Skip to content

Commit 912c8df

Browse files
author
Steven Smith
committed
Adds egress netpol docs
1 parent 1de0f04 commit 912c8df

13 files changed

+676
-0
lines changed

‎_topic_maps/_topic_map.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1479,6 +1479,8 @@ Topics:
14791479
File: default-network-policy
14801480
- Name: Configuring multitenant isolation with network policy
14811481
File: multitenant-network-policy
1482+
- Name: Configuring full multitenant isolation with network policy using ingress and egress
1483+
File: nw-networkpolicy-full-multitenant-isolation
14821484
- Name: Audit logging for network security
14831485
File: logging-network-security
14841486
- Name: Egress Firewall

‎modules/nw-networkpolicy-allow-internet.adoc

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * networking/network_security/network_policy/nw-networkpolicy-full-multitenant-isolation.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="nw-networkpolicy-allow-internet_{context}"]
7+
= Creating an allow internet access network policy
8+
9+
With the `deny-by-default` network policy in place, no pods can talk to each other or receive traffic from external sources. One option to enable communication is to allow some pods to receive traffic. To do so, you can create the following `internet-access` network policy. With this network policy, pods with the `networking/allow-internet-access=true` label can receive network traffic.
10+
11+
.Prerequisites
12+
13+
* You have created the `deny-by-default` network policy and applied it to the necessary namespaces.
14+
15+
.Procedure
16+
17+
. Create the following `internet-access` network policy to allow pods with the `networking/allow-internet-access` label to receive traffic from outside sources. Save the YAML in the `internet-access.yaml` file:
18+
+
19+
[source,yaml]
20+
----
21+
apiVersion: networking.k8s.io/v1
22+
kind: NetworkPolicy
23+
metadata:
24+
name: internet-access
25+
spec:
26+
podSelector:
27+
matchLabels:
28+
networking/allow-internet-access: "true" <1>
29+
policyTypes:
30+
- Ingress
31+
ingress:
32+
- {}
33+
----
34+
<1> Apply this label to pods to enable the pod to receive traffic from outside sources.
35+
36+
. Apply the network policy to the `project-a` namespace by entering the following command:
37+
+
38+
[source,terminal]
39+
----
40+
$ oc apply -f internet-access.yaml -n project-a
41+
----
42+
43+
. Apply the network policy to the `project-b` namespace by entering the following command:
44+
+
45+
[source,terminal]
46+
----
47+
$ oc apply -f internet-access.yaml -n project-b
48+
----
49+
50+
. Apply the `networking/allow-internet-access=true` label to pods that must receive outside traffic by entering the following command:
51+
+
52+
[source,terminal]
53+
----
54+
$ oc label pod busybox-pod networking/allow-internet-access=true -n project-a
55+
----
56+
57+
.Verification
58+
59+
. Obtain the IP addresses of pods in `project-a` by running the following command:
60+
+
61+
[source,terminal]
62+
----
63+
$ oc get pod -n project-a -o wide
64+
----
65+
+
66+
.Example output
67+
+
68+
[source,terminal]
69+
----
70+
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
71+
busybox-pod 1/1 Running 0 4m9s 10.132.0.44 ip-10-0-143-210.ec2.internal <none> <none>
72+
test-pod 1/1 Running 0 3m47s 10.132.0.46 ip-10-0-143-210.ec2.internal <none> <none>
73+
----
74+
75+
. Ensure that pods with the `networking/allow-internet-access=true` label can receive traffic by entering the following command. If you followed these instructions, the `busybox-pod` in `project-a` should be able to receive traffic. For example:
76+
+
77+
[source,terminal]
78+
----
79+
$ oc exec -it test-pod -n project-b -- ping 10.132.0.44
80+
----
81+
+
82+
.Example output
83+
+
84+
[source,terminal]
85+
----
86+
PING 10.132.0.44 (10.132.0.44): 56 data bytes
87+
64 bytes from 10.132.0.44: seq=0 ttl=42 time=1.137 ms
88+
64 bytes from 10.132.0.44: seq=1 ttl=42 time=0.672 ms
89+
----
90+
91+
. Ensure that pods without the `networking/allow-internet-access=true` label cannot receive traffic by entering the following command. If you followed these instructions, `test-pod` in `project-a`, which has an IP address of `10.143.0.46`, should not be able to receive traffic. For example:
92+
+
93+
[source,terminal]
94+
----
95+
$ oc exec -it busybox-pod -n project-a -- ping 10.132.0.46
96+
----
97+
+
98+
.Example output
99+
+
100+
[source,terminal]
101+
----
102+
PING 10.132.0.46 (10.132.0.46): 56 data bytes
103+
--- 10.132.0.46 ping statistics ---
104+
3 packets transmitted, 0 packets received, 100% packet loss
105+
----

