Adds egress netpol docs #92159
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
| @@ -0,0 +1,107 @@ | ||||||
| // Module included in the following assemblies: | ||||||
| // | ||||||
| // * networking/network_security/network_policy/nw-networkpolicy-full-multitenant-isolation.adoc | ||||||
|
|
||||||
| :_mod-docs-content-type: PROCEDURE | ||||||
| [id="nw-networkpolicy-allow-ingress_{context}"] | ||||||
| = Creating an allow ingress access network policy | ||||||
|
|
||||||
| With the `deny-by-default` network policy in place, no pods can talk to each other or receive traffic from external sources. One option to enable communication is to allow some pods to receive traffic. To do so, you can create the following `ingress-access` network policy. With this network policy, pods with the `networking/allow-ingress-access=true` label can receive network traffic. | ||||||
|
|
||||||
| .Prerequisites | ||||||
|
|
||||||
| * You have created the `deny-by-default` network policy and applied it to the necessary namespaces. | ||||||
|
There was a problem hiding this comment.
Suggested change
|
||||||
|
|
||||||
| .Procedure | ||||||
|
|
||||||
| . Create the following `ingress-access` network policy to allow pods with the `networking/allow-ingress-access` label to receive traffic from outside sources. Save the YAML in the `ingress-access.yaml` file: | ||||||
| + | ||||||
| [source,yaml] | ||||||
| ---- | ||||||
| apiVersion: networking.k8s.io/v1 | ||||||
| kind: NetworkPolicy | ||||||
| metadata: | ||||||
| name: ingress-access | ||||||
| spec: | ||||||
| podSelector: | ||||||
| matchLabels: | ||||||
| networking/allow-ingress-access: "true" <1> | ||||||
| policyTypes: | ||||||
| - Ingress | ||||||
| ingress: | ||||||
| - {} | ||||||
| ---- | ||||||
| <1> Apply this label to pods to enable the pod to receive traffic from outside sources. | ||||||
|
There was a problem hiding this comment.
Suggested change
|
||||||
|
|
||||||
| . Apply the network policy to the `project-a` namespace by entering the following command: | ||||||
| + | ||||||
| [source,terminal] | ||||||
| ---- | ||||||
| $ oc apply -f ingress-access.yaml -n project-a | ||||||
| ---- | ||||||
|
|
||||||
| . Apply the network policy to the `project-b` namespace by entering the following command: | ||||||
| + | ||||||
| [source,terminal] | ||||||
| ---- | ||||||
| $ oc apply -f ingress-access.yaml -n project-b | ||||||
| ---- | ||||||
|
|
||||||
| . Apply the `networking/allow-ingress-access=true` label to pods that must receive outside traffic by entering the following command: | ||||||
| + | ||||||
| [source,terminal] | ||||||
| ---- | ||||||
| $ oc label pod busybox-pod-a networking/allow-ingress-access=true -n project-a | ||||||
| ---- | ||||||
| + | ||||||
| Repeat this step for all pods that must receive outside traffic. | ||||||
|
|
||||||
| .Verification | ||||||
|
|
||||||
| . Obtain the IP addresses of pods in `project-a` by running the following command: | ||||||
| + | ||||||
| [source,terminal] | ||||||
| ---- | ||||||
| $ oc get pod -n project-a -o wide | ||||||
| ---- | ||||||
| + | ||||||
| .Example output | ||||||
| + | ||||||
| [source,terminal] | ||||||
| ---- | ||||||
| NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES | ||||||
| busybox-pod-a 1/1 Running 0 13m 10.132.0.38 ip-10-0-132-187.ec2.internal <none> <none> | ||||||
| test-pod-a 1/1 Running 0 13m 10.132.0.40 ip-10-0-132-187.ec2.internal <none> <none> | ||||||
| ---- | ||||||
|
|
||||||
| . Ensure that pods with the `networking/allow-ingress-access=true` label can receive traffic by entering the following command. If you followed these instructions, the `busybox-pod-a` pod in `project-a` can receive traffic from another pod. For example: | ||||||
| + | ||||||
| [source,terminal] | ||||||
| ---- | ||||||
| $ oc exec -it test-pod-b -n project-b -- ping 10.132.0.44 | ||||||
|
There was a problem hiding this comment.
