Adds egress netpol docs #92159
Open
Adds egress netpol docs #92159
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
openshift-ci
bot
added
the
size/L
openshift-ci
bot
added
size/XL
stevsmit
force-pushed
the
OCPBUGS-54674
branch
3 times, most recently
from
b1988cc to
912c8df
Compare
|
|
||
| .Procedure | ||
|
|
||
| . Create the following `allow-n1-a-to-n2-b` network policy to allow pods across namespaces to communicate with each other. With this YAML, pods in the `project-a` namespace can communicate with pods in the `project-b` namespace, so long as those namespaces are labeled `networking/namespace: n1` and `networking/namespace: n2`, respectively. Save the YAML in the `allow-n1-a-to-n2-b` file: |
There was a problem hiding this comment.
🤖 [error] RedHat.TermsErrors: Use 'if' or 'when' rather than 'so long as'. For more information, see RedHat.TermsErrors.
openshift-ci
bot
added
size/XXL
|
@stevsmit: all tests passed! Full PR test history. Your PR dashboard. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
The This is because your PR targets the If the update in your PR does NOT apply to version 4.20 onward, please re-target this PR to go directly into the appropriate version branch or branches (enterprise-4.x) instead of main. |
asood-rh
reviewed
Jun 16, 2025
| ingress: | ||
| - {} | ||
| ---- | ||
| <1> Apply this label to pods to enable the pod to receive traffic from outside sources. |
There was a problem hiding this comment.
Suggested change
| <1> Apply this label to pods to enable the pod to receive traffic from outside sources. | |
| <1> Apply this label to pods to enable the pods to receive traffic from outside sources. |
asood-rh
reviewed
Jun 17, 2025
| + | ||
| [source,terminal] | ||
| ---- | ||
| $ oc exec -it test-pod-b -n project-b -- ping 10.132.0.44 |
There was a problem hiding this comment.
Suggested change
| $ oc exec -it test-pod-b -n project-b -- ping 10.132.0.44 | |
| $ oc exec -it test-pod-b -n project-b -- ping -c 2 10.132.0.44 |
You could just say send 2 ICMP packets
asood-rh
reviewed
Jun 17, 2025
| + | ||
| [source,terminal] | ||
| ---- | ||
| $ oc exec -it busybox-pod-a -n project-a -- ping 10.132.0.40 |
There was a problem hiding this comment.
Suggested change
| $ oc exec -it busybox-pod-a -n project-a -- ping 10.132.0.40 | |
| $ oc exec -it busybox-pod-a -n project-a -- ping -c 2 10.132.0.40 |
This would ensure user does not have to issue Ctl C to stop sending ICMP packets
asood-rh
reviewed
Jun 17, 2025
|
|
||
| .Prerequisites | ||
|
|
||
| * You have created the `deny-by-default` network policy and applied it to the necessary namespaces. |
There was a problem hiding this comment.
Suggested change
| * You have created the `deny-by-default` network policy and applied it to the necessary namespaces. | |
| * You have created the `deny-by-default` network policy and applied it to the necessary namespaces. The policy denies ingress traffic to pods in the project. |
asood-rh
reviewed
Jun 17, 2025
|
|
||
| .Prerequisites | ||
|
|
||
| * Your cluster uses a network plugin that supports `NetworkPolicy` objects, such as the OVN-Kubernetes network plugin, with `mode: NetworkPolicy` set. |
There was a problem hiding this comment.
Suggested change
| * Your cluster uses a network plugin that supports `NetworkPolicy` objects, such as the OVN-Kubernetes network plugin, with `mode: NetworkPolicy` set. | |
| * Your cluster uses a network plugin that supports `NetworkPolicy` objects, such as the OVN-Kubernetes network plugin, with `mode: NetworkPolicy` set. |
We do not have such a mode in OVNK clusters.
asood-rh
reviewed
Jun 17, 2025
| [id="nw-networkpolicy-allow-ingress_{context}"] | ||
| = Creating an allow ingress access network policy | ||
|
|
||
| With the `deny-by-default` network policy in place, no pods can talk to each other or receive traffic from external sources. One option to enable communication is to allow some pods to receive traffic. To do so, you can create the following `ingress-access` network policy. With this network policy, pods with the `networking/allow-ingress-access=true` label can receive network traffic. |
There was a problem hiding this comment.
