Skip to content

Commit 40ca581

Browse files
jboxmanjboxman
committed
Update network policy procedures
It was always possible to perform these procedures as an `admin` user, so the text should reflect this. Drops callouts in favor of alternate style.
1 parent a262322 commit 40ca581

13 files changed

+215
-56
lines changed

‎_topic_map.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -846,7 +846,7 @@ Topics:
846846
File: editing-network-policy
847847
- Name: Deleting a network policy
848848
File: deleting-network-policy
849-
- Name: Defining a default network policy
849+
- Name: Defining a default network policy for projects
850850
File: default-network-policy
851851
- Name: Configuring multitenant network policy
852852
File: multitenant-network-policy

‎modules/nw-networkpolicy-create.adoc‎

Lines changed: 62 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,59 +1,101 @@
11
// Module included in the following assemblies:
22
//
33
// * networking/network_policy/creating-network-policy.adoc
4-
// * networking/configuring-networkpolicy.adoc
54
// * post_installation_configuration/network-configuration.adoc
65

7-
[id="nw-networkpolicy-create_{context}"]
6+
ifeval::[{product-version} >= 4.6]
7+
:ovn:
8+
endif::[]
89

10+
[id="nw-networkpolicy-create_{context}"]
911
= Creating a network policy
1012

11-
To define granular rules describing ingress network traffic allowed for projects
12-
in your cluster, you can create a network policy.
13+
To define granular rules describing ingress or egress network traffic allowed for namespaces in your cluster, you can create a network policy.
14+
15+
[NOTE]
16+
====
17+
If you log in with a user with the `cluster-admin` role, then you can create a network policy in any namespace in the cluster.
18+
====
1319

1420
.Prerequisites
1521

16-
* Your cluster is using a default CNI network provider that supports `NetworkPolicy` objects, such as the OpenShift SDN network provider with `mode: NetworkPolicy` set. This mode is the default for OpenShift SDN.
22+
* Your cluster is using a cluster network provider that supports `NetworkPolicy` objects, such as
23+
ifndef::ovn[]
24+
the OpenShift SDN network provider with `mode: NetworkPolicy` set.
25+
endif::ovn[]
26+
ifdef::ovn[]
27+
the OVN-Kubernetes network provider or the OpenShift SDN network provider with `mode: NetworkPolicy` set.
28+
endif::ovn[]
29+
This mode is the default for OpenShift SDN.
1730
* You installed the OpenShift CLI (`oc`).
18-
* You are logged in to the cluster with a user with `cluster-admin` privileges.
31+
* You are logged in to the cluster with a user with `admin` privileges.
32+
* You are working in the namespace that the network policy applies to.
1933

2034
.Procedure
2135

2236
. Create a policy rule:
23-
.. Create a `<policy-name>.yaml` file where `<policy-name>` describes the policy
24-
rule.
25-
.. In the file you just created define a policy object, such as in the following
26-
example:
37+
.. Create a `<policy_name>.yaml` file:
38+
+
39+
[source,terminal]
40+
----
41+
$ touch <policy_name>.yaml
42+
----
43+
+
44+
--
45+
where:
46+
47+
`<policy_name>`:: Specifies the network policy file name.
48+
--
49+
50+
.. Define a network policy in the file that you just created, such as in the following examples:
2751
+
52+
.Deny ingress from all pods in all namespaces
2853
[source,yaml]
2954
----
3055
kind: NetworkPolicy
3156
apiVersion: networking.k8s.io/v1
3257
metadata:
33-
name: <policy-name> <1>
58+
name: deny-by-default
3459
spec:
3560
podSelector:
3661
ingress: []
3762
----
38-
<1> Specify a name for the policy object.
39-
40-
. Run the following command to create the policy object:
4163
+
42-
[source,terminal]
64+
.Allow ingress from all pods in the same namespace
65+
[source,yaml]
4366
----
44-
$ oc create -f <policy-name>.yaml -n <project>
67+
kind: NetworkPolicy
68+
apiVersion: networking.k8s.io/v1
69+
metadata:
70+
name: allow-same-namespace
71+
spec:
72+
podSelector:
73+
ingress:
74+
- from:
75+
- podSelector: {}
4576
----
46-
+
47-
In the following example, a new `NetworkPolicy` object is created in a project
48-
named `project1`:
77+
78+
79+
. To create the network policy object, enter the following command:
4980
+
5081
[source,terminal]
5182
----
52-
$ oc create -f default-deny.yaml -n project1
83+
$ oc apply -f <policy_name>.yaml -n <namespace>
5384
----
5485
+
86+
--
87+
where:
88+
89+
`<policy_name>`:: Specifies the network policy file name.
90+
`<namespace>`:: Optional: Specifies the namespace if the object is defined in a different namespace than the current namespace.
91+
--
92+
+
5593
.Example output
5694
[source,terminal]
5795
----
5896
networkpolicy "default-deny" created
5997
----
98+
99+
ifdef::ovn[]
100+
:!ovn:
101+
endif::ovn[]

