Chapter 3. Post-installation network configuration

• Deny all traffic:

  To make a project deny by default, add a NetworkPolicy object that matches all pods but accepts no traffic:

  kind: NetworkPolicy
  apiVersion: networking.k8s.io/v1
  metadata:
    name: deny-by-default
  spec:
    podSelector:
    ingress: []

• Only allow connections from the OpenShift Container Platform Ingress Controller:

  To make a project allow only connections from the OpenShift Container Platform Ingress Controller, add the following NetworkPolicy object.

  Important

  For the OVN-Kubernetes network provider plug-in, when the Ingress Controller is configured to use the HostNetwork endpoint publishing strategy, there is no supported way to apply network policy so that ingress traffic is allowed and all other traffic is denied.

  apiVersion: networking.k8s.io/v1
  kind: NetworkPolicy
  metadata:
    name: allow-from-openshift-ingress
  spec:
    ingress:
    - from:
      - namespaceSelector:
          matchLabels:
            network.openshift.io/policy-group: ingress
    podSelector: {}
    policyTypes:
    - Ingress

  If the Ingress Controller is configured with endpointPublishingStrategy: HostNetwork, then the Ingress Controller pod runs on the host network. When running on the host network, the traffic from the Ingress Controller is assigned the netid:0 Virtual Network ID (VNID). The netid for the namespace that is associated with the Ingress Operator is different, so the matchLabel in the allow-from-openshift-ingress network policy does not match traffic from the default Ingress Controller. With OpenShift SDN, the default namespace is assigned the netid:0 VNID and you can allow traffic from the default Ingress Controller by labeling your default namespace with network.openshift.io/policy-group: ingress.

• Only accept connections from pods within a project:

  To make pods accept connections from other pods in the same project, but reject all other connections from pods in other projects, add the following NetworkPolicy object:

  kind: NetworkPolicy
  apiVersion: networking.k8s.io/v1
  metadata:
    name: allow-same-namespace
  spec:
    podSelector:
    ingress:
    - from:
      - podSelector: {}

• Only allow HTTP and HTTPS traffic based on pod labels:

  To enable only HTTP and HTTPS access to the pods with a specific label (role=frontend in following example), add a NetworkPolicy object similar to the following:

  kind: NetworkPolicy
  apiVersion: networking.k8s.io/v1
  metadata:
    name: allow-http-and-https
  spec:
    podSelector:
      matchLabels:
        role: frontend
    ingress:
    - ports:
      - protocol: TCP
        port: 80
      - protocol: TCP
        port: 443

• Accept connections by using both namespace and pod selectors:

  To match network traffic by combining namespace and pod selectors, you can use a NetworkPolicy object similar to the following:

  kind: NetworkPolicy
  apiVersion: networking.k8s.io/v1
  metadata:
    name: allow-pod-and-namespace-both
  spec:
    podSelector:
      matchLabels:
        name: test-pods
    ingress:
      - from:
        - namespaceSelector:
            matchLabels:
              project: project_name
          podSelector:
            matchLabels:
              name: test-pods

Prerequisites

• Your cluster uses a cluster network provider that supports NetworkPolicy objects, such as the OpenShift SDN network provider with mode: NetworkPolicy set. This mode is the default for OpenShift SDN.
• You installed the OpenShift CLI (oc).
• You are logged in to the cluster with a user with admin privileges.
• You are working in the namespace that the network policy applies to.

Prerequisites

• Your cluster uses a cluster network provider that supports NetworkPolicy objects, such as the OpenShift SDN network provider with mode: NetworkPolicy set. This mode is the default for OpenShift SDN.
• You installed the OpenShift CLI (oc).
• You are logged in to the cluster with a user with admin privileges.
• You are working in the namespace where the network policy exists.

Procedure

• To delete a NetworkPolicy object, enter the following command:

  $ oc delete networkpolicy <policy_name> -n <namespace>

  where:

  <policy_name>

  Specifies the name of the network policy.

  <namespace>

  Optional: Specifies the namespace if the object is defined in a different namespace than the current namespace.

  Example output

  networkpolicy.networking.k8s.io/allow-same-namespace deleted

Prerequisites

• You installed the OpenShift CLI (oc).
• You are logged in to the cluster with a user with admin privileges.
• You are working in the namespace where the network policy exists.

Procedure

• List network policies in a namespace:

  • To view NetworkPolicy objects defined in a namespace, enter the following command:

    $ oc get networkpolicy

  • Optional: To examine a specific network policy, enter the following command:

    $ oc describe networkpolicy <policy_name> -n <namespace>

    where:

    <policy_name>

    Specifies the name of the network policy to inspect.

    <namespace>

    Optional: Specifies the namespace if the object is defined in a different namespace than the current namespace.

    For example:

    $ oc describe networkpolicy allow-same-namespace

    Output for oc describe command

    Name:         allow-same-namespace
    Namespace:    ns1
    Created on:   2021-05-24 22:28:56 -0400 EDT
    Labels:       <none>
    Annotations:  <none>
    Spec:
      PodSelector:     <none> (Allowing the specific traffic to all pods in this namespace)
      Allowing ingress traffic:
        To Port: <any> (traffic allowed to all ports)
        From:
          PodSelector: <none>
      Not affecting egress traffic
      Policy Types: Ingress

Prerequisites

• Your cluster uses a cluster network provider that supports NetworkPolicy objects, such as the OpenShift SDN network provider with mode: NetworkPolicy set. This mode is the default for OpenShift SDN.
• You installed the OpenShift CLI (oc).
• You are logged in to the cluster with a user with admin privileges.

• The Kiali observability console is only supported on the two most recent releases of the Chrome, Edge, Firefox, or Safari browsers.

• This release only supports the following Mixer adapter:

  • 3scale Istio Adapter

• Elasticsearch - Based on the open source Elasticsearch project that enables you to configure and manage an Elasticsearch cluster for tracing and logging with Jaeger.
• Jaeger - based on the open source Jaeger project, lets you perform tracing to monitor and troubleshoot transactions in complex distributed systems.
• Kiali - based on the open source Kiali project, provides observability for your service mesh. By using Kiali you can view configurations, monitor traffic, and view and analyze traces in a single console.

• Red Hat OpenShift Service Mesh - based on the open source Istio project, lets you connect, secure, control, and observe the microservices that make up your applications.

Next steps

• Install Red Hat OpenShift Service Mesh in your OpenShift Container Platform environment.

• HTTP keep-alive/close mode
• Route type
• TLS session resumption client support
• Number of concurrent connections per target route
• Number of target routes
• Back end server page size
• Underlying infrastructure (network/SDN solution, CPU, and so on)