Configuring an egress firewall for a project

As a cluster administrator, you can create an egress firewall for a project that restricts egress traffic leaving your OKD cluster.

How an egress firewall works in a project

As a cluster administrator, you can use an egress firewall to limit the external hosts that some or all pods can access from within the cluster. An egress firewall supports the following scenarios:

  • A pod can only connect to internal hosts and cannot initiate connections to the public Internet.

  • A pod can only connect to the public Internet and cannot initiate connections to internal hosts that are outside the OKD cluster.

  • A pod cannot reach specified internal subnets or hosts outside the OKD cluster.

  • A pod can connect to only specific external hosts.

For example, you can allow one project access to a specified IP range but deny the same access to a different project. Or you can restrict application developers from updating from Python pip mirrors, and force updates to come only from approved sources.

You configure an egress firewall policy by creating an EgressFirewall custom resource (CR) object. The egress firewall matches network traffic that meets any of the following criteria:

  • An IP address range in CIDR format

  • A port number

  • A protocol that is one of the following protocols: TCP, UDP, and SCTP

If your egress firewall includes a deny rule for 0.0.0.0/0, access to your OKD API servers is blocked. To ensure that pods can continue to access the OKD API servers, you must include the IP address range that the API servers listen on in your egress firewall rules, as in the following example:

  1. apiVersion: k8s.ovn.org/v1
  2. kind: EgressFirewall
  3. metadata:
  4.   name: default
  5.   namespace: <namespace> (1)
  6. spec:
  7.   egress:
  8.   - to:
  9.       cidrSelector: <api_server_address_range> (2)
  10.     type: Allow
  11. # …
  12.   - deny:
  13.       cidrSelector: 0.0.0.0/0 (3)
  14.     type: Deny
1The namespace for the egress firewall.
2The IP address range that includes your OKD API servers.
3A global deny rule prevents access to the OKD API servers.

To find the IP address for your API servers, run oc get ep kubernetes -n default.

For more information, see BZ#1988324.

Egress firewall rules do not apply to traffic that goes through routers. Any user with permission to create a Route CR object can bypass egress firewall policy rules by creating a route that points to a forbidden destination.

Limitations of an egress firewall

An egress firewall has the following limitations:

  • No project can have more than one EgressFirewall object.

  • A maximum of one EgressFirewall object with a maximum of 8,000 rules can be defined per project.

Violating any of these restrictions results in a broken egress firewall for the project, and may cause all external network traffic to be dropped.

Matching order for egress firewall policy rules

The egress firewall policy rules are evaluated in the order that they are defined, from first to last. The first rule that matches an egress connection from a pod applies. Any subsequent rules are ignored for that connection.

EgressFirewall custom resource (CR) object

You can define one or more rules for an egress firewall. A rule is either an Allow rule or a Deny rule, with a specification for the traffic that the rule applies to.

The following YAML describes an EgressFirewall CR object:

EgressFirewall object

  1. apiVersion: k8s.ovn.org/v1
  2. kind: EgressFirewall
  3. metadata:
  4.   name: <name> (1)
  5. spec:
  6.   egress: (2)
  7.     ...
1The name for the object must be default.
2A collection of one or more egress network policy rules as described in the following section.

EgressFirewall rules

The following YAML describes an egress firewall rule object. The egress stanza expects an array of one or more objects.

Egress policy rule stanza

  1. egress:
  2. - type: <type> (1)
  3.   to: (2)
  4.     cidrSelector: <cidr> (3)
  5.   ports: (4)
  6.       ...
1The type of rule. The value must be either Allow or Deny.
2A stanza describing an egress traffic match rule.
3An IP address range in CIDR format.
4Optional: A stanza describing a collection of network ports and protocols for the rule.

Ports stanza

  1. ports:
  2. - port: <port> (1)
  3.   protocol: <protocol> (2)
1A network port, such as 80 or 443. If you specify a value for this field, you must also specify a value for protocol.
2A network protocol. The value must be either TCP, UDP, or SCTP.

Example EgressFirewall CR objects

The following example defines several egress firewall policy rules:

  1. apiVersion: k8s.ovn.org/v1
  2. kind: EgressFirewall
  3. metadata:
  4.   name: default
  5. spec:
  6.   egress: (1)
  7.   - type: Allow
  8.     to:
  9.       cidrSelector: 1.2.3.0/24
  10.   - type: Deny
  11.     to:
  12.       cidrSelector: 0.0.0.0/0
1A collection of egress firewall policy rule objects.

The following example defines a policy rule that denies traffic to the host at the 172.16.1.1 IP address, if the traffic is using either the TCP protocol and destination port 80 or any protocol and destination port 443.

  1. apiVersion: k8s.ovn.org/v1
  2. kind: EgressFirewall
  3. metadata:
  4.   name: default
  5. spec:
  6.   egress:
  7.   - type: Deny
  8.     to:
  9.       cidrSelector: 172.16.1.1
  10.     ports:
  11.     - port: 80
  12.       protocol: TCP
  13.     - port: 443

Creating an egress firewall policy object

As a cluster administrator, you can create an egress firewall policy object for a project.

If the project already has an EgressFirewall object defined, you must edit the existing policy to make changes to the egress firewall rules.

Prerequisites

  • A cluster that uses the OVN-Kubernetes default Container Network Interface (CNI) network provider plug-in.

  • Install the OpenShift CLI (oc).

  • You must log in to the cluster as a cluster administrator.

Procedure

  1. Create a policy rule:

    1. Create a <policy_name>.yaml file where <policy_name> describes the egress policy rules.

    2. In the file you created, define an egress policy object.

  2. Enter the following command to create the policy object. Replace <policy_name> with the name of the policy and <project> with the project that the rule applies to.

    1. $ oc create -f <policy_name>.yaml -n <project>

    In the following example, a new EgressFirewall object is created in a project named project1:

    1. $ oc create -f default.yaml -n project1

    Example output

    1. egressfirewall.k8s.ovn.org/v1 created

  3. Optional: Save the <policy_name>.yaml file so that you can make changes later.