Chapter 2. Network policies A cluster hosts two types of projects: Projects associated with managed services. These projects support inbound and outbound connections. User projects. These projects support communication from managed services. In OpenShift Dedicated, there are two approaches to enabling communications: Using network policies Using the join-project option of the oc command In OpenShift API Management, you can use network policies to enable communication and allow 3scale to communicate directly with the service endpoint, instead of the external URL. You cannot use the join-projects option of the oc command with managed services projects. 2.1. Enabling communication between managed services and customer applications You can create NetworkPolicy objects to define granular rules describing the Ingress network traffic that is allowed for projects in your cluster. By default, when you create projects in a cluster, communication between the projects is disabled. This procedure describes how to enable communication for a project so that managed services, such as 3scale, can access customer applications. Prerequisites You have installed the OpenShift command-line interface (CLI), commonly known as oc . Procedure Log in to the cluster using the oc login command. Use the following command to change the project: where <project_name> is the name of a project that you want to accept communications from other projects. Create a NetworkPolicy object: Create a allow-from-middleware-namespaces.yaml file. Define a policy in the file you just created, such as in the following example: Run the following command to create the policy object: 2.2. Enabling communication between managed services and projects By default, when you create projects in a cluster, communication between the projects is disabled. Use this procedure to enable communication in a project. Prerequisites You have installed the OpenShift command-line interface (CLI), commonly known as oc . Procedure Log in to the cluster using the oc login command. Use the following command to change the project: where <project_name> is the name of a project that you want to accept communications from other projects. Create a NetworkPolicy object: Create a NetworkPolicy.yaml file. Define a policy in the file you just created, such as in the following example. This policy enables incoming communication for all projects in the cluster: Note This policy configuration enables this project to communicate with all projects in the cluster. Run the following command to create the policy object: 2.3. Enabling communication between customer applications You can enable communication between user applications. Prerequisites You have installed the OpenShift command-line interface (CLI), commonly known as oc . Procedure Log in to the cluster using the oc login command. Use the following command to change the project: <project_name> is the name of a project that you want to accept communications from. Create a NetworkPolicy object: Create a allow-from-myproject-namespace.yaml file. Define a policy in the file you just created, such as in the following example. This policy enables incoming communication for a specific project ( myproject ): Run the following commands to create the policy object: 2.4. Disabling communication from a managed service to a project By default, projects are created with a template that allows communication from a managed service. For example, 3scale can communicate with all of your projects. You can disable the communication from a managed service to a project. Prerequisites You have installed the OpenShift command-line interface (CLI), commonly known as oc You have a project you want to isolate from the managed services. Procedure Log in to the cluster using the oc login command. Use the following command to change the project: where <project_name> is the name of a project that you want to isolate from the managed services. Create a NetworkPolicy object: Create a deny-all.yaml file. Define a policy in the file you just created, such as in the following example: Run the following command to create the policy object: 2.5. Additional resources Networking in OpenShift Dedicated

Commands:
oc project <project_name>
apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: allow-from-middleware-namespaces spec: podSelector: ingress: - from: - namespaceSelector: matchLabels: integreatly-middleware-service: 'true'
oc create -f allow-from-middleware-namespaces.yaml -n <project> networkpolicy "allow-from-middleware-namespaces" created
oc project <project_name>
kind: NetworkPolicy apiVersion: networking.k8s.io/v1 metadata: name: allow-all spec: podSelector: ingress: - {}
oc create -f <policy-name>.yaml -n <project>
oc project <project_name>
apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: allow-from-myproject-namespace spec: podSelector: ingress: - from: - namespaceSelector: matchLabels: project: myproject
oc create -f allow-from-myproject-namespace.yaml -n <project> networkpolicy "allow-from-myproject-namespace" created
oc project <project_name>
kind: NetworkPolicy apiVersion: networking.k8s.io/v1 metadata: name: deny-all spec: podSelector: {} ingress: - from: - namespaceSelector: matchLabels: integreatly-middleware-service: 'true'
oc create -f <policy-name>.yaml -n <project>