‎modules/nw-networkpolicy-delete.adoc‎

Lines changed: 39 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,25 +1,58 @@
11
// Module included in the following assemblies:
22
//
33
// * networking/network_policy/deleting-network-policy.adoc
4-
// * networking/configuring-networkpolicy.adoc
54
// * post_installation_configuration/network-configuration.adoc
65

7-
[id="nw-networkpolicy-delete_{context}"]
6+
ifeval::[{product-version} >= 4.6]
7+
:ovn:
8+
endif::[]
89

10+
[id="nw-networkpolicy-delete_{context}"]
911
= Deleting a network policy
1012

11-
You can delete a network policy.
13+
You can delete a network policy in a namespace.
14+
15+
[NOTE]
16+
====
17+
If you log in with a user with the `cluster-admin` role, then you can delete any network policy in the cluster.
18+
====
1219

1320
.Prerequisites
1421

22+
* Your cluster is using a cluster network provider that supports `NetworkPolicy` objects, such as
23+
ifndef::ovn[]
24+
the OpenShift SDN network provider with `mode: NetworkPolicy` set.
25+
endif::ovn[]
26+
ifdef::ovn[]
27+
the OVN-Kubernetes network provider or the OpenShift SDN network provider with `mode: NetworkPolicy` set.
28+
endif::ovn[]
29+
This mode is the default for OpenShift SDN.
1530
* You installed the OpenShift CLI (`oc`).
16-
* You are logged in to the cluster with a user with `cluster-admin` privileges.
31+
* You are logged in to the cluster with a user with `admin` privileges.
32+
* You are working in the namespace where the network policy exists.
1733

1834
.Procedure
1935

20-
* To delete a `NetworkPolicy` object, enter the following command. Replace `<policy-name>` with the name of the object.
36+
* To delete a `NetworkPolicy` object, enter the following command:
2137
+
2238
[source,terminal]
2339
----
24-
$ oc delete networkpolicy <policy-name>
40+
$ oc delete networkpolicy <policy_name> -n <namespace>
2541
----
42+
+
43+
--
44+
where:
45+
46+
`<policy_name>`:: Specifies the name of the network policy.
47+
`<namespace>`:: Optional: Specifies the namespace if the object is defined in a different namespace than the current namespace.
48+
--
49+
+
50+
.Example output
51+
[source,text]
52+
----
53+
networkpolicy.networking.k8s.io/allow-same-namespace deleted
54+
----
55+
56+
ifdef::ovn[]
57+
:!ovn:
58+
endif::ovn[]

‎modules/nw-networkpolicy-edit.adoc‎

Lines changed: 56 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -2,54 +2,93 @@
22
//
33
// * networking/network_policy/editing-network-policy.adoc
44

5-
[id="nw-networkpolicy-edit_{context}"]
5+
ifeval::[{product-version} >= 4.6]
6+
:ovn:
7+
endif::[]
68

9+
[id="nw-networkpolicy-edit_{context}"]
710
= Editing a network policy
811

912
You can edit a network policy in a namespace.
1013

14+
[NOTE]
15+
====
16+
If you log in with a user with the `cluster-admin` role, then you can edit a network policy in any namespace in the cluster.
17+
====
18+
1119
.Prerequisites
1220

13-
* Your cluster is using a default CNI network provider that supports `NetworkPolicy` objects, such as the OpenShift SDN network provider with `mode: NetworkPolicy` set. This mode is the default for OpenShift SDN.
21+
* Your cluster is using a cluster network provider that supports `NetworkPolicy` objects, such as
22+
ifndef::ovn[]
23+
the OpenShift SDN network provider with `mode: NetworkPolicy` set.
24+
endif::ovn[]
25+
ifdef::ovn[]
26+
the OVN-Kubernetes network provider or the OpenShift SDN network provider with `mode: NetworkPolicy` set.
27+
endif::ovn[]
28+
This mode is the default for OpenShift SDN.
1429
* You installed the OpenShift CLI (`oc`).
15-
* You are logged in to the cluster with a user with `cluster-admin` privileges.
30+
* You are logged in to the cluster with a user with `admin` privileges.
31+
* You are working in the namespace where the network policy exists.
1632

