Skip to content

Commit 5b30833

Browse files
committed
Added allow-from-router part and given the same references in other respective sections.
1 parent 75790af commit 5b30833

File tree

2 files changed

+55
-5
lines changed

2 files changed

+55
-5
lines changed

modules/nw-networkpolicy-about.adoc

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -123,3 +123,49 @@ spec:
123123
`NetworkPolicy` objects are additive, which means you can combine multiple `NetworkPolicy` objects together to satisfy complex network requirements.
124124

125125
For example, for the `NetworkPolicy` objects defined in previous samples, you can define both `allow-same-namespace` and `allow-http-and-https` policies within the same project. Thus allowing the pods with the label `role=frontend`, to accept any connection allowed by each policy. That is, connections on any port from pods in the same namespace, and connections on ports `80` and `443` from pods in any namespace.
126+
127+
[id="nw-networkpolicy-allow-from-router_{context}"]
128+
== Using the allow-from-router network policy
129+
130+
Use the following `NetworkPolicy` to allow external traffic regardless of the router configuration:
131+
132+
[source,yaml]
133+
----
134+
apiVersion: networking.k8s.io/v1
135+
kind: NetworkPolicy
136+
metadata:
137+
name: allow-from-router
138+
spec:
139+
ingress:
140+
- from:
141+
- namespaceSelector:
142+
matchLabels:
143+
policy-group.network.openshift.io/ingress:""<1>
144+
podSelector: {}
145+
policyTypes:
146+
- Ingress
147+
----
148+
<1> `policy-group.network.openshift.io/ingress:""` label supports both Openshift-SDN and OVN-Kubernetes.
149+
150+
151+
[id="nw-networkpolicy-allow-from-hostnetwork_{context}"]
152+
== Using the allow-from-hostnetwork network policy
153+
154+
Add the following `allow-from-hostnetwork` `NetworkPolicy` object to direct traffic from the host network pods:
155+
156+
[source,yaml]
157+
----
158+
apiVersion: networking.k8s.io/v1
159+
kind: NetworkPolicy
160+
metadata:
161+
name: allow-from-hostnetwork
162+
spec:
163+
ingress:
164+
- from:
165+
- namespaceSelector:
166+
matchLabels:
167+
policy-group.network.openshift.io/host-network:""
168+
podSelector: {}
169+
policyTypes:
170+
- Ingress
171+
----

networking/configuring_ingress_cluster_traffic/configuring-ingress-cluster-traffic-ingress-controller.adoc

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -55,8 +55,12 @@ include::modules/nw-ingress-sharding-route-configuration.adoc[leveloffset=+1]
5555
[role="_additional-resources"]
5656
== Additional resources
5757

58-
* The Ingress Operator manages wildcard DNS. For more information, see
59-
xref:../../networking/ingress-operator.adoc#configuring-ingress[Ingress Operator in {product-title}],
60-
xref:../../installing/installing_bare_metal/installing-bare-metal.adoc#installing-bare-metal[Installing a cluster on bare metal], and
61-
xref:../../installing/installing_vsphere/installing-vsphere.adoc#installing-vsphere[Installing a cluster on vSphere].
62-
endif::[]
58+
The Ingress Operator manages wildcard DNS. For more information, see the following:
59+
60+
* xref:../../networking/ingress-operator.adoc#configuring-ingress[Ingress Operator in {product-title}].
61+
62+
* xref:../../installing/installing_bare_metal/installing-bare-metal.adoc#installing-bare-metal[Installing a cluster on bare metal].
63+
64+
* xref:../../installing/installing_vsphere/installing-vsphere.adoc#installing-vsphere[Installing a cluster on vSphere].
65+
66+
* xref:../../networking/network_policy/about-network-policy.adoc#about-network-policy[About network policy].

0 commit comments

Comments
 (0)