Skip to content

Commit 04b387e

Browse files
authored
Merge pull request #65075 from stevsmit/OCPBUGS-19477
Adds an IMPORTANT admonition to limitations of egress firewall
2 parents bc61062 + 38a15cd commit 04b387e

File tree

1 file changed

+8
-1
lines changed

1 file changed

+8
-1
lines changed

modules/nw-egressnetworkpolicy-about.adoc

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -96,6 +96,13 @@ Egress firewall rules do not apply to traffic that goes through routers. Any use
9696
An egress firewall has the following limitations:
9797

9898
* No project can have more than one {kind} object.
99+
ifdef::openshift-sdn[]
100+
+
101+
[IMPORTANT]
102+
====
103+
The creation of more than one {kind} object is allowed, however it should not be done. When you create more than one {kind} object, the following message is returned: `dropping all rules`. In actuality, all external traffic is dropped, which can cause security risks for your organization.
104+
====
105+
endif::openshift-sdn[]
99106

100107
ifdef::ovn[]
101108
* A maximum of one {kind} object with a maximum of 8,000 rules can be defined per project.
@@ -114,7 +121,7 @@ ifdef::openshift-sdn[]
114121
- Projects merged by using the `oc adm pod-network join-projects` command cannot use an egress firewall in any of the joined projects.
115122
endif::openshift-sdn[]
116123

117-
Violating any of these restrictions results in a broken egress firewall for the project, and might cause all external network traffic to be dropped.
124+
Violating any of these restrictions results in a broken egress firewall for the project. Consequently, all external network traffic is dropped, which can cause security risks for your organization.
118125

119126
An Egress Firewall resource can be created in the `kube-node-lease`, `kube-public`, `kube-system`, `openshift` and `openshift-` projects.
120127

0 commit comments

Comments
 (0)