Chapter 6. Network Policy
As a user with the admin role, you can create a network policy for the netobserv namespace.
6.1. Creating a network policy for Network Observability
You might need to create a network policy to secure ingress traffic to the netobserv namespace. In the web console, you can create a network policy using the form view.
Procedure
-
Navigate to Networking
NetworkPolicies. -
Select the
netobservproject from the Project dropdown menu. -
Name the policy. For this example, the policy name is
allow-ingress. - Click Add ingress rule three times to create three ingress rules.
Specify the following in the form:
Make the following specifications for the first Ingress rule:
- From the Add allowed source dropdown menu, select Allow pods from the same namespace.
Make the following specifications for the second Ingress rule:
- From the Add allowed source dropdown menu, select Allow pods from inside the cluster.
- Click + Add namespace selector.
-
Add the label,
kubernetes.io/metadata.name, and the selector,openshift-console.
Make the following specifications for the third Ingress rule:
- From the Add allowed source dropdown menu, select Allow pods from inside the cluster.
- Click + Add namespace selector.
-
Add the label,
kubernetes.io/metadata.name, and the selector,openshift-monitoring.
Verification
-
Navigate to Observe
Network Traffic. - View the Traffic Flows tab, or any tab, to verify that the data is displayed.
-
Navigate to Observe
Dashboards. In the NetObserv/Health selection, verify that the flows are being ingested and sent to Loki, which is represented in the first graph.
6.2. Example network policy
The following annotates an example NetworkPolicy object for the netobserv namespace:
Sample network policy
kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
name: allow-ingress
namespace: netobserv
spec:
podSelector: {} 1
ingress:
- from:
- podSelector: {} 2
namespaceSelector: 3
matchLabels:
kubernetes.io/metadata.name: openshift-console
- podSelector: {}
namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: openshift-monitoring
policyTypes:
- Ingress
status: {}
- 1
- A selector that describes the pods to which the policy applies. The policy object can only select pods in the project that defines the
NetworkPolicyobject. In this documentation, it would be the project in which the Network Observability Operator is installed, which is thenetobservproject. - 2
- A selector that matches the pods from which the policy object allows ingress traffic. The default is that the selector matches pods in the same namespace as the
NetworkPolicy. - 3
- When the
namespaceSelectoris specified, the selector matches pods in the specified namespace.
Additional resources