‎modules/nw-networkpolicy-configuring-internet-egress-pods.adoc

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * networking/network_security/network_policy/creating-network-policy.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="nw-networkpolicy-configuring-internet-egress-pods_{context}"]
7+
= Configuring internet egress for pods
8+
9+
With the deny all egress network policy created in a namespace, pods within that namespace are made incapable of reaching _out_ to the internet. In most cases, at least some pods within a namespace will need the able to reach external traffic.
10+
11+
The following procedure shows you how to designate labels to pods that require internet egress.
12+
13+
.Prerequisites
14+
15+
* You have created a network policy to deny all egress traffic.
16+
17+
.Procedure
18+
19+
. Create the following `internet-egress.yaml` file that both defines a network policy that allows traffic from pods with the matching label to access internet egress. For example:
20+
+
21+
[source,yaml]
22+
----
23+
apiVersion: networking.k8s.io/v1
24+
kind: NetworkPolicy
25+
metadata:
26+
name: internet-egress
27+
spec:
28+
podSelector:
29+
matchLabels:
30+
networking/allow-internet-egress: "true" <1>
31+
egress:
32+
- {}
33+
policyTypes:
34+
- Egress
35+
----
36+
37+
. Apply the network policy to the `project-a` namespace by entering the following command:
38+
+
39+
[source,terminal]
40+
----
41+
$ oc apply -f internet-egress.yaml -n project-a
42+
----
43+
44+
. Apply the network policy to the `project-b` namespace by entering the following command:
45+
+
46+
[source,terminal]
47+
----
48+
$ oc apply -f internet-egress.yaml -n project-b
49+
----
50+
51+
. Apply the `networking/allow-internet-egress=true` label to pods that require egress by entering the following command:
52+
+
53+
[source,terminal]
54+
----
55+
$ oc label pod <pod_name> networking/allow-internet-egress=true -n project-a
56+
----
57+
58+
.Verification
59+
60+
* Check whether a labeled pod in a namespace where you applied the `internet-egress.yaml` network policy can resolve a DNS name by entering the following command:
61+
+
62+
[source,terminal]
63+
----
64+
$ oc exec -it <pod_name> -n project-a -- nslookup google.com
65+
----
66+
+
67+
.Example output
68+
+
69+
[source,terminal]
70+
----
71+
...
72+
Name: google.com
73+
Address: 142.250.125.102
74+
...
75+
----

‎modules/nw-networkpolicy-cross-namespace-communication.adoc

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * networking/network_security/network_policy/nw-networkpolicy-full-multitenant-isolation.adoc
4+
5+
:_mod-docs-content-type: REFERENCE
6+
[id="nw-networkpolicy-cross-namespace-communication_{context}"]
7+
= Creating a network policy for cross-namespace communication
8+
9+
To allow pod-to-pod communication across namespaces, you must create a label for the primary namespace and add a `namespaceSelector` query and a `podSelector` query.
10+
11+
.Prerequisites
12+
13+
* You have created the `deny-by-default` network policy and applied it to all necessary namespaces.
14+
15+
.Procedure
16+
17+
. Create the following `allow-n1-a-to-n2-b` network policy to allow pods across namespaces to communicate with each other. With this YAML, pods in the `project-a` namespace can communicate with pods in the `project-b` namespace, so long as those namespaces are labeled `networking/namespace: n1` and `networking/namespace: n2`, respectively. Save the YAML in the `allow-n1-a-to-n2-b` file:
18+
+
19+
[source,yaml]
20+
----
21+
apiVersion: networking.k8s.io/v1
22+
kind: NetworkPolicy
23+
metadata:
24+
name: allow-n1-a-to-n2-b
25+
spec:
26+
podSelector:
27+
matchLabels:
28+
app: receive-data # this label goes on pods in project-b
29+
policyTypes:
30+
- Ingress
31+
ingress:
32+
- from:
33+
- namespaceSelector:
34+
matchLabels:
35+
networking/namespace: n1 # this label goes on the project-a namespace
36+
podSelector:
37+
matchLabels:
38+
app: send-data # this label goes on pods in project-a
39+
----
40+
41+
. Apply the `allow-n1-a-to-n2-b` network policy to the `project-b` namespace by running the following command:
42+
+
43+
[source,terminal]
44+
----
45+
$ oc apply -f allow-n1-a-to-n2-b.yaml -n project-b
46+
----
47+
48+
. Label the `project-a` namespace with the `networking/namespace=n1` label by entering the following command:
49+
+
50+
[source,terminal]
51+
----
52+
$ oc label namespace project-a networking/namespace=n1 --overwrite
53+
----
54+
55+
. Label the `project-b` namespace with the `networking/namespace=n2` label by entering the following command:
56+
+
57+
[source,terminal]
58+
----
59+
$ oc label namespace project-b networking/namespace=n2 --overwrite
60+
----
61+
62+
. If it is not already labeled, label the `busybox-pod` in `project-a` with the `send-data` label by entering the following command:
63+
+
64+
[source,terminal]
65+
----
66+
$ oc label pod busybox-pod app=send-data -n project-a
67+
----
68+
69+
. If it is not already labeled, label the `test-pod` in `project-b` with the `receive-data` label by entering the following command:
70+
+
71+
[source,terminal]
72+
----
73+
$ oc label pod test-pod app=receive-data -n project-b --overwrite
74+
----
75+
76+
.Verification
77+
78+
. Obtain the IP addresses of pods in `project-b` by running the following command:
79+
+
80+
[source,terminal]
81+
----
82+
$ oc get pod -n project-b -o wide
83+
----
84+
+
85+
.Example output
86+
+
87+
[source,terminal]
88+
----
89+
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
90+
busybox-pod 1/1 Running 0 47m 10.132.0.40 ip-10-0-132-137.ec2.internal <none> <none>
91+
test-pod 1/1 Running 0 47m 10.132.0.42 ip-10-0-132-137.ec2.internal <none> <none>
92+
----
93+
94+
. Ensure that `busybox-pod` in `project-a`, labeled with `send-data`, can send data to `test-pod` in `project-b` by entering the following command:
95+
+
96+
[source,terminal]
97+
----
98+
$ oc exec -it busybox-pod -n tenant-a -- ping 10.132.0.42
99+
----
100+
+
101+
.Example output
102+
+
103+
[source,terminal]
104+
----
105+
PING 10.132.0.40 (10.132.0.40): 56 data bytes
106+
64 bytes from 10.132.0.40: seq=0 ttl=42 time=1.201 ms
107+
64 bytes from 10.132.0.40: seq=1 ttl=42 time=0.640 ms
108+
----

