Network Policy

As a user with the admin role, you can create a network policy for the netobserv namespace.

Creating a network policy for Network Observability

You might need to create a network policy to secure ingress traffic to the netobserv namespace. In the web console, you can create a network policy using the form view.

Procedure

  1. Navigate to Networking → NetworkPolicies.

  2. Select the netobserv project from the Project dropdown menu.

  3. Name the policy. For this example, the policy name is allow-ingress.

  4. Click Add ingress rule three times to create three ingress rules.

  5. Specify the following in the form:

    1. Make the following specifications for the first Ingress rule:

      1. From the Add allowed source dropdown menu, select Allow pods from the same namespace.

    2. Make the following specifications for the second Ingress rule:

      1. From the Add allowed source dropdown menu, select Allow pods from inside the cluster.

      2. Click + Add namespace selector.

      3. Add the label, kubernetes.io/metadata.name, and the selector, openshift-console.

    3. Make the following specifications for the third Ingress rule:

      1. From the Add allowed source dropdown menu, select Allow pods from inside the cluster.

      2. Click + Add namespace selector.

      3. Add the label, kubernetes.io/metadata.name, and the selector, openshift-monitoring.

Verification

  1. Navigate to Observe → Network Traffic.

  2. View the Traffic Flows tab, or any tab, to verify that the data is displayed.

  3. Navigate to Observe → Dashboards. In the NetObserv/Health selection, verify that the flows are being ingested and sent to Loki, which is represented in the first graph.

Example network policy

The following annotates an example NetworkPolicy object for the netobserv namespace:

Sample network policy

  1. kind: NetworkPolicy
  2. apiVersion: networking.k8s.io/v1
  3. metadata:
  4.   name: allow-ingress
  5.   namespace: netobserv
  6. spec:
  7.   podSelector: {}            (1)
  8.   ingress:
  9.     - from:
  10.         - podSelector: {}    (2)
  11.           namespaceSelector: (3)
  12.             matchLabels:
  13.               kubernetes.io/metadata.name: openshift-console
  14.         - podSelector: {}
  15.           namespaceSelector:
  16.             matchLabels:
  17.               kubernetes.io/metadata.name: openshift-monitoring
  18.   policyTypes:
  19.     - Ingress
  20. status: {}
1A selector that describes the pods to which the policy applies. The policy object can only select pods in the project that defines the NetworkPolicy object. In this documentation, it would be the project in which the Network Observability Operator is installed, which is the netobserv project.
2A selector that matches the pods from which the policy object allows ingress traffic. The default is that the selector matches pods in the same namespace as the NetworkPolicy.
3When the namespaceSelector is specified, the selector matches pods in the specified namespace.

Additional resources

Creating a network policy using the CLI