Skip to content

Commit a813968

Browse files
author
Steven Smith
committed
Adds egress netpol docs
1 parent 1de0f04 commit a813968

15 files changed

+1099
-0
lines changed

‎_topic_maps/_topic_map.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1479,6 +1479,8 @@ Topics:
14791479
File: default-network-policy
14801480
- Name: Configuring multitenant isolation with network policy
14811481
File: multitenant-network-policy
1482+
- Name: Configuring full multitenant isolation with ingress and egress network policies
1483+
File: nw-networkpolicy-full-multitenant-isolation
14821484
- Name: Audit logging for network security
14831485
File: logging-network-security
14841486
- Name: Egress Firewall

‎modules/nw-networkpolicy-allow-internet.adoc

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * networking/network_security/network_policy/nw-networkpolicy-full-multitenant-isolation.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="nw-networkpolicy-allow-ingress_{context}"]
7+
= Creating an allow ingress access network policy
8+
9+
With the `deny-by-default` network policy in place, no pods can talk to each other or receive traffic from external sources. One option to enable communication is to allow some pods to receive traffic. To do so, you can create the following `ingress-access` network policy. With this network policy, pods with the `networking/allow-ingress-access=true` label can receive network traffic.
10+
11+
.Prerequisites
12+
13+
* You have created the `deny-by-default` network policy and applied it to the necessary namespaces.
14+
15+
.Procedure
16+
17+
. Create the following `ingress-access` network policy to allow pods with the `networking/allow-ingress-access` label to receive traffic from outside sources. Save the YAML in the `ingress-access.yaml` file:
18+
+
19+
[source,yaml]
20+
----
21+
apiVersion: networking.k8s.io/v1
22+
kind: NetworkPolicy
23+
metadata:
24+
name: ingress-access
25+
spec:
26+
podSelector:
27+
matchLabels:
28+
networking/allow-ingress-access: "true" <1>
29+
policyTypes:
30+
- Ingress
31+
ingress:
32+
- {}
33+
----
34+
<1> Apply this label to pods to enable the pod to receive traffic from outside sources.
35+
36+
. Apply the network policy to the `project-a` namespace by entering the following command:
37+
+
38+
[source,terminal]
39+
----
40+
$ oc apply -f ingress-access.yaml -n project-a
41+
----
42+
43+
. Apply the network policy to the `project-b` namespace by entering the following command:
44+
+
45+
[source,terminal]
46+
----
47+
$ oc apply -f ingress-access.yaml -n project-b
48+
----
49+
50+
. Apply the `networking/allow-ingress-access=true` label to pods that must receive outside traffic by entering the following command:
51+
+
52+
[source,terminal]
53+
----
54+
$ oc label pod busybox-pod-a networking/allow-ingress-access=true -n project-a
55+
----
56+
+
57+
Repeat this step for all pods that must receive outside traffic.
58+
59+
.Verification
60+
61+
. Obtain the IP addresses of pods in `project-a` by running the following command:
62+
+
63+
[source,terminal]
64+
----
65+
$ oc get pod -n project-a -o wide
66+
----
67+
+
68+
.Example output
69+
+
70+
[source,terminal]
71+
----
72+
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
73+
busybox-pod-a 1/1 Running 0 13m 10.132.0.38 ip-10-0-132-187.ec2.internal <none> <none>
74+
test-pod-a 1/1 Running 0 13m 10.132.0.40 ip-10-0-132-187.ec2.internal <none> <none>
75+
----
76+
77+
. Ensure that pods with the `networking/allow-ingress-access=true` label can receive traffic by entering the following command. If you followed these instructions, the `busybox-pod-a` pod in `project-a` can receive traffic from another pod. For example:
78+
+
79+
[source,terminal]
80+
----
81+
$ oc exec -it test-pod-b -n project-b -- ping 10.132.0.44
82+
----
83+
+
84+
.Example output
85+
+
86+
[source,terminal]
87+
----
88+
PING 10.132.0.44 (10.132.0.44): 56 data bytes
89+
64 bytes from 10.132.0.44: seq=0 ttl=42 time=1.137 ms
90+
64 bytes from 10.132.0.44: seq=1 ttl=42 time=0.672 ms
91+
----
92+
93+
. Ensure that pods without the `networking/allow-ingress-access=true` label cannot receive traffic by entering the following command. If you followed these instructions, the `test-pod-a` pod in `project-a` cannot receive traffic. For example:
94+
+
95+
[source,terminal]
96+
----
97+
$ oc exec -it busybox-pod-a -n project-a -- ping 10.132.0.40
98+
----
99+
+
100+
.Example output
101+
+
102+
[source,terminal]
103+
----
104+
PING 10.132.0.40 (10.132.0.40): 56 data bytes
105+
--- 10.132.0.40 ping statistics ---
106+
3 packets transmitted, 0 packets received, 100% packet loss
107+
----

