o yaml > template.yaml
Use a text editor to modify the generated template.yaml
file by adding
objects or modifying existing objects.
The project template must be created in the openshift-config
namespace. Load
your modified template:
$ oc create -f template.yaml -n openshift-config
Edit the project configuration resource using the web console or CLI.
Using the web console:
Navigate to the Administration → Cluster Settings page.
Click Configuration to view all configuration resources.
Find the entry for Project and click Edit YAML.
Using the CLI:
Edit the project.config.openshift.io/cluster
resource:
$ oc edit project.config.openshift.io/cluster
Update the spec
section to include the projectRequestTemplate
and name
parameters, and set the name of your uploaded project template. The default name
is project-request
.
apiVersion: config.openshift.io/v1
kind: Project
metadata:
# ...
spec:
projectRequestTemplate:
name: <template_name>
# ...
After you save your changes, create a new project to verify that your changes were successfully applied.
As a cluster administrator, you can add network policies to the default template for new projects.
Red Hat OpenShift Service on AWS will automatically create all the NetworkPolicy
objects specified in the template in the project.
Your cluster uses a default CNI network plugin that supports NetworkPolicy
objects, such as the OpenShift SDN network plugin with mode: NetworkPolicy
set. This mode is the default for OpenShift SDN.
You installed the OpenShift CLI (oc
).
You must log in to the cluster with a user with cluster-admin
privileges.
You must have created a custom default project template for new projects.
Edit the default template for a new project by running the following command:
$ oc edit template <project_template> -n openshift-config
Replace <project_template>
with the name of the default template that you
configured for your cluster. The default template name is project-request
.
In the template, add each NetworkPolicy
object as an element to the objects
parameter. The objects
parameter accepts a collection of one or more objects.
In the following example, the objects
parameter collection includes several NetworkPolicy
objects.
objects:
- apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-from-same-namespace
spec:
podSelector: {}
ingress:
- from:
- podSelector: {}
- apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-from-openshift-ingress
spec:
ingress:
- from:
- namespaceSelector:
matchLabels:
network.openshift.io/policy-group: ingress
podSelector: {}
policyTypes:
- Ingress
- apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-from-kube-apiserver-operator
spec:
ingress:
- from:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: openshift-kube-apiserver-operator
podSelector:
matchLabels:
app: kube-apiserver-operator
policyTypes:
- Ingress
...
Optional: Create a new project to confirm that your network policy objects are created successfully by running the following commands:
Create a new project:
$ oc new-project <project> (1)
1 | Replace <project> with the name for the project you are creating. |
Confirm that the network policy objects in the new project template exist in the new project:
$ oc get networkpolicy
NAME POD-SELECTOR AGE
allow-from-openshift-ingress <none> 7s
allow-from-same-namespace <none> 7s