‎modules/nw-networkpolicy-deny-all-allowed.adoc

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
// * networking/multiple_networks/configuring-multi-network-policy.adoc
44
// * networking/network_security/network_policy/creating-network-policy.adoc
55
// * microshift_networking/microshift-creating-network-policy.adoc
6+
// * networking/network_security/network_policy/nw-networkpolicy-full-multitenant-isolation.adoc
67

78
:name: network
89
:role: admin

‎modules/nw-networkpolicy-deny-all-egress-network-policy.adoc

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * networking/network_security/network_policy/creating-network-policy.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="nw-networkpolicy-deny-all-egress-network-policy_{context}"]
7+
= Creating a default deny all egress network policy
8+
9+
Use the following procedure to create a `default-deny-all` network policy that isolates all pods for egress.
10+
11+
[WARNING]
12+
====
13+
Without configuring a `NetworkPolicy` custom resource (CR) that allows traffic communication, the following policy might cause communication problems across your cluster.
14+
Creating a `default-deny-all` network policy that isolates pods for egress breaks pod-to-pod communication for ingress. This behavior is expected, and every connection allowed in the ingress direction must also allowlist connections in the egress direction. After creating a `default-deny-all` network policy, you should "Configure internet for egress pods" and "Enable pod-to-pod communication".
15+
====
16+
17+
.Prerequisites
18+
19+
* Your cluster uses a network plugin that supports `NetworkPolicy` objects, such as the OVN-Kubernetes network plugin, with `mode: NetworkPolicy` set.
20+
* You installed the OpenShift CLI (`oc`).
21+
* You are logged in to the cluster with a user with admin privileges.
22+
* You have configured an ingress network policy.
23+
* You have created at least two projects in your cluster.
24+
* You have created pods in your cluster.
25+
26+
.Procedure
27+
28+
. Create the following YAML that defines a `deny-by-default-egress` network policy to deny egress for all pods in the namespace. Save the YAML in the `deny-by-default-egress.yaml` file:
29+
+
30+
[source,yaml]
31+
----
32+
apiVersion: networking.k8s.io/v1
33+
kind: NetworkPolicy
34+
metadata:
35+
name: deny-by-default-egress
36+
spec:
37+
podSelector: {}
38+
egress:
39+
- to:
40+
ports:
41+
- protocol: TCP
42+
port: 53 <1>
43+
- protocol: UDP
44+
port: 53 <1>
45+
policyTypes:
46+
- Egress
47+
----
48+
<1> Allows connections to port `53` on any IP to facilitate DNS lookups.
49+
50+
. Apply the policy by entering the following command:
51+
+
52+
[IMPORTANT]
53+
====
54+
Do not apply this network policy to the `kube-system` namespace, as it can break cluster functionality.
55+
====
56+
+
57+
[source,terminal]
58+
----
59+
$ oc apply -f deny-by-default-egress.yaml -n project-a
60+
----
61+
62+
. Because network policies are namespaced resources, you must create this network policy for each namespace. Apply the policy to other applicable namespaces by entering the following command:
63+
+
64+
[source,terminal]
65+
----
66+
$ oc apply -f deny-by-default-egress.yaml -n project-b
67+
----
68+
+
69+
With the application of the `deny-by-default-egress` network policy, pods in those namespaces are made incapable of egress traffic.
70+
71+
.Verification
72+
73+
* Test egress connection on a pod by entering the following command. If the network policy was successfully applied, then the pod is unable to reach the endpoint:
74+
+
75+
[source,terminal]
76+
----
77+
$ oc exec -it <example_pod> -n <namespace_b> -- nslookup google.com
78+
----
79+
+
80+
.Example output
81+
+
82+
[source,terminal]
83+
----
84+
;; connection timed out; no servers could be reached
85+
command terminated with exit code 1
86+
----

0 commit comments

Comments
 (0)