Viewing a network policy¶

As a cluster administrator, you can view a network policy for a namespace.

Example NetworkPolicy object¶

Reference the example NetworkPolicy object to understand how to configure this object.

kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
  name: allow-27107
spec:
  podSelector:
    matchLabels:
      app: mongodb
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: app
    ports:
    - protocol: TCP
      port: 27017

where:

name

The name of the NetworkPolicy object.

spec.podSelector

A selector that describes the pods to which the policy applies. The policy object can only select pods in the project that defines the NetworkPolicy object.

ingress.from.podSelector

A selector that matches the pods from which the policy object allows ingress traffic. The selector matches pods in the same namespace as the NetworkPolicy.

ingