Skip to content

Commit c8e9c93

Browse files
committed
Omit network policy Ingress Controller exception
- https://issues.redhat.com/browse/OSDOCS-1811
1 parent e95b599 commit c8e9c93

File tree

1 file changed

+0
-10
lines changed

1 file changed

+0
-10
lines changed

modules/nw-networkpolicy-about.adoc

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -47,11 +47,6 @@ spec:
4747
+
4848
To make a project allow only connections from the {product-title} Ingress Controller, add the following `NetworkPolicy` object.
4949
+
50-
[IMPORTANT]
51-
====
52-
For the OVN-Kubernetes network provider plug-in, when the Ingress Controller is configured to use the `HostNetwork` endpoint publishing strategy, there is no supported way to apply network policy so that ingress traffic is allowed and all other traffic is denied.
53-
====
54-
+
5550
[source,yaml]
5651
----
5752
apiVersion: networking.k8s.io/v1
@@ -68,11 +63,6 @@ spec:
6863
policyTypes:
6964
- Ingress
7065
----
71-
+
72-
If the Ingress Controller is configured with `endpointPublishingStrategy: HostNetwork`, then the Ingress Controller pod runs on the host network.
73-
When running on the host network, the traffic from the Ingress Controller is assigned the `netid:0` Virtual Network ID (VNID).
74-
The `netid` for the namespace that is associated with the Ingress Operator is different, so the `matchLabel` in the `allow-from-openshift-ingress` network policy does not match traffic from the `default` Ingress Controller.
75-
With OpenShift SDN, the `default` namespace is assigned the `netid:0` VNID and you can allow traffic from the `default` Ingress Controller by labeling your `default` namespace with `network.openshift.io/policy-group: ingress`.
7666

7767
* Only accept connections from pods within a project:
7868
+

0 commit comments

Comments
 (0)