Skip to content

Commit aa5de97

Browse files
author
Steven Smith
committed
Adds egress netpol docs
1 parent 1de0f04 commit aa5de97

14 files changed

+837
-0
lines changed

‎_topic_maps/_topic_map.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1479,6 +1479,8 @@ Topics:
14791479
File: default-network-policy
14801480
- Name: Configuring multitenant isolation with network policy
14811481
File: multitenant-network-policy
1482+
- Name: Configuring full multitenant isolation with network policy using ingress and egress
1483+
File: nw-networkpolicy-full-multitenant-isolation
14821484
- Name: Audit logging for network security
14831485
File: logging-network-security
14841486
- Name: Egress Firewall

‎modules/nw-networkpolicy-allow-internet.adoc

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * networking/network_security/network_policy/nw-networkpolicy-full-multitenant-isolation.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="nw-networkpolicy-allow-ingress_{context}"]
7+
= Creating an allow ingress access network policy
8+
9+
With the `deny-by-default` network policy in place, no pods can talk to each other or receive traffic from external sources. One option to enable communication is to allow some pods to receive traffic. To do so, you can create the following `ingress-access` network policy. With this network policy, pods with the `networking/allow-ingress-access=true` label can receive network traffic.
10+
11+
.Prerequisites
12+
13+
* You have created the `deny-by-default` network policy and applied it to the necessary namespaces.
14+
15+
.Procedure
16+
17+
. Create the following `ingress-access` network policy to allow pods with the `networking/allow-ingress-access` label to receive traffic from outside sources. Save the YAML in the `ingress-access.yaml` file:
18+
+
19+
[source,yaml]
20+
----
21+
apiVersion: networking.k8s.io/v1
22+
kind: NetworkPolicy
23+
metadata:
24+
name: ingress-access
25+
spec:
26+
podSelector:
27+
matchLabels:
28+
networking/allow-ingress-access: "true" <1>
29+
policyTypes:
30+
- Ingress
31+
ingress:
32+
- {}
33+
----
34+
<1> Apply this label to pods to enable the pod to receive traffic from outside sources.
35+
36+
. Apply the network policy to the `project-a` namespace by entering the following command:
37+
+
38+
[source,terminal]
39+
----
40+
$ oc apply -f ingress-access.yaml -n project-a
41+
----
42+
43+
. Apply the network policy to the `project-b` namespace by entering the following command:
44+
+
45+
[source,terminal]
46+
----
47+
$ oc apply -f ingress-access.yaml -n project-b
48+
----
49+
50+
. Apply the `networking/allow-ingress-access=true` label to pods that must receive outside traffic by entering the following command:
51+
+
52+
[source,terminal]
53+
----
54+
$ oc label pod busybox-pod-a networking/allow-ingress-access=true -n project-a
55+
----
56+
+
57+
Repeat this step for all pods that must receive outside traffic.
58+
59+
.Verification
60+
61+
. Obtain the IP addresses of pods in `project-a` by running the following command:
62+
+
63+
[source,terminal]
64+
----
65+
$ oc get pod -n project-a -o wide
66+
----
67+
+
68+
.Example output
69+
+
70+
[source,terminal]
71+
----
72+
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
73+
busybox-pod-a 1/1 Running 0 13m 10.132.0.38 ip-10-0-132-187.ec2.internal <none> <none>
74+
test-pod-a 1/1 Running 0 13m 10.132.0.40 ip-10-0-132-187.ec2.internal <none> <none>
75+
----
76+
77+
. Ensure that pods with the `networking/allow-ingress-access=true` label can receive traffic by entering the following command. If you followed these instructions, the `busybox-pod-a` pod in `project-a` can receive traffic from another pod. For example:
78+
+
79+
[source,terminal]
80+
----
81+
$ oc exec -it test-pod-b -n project-b -- ping 10.132.0.44
82+
----
83+
+
84+
.Example output
85+
+
86+
[source,terminal]
87+
----
88+
PING 10.132.0.44 (10.132.0.44): 56 data bytes
89+
64 bytes from 10.132.0.44: seq=0 ttl=42 time=1.137 ms
90+
64 bytes from 10.132.0.44: seq=1 ttl=42 time=0.672 ms
91+
----
92+
93+
. Ensure that pods without the `networking/allow-ingress-access=true` label cannot receive traffic by entering the following command. If you followed these instructions, the `test-pod-a` pod in `project-a` cannot receive traffic. For example:
94+
+
95+
[source,terminal]
96+
----
97+
$ oc exec -it busybox-pod-a -n project-a -- ping 10.132.0.40
98+
----
99+
+
100+
.Example output
101+
+
102+
[source,terminal]
103+
----
104+
PING 10.132.0.46 (10.132.0.46): 56 data bytes
105+
--- 10.132.0.46 ping statistics ---
106+
3 packets transmitted, 0 packets received, 100% packet loss
107+
----