Suggested change
You could just say send 2 ICMP packets |
||||||
| ---- | ||||||
| + | ||||||
| .Example output | ||||||
| + | ||||||
| [source,terminal] | ||||||
| ---- | ||||||
| PING 10.132.0.44 (10.132.0.44): 56 data bytes | ||||||
| 64 bytes from 10.132.0.44: seq=0 ttl=42 time=1.137 ms | ||||||
| 64 bytes from 10.132.0.44: seq=1 ttl=42 time=0.672 ms | ||||||
| ---- | ||||||
|
|
||||||
| . Ensure that pods without the `networking/allow-ingress-access=true` label cannot receive traffic by entering the following command. If you followed these instructions, the `test-pod-a` pod in `project-a` cannot receive traffic. For example: | ||||||
| + | ||||||
| [source,terminal] | ||||||
| ---- | ||||||
| $ oc exec -it busybox-pod-a -n project-a -- ping 10.132.0.40 | ||||||
|
There was a problem hiding this comment.
Suggested change
This would ensure user does not have to issue Ctl C to stop sending ICMP packets |
||||||
| ---- | ||||||
| + | ||||||
| .Example output | ||||||
| + | ||||||
| [source,terminal] | ||||||
| ---- | ||||||
| PING 10.132.0.40 (10.132.0.40): 56 data bytes | ||||||
| --- 10.132.0.40 ping statistics --- | ||||||
| 3 packets transmitted, 0 packets received, 100% packet loss | ||||||
| ---- | ||||||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
| @@ -0,0 +1,171 @@ | ||||||
| // Module included in the following assemblies: | ||||||
| // | ||||||
| // * networking/network_security/network_policy/nw-networkpolicy-full-multitenant-isolation.adoc | ||||||
|
|
||||||
| :_mod-docs-content-type: REFERENCE | ||||||
| [id="nw-networkpolicy-ingress-new-deployments_{context}"] | ||||||
| = Creating a network policy for new projects | ||||||
|
|
||||||
| After you have created a network policy that defines specific connections, new pods within a project are unable to communicate with existing pods in the same project, until the proper network policy has been applied to that pod. To address this behavior, you can create the following `allow-ingress-from-new` and `allow-ingress-to-new` network policies in a project, which allows new pods with the `networking/allow-all-connections=true` label to communicate with existing pods until more granular policies are created. | ||||||
|
|
||||||
| .Prerequisites | ||||||
|
|
||||||
| * You have created the `deny-by-default` network policy and applied it to a project. | ||||||
|
|
||||||
| .Procedure | ||||||
|
|
||||||
| . Create a new project, for example, `project-c`, by running the following command: | ||||||
| + | ||||||
| [source,terminal] | ||||||
| ---- | ||||||
| $ oc new-project project-c | ||||||
| ---- | ||||||
|
|
||||||
| . In the `project-c` namespace, create a new pod by running the following command: | ||||||
| + | ||||||
| [source,terminal] | ||||||
| ---- | ||||||
| $ cat <<EOF | oc apply -f - -n project-c | ||||||
| apiVersion: v1 | ||||||
| kind: Pod | ||||||
| metadata: | ||||||
| name: busybox-pod | ||||||
| labels: | ||||||
| app: busybox | ||||||
| spec: | ||||||
| containers: | ||||||
| - name: busybox | ||||||
| image: alpine:latest | ||||||
| command: [ "sleep", "3600" ] | ||||||
| securityContext: | ||||||
| runAsNonRoot: true | ||||||
| allowPrivilegeEscalation: false | ||||||
| capabilities: | ||||||
| drop: | ||||||
| - "ALL" | ||||||
| seccompProfile: | ||||||
| type: "RuntimeDefault" | ||||||
| EOF | ||||||
| ---- | ||||||
|
|
||||||
| . In the `project-a` namespace: | ||||||
|
|
||||||
| .. Create the following `allow-ingress-from-new` network policy, which allows pods in this project the ability to receive ingress from a new project: | ||||||
| + | ||||||
| [source,yaml] | ||||||
| ---- | ||||||
| apiVersion: networking.k8s.io/v1 | ||||||
| kind: NetworkPolicy | ||||||
| metadata: | ||||||
| name: allow-ingress-from-new | ||||||
| spec: | ||||||
| podSelector: {} | ||||||
| policyTypes: | ||||||
| - Ingress | ||||||
