// Module included in the following assemblies:
//
// * networking/network_security/network_policy/about-network-policy.adoc

:_mod-docs-content-type: REFERENCE
[id="nw-network-policy-examples_{context}"]
= Network policy examples

[role="_abstract"]
You can define network policies that restrict traffic to pods in your cluster.

The following examples show `NetworkPolicy` objects for different traffic scenarios.

[id="nw-network-policy-deny-all_{context}"]
== Example: Deny all traffic
To make a project deny traffic by default, add a `NetworkPolicy` object that matches all pods but accepts no traffic.

[source,yaml]
----
kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
  name: deny-by-default
spec:
  podSelector: {}
  ingress: []
----

[id="nw-network-policy-allow-ingress_{context}"]
== Example: Allow connections from the Ingress Controller
To allow only connections from the {product-title} Ingress Controller, add the following `NetworkPolicy` object.

[source,yaml]
----
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-from-openshift-ingress
spec:
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          policy-group.network.openshift.io/ingress: ""
  podSelector: {}
  policyTypes:
  - Ingress
----

[id="nw-network-policy-allow-same-namespace_{context}"]
== Example: Allow connections from pods in the same project
To allow pods to accept connections from other pods in the same project while rejecting connections from other projects, add the following object.

[IMPORTANT]
====
To allow ingress connections from `hostNetwork` pods in the same namespace, you must apply the `allow-from-hostnetwork` policy together with the `allow-same-namespace` policy.
====

[source,yaml]
----
kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
  name: allow-same-namespace
spec:
  podSelector: {}
  ingress:
  - from:
    - podSelector: {}
----

[id="nw-network-policy-allow-http-https_{context}"]
== Example: Allow HTTP and HTTPS traffic based on pod labels
To enable only HTTP and HTTPS access to pods with a specific label, such as `role=frontend`, use an object similar to the following.

[source,yaml]
----
kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
  name: allow-http-and-https
spec:
  podSelector:
    matchLabels:
      role: frontend
  ingress:
  - ports:
    - protocol: TCP
      port: 80
    - protocol: TCP
      port: 443
----

[id="nw-network-policy-allow-pod-namespace_{context}"]
== Example: Accept connections using both namespace and pod selectors
To match network traffic by combining namespace and pod selectors, use an object similar to the following.

[source,yaml]
----
kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
  name: allow-pod-and-namespace-both
spec:
  podSelector:
    matchLabels:
      name: test-pods
  ingress:
    - from:
      - namespaceSelector:
          matchLabels:
            project: project_name
        podSelector:
          matchLabels:
            name: test-pods
----