Chapter 3. Network policy

Procedure

1. Create a policy rule:

   1. Create a <policy_name>.yaml file:

      $ touch <policy_name>.yaml

      Copy to Clipboard Toggle word wrap

      where:

      <policy_name>

      Specifies the network policy file name.

   2. Define a network policy in the file that you just created, such as in the following examples:

      Deny ingress from all pods in all namespaces

      This is a fundamental policy, blocking all cross-pod networking other than cross-pod traffic allowed by the configuration of other Network Policies.

      kind: NetworkPolicy
      apiVersion: networking.k8s.io/v1
      metadata:
        name: deny-by-default
      spec:
        podSelector: {}
        policyTypes:
        - Ingress
        ingress: []

      Copy to Clipboard Toggle word wrap

      Allow ingress from all pods in the same namespace

      kind: NetworkPolicy
      apiVersion: networking.k8s.io/v1
      metadata:
        name: allow-same-namespace
      spec:
        podSelector:
        ingress:
        - from:
          - podSelector: {}

      Copy to Clipboard Toggle word wrap

      Allow ingress traffic to one pod from a particular namespace

      This policy allows traffic to pods that have the pod-a label from pods running in namespace-y.

      kind: NetworkPolicy
      apiVersion: networking.k8s.io/v1
      metadata:
        name: allow-traffic-pod
      spec:
        podSelector:
         matchLabels:
            pod: pod-a
        policyTypes:
        - Ingress
        ingress:
        - from:
          - namespaceSelector:
              matchLabels:
                 kubernetes.io/metadata.name: namespace-y

      Copy to Clipboard Toggle word wrap

2. To create the network policy object, enter the following command. Successful output lists the name of the policy object and the created status.

   $ oc apply -f <policy_name>.yaml -n <namespace>

   Copy to Clipboard Toggle word wrap

   where:

   <policy_name>

   Specifies the network policy file name.

   <namespace>

   Optional parameter. If you defined the object in a different namespace than the current namespace, the parameter specifices the namespace.

   Successful output lists the name of the policy object and the created status.

Procedure

1. Create the following YAML that defines a deny-by-default policy to deny ingress from all pods in all namespaces. Save the YAML in the deny-by-default.yaml file:

   kind: NetworkPolicy
   apiVersion: networking.k8s.io/v1
   metadata:
     name: deny-by-default
     namespace: my-project 

   1

   
   spec:
     podSelector: {} 

   2

   
     ingress: [] 

   3

   Copy to Clipboard Toggle word wrap

   1

   Specifies the namespace in which to deploy the policy. For example, the `my-project namespace.

   2

   If this field is empty, the configuration matches all the pods. Therefore, the policy applies to all pods in the my-project namespace.

   3

   There are no ingress rules specified. This causes incoming traffic to be dropped to all pods.

2. Apply the policy by entering the following command. Successful output lists the name of the policy object and the created status.

   $ oc apply -f deny-by-default.yaml

   Copy to Clipboard Toggle word wrap

   Successful output lists the name of the policy object and the created status.

Procedure

1. Create a policy that allows traffic from the public Internet directly or by using a load balancer to access the pod. Save the YAML in the web-allow-external.yaml file:

   kind: NetworkPolicy
   apiVersion: networking.k8s.io/v1
   metadata:
     name: web-allow-external
     namespace: default
   spec:
     policyTypes:
     - Ingress
     podSelector:
       matchLabels:
         app: web
     ingress:
       - {}

   Copy to Clipboard Toggle word wrap

2. Apply the policy by entering the following command. Successful output lists the name of the policy object and the created status.

   $ oc apply -f web-allow-external.yaml

   Copy to Clipboard Toggle word wrap

   Successful output lists the name of the policy object and the created status. This policy allows traffic from all resources, including external traffic as illustrated in the following diagram:

Procedure

1. Create a policy that allows traffic from all pods in all namespaces to a particular application. Save the YAML in the web-allow-all-namespaces.yaml file:

   kind: NetworkPolicy
   apiVersion: networking.k8s.io/v1
   metadata:
     name: web-allow-all-namespaces
     namespace: default
   spec:
     podSelector:
       matchLabels:
         app: web 

   1

   
     policyTypes:
     - Ingress
     ingress:
     - from:
       - namespaceSelector: {} 

   2

   Copy to Clipboard Toggle word wrap

   1

   Applies the policy only to app:web pods in default namespace.

   2

   Selects all pods in all namespaces.

   Note

   By default, if you do not specify a namespaceSelector parameter in the policy object, no namespaces get selected. This means the policy allows traffic only from the namespace where the network policy deployes.

2. Apply the policy by entering the following command. Successful output lists the name of the policy object and the created status.

   $ oc apply -f web-allow-all-namespaces.yaml

   Copy to Clipboard Toggle word wrap

   Successful output lists the name of the policy object and the created status.

