This is a cache of https://docs.openshift.com/acs/4.5/cli/generating-build-time-network-policies.html. It is a snapshot of the page at 2024-11-05T18:08:00.788+0000.
Generating build-time network policies | roxctl CLI | Red Hat Advanced Cluster Security for Kubernetes 4.5
  1. Documentation
    2. history bug_report picture_as_pdf
×

Generating build-time network policies

The build-time network policy generator is included in the roxctl CLI. For the build-time network policy generation feature, roxctl CLI does not need to communicate with RHACS Central so you can use it in any development environment.

Using the build-time network policy generator

You can generate network policies by using the built-in network policy generator in the roxctl CLI.

Prerequisites

  1. The build-time network policy generator recursively scans the directory you specify when you run the command. Therefore, before you run the command, you must already have service manifests, config maps, and workload manifests such as Pod, Deployment, ReplicaSet, Job, DaemonSet, and StatefulSet as YAML files in the specified directory.

  2. Verify that you can apply these YAML files as-is using the kubectl apply -f command. The build-time network policy generator does not work with files that use Helm-style templating.

  3. Verify that the service network addresses are not hard-coded. Every workload that needs to connect to a service must specify the service network address as a variable. You can specify this variable by using the workload’s resource environment variable or in a config map.

  4. Service network addresses must match the following official regular expression pattern:

    (http(s)?://)?<svc>(.<ns>(.svc.cluster.local)?)?(:<portNum>)? (1)
    1 In this pattern,

    • <svc> is the service name.

    • <ns> is the namespace where you defined the service.

    • <portNum> is the exposed service port number.

    Following are some examples that match the pattern:

    • wordpress-mysql:3306

    • redis-follower.redis.svc.cluster.local:6379

    • redis-leader.redis

    • http://rating-service.

Procedure

  1. Verify that the build-time network policy generation feature is available by running the help command:

    $ roxctl netpol generate -h

  2. Generate the policies by using the netpol generate command:

    $ roxctl netpol generate <folder-path> (1)
    1 Specify the path of the folder that has the Kubernetes manifests.

The roxctl netpol generate command supports the following options:

Option

Description

-h, --help

View the help text for the netpol command.

-d, --output-dir <dir>

Save the generated policies into a target folder. One file per policy.

-f, --output-file <filename>

Save and merge the generated policies into a single YAML file.

--fail

Fail on the first encountered error. The default value is false.

--remove

Remove the output path if it already exist.

--strict

Treat warnings as errors. The default value is false.

--dnsport

Specify the default DNS port to use in the egress rules of the generated policies. The default value is 53.