‎modules/nw-networkpolicy-configuring-ingress-new-deployment.adoc

Lines changed: 171 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,171 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * networking/network_security/network_policy/nw-networkpolicy-full-multitenant-isolation.adoc
4+
5+
:_mod-docs-content-type: REFERENCE
6+
[id="nw-networkpolicy-ingress-new-deployments_{context}"]
7+
= Creating a network policy for new projects
8+
9+
After you have created a network policy that defines specific connections, new pods within a project are unable to communicate with existing pods in the same project, until the proper network policy has been applied to that pod. To address this behavior, you can create the following `allow-ingress-from-new` and `allow-ingress-to-new` network policies in a project, which allows new pods with the `networking/allow-all-connections=true` label to communicate with existing pods until more granular policies are created.
10+
11+
.Prerequisites
12+
13+
* You have created the `deny-by-default` network policy and applied it to a project.
14+
15+
.Procedure
16+
17+
. Create a new project, for example, `project-c`, by running the following command:
18+
+
19+
[source,terminal]
20+
----
21+
$ oc new-project project-c
22+
----
23+
24+
. In the `project-c` namespace, create a new pod by running the following command:
25+
+
26+
[source,terminal]
27+
----
28+
$ cat <<EOF | oc apply -f - -n project-c
29+
apiVersion: v1
30+
kind: Pod
31+
metadata:
32+
name: busybox-pod
33+
labels:
34+
app: busybox
35+
spec:
36+
containers:
37+
- name: busybox
38+
image: alpine:latest
39+
command: [ "sleep", "3600" ]
40+
securityContext:
41+
runAsNonRoot: true
42+
allowPrivilegeEscalation: false
43+
capabilities:
44+
drop:
45+
- "ALL"
46+
seccompProfile:
47+
type: "RuntimeDefault"
48+
EOF
49+
----
50+
51+
. In the `project-a` namespace:
52+
53+
.. Create the following `allow-ingress-from-new` network policy, which allows pods in this project the ability to receive ingress from a new project:
54+
+
55+
[source,yaml]
56+
----
57+
apiVersion: networking.k8s.io/v1
58+
kind: NetworkPolicy
59+
metadata:
60+
name: allow-ingress-from-new
61+
spec:
62+
podSelector: {}
63+
policyTypes:
64+
- Ingress
65+
ingress:
66+
- from:
67+
- podSelector:
68+
matchLabels:
69+
networking/allow-all-connections: "true"
70+
----
71+
72+
.. Apply the network policy by entering the following command:
73+
+
74+
[source,terminal]
75+
----
76+
$ oc apply -f allow-ingress-from-new.yaml -n project-a
77+
----
78+
79+
.. Create the following `allow-ingress-to-new` network policy, which allows pods in this project the ability to send ingress to a new project:
80+
+
81+
[source,yaml]
82+
----
83+
apiVersion: networking.k8s.io/v1
84+
kind: NetworkPolicy
85+
metadata:
86+
name: allow-ingress-to-new
87+
spec:
88+
podSelector:
89+
matchLabels:
90+
networking/allow-all-connections: "true"
91+
policyTypes:
92+
- Ingress
93+
ingress:
94+
- from:
95+
- podSelector: {}
96+
----
97+
98+
.. Apply the network policy by entering the following command:
99+
+
100+
[source,terminal]
101+
----
102+
$ oc apply -f allow-ingress-tp-new.yaml -n project-a
103+
----
104+
105+
.. Apply the `networking/allow-all-connections=true` to pods in `project-a` that you want to be able to communicate with pods in `project-c` by running the following command:
106+
+
107+
[source,terminal]
108+
----
109+
$ oc label pod <pod_name> networking/allow-all-connections=true -n project-a
110+
----
111+
112+
. In the `project-c` namespace:
113+
114+
.. Create the following `allow-ingress-from-new` network policy, which allows pods in this project the ability to receive ingress from a new project:
115+
+
116+
[source,yaml]
117+
----
118+
apiVersion: networking.k8s.io/v1
119+
kind: NetworkPolicy
120+
metadata:
121+
name: allow-ingress-from-new
122+
spec:
123+
podSelector: {}
124+
policyTypes:
125+
- Ingress
126+
ingress:
127+
- from:
128+
- podSelector:
129+
matchLabels:
130+
networking/allow-all-connections: "true"
131+
----
132+
133+
.. Apply the network policy by entering the following command:
134+
+
135+
[source,terminal]
136+
----
137+
$ oc apply -f allow-ingress-from-new.yaml -n project-c
138+
----
139+
140+
.. Create the following `allow-ingress-to-new` network policy, which allows pods in this project the ability to send ingress to a new project:
141+
+
142+
[source,yaml]
143+
----
144+
apiVersion: networking.k8s.io/v1
145+
kind: NetworkPolicy
146+
metadata:
147+
name: allow-ingress-to-new
148+
spec:
149+
podSelector:
150+
matchLabels:
151+
networking/allow-all-connections: "true"
152+
policyTypes:
153+
- Ingress
154+
ingress:
155+
- from:
156+
- podSelector: {}
157+
----
158+
159+
.. Apply the network policy by entering the following command:
160+
+
161+
[source,terminal]
162+
----
163+
$ oc apply -f allow-ingress-tp-new.yaml -n project-c
164+
----
165+
166+
.. Apply the `networking/allow-all-connections=true` to pods in `project-c` that you want to be able to communicate with pods in `project-a` by running the following command:
167+
+
168+
[source,terminal]
169+
----
170+
$ oc label pod busybox-pod networking/allow-all-connections=true -n project-c
171+
----

