Chapter 2. Network policies

Procedure

1. Log in to the cluster using the oc login command.

2. Use the following command to change the project:

   $ oc project <project_name>

   where <project_name> is the name of a project that you want to accept communications from other projects.

3. Create a NetworkPolicy object:

   1. Create a allow-from-middleware-namespaces.yaml file.

   2. Define a policy in the file you just created, such as in the following example:

      apiVersion: networking.k8s.io/v1
      kind: NetworkPolicy
      metadata:
        name: allow-from-middleware-namespaces
      spec:
        podSelector:
        ingress:
          - from:
              - namespaceSelector:
                  matchLabels:
                    integreatly-middleware-service: 'true'

   3. Run the following command to create the policy object:

      $ oc create -f allow-from-middleware-namespaces.yaml -n <project>
      
      networkpolicy "allow-from-middleware-namespaces" created

Procedure

1. Log in to the cluster using the oc login command.

2. Use the following command to change the project:

   $ oc project <project_name>

   where <project_name> is the name of a project that you want to accept communications from other projects.

3. Create a NetworkPolicy object:

   1. Create a NetworkPolicy.yaml file.

   2. Define a policy in the file you just created, such as in the following example.

      This policy enables incoming communication for all projects in the cluster:

      kind: NetworkPolicy
      apiVersion: networking.k8s.io/v1
      metadata:
        name: allow-all
      spec:
        podSelector:
        ingress:
        - {}

      Note

      This policy configuration enables this project to communicate with all projects in the cluster.

   3. Run the following command to create the policy object:

      $ oc create -f <policy-name>.yaml -n <project>

Procedure

1. Log in to the cluster using the oc login command.

2. Use the following command to change the project:

   $ oc project <project_name>

   <project_name> is the name of a project that you want to accept communications from.

3. Create a NetworkPolicy object:

   1. Create a allow-from-myproject-namespace.yaml file.

   2. Define a policy in the file you just created, such as in the following example.

      This policy enables incoming communication for a specific project (myproject):

      apiVersion: networking.k8s.io/v1
      kind: NetworkPolicy
      metadata:
        name: allow-from-myproject-namespace
      spec:
        podSelector:
        ingress:
          - from:
              - namespaceSelector:
                   matchLabels:
                     project: myproject

4. Run the following commands to create the policy object:

   $ oc create -f allow-from-myproject-namespace.yaml -n <project>
   networkpolicy "allow-from-myproject-namespace" created

Procedure

1. Log in to the cluster using the oc login command.

2. Use the following command to change the project:

   $ oc project <project_name>

   where <project_name> is the name of a project that you want to isolate from the managed services.

3. Create a NetworkPolicy object:

   1. Create a deny-all.yaml file.

   2. Define a policy in the file you just created, such as in the following example:

      kind: NetworkPolicy
      apiVersion: networking.k8s.io/v1
      metadata:
        name: deny-all
      spec:
        podSelector: {}
        ingress:
          - from:
              - namespaceSelector:
                  matchLabels:
                    integreatly-middleware-service: 'true'

   3. Run the following command to create the policy object:

      $ oc create -f <policy-name>.yaml -n <project>