Verification

1. Start a web service in the default namespace by entering the following command:

   $ oc run web --namespace=default --image=nginx --labels="app=web" --expose --port=80

   Copy to Clipboard Toggle word wrap

2. Run the following command to deploy an alpine image in the secondary namespace and to start a shell:

   $ oc run test-$RANDOM --namespace=secondary --rm -i -t --image=alpine -- sh

   Copy to Clipboard Toggle word wrap

3. Run the following command in the shell and observe that the service allows the request:

   # wget -qO- --timeout=2 http://web.default

   Copy to Clipboard Toggle word wrap

   Expected output

   <!DOCTYPE html>
   <html>
   <head>
   <title>Welcome to nginx!</title>
   <style>
   html { color-scheme: light dark; }
   body { width: 35em; margin: 0 auto;
   font-family: Tahoma, Verdana, Arial, sans-serif; }
   </style>
   </head>
   <body>
   <h1>Welcome to nginx!</h1>
   <p>If you see this page, the nginx web server is successfully installed and
   working. Further configuration is required.</p>
   
   <p>For online documentation and support please refer to
   <a href="http://nginx.org/">nginx.org</a>.<br/>
   Commercial support is available at
   <a href="http://nginx.com/">nginx.com</a>.</p>
   
   <p><em>Thank you for using nginx.</em></p>
   </body>
   </html>

   Copy to Clipboard Toggle word wrap

Procedure

1. Create a policy that allows traffic from all pods in a particular namespaces with a label purpose=production. Save the YAML in the web-allow-prod.yaml file:

   kind: NetworkPolicy
   apiVersion: networking.k8s.io/v1
   metadata:
     name: web-allow-prod
     namespace: default
   spec:
     podSelector:
       matchLabels:
         app: web 

   1

   
     policyTypes:
     - Ingress
     ingress:
     - from:
       - namespaceSelector:
           matchLabels:
             purpose: production 

   2

   Copy to Clipboard Toggle word wrap

   1

   Applies the policy only to app:web pods in the default namespace.

   2

   Restricts traffic to only pods in namespaces that have the label purpose=production.

2. Apply the policy by entering the following command. Successful output lists the name of the policy object and the created status.

   $ oc apply -f web-allow-prod.yaml

   Copy to Clipboard Toggle word wrap

   Successful output lists the name of the policy object and the created status.

Verification

1. Start a web service in the default namespace by entering the following command:

   $ oc run web --namespace=default --image=nginx --labels="app=web" --expose --port=80

   Copy to Clipboard Toggle word wrap

2. Run the following command to create the prod namespace:

   $ oc create namespace prod

   Copy to Clipboard Toggle word wrap

3. Run the following command to label the prod namespace:

   $ oc label namespace/prod purpose=production

   Copy to Clipboard Toggle word wrap

4. Run the following command to create the dev namespace:

   $ oc create namespace dev

   Copy to Clipboard Toggle word wrap

5. Run the following command to label the dev namespace:

   $ oc label namespace/dev purpose=testing

   Copy to Clipboard Toggle word wrap

6. Run the following command to deploy an alpine image in the dev namespace and to start a shell:

   $ oc run test-$RANDOM --namespace=dev --rm -i -t --image=alpine -- sh

   Copy to Clipboard Toggle word wrap

7. Run the following command in the shell and observe the reason for the blocked request. For example, expected output states wget: download timed out.

   # wget -qO- --timeout=2 http://web.default

   Copy to Clipboard Toggle word wrap

8. Run the following command to deploy an alpine image in the prod namespace and start a shell:

   $ oc run test-$RANDOM --namespace=prod --rm -i -t --image=alpine -- sh

   Copy to Clipboard Toggle word wrap

9. Run the following command in the shell and observe that the request is allowed:

   # wget -qO- --timeout=2 http://web.default

   Copy to Clipboard Toggle word wrap

   Expected output

   <!DOCTYPE html>
   <html>
   <head>
   <title>Welcome to nginx!</title>
   <style>
   html { color-scheme: light dark; }
   body { width: 35em; margin: 0 auto;
   font-family: Tahoma, Verdana, Arial, sans-serif; }
   </style>
   </head>
   <body>
   <h1>Welcome to nginx!</h1>
   <p>If you see this page, the nginx web server is successfully installed and
   working. Further configuration is required.</p>
   
   <p>For online documentation and support please refer to
   <a href="http://nginx.org/">nginx.org</a>.<br/>
   Commercial support is available at
   <a href="http://nginx.com/">nginx.com</a>.</p>
   
   <p><em>Thank you for using nginx.</em></p>
   </body>
   </html>

   Copy to Clipboard Toggle word wrap

Procedure

1. Optional: To list the network policy objects in a namespace, enter the following command:

   $ oc get networkpolicy

   Copy to Clipboard Toggle word wrap

   where:

   <namespace>

   Optional: Specifies the namespace if the object is defined in a different namespace than the current namespace.

2. Edit the network policy object.

   • If you saved the network policy definition in a file, edit the file and make any necessary changes, and then enter the following command.

     $ oc apply -n <namespace> -f <policy_file>.yaml

     Copy to Clipboard Toggle word wrap

     where:

     <namespace>

     Optional: Specifies the namespace if the object is defined in a different namespace than the current namespace.

     <policy_file>

     Specifies the name of the file containing the network policy.

   • If you need to update the network policy object directly, enter the following command:

     $ oc edit networkpolicy <policy_name> -n <namespace>

     Copy to Clipboard Toggle word wrap

     where:

     <policy_name>

     Specifies the name of the network policy.

     <namespace>

     Optional: Specifies the namespace if the object is defined in a different namespace than the current namespace.

3. Confirm that the network policy object is updated.

   $ oc describe networkpolicy <policy_name> -n <namespace>

   Copy to Clipboard Toggle word wrap

   where:

   <policy_name>

   Specifies the name of the network policy.

   <namespace>

   Optional: Specifies the namespace if the object is defined in a different namespace than the current namespace.