| ingress: | ||||||
| - from: | ||||||
| - podSelector: | ||||||
| matchLabels: | ||||||
| networking/allow-all-connections: "true" | ||||||
| ---- | ||||||
|
There was a problem hiding this comment. If the intent is to allow the ingress from new project-c then the policy needs to be as below in project-a apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-ingress-from-new
spec:
ingress:
- from:
- namespaceSelector: {}
podSelector:
matchLabels:
networking/allow-all-connections: "true"
podSelector: {}
policyTypes:
- Ingress
|
||||||
|
|
||||||
| .. Apply the network policy by entering the following command: | ||||||
| + | ||||||
| [source,terminal] | ||||||
| ---- | ||||||
| $ oc apply -f allow-ingress-from-new.yaml -n project-a | ||||||
| ---- | ||||||
|
|
||||||
| .. Create the following `allow-ingress-to-new` network policy, which allows pods in this project the ability to send ingress to a new project: | ||||||
| + | ||||||
| [source,yaml] | ||||||
| ---- | ||||||
| apiVersion: networking.k8s.io/v1 | ||||||
| kind: NetworkPolicy | ||||||
| metadata: | ||||||
| name: allow-ingress-to-new | ||||||
| spec: | ||||||
| podSelector: | ||||||
| matchLabels: | ||||||
| networking/allow-all-connections: "true" | ||||||
| policyTypes: | ||||||
| - Ingress | ||||||
| ingress: | ||||||
| - from: | ||||||
| - podSelector: {} | ||||||
| ---- | ||||||
|
There was a problem hiding this comment. Same as above for cross project ingress traffic |
||||||
|
|
||||||
| .. Apply the network policy by entering the following command: | ||||||
| + | ||||||
| [source,terminal] | ||||||
| ---- | ||||||
| $ oc apply -f allow-ingress-tp-new.yaml -n project-a | ||||||
|
There was a problem hiding this comment.
Suggested change
|
||||||
| ---- | ||||||
|
|
||||||
| .. Apply the `networking/allow-all-connections=true` to pods in `project-a` that you want to be able to communicate with pods in `project-c` by running the following command: | ||||||
| + | ||||||
| [source,terminal] | ||||||
| ---- | ||||||
| $ oc label pod <pod_name> networking/allow-all-connections=true -n project-a | ||||||
| ---- | ||||||
|
|
||||||
| . In the `project-c` namespace: | ||||||
|
|
||||||
| .. Create the following `allow-ingress-from-new` network policy, which allows pods in this project the ability to receive ingress from a new project: | ||||||
| + | ||||||
| [source,yaml] | ||||||
| ---- | ||||||
| apiVersion: networking.k8s.io/v1 | ||||||
| kind: NetworkPolicy | ||||||
| metadata: | ||||||
| name: allow-ingress-from-new | ||||||
| spec: | ||||||
| podSelector: {} | ||||||
| policyTypes: | ||||||
| - Ingress | ||||||
| ingress: | ||||||
| - from: | ||||||
| - podSelector: | ||||||
| matchLabels: | ||||||
| networking/allow-all-connections: "true" | ||||||
| ---- | ||||||
|
|
||||||
| .. Apply the network policy by entering the following command: | ||||||
| + | ||||||
| [source,terminal] | ||||||
| ---- | ||||||
| $ oc apply -f allow-ingress-from-new.yaml -n project-c | ||||||
| ---- | ||||||
|
|
||||||
| .. Create the following `allow-ingress-to-new` network policy, which allows pods in this project the ability to send ingress to a new project: | ||||||
| + | ||||||
| [source,yaml] | ||||||
| ---- | ||||||
| apiVersion: networking.k8s.io/v1 | ||||||
| kind: NetworkPolicy | ||||||
| metadata: | ||||||
| name: allow-ingress-to-new | ||||||
| spec: | ||||||
| podSelector: | ||||||
| matchLabels: | ||||||
| networking/allow-all-connections: "true" | ||||||
| policyTypes: | ||||||
| - Ingress | ||||||
| ingress: | ||||||
| - from: | ||||||
| - podSelector: {} | ||||||
| ---- | ||||||
|
|
||||||
| .. Apply the network policy by entering the following command: | ||||||
| + | ||||||
| [source,terminal] | ||||||
| ---- | ||||||
| $ oc apply -f allow-ingress-tp-new.yaml -n project-c | ||||||
|
There was a problem hiding this comment.