Suggested change
| With the `deny-by-default` network policy in place, no pods can talk to each other or receive traffic from external sources. One option to enable communication is to allow some pods to receive traffic. To do so, you can create the following `ingress-access` network policy. With this network policy, pods with the `networking/allow-ingress-access=true` label can receive network traffic. | |
| With the `deny-by-default` network policy, that denies both ingress and egress traffic, in place, no pods can talk to each other or receive traffic from external sources. One option to enable communication is to allow some pods to receive traffic. To do so, you can create the following `ingress-access` network policy. With this network policy, pods with the `networking/allow-ingress-access=true` label can receive network traffic. |
There was a problem hiding this comment.
@stevsmit If it is both ingress or egress pod traffic, it has to be default deny ingress and egress.
If it is about ingress then it should just refer to incoming traffic.
asood-rh
reviewed
Jun 17, 2025
|
|
||
| :_mod-docs-content-type: PROCEDURE | ||
| [id="nw-networkpolicy-configuring-internet-egress-pods_{context}"] | ||
| = Configuring internet egress for pods |
There was a problem hiding this comment.
Suggested change
| = Configuring internet egress for pods | |
| = Configuring external egress for pods |
asood-rh
reviewed
Jun 17, 2025
|
|
||
| [WARNING] | ||
| ==== | ||
| Without configuring a `NetworkPolicy` custom resource (CR) that allows traffic communication, the following policy might cause communication problems across your cluster. |
There was a problem hiding this comment.
Suggested change
| Without configuring a `NetworkPolicy` custom resource (CR) that allows traffic communication, the following policy might cause communication problems across your cluster. | |
| Without configuring a `NetworkPolicy` that allows traffic communication, the following policy might cause communication problems across your cluster. |
(B)ANP would be custom resouce, network policy is API.
asood-rh
reviewed
Jun 17, 2025
| + | ||
| [source,terminal] | ||
| ---- | ||
| $ oc apply -f allow-ingress-tp-new.yaml -n project-a |
There was a problem hiding this comment.
Suggested change
| $ oc apply -f allow-ingress-tp-new.yaml -n project-a | |
| $ oc apply -f allow-ingress-to-new.yaml -n project-a |
asood-rh
reviewed
Jun 17, 2025
| + | ||
| [source,terminal] | ||
| ---- | ||
| $ oc apply -f allow-ingress-tp-new.yaml -n project-c |
There was a problem hiding this comment.
Suggested change
| $ oc apply -f allow-ingress-tp-new.yaml -n project-c | |
| $ oc apply -f allow-ingress-to-new.yaml -n project-c |
asood-rh
reviewed
Jun 17, 2025
| - podSelector: | ||
| matchLabels: | ||
| networking/allow-all-connections: "true" | ||
| ---- |
There was a problem hiding this comment.
If the intent is to allow the ingress from new project-c then the policy needs to be as below in project-a
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-ingress-from-new
spec:
ingress:
- from:
- namespaceSelector: {}
podSelector:
matchLabels:
networking/allow-all-connections: "true"
podSelector: {}
policyTypes:
- Ingress
asood-rh
reviewed
Jun 17, 2025
| ingress: | ||
| - from: | ||
| - podSelector: {} | ||
| ---- |
There was a problem hiding this comment.
Same as above for cross project ingress traffic
asood-rh
reviewed
Jun 17, 2025
| [id="nw-networkpolicy-configuring-internet-egress-pods_{context}"] | ||
| = Configuring internet egress for pods | ||
|
|
||
| With the deny all egress network policy created in a namespace, pods within that namespace are made incapable of reaching _out_ to the internet. In most cases, at least some pods within a namespace need to reach external traffic. |
There was a problem hiding this comment.
Suggested change
| With the deny all egress network policy created in a namespace, pods within that namespace are made incapable of reaching _out_ to the internet. In most cases, at least some pods within a namespace need to reach external traffic. | |
| With the deny all egress network policy created in a namespace, pods within that namespace are made incapable of reaching _out_ to the internet. In most cases, at least some pods within a namespace need to reach external destinations. |
asood-rh
reviewed
Jun 17, 2025
| $ oc apply -f internet-egress.yaml -n project-a | ||
| ---- | ||
|
|
||
| . Apply the network policy to the `project-b` namespace by entering the following command: |
There was a problem hiding this comment.