‎modules/nw-networkpolicy-configuring-internet-egress-pods.adoc

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * networking/network_security/network_policy/creating-network-policy.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="nw-networkpolicy-configuring-internet-egress-pods_{context}"]
7+
= Configuring internet egress for pods
8+
9+
With the deny all egress network policy created in a namespace, pods within that namespace are made incapable of reaching _out_ to the internet. In most cases, at least some pods within a namespace will need the able to reach external traffic.
10+
11+
The following procedure shows you how to designate labels to pods that require internet egress.
12+
13+
.Prerequisites
14+
15+
* You have created a network policy to deny all egress traffic.
16+
17+
.Procedure
18+
19+
. Create the following `internet-egress.yaml` file that both defines a network policy that allows traffic from pods with the matching label to access internet egress. For example:
20+
+
21+
[source,yaml]
22+
----
23+
apiVersion: networking.k8s.io/v1
24+
kind: NetworkPolicy
25+
metadata:
26+
name: internet-egress
27+
spec:
28+
podSelector:
29+
matchLabels:
30+
networking/allow-internet-egress: "true" <1>
31+
egress:
32+
- {}
33+
policyTypes:
34+
- Egress
35+
----
36+
37+
. Apply the network policy to the `project-a` namespace by entering the following command:
38+
+
39+
[source,terminal]
40+
----
41+
$ oc apply -f internet-egress.yaml -n project-a
42+
----
43+
44+
. Apply the network policy to the `project-b` namespace by entering the following command:
45+
+
46+
[source,terminal]
47+
----
48+
$ oc apply -f internet-egress.yaml -n project-b
49+
----
50+
51+
. Apply the `networking/allow-internet-egress=true` label to pods that require egress by entering the following command:
52+
+
53+
[source,terminal]
54+
----
55+
$ oc label pod <pod_name> networking/allow-internet-egress=true -n project-a
56+
----
57+
58+
.Verification
59+
60+
* Check whether a labeled pod in a namespace where you applied the `internet-egress.yaml` network policy can resolve a DNS name by entering the following command:
61+
+
62+
[source,terminal]
63+
----
64+
$ oc exec -it <pod_name> -n project-a -- nslookup google.com
65+
----
66+
+
67+
.Example output
68+
+
69+
[source,terminal]
70+
----
71+
...
72+
Name: google.com
73+
Address: 142.250.125.102
74+
...
75+
----