Suggested change
|
||||||
| ---- | ||||||
|
|
||||||
| .. Apply the `networking/allow-all-connections=true` to pods in `project-c` that you want to be able to communicate with pods in `project-a` by running the following command: | ||||||
| + | ||||||
| [source,terminal] | ||||||
| ---- | ||||||
| $ oc label pod busybox-pod networking/allow-all-connections=true -n project-c | ||||||
| ---- | ||||||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
| @@ -0,0 +1,75 @@ | ||||||
| // Module included in the following assemblies: | ||||||
| // | ||||||
| // * networking/network_security/network_policy/nw-networkpolicy-full-multitenant-isolation.adoc | ||||||
|
|
||||||
| :_mod-docs-content-type: PROCEDURE | ||||||
| [id="nw-networkpolicy-configuring-internet-egress-pods_{context}"] | ||||||
| = Configuring internet egress for pods | ||||||
|
There was a problem hiding this comment.
Suggested change
|
||||||
|
|
||||||
| With the deny all egress network policy created in a namespace, pods within that namespace are made incapable of reaching _out_ to the internet. In most cases, at least some pods within a namespace need to reach external traffic. | ||||||
|
There was a problem hiding this comment.
Suggested change
|
||||||
|
|
||||||
| The following procedure shows you how to designate labels to pods that require internet egress. | ||||||
|
|
||||||
| .Prerequisites | ||||||
|
|
||||||
| * You have created a network policy to deny all egress traffic. | ||||||
|
|
||||||
| .Procedure | ||||||
|
|
||||||
| . Create the following `internet-egress.yaml` file that both defines a network policy that allows traffic from pods with the matching label to access internet egress. For example: | ||||||
| + | ||||||
| [source,yaml] | ||||||
| ---- | ||||||
| apiVersion: networking.k8s.io/v1 | ||||||
| kind: NetworkPolicy | ||||||
| metadata: | ||||||
| name: internet-egress | ||||||
| spec: | ||||||
| podSelector: | ||||||
| matchLabels: | ||||||
| networking/allow-internet-egress: "true" <1> | ||||||
| egress: | ||||||
| - {} | ||||||
| policyTypes: | ||||||
| - Egress | ||||||
| ---- | ||||||
|
|
||||||
| . Apply the network policy to the `project-a` namespace by entering the following command: | ||||||
| + | ||||||
| [source,terminal] | ||||||
| ---- | ||||||
| $ oc apply -f internet-egress.yaml -n project-a | ||||||
| ---- | ||||||
|
|
||||||
| . Apply the network policy to the `project-b` namespace by entering the following command: | ||||||
|
There was a problem hiding this comment. Do not need to add policy in project-b when demonstrating egress to external destination. Makes sense if egress to another namespace needs to be demonstrated |
||||||
| + | ||||||
| [source,terminal] | ||||||
| ---- | ||||||
| $ oc apply -f internet-egress.yaml -n project-b | ||||||
| ---- | ||||||
|
|
||||||
| . Apply the `networking/allow-internet-egress=true` label to pods that require egress by entering the following command: | ||||||
| + | ||||||
| [source,terminal] | ||||||
| ---- | ||||||
| $ oc label pod busybox-pod-a networking/allow-internet-egress=true -n project-a | ||||||
| ---- | ||||||
|
|
||||||
| .Verification | ||||||
|
|
||||||
| * Check whether a labeled pod in a namespace where you applied the `internet-egress.yaml` network policy can resolve a DNS name by entering the following command: | ||||||
| + | ||||||
| [source,terminal] | ||||||
| ---- | ||||||
| $ oc exec -it <pod_name> -n project-a -- nslookup google.com | ||||||
|
There was a problem hiding this comment.
Suggested change
As the pod was labelled in previous step. |
||||||
| ---- | ||||||
| + | ||||||
| .Example output | ||||||
| + | ||||||
| [source,terminal] | ||||||
| ---- | ||||||
| ... | ||||||
| Name: google.com | ||||||
| Address: 142.250.125.102 | ||||||
| ... | ||||||
| ---- | ||||||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@stevsmit If it is both ingress or egress pod traffic, it has to be default deny ingress and egress.
If it is about ingress then it should just refer to incoming traffic.