‎modules/nw-networkpolicy-configuring-internet-egress-pods.adoc

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * networking/network_security/network_policy/nw-networkpolicy-full-multitenant-isolation.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="nw-networkpolicy-configuring-internet-egress-pods_{context}"]
7+
= Configuring internet egress for pods
8+
9+
With the deny all egress network policy created in a namespace, pods within that namespace are made incapable of reaching _out_ to the internet. In most cases, at least some pods within a namespace need to reach external traffic.
10+
11+
The following procedure shows you how to designate labels to pods that require internet egress.
12+
13+
.Prerequisites
14+
15+
* You have created a network policy to deny all egress traffic.
16+
17+
.Procedure
18+
19+
. Create the following `internet-egress.yaml` file that both defines a network policy that allows traffic from pods with the matching label to access internet egress. For example:
20+
+
21+
[source,yaml]
22+
----
23+
apiVersion: networking.k8s.io/v1
24+
kind: NetworkPolicy
25+
metadata:
26+
name: internet-egress
27+
spec:
28+
podSelector:
29+
matchLabels:
30+
networking/allow-internet-egress: "true" <1>
31+
egress:
32+
- {}
33+
policyTypes:
34+
- Egress
35+
----
36+
37+
. Apply the network policy to the `project-a` namespace by entering the following command:
38+
+
39+
[source,terminal]
40+
----
41+
$ oc apply -f internet-egress.yaml -n project-a
42+
----
43+
44+
. Apply the network policy to the `project-b` namespace by entering the following command:
45+
+
46+
[source,terminal]
47+
----
48+
$ oc apply -f internet-egress.yaml -n project-b
49+
----
50+
51+
. Apply the `networking/allow-internet-egress=true` label to pods that require egress by entering the following command:
52+
+
53+
[source,terminal]
54+
----
55+
$ oc label pod busybox-pod-a networking/allow-internet-egress=true -n project-a
56+
----
57+
58+
.Verification
59+
60+
* Check whether a labeled pod in a namespace where you applied the `internet-egress.yaml` network policy can resolve a DNS name by entering the following command:
61+
+
62+
[source,terminal]
63+
----
64+
$ oc exec -it <pod_name> -n project-a -- nslookup google.com
65+
----
66+
+
67+
.Example output
68+
+
69+
[source,terminal]
70+
----
71+
...
72+
Name: google.com
73+
Address: 142.250.125.102
74+
...
75+
----

0 commit comments

Comments
 (0)