1733
.Procedure
1834

19-
. Optional: List the current `NetworkPolicy` objects.
20-
.. If you want to list the policy objects in a specific namespace, enter the following command. Replace `<namespace>` with the namespace for a project.
35+
. Optional: To list the network policy objects in a namespace, enter the following command:
2136
+
2237
[source,terminal]
2338
----
2439
$ oc get networkpolicy -n <namespace>
2540
----
26-
27-
.. If you want to list the policy objects for the entire cluster, enter the following command:
2841
+
29-
[source,terminal]
30-
----
31-
$ oc get networkpolicy --all-namespaces
32-
----
42+
--
43+
where:
44+
45+
`<namespace>`:: Optional: Specifies the namespace if the object is defined in a different namespace than the current namespace.
46+
--
3347

3448
. Edit the `NetworkPolicy` object.
3549

36-
.. If you saved the network policy definition in a file, edit the file and make any necessary changes, and then enter the following command. Replace `<policy-file>` with the name of the file containing the object definition.
50+
** If you saved the network policy definition in a file, edit the file and make any necessary changes, and then enter the following command.
3751
+
3852
[source,terminal]
3953
----
40-
$ oc apply -f <policy-file>.yaml
54+
$ oc apply -n <namespace> -f <policy_file>.yaml
4155
----
56+
+
57+
--
58+
where:
59+
60+
`<namespace>`:: Optional: Specifies the namespace if the object is defined in a different namespace than the current namespace.
61+
`<policy_file>`:: Specifies the name of the file containing the network policy.
62+
--
4263

43-
.. If you need to update the `NetworkPolicy` object directly, you can enter the following command. Replace `<policy-name>` with the name of the `NetworkPolicy` object and `<namespace>` with the name of the project where the object exists.
64+
** If you need to update the `NetworkPolicy` object directly, enter the following command:
4465
+
4566
[source,terminal]
4667
----
47-
$ oc edit <policy-name> -n <namespace>
68+
$ oc edit networkpolicy <policy_name> -n <namespace>
4869
----
70+
+
71+
--
72+
where:
73+
74+
`<policy_name>`:: Specifies the name of the network policy.
75+
`<namespace>`:: Optional: Specifies the namespace if the object is defined in a different namespace than the current namespace.
76+
--
4977

50-
. Confirm that the `NetworkPolicy` object is updated. Replace `<namespace>` with the name of the project where the object exists.
78+
. Confirm that the `NetworkPolicy` object is updated.
5179
+
5280
[source,terminal]
5381
----
54-
$ oc get networkpolicy -n <namespace> -o yaml
82+
$ oc describe networkpolicy <policy_name> -n <namespace>
5583
----
84+
+
85+
--
86+
where:
87+
88+
`<policy_name>`:: Specifies the name of the network policy.
89+
`<namespace>`:: Optional: Specifies the namespace if the object is defined in a different namespace than the current namespace.
90+
--
91+
92+
ifdef::ovn[]
93+
:!ovn:
94+
endif::ovn[]

‎modules/nw-networkpolicy-multitenant-isolation.adoc‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
// Module included in the following assemblies:
22
//
33
// * networking/network_policy/multitenant-network-policy.adoc
4-
// * networking/configuring-networkpolicy.adoc
54
// * post_installation_configuration/network-configuration.adoc
65

76
ifeval::[{product-version} >= 4.6]
@@ -25,7 +24,7 @@ the OVN-Kubernetes network provider or the OpenShift SDN network provider with `
2524
endif::ovn[]
2625
This mode is the default for OpenShift SDN.
2726
* You installed the OpenShift CLI (`oc`).
28-
* You are logged in to the cluster with a user with `cluster-admin` privileges.
27+
* You are logged in to the cluster with a user with `admin` privileges.
2928

3029
.Procedure
3130

‎modules/nw-networkpolicy-object.adoc‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,6 @@
33
// * networking/network_policy/creating-network-policy.adoc
44
// * networking/network_policy/viewing-network-policy.adoc
55
// * networking/network_policy/editing-network-policy.adoc
6-
// * networking/configuring-networkpolicy.adoc
76
// * post_installation_configuration/network-configuration.adoc
87

98
[id="nw-networkpolicy-object_{context}"]

0 commit comments

Comments
 (0)