Do not need to add policy in project-b when demonstrating egress to external destination. Makes sense if egress to another namespace needs to be demonstrated
asood-rh
reviewed
Jun 17, 2025
| + | ||
| [source,terminal] | ||
| ---- | ||
| $ oc exec -it <pod_name> -n project-a -- nslookup google.com |
There was a problem hiding this comment.
Suggested change
| $ oc exec -it <pod_name> -n project-a -- nslookup google.com | |
| $ oc exec -it busybox-pod-a -n project-a -- nslookup google.com |
As the pod was labelled in previous step.
$ oc exec -it test-pod-a -n project-a -- nslookup google.com can be used to demonstrate egress traffic does not work if the pod does not have a required label.
asood-rh
reviewed
Jun 18, 2025
|
|
||
| [WARNING] | ||
| ==== | ||
| Without configuring a `NetworkPolicy` custom resource (CR) that allows traffic communication, the following policy might cause communication problems across your cluster. |
There was a problem hiding this comment.
Suggested change
| Without configuring a `NetworkPolicy` custom resource (CR) that allows traffic communication, the following policy might cause communication problems across your cluster. | |
| Without configuring a `NetworkPolicy` that allows traffic communication, the following policy might cause communication problems across your cluster. |
asood-rh
reviewed
Jun 18, 2025
|
|
||
| .Prerequisites | ||
|
|
||
| * Your cluster uses a network plugin that supports `NetworkPolicy` objects, such as the OVN-Kubernetes network plugin, with `mode: NetworkPolicy` set. |
There was a problem hiding this comment.
Suggested change
| * Your cluster uses a network plugin that supports `NetworkPolicy` objects, such as the OVN-Kubernetes network plugin, with `mode: NetworkPolicy` set. | |
| * Your cluster uses a network plugin that supports `NetworkPolicy` objects, such as the OVN-Kubernetes network plugin. |
The plugin is deprecated so should not mention it in latest documentation. The OVN-Kubernetes plugin does not have the mentioned mode.
asood-rh
reviewed
Jun 18, 2025
| ;; connection timed out; no servers could be reached | ||
| ---- | ||
|
|
||
| . Test ingress connection between pods in the `project-a` and `project-b` namespaces by entering the following command. Because the `default-deny-all-egress` network policy breaks pod-to-pod communication for ingress, pods should not longer be able to communicate. |
There was a problem hiding this comment.
Suggested change
| . Test ingress connection between pods in the `project-a` and `project-b` namespaces by entering the following command. Because the `default-deny-all-egress` network policy breaks pod-to-pod communication for ingress, pods should not longer be able to communicate. | |
| . Test ingress connection between pods in the `project-a` and `project-b` namespaces by entering the following command. Because the `default-deny-all-egress` network policy breaks pod-to-pod communication for egress, pods should not longer be able to communicate. |
asood-rh
reviewed
Jun 18, 2025
|
|
||
| .Prerequisites | ||
|
|
||
| * Your cluster uses a network plugin that supports `NetworkPolicy` objects, such as the OVN-Kubernetes network plugin, with `mode: NetworkPolicy` set. |
There was a problem hiding this comment.
Suggested change
| * Your cluster uses a network plugin that supports `NetworkPolicy` objects, such as the OVN-Kubernetes network plugin, with `mode: NetworkPolicy` set. | |
| * Your cluster uses a network plugin that supports `NetworkPolicy` objects, such as the OVN-Kubernetes network plugin. |
asood-rh
reviewed
Jun 18, 2025
| [id="nw-networkpolicy-same-namespace-communication_{context}"] | ||
| = Creating a network policy for same namespace communication | ||
|
|
||
| With the `deny-by-default` network policy in place, a second option to enable communication is to create a network policy that allows for same namespace communication using the following `allow-same-namespace` network policy. |
There was a problem hiding this comment.
Suggested change
| With the `deny-by-default` network policy in place, a second option to enable communication is to create a network policy that allows for same namespace communication using the following `allow-same-namespace` network policy. | |
| With the `deny-by-default` network policy in place, a second option to enable pod to pod communication within namespace is to create a network policy that allows for same namespace communication using the following `allow-same-namespace` network policy. |
asood-rh
reviewed
Jun 18, 2025
| + | ||
| [source,terminal] | ||
| ---- | ||
| $ oc label namespace project-a networking/namespace=n1 --overwrite |
There was a problem hiding this comment.
