Creating a network policy - Network policy | Networking

Creating a NetworkPolicy object
Example NetworkPolicy object

As a cluster administrator, you can create a network policy for a namespace.

Creating a NetworkPolicy object

To define granular rules describing ingress network traffic allowed for projects in your cluster, you can create NetworkPolicy objects.

Prerequisites

Your cluster is using a default CNI network provider that supports NetworkPolicy objects, such as the OpenShift SDN network provider with mode: NetworkPolicy set. This mode is the default for OpenShift SDN.
You installed the OpenShift CLI (oc).
You are logged in to the cluster with a user with cluster-admin privileges.

Procedure

Create a policy rule:
1. Create a <policy-name>.yaml file where <policy-name> describes the policy rule.
2. In the file you just created define a policy object, such as in the following example:
  kind: NetworkPolicy apiVersion: networking.k8s.io/v1 metadata: name: <policy-name> (1) spec: podSelector: ingress: []
  1 Specify a name for the policy object.
Run the following command to create the policy object:
```
$ oc create -f <policy-name>.yaml -n <project>
```
In the following example, a new NetworkPolicy object is created in a project named project1:
```
$ oc create -f default-deny.yaml -n project1
```
Example output
```
networkpolicy "default-deny" created
```

Example NetworkPolicy object

The following annotates an example NetworkPolicy object:

kind: NetworkPolicy
apiVersion: extensions/v1beta1
metadata:
  name: allow-27107 (1)
spec:
  podSelector: (2)
    matchLabels:
      app: mongodb
  ingress:
  - from:
    - podSelector: (3)
        matchLabels:
          app: app
    ports: (4)
    - protocol: TCP
      port: 27017

1	The `name` of the NetworkPolicy object.
2	A selector describing the Pods the policy applies to. The policy object can only select Pods in the project that the NetworkPolicy object is defined.
3	A selector matching the Pods that the policy object allows ingress traffic from. The selector will match Pods in any project.
4	A list of one or more destination ports to accept traffic on.