About network policy

    In a cluster using a Kubernetes Container Network Interface (CNI) plug-in that supports Kubernetes network policy, network isolation is controlled entirely by objects. In OKD 4.8, OpenShift SDN supports using network policy in its default network isolation mode.

    By default, all pods in a project are accessible from other pods and network endpoints. To isolate one or more pods in a project, you can create NetworkPolicy objects in that project to indicate the allowed incoming connections. Project administrators can create and delete NetworkPolicy objects within their own project.

    If a pod is matched by selectors in one or more NetworkPolicy objects, then the pod will accept only connections that are allowed by at least one of those NetworkPolicy objects. A pod that is not selected by any NetworkPolicy objects is fully accessible.

    The following example NetworkPolicy objects demonstrate supporting different scenarios:

    • Deny all traffic:

      To make a project deny by default, add a object that matches all pods but accepts no traffic:

    • To make a project allow only connections from the OKD Ingress Controller, add the following NetworkPolicy object.

    • Only accept connections from pods within a project:

      To make pods accept connections from other pods in the same project, but reject all other connections from pods in other projects, add the following NetworkPolicy object:

    • Only allow HTTP and HTTPS traffic based on pod labels:

      To enable only HTTP and HTTPS access to the pods with a specific label (role=frontend in following example), add a NetworkPolicy object similar to the following:

    • Accept connections by using both namespace and pod selectors:

      To match network traffic by combining namespace and pod selectors, you can use a NetworkPolicy object similar to the following:

    NetworkPolicy objects are additive, which means you can combine multiple NetworkPolicy objects together to satisfy complex network requirements.

    For example, for the NetworkPolicy objects defined in previous samples, you can define both allow-same-namespace and policies within the same project. Thus allowing the pods with the label role=frontend, to accept any connection allowed by each policy. That is, connections on any port from pods in the same namespace, and connections on ports 80 and 443 from pods in any namespace.

    Use a network policy to isolate pods that are differentiated from one another by labels within a namespace.

    It is inefficient to apply NetworkPolicy objects to large numbers of individual pods in a single namespace. Pod labels do not exist at the IP address level, so a network policy generates a separate Open vSwitch (OVS) flow rule for every possible link between every pod selected with a podSelector.

    For example, if the spec podSelector and the ingress podSelector within a NetworkPolicy object each match 200 pods, then 40,000 (200*200) OVS flow rules are generated. This might slow down a node.

    When designing your network policy, refer to the following guidelines:

    • Keep the pods that do not need to be isolated in their original namespace, and move the pods that require isolation into one or more different namespaces.

    • Create additional targeted cross-namespace network policies to allow the specific traffic that you do want to allow from the isolated pods.