Skip to content

Commit e9d7845

Browse files
committed
OSDOCS-13364:adds ovn-k conditional for egress firewall
1 parent 2d625d9 commit e9d7845

File tree

1 file changed

+3
-2
lines changed

1 file changed

+3
-2
lines changed

modules/nw-egressnetworkpolicy-about.adoc

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ You configure an egress firewall policy by creating an {kind} custom resource (C
4242
ifdef::ovn[]
4343
- A port number
4444
- A protocol that is one of the following protocols: TCP, UDP, and SCTP
45-
endif::ovn[]
45+
4646

4747
[IMPORTANT]
4848
====
@@ -75,6 +75,7 @@ To find the IP address for your API servers, run `oc get ep kubernetes -n defaul
7575
7676
For more information, see link:https://bugzilla.redhat.com/show_bug.cgi?id=1988324[BZ#1988324].
7777
====
78+
endif::ovn[]
7879

7980
ifdef::openshift-sdn[]
8081
[IMPORTANT]
@@ -120,7 +121,7 @@ ifdef::openshift-sdn[]
120121

121122
- Projects merged by using the `oc adm pod-network join-projects` command cannot use an egress firewall in any of the joined projects.
122123

123-
* If you create a selectorless service and manually define endpoints or `EndpointSlices` that point to external IPs, traffic to the service IP might still be allowed, even if your `EgressNetworkPolicy` is configured to deny all egress traffic. This occurs because OpenShift SDN does not fully enforce egress network policies for these external endpoints. Consequently, this might result in unexpected access to external services.
124+
* If you create a selectorless service and manually define endpoints or `EndpointSlices` that point to external IPs, traffic to the service IP might still be allowed, even if your egress network policy is configured to deny all egress traffic. This occurs because OpenShift SDN does not fully enforce egress network policies for these external endpoints. Consequently, this might result in unexpected access to external services.
124125
endif::openshift-sdn[]
125126

126127
Violating any of these restrictions results in a broken egress firewall for the project. Consequently, all external network traffic is dropped, which can cause security risks for your organization.

0 commit comments

Comments
 (0)