Skip to content

Commit ab87505

Browse files
authored
Merge pull request #14 from appuio/update/netpol
Update network policies overview with new default policy names
2 parents 486d24e + 8ffb138 commit ab87505

File tree

1 file changed

+10
-3
lines changed

1 file changed

+10
-3
lines changed

docs/modules/ROOT/pages/network/network-policies.adoc

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -64,12 +64,13 @@ To summarize, Kubernetes network policies have the following properties:
6464

6565
VSHN Managed OpenShift deploys default network policies in each namespace which isolate namespaces from each other.
6666
The default network policies are managed actively and not intended to be modified by users.
67+
The managed policies are organized into policy sets which can be enabled and disabled individually.
6768

6869
By default the following policies are deployed:
6970

70-
`NetworkPolicy/allow-from-other-namespaces`:: Allows incoming traffic from the monitoring stack, cluster ingress controllers, and pods with `hostNetwork: true`.
71-
`NetworkPolicy/allow-from-same-namespace`:: Allows unrestricted traffic within the same namespace.
72-
`CiliumNetworkPolicy/allow-from-cluster-nodes`:: Allows traffic from the cluster's nodes.
71+
`NetworkPolicy/syn-internal-set-base`:: Allows incoming traffic from the monitoring stack, cluster ingress controllers, and pods with `hostNetwork: true`.
72+
`NetworkPolicy/syn-set-default-allow-intra-namespace`:: Allows unrestricted traffic within the same namespace.
73+
`CiliumNetworkPolicy/syn-internal-set-base`:: Allows traffic from the cluster's nodes.
7374

7475
Any other traffic (in particular traffic from arbitrary other namespaces) is denied by the default policies.
7576
Because policies are additive, you can easily allow additional traffic by deploying additional `NetworkPolicy` objects in a namespace.
@@ -88,6 +89,12 @@ Once that label is set on a namespace, changes or deletions of the default polic
8889
When setting the label, the user becomes responsible to ensure that cluster components such as the ingress controller or the monitoring stack are allowed to access workloads if desired.
8990
====
9091

92+
[TIP]
93+
====
94+
For advanced use cases on VSHN Managed OpenShift, we can deploy additional policy sets on user request.
95+
Please contact us if you're interested in using additional policy sets on your clusters.
96+
====
97+
9198
== Additional resources
9299

93100
The Kubernetes documentation on https://kubernetes.io/docs/concepts/services-networking/network-policies/[network policies] is a valuable resource.

0 commit comments

Comments
 (0)