Suggested change
| $ oc label namespace project-a networking/namespace=n1 --overwrite | |
| $ oc label namespace project-a networking/namespace=n1 |
--overwrite is not needed as the label does not exist on the namespace
asood-rh
reviewed
Jun 18, 2025
| + | ||
| [source,terminal] | ||
| ---- | ||
| $ oc label namespace project-b networking/namespace=n2 --overwrite |
There was a problem hiding this comment.
Suggested change
| $ oc label namespace project-b networking/namespace=n2 --overwrite | |
| $ oc label namespace project-b networking/namespace=n2 |
asood-rh
reviewed
Jun 18, 2025
| + | ||
| [source,terminal] | ||
| ---- | ||
| $ oc label pod busybox-pod-a app=send-data -n project-a |
There was a problem hiding this comment.
Suggested change
| $ oc label pod busybox-pod-a app=send-data -n project-a | |
| $ oc label pod busybox-pod-a app=send-data -n project-a --overwrite |
asood-rh
reviewed
Jun 18, 2025
| [id="nw-networkpolicy-enable-pod-pod-communication-egress_{context}"] | ||
| = Enabling pod-to-pod communication | ||
|
|
||
| After creating a `default-deny-all` network policy that isolates pods for egress, pod-to-pod communication is broken for ingress. To re-establish ingress communication for pods, you must create a complementary egress network policy that _mirrors_ the network policy that allowed for ingress pod-to-pod communication across namespaces. |
There was a problem hiding this comment.
Suggested change
| After creating a `default-deny-all` network policy that isolates pods for egress, pod-to-pod communication is broken for ingress. To re-establish ingress communication for pods, you must create a complementary egress network policy that _mirrors_ the network policy that allowed for ingress pod-to-pod communication across namespaces. | |
| After creating a egress `default-deny-all` network policy that isolates pods for egress, pod-to-pod communication is broken for ingress in the other namespace. To re-establish ingress communication for pods, you must create a complementary egress network policy that _mirrors_ the network policy that allowed for ingress pod-to-pod communication across namespaces. |
asood-rh
reviewed
Jun 18, 2025
| - from: | ||
| - namespaceSelector: | ||
| matchLabels: | ||
| networking/namespace: |
There was a problem hiding this comment.
Suggested change
| networking/namespace: | |
| networking/namespace: n1 |
asood-rh
reviewed
Jun 18, 2025
|
|
||
| .Prerequisites | ||
|
|
||
| * You have created the following `allow-n1-a-to-n2-b` ingress network policy: |
There was a problem hiding this comment.
Suggested change
| * You have created the following `allow-n1-a-to-n2-b` ingress network policy: | |
| * You have created the following `allow-n1-a-to-n2-b` ingress network policy in project-b: |
asood-rh
reviewed
Jun 18, 2025
| apiVersion: networking.k8s.io/v1 | ||
| kind: NetworkPolicy | ||
| metadata: | ||
| name: allow-n1-a-to-n2-b-egress |
There was a problem hiding this comment.
Suggested change
| name: allow-n1-a-to-n2-b-egress | |
| name: egress-allow-n1-a-to-n2-b |
asood-rh
reviewed
Jun 18, 2025
| + | ||
| [source,terminal] | ||
| ---- | ||
| $ oc apply -f allow-n1-a-to-n2-b-egress.yaml -n project-a |
There was a problem hiding this comment.
Suggested change
| $ oc apply -f allow-n1-a-to-n2-b-egress.yaml -n project-a | |
| $ oc apply -f egress-allow-n1-a-to-n2-b.yaml -n project-a |
asood-rh
reviewed
Jun 18, 2025
| + | ||
| [source,terminal] | ||
| ---- | ||
| $ oc get pod -n project-a -o wide |
There was a problem hiding this comment.
Suggested change
| $ oc get pod -n project-a -o wide | |
| $ oc get pod -n project-b -o wide |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Version(s):
Issue:
https://issues.redhat.com/browse/OCPBUGS-54674
Link to docs preview:
https://92159--ocpdocs-pr.netlify.app/openshift-enterprise/latest/networking/network_security/network_policy/nw-networkpolicy-full-multitenant-isolation
QE review:
Additional information: