// Module included in the following assemblies:
//
// * microshift_networking/microshift-network-policies.adoc

:_mod-docs-content-type: CONCEPT
[id="microshift-nw-network-policy-intro_{context}"]
= How network policy works in {microshift-short}

[role="_abstract"]
In a node that is using the default OVN-Kubernetes Container Network Interface (CNI) plugin for {microshift-short}, network isolation is controlled by both firewalld, which is configured on the host, and by `NetworkPolicy` objects created within {microshift-short}. Simultaneous use of firewalld and `NetworkPolicy` is supported.

* Network policies work only within boundaries of OVN-Kubernetes-controlled traffic, so they can apply to every situation except for `hostPort/hostNetwork` enabled pods.

* Firewalld settings also do not apply to `hostPort/hostNetwork` enabled pods.

* Firewalld rules run before any `NetworkPolicy` is enforced.

[WARNING]
====
Network policy does not apply to the host network namespace. Pods with host networking enabled are unaffected by network policy rules. However, pods connecting to the host-networked pods might be affected by the network policy rules.

Network policies cannot block traffic from localhost.
====

By default, all pods in a {microshift-short} node are accessible from other pods and network endpoints. To isolate one or more pods in a node, you can create `NetworkPolicy` objects to indicate allowed incoming connections. You can create and delete `NetworkPolicy` objects.

If a pod is matched by selectors in one or more `NetworkPolicy` objects, then the pod accepts only connections that are allowed by at least one of those `NetworkPolicy` objects. A pod that is not selected by any `NetworkPolicy` objects is fully accessible.

A network policy applies to only the TCP, UDP, ICMP, and SCTP protocols. Other protocols are not affected.

The following example `NetworkPolicy` objects demonstrate supporting different scenarios:

* Deny all traffic:
+
To make a project deny by default, add a `NetworkPolicy` object that matches all pods but accepts no traffic:
+
[source,yaml]
----
kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
  name: deny-by-default
spec:
  podSelector: {}
  ingress: []
----

* Allow connections from the default router, which is the ingress in {microshift-short}:
+
To allow connections from the {microshift-short} default router, add the following `NetworkPolicy` object:
+
[source,yaml]
----
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-from-openshift-ingress
spec:
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          ingresscontroller.operator.openshift.io/deployment-ingresscontroller: default
  podSelector: {}
  policyTypes:
  - Ingress
----

* Only accept connections from pods within the same namespace:
+
To make pods accept connections from other pods in the same namespace, but reject all other connections from pods in other namespaces, add the following `NetworkPolicy` object:
+
[source,yaml]
----
kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
  name: allow-same-namespace
spec:
  podSelector: {}
  ingress:
  - from:
    - podSelector: {}
----

* Only allow HTTP and HTTPS traffic based on pod labels:
+
To enable only HTTP and HTTPS access to the pods with a specific label (`role=frontend` in following example), add a `NetworkPolicy` object similar to the following:
+
[source,yaml]
----
kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
  name: allow-http-and-https
spec:
  podSelector:
    matchLabels:
      role: frontend
  ingress:
  - ports:
    - protocol: TCP
      port: 80
    - protocol: TCP
      port: 443
----

* Accept connections by using both namespace and pod selectors:
+
To match network traffic by combining namespace and pod selectors, you can use a `NetworkPolicy` object similar to the following:
+
[source,yaml]
----
kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
  name: allow-pod-and-namespace-both
spec:
  podSelector:
    matchLabels:
      name: test-pods
  ingress:
    - from:
      - namespaceSelector:
          matchLabels:
            project: project_name
        podSelector:
          matchLabels:
            name: test-pods
----

`NetworkPolicy` objects are additive, which means you can combine multiple `NetworkPolicy` objects together to satisfy complex network requirements.

For example, for the `NetworkPolicy` objects defined in previous examples, you can define both `allow-same-namespace` and `allow-http-and-https` policies. That configuration allows the pods with the label `role=frontend` to accept any connection allowed by each policy. That is, connections on any port from pods in the same namespace, and connections on ports `80` and `443` from pods in any namespace.
