Skip to content

OSDOCS-13364:adds ovn-k conditional for egress firewall #97444

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: enterprise-4.16
Choose a base branch
from
Open

OSDOCS-13364:adds ovn-k conditional for egress firewall #97444

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions modules/nw-egressnetworkpolicy-about.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,7 @@ You configure an egress firewall policy by creating an {kind} custom resource (C
ifdef::ovn[]
- A port number
- A protocol that is one of the following protocols: TCP, UDP, and SCTP
endif::ovn[]


[IMPORTANT]
====
Expand Down Expand Up @@ -75,6 +75,7 @@ To find the IP address for your API servers, run `oc get ep kubernetes -n defaul

For more information, see link:https://bugzilla.redhat.com/show_bug.cgi?id=1988324[BZ#1988324].
====
endif::ovn[]

ifdef::openshift-sdn[]
[IMPORTANT]
Expand Down Expand Up @@ -120,7 +121,7 @@ ifdef::openshift-sdn[]

- Projects merged by using the `oc adm pod-network join-projects` command cannot use an egress firewall in any of the joined projects.

* If you create a selectorless service and manually define endpoints or `EndpointSlices` that point to external IPs, traffic to the service IP might still be allowed, even if your `EgressNetworkPolicy` is configured to deny all egress traffic. This occurs because OpenShift SDN does not fully enforce egress network policies for these external endpoints. Consequently, this might result in unexpected access to external services.
* If you create a selectorless service and manually define endpoints or `EndpointSlices` that point to external IPs, traffic to the service IP might still be allowed, even if your `EgressNetworkPolicy` is configured to deny all egress traffic. This occurs because OpenShift SDN does not fully enforce egress network policies for these external endpoints. Consequently, this might result in unexpected access to external services.
endif::openshift-sdn[]

Violating any of these restrictions results in a broken egress firewall for the project. Consequently, all external network traffic is dropped, which can cause security risks for your organization.
Expand Down