Chapter 2. Network policies

Procedure

1. Log in to the cluster using the oc login command.

2. Use the following command to change the project:

   $ oc project <project_name>

   Copy to Clipboard Toggle word wrap

   where <project_name> is the name of a project that you want to accept communications from other projects.

3. Create a NetworkPolicy object:

   1. Create a allow-from-middleware-namespaces.yaml file.

   2. Define a policy in the file you just created, such as in the following example:

      apiVersion: networking.k8s.io/v1
      kind: NetworkPolicy
      metadata:
        name: allow-from-middleware-namespaces
      spec:
        podSelector:
        ingress:
          - from:
              - namespaceSelector:
                  matchLabels:
                    integreatly-middleware-service: 'true'

      Copy to Clipboard Toggle word wrap

   3. Run the following command to create the policy object:

      $ oc create -f allow-from-middleware-namespaces.yaml -n <project>
      
      networkpolicy "allow-from-middleware-namespaces" created

      Copy to Clipboard Toggle word wrap

Procedure

1. Log in to the cluster using the oc login command.

2. Use the following command to change the project:

   $ oc project <project_name>

   Copy to Clipboard Toggle word wrap

   where <project_name> is the name of a project that you want to accept communications from other projects.

3. Create a NetworkPolicy object:

   1. Create a NetworkPolicy.yaml file.

   2. Define a policy in the file you just created, such as in the following example.

      This policy enables incoming communication for all projects in the cluster:

      kind: NetworkPolicy
      apiVersion: networking.k8s.io/v1
      metadata:
        name: allow-all
      spec:
        podSelector:
        ingress:
        - {}

      Copy to Clipboard Toggle word wrap
      Note

      This policy configuration enables this project to communicate with all projects in the cluster.

   3. Run the following command to create the policy object:

      $ oc create -f <policy-name>.yaml -n <project>

      Copy to Clipboard Toggle word wrap

Procedure

1. Log in to the cluster using the oc login command.

2. Use the following command to change the project:

   $ oc project <project_name>

   Copy to Clipboard Toggle word wrap

   <project_name> is the name of a project that you want to accept communications from.

3. Create a NetworkPolicy object:

   1. Create a allow-from-myproject-namespace.yaml file.

   2. Define a policy in the file you just created, such as in the following example.

      This policy enables incoming communication for a specific project (myproject):

      apiVersion: networking.k8s.io/v1
      kind: NetworkPolicy
      metadata:
        name: allow-from-myproject-namespace
      spec:
        podSelector:
        ingress:
          - from:
              - namespaceSelector:
                   matchLabels:
                     project: myproject

      Copy to Clipboard Toggle word wrap

4. Run the following commands to create the policy object:

   $ oc create -f allow-from-myproject-namespace.yaml -n <project>
   networkpolicy "allow-from-myproject-namespace" created

   Copy to Clipboard Toggle word wrap

Procedure

1. Log in to the cluster using the oc login command.

2. Use the following command to change the project:

   $ oc project <project_name>

   Copy to Clipboard Toggle word wrap

   where <project_name> is the name of a project that you want to isolate from the managed services.

3. Create a NetworkPolicy object:

   1. Create a deny-all.yaml file.

   2. Define a policy in the file you just created, such as in the following example:

      kind: NetworkPolicy
      apiVersion: networking.k8s.io/v1
      metadata:
        name: deny-all
      spec:
        podSelector: {}
        ingress:
          - from:
              - namespaceSelector:
                  matchLabels:
                    integreatly-middleware-service: 'true'

      Copy to Clipboard Toggle word wrap

   3. Run the following command to create the policy object:

      $ oc create -f <policy-name>.yaml -n <project>

      Copy to Clipboard Toggle word wrap