‎modules/nw-networkpolicy-cross-namespace-communication.adoc

Lines changed: 127 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,127 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * networking/network_security/network_policy/nw-networkpolicy-full-multitenant-isolation.adoc
4+
5+
:_mod-docs-content-type: REFERENCE
6+
[id="nw-networkpolicy-cross-namespace-communication_{context}"]
7+
= Creating a network policy for cross-namespace communication
8+
9+
To allow pod-to-pod communication across namespaces, you must create a label for the primary namespace and add a `namespaceSelector` query and a `podSelector` query.
10+
11+
.Prerequisites
12+
13+
* You have created the `deny-by-default` network policy and applied it to all necessary namespaces.
14+
15+
.Procedure
16+
17+
. Create the following `allow-n1-a-to-n2-b` network policy to allow pods across namespaces to communicate with each other. With this YAML, pods in the `project-a` that are labeled with `send-data` can communicate with pods in the `project-b` namespace that are labeled with `receive-data`. The namespaces must also be labeled to allow for communication. Save the YAML in the `allow-n1-a-to-n2-b` file:
18+
+
19+
[source,yaml]
20+
----
21+
apiVersion: networking.k8s.io/v1
22+
kind: NetworkPolicy
23+
metadata:
24+
name: allow-n1-a-to-n2-b
25+
spec:
26+
podSelector:
27+
matchLabels:
28+
app: receive-data <1>
29+
policyTypes:
30+
- Ingress
31+
ingress:
32+
- from:
33+
- namespaceSelector:
34+
matchLabels:
35+
networking/namespace: n1 <2>
36+
podSelector:
37+
matchLabels:
38+
app: send-data <3>
39+
----
40+
<1> Apply the `app: receive-data` label to pods in the `project-b` namespace.
41+
<2> Apply the `n1` label to the `project-a` namespace.
42+
<3> Apply the `app: send-data` label to pods in the `project-a` namespace.
43+
44+
. Apply the `allow-n1-a-to-n2-b` network policy to the `project-b` namespace by running the following command:
45+
+
46+
[source,terminal]
47+
----
48+
$ oc apply -f allow-n1-a-to-n2-b.yaml -n project-b
49+
----
50+
51+
. Label the `project-a` namespace with the `networking/namespace=n1` label by entering the following command:
52+
+
53+
[source,terminal]
54+
----
55+
$ oc label namespace project-a networking/namespace=n1 --overwrite
56+
----
57+
58+
. Label the `project-b` namespace with the `networking/namespace=n2` label by entering the following command:
59+
+
60+
[source,terminal]
61+
----
62+
$ oc label namespace project-b networking/namespace=n2 --overwrite
63+
----
64+
65+
. If it is not already labeled, label the `busybox-pod` in `project-a` with the `send-data` label by entering the following command:
66+
+
67+
[source,terminal]
68+
----
69+
$ oc label pod busybox-pod app=send-data -n project-a
70+
----
71+
72+
. If it is not already labeled, label the `test-pod` in `project-b` with the `receive-data` label by entering the following command:
73+
+
74+
[source,terminal]
75+
----
76+
$ oc label pod test-pod app=receive-data -n project-b --overwrite
77+
----
78+
79+
.Verification
80+
81+
. Obtain the IP addresses of pods in `project-b` by running the following command:
82+
+
83+
[source,terminal]
84+
----
85+
$ oc get pod -n project-b -o wide
86+
----
87+
+
88+
.Example output
89+
+
90+
[source,terminal]
91+
----
92+
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
93+
busybox-pod-b 1/1 Running 0 51m 10.132.0.39 ip-10-0-132-187.ec2.internal <none> <none>
94+
test-pod-b 1/1 Running 0 51m 10.132.0.41 ip-10-0-132-187.ec2.internal <none> <none>
95+
----
96+
97+
. Ensure that the `busybox-pod-a` pod in the `project-a` namespace can send data to the `test-pod-b` pod in the `project-b` namespace by entering the following command:
98+
+
99+
[source,terminal]
100+
----
101+
$ oc exec -it busybox-pod -n project-a -- ping 10.132.0.42
102+
----
103+
+
104+
.Example output
105+
+
106+
[source,terminal]
107+
----
108+
PING 10.132.0.40 (10.132.0.40): 56 data bytes
109+
64 bytes from 10.132.0.40: seq=0 ttl=42 time=1.201 ms
110+
64 bytes from 10.132.0.40: seq=1 ttl=42 time=0.640 ms
111+
----
112+
113+
. Ensure that unlabeled pods cannot send and receive data by entering the following command. In this example, because the `test-pod-a` pod is not labeled with `send-data`, it cannot send data to the `test-pod-b` pod, even though that pod has the `receive-data` label.
114+
+
115+
[source,terminal]
116+
----
117+
$ oc exec -it test-pod-a -n project-a -- ping 10.132.0.41
118+
----
119+
+
120+
.Example output
121+
+
122+
[source,terminal]
123+
----
124+
PING 10.132.0.41 (10.132.0.41): 56 data bytes
125+
--- 10.132.0.41 ping statistics ---
126+
2 packets transmitted, 0 packets received, 100% packet loss
127+
----

‎modules/nw-networkpolicy-deny-all-allowed.adoc

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
// * networking/multiple_networks/configuring-multi-network-policy.adoc
44
// * networking/network_security/network_policy/creating-network-policy.adoc
55
// * microshift_networking/microshift-creating-network-policy.adoc
6+
// * networking/network_security/network_policy/nw-networkpolicy-full-multitenant-isolation.adoc
67

78
:name: network
89
:role: admin

0 commit comments

Comments
 (0)