Understanding network policy APIs - Network security | Networking

Key differences between AdminNetworkPolicy and NetworkPolicy custom resources

Kubernetes offers two features that users can use to enforce network security. One feature that allows users to enforce network policy is the NetworkPolicy API that is designed mainly for application developers and namespace tenants to protect their namespaces by creating namespace-scoped policies.

The second feature is AdminNetworkPolicy which consists of two APIs: the AdminNetworkPolicy (ANP) API and the BaselineAdminNetworkPolicy (BANP) API. ANP and BANP are designed for cluster and network administrators to protect their entire cluster by creating cluster-scoped policies. Cluster administrators can use ANPs to enforce non-overridable policies that take precedence over NetworkPolicy objects. Administrators can use BANP to set up and enforce optional cluster-scoped network policy rules that are overridable by users using NetworkPolicy objects when necessary. When used together, ANP, BANP, and network policy can achieve full multi-tenant isolation that administrators can use to secure their cluster.

OVN-Kubernetes CNI in OpenShift Container Platform implements these network policies using Access Control List (ACL) Tiers to evaluate and apply them. ACLs are evaluated in descending order from Tier 1 to Tier 3.

Tier 1 evaluates AdminNetworkPolicy (ANP) objects. Tier 2 evaluates NetworkPolicy objects. Tier 3 evaluates BaselineAdminNetworkPolicy (BANP) objects.

OVK-Kubernetes Access Control List (ACL)

ANPs are evaluated first. When the match is an ANP allow or deny rule, any existing NetworkPolicy and BaselineAdminNetworkPolicy (BANP) objects in the cluster are skipped from evaluation. When the match is an ANP pass rule, then evaluation moves from tier 1 of the ACL to tier 2 where the NetworkPolicy policy is evaluated. If no NetworkPolicy matches the traffic then evaluation moves from tier 2 ACLs to tier 3 ACLs where BANP is evaluated.

Key differences between AdminNetworkPolicy and NetworkPolicy custom resources

The following table explains key differences between the cluster scoped AdminNetworkPolicy API and the namespace scoped NetworkPolicy API.

Policy elements AdminNetworkPolicy NetworkPolicy

Policy elements	AdminNetworkPolicy	NetworkPolicy
Applicable user	Cluster administrator or equivalent	Namespace owners
Scope	Cluster	Namespaced
Drop traffic	Supported with an explicit `Deny` action set as a rule.	Supported via implicit `Deny` isolation at policy creation time.
Delegate traffic	Supported with an `Pass` action set as a rule.	Not applicable
Allow traffic	Supported with an explicit `Allow` action set as a rule.	The default action for all rules is to allow.
Rule precedence within the policy	Depends on the order in which they appear within an ANP. The higher the rule’s position the higher the precedence.	Rules are additive
Policy precedence	Among ANPs the `priority` field sets the order for evaluation. The lower the priority number higher the policy precedence.	There is no policy ordering between policies.
Feature precedence	Evaluated first via tier 1 ACL and BANP is evaluated last via tier 3 ACL.	Enforced after ANP and before BANP, they are evaluated in tier 2 of the ACL.
Matching pod selection	Can apply different rules across namespaces.	Can apply different rules across pods in single namespace.
Cluster egress traffic	Supported via `nodes` and `networks` peers	Supported through `ipBlock` field along with accepted CIDR syntax.
Cluster ingress traffic	Not supported	Not supported
Fully qualified domain names (FQDN) peer support	Not supported	Not supported
Namespace selectors	Supports advanced selection of Namespaces with the use of `namespaces.matchLabels` field	Supports label based namespace selection with the use of `namespaceSelector` field

Applicable user

Cluster administrator or equivalent

Namespace owners

Scope

Cluster

Namespaced

Drop traffic

Supported with an explicit Deny action set as a rule.

Supported via implicit Deny isolation at policy creation time.

Delegate traffic

Supported with an Pass action set as a rule.

Not applicable

Allow traffic

Supported with an explicit Allow action set as a rule.

The default action for all rules is to allow.

Rule precedence within the policy

Depends on the order in which they appear within an ANP. The higher the rule’s position the higher the precedence.

Rules are additive

Policy precedence

Among ANPs the priority field sets the order for evaluation. The lower the priority number higher the policy precedence.

There is no policy ordering between policies.

Feature precedence

Evaluated first via tier 1 ACL and BANP is evaluated last via tier 3 ACL.

Enforced after ANP and before BANP, they are evaluated in tier 2 of the ACL.

Matching pod selection

Can apply different rules across namespaces.

Can apply different rules across pods in single namespace.

Cluster egress traffic

Supported via nodes and networks peers

Supported through ipBlock field along with accepted CIDR syntax.

Cluster ingress traffic

Not supported

Fully qualified domain names (FQDN) peer support

Not supported

Namespace selectors

Supports advanced selection of Namespaces with the use of namespaces.matchLabels field

Supports label based namespace selection with the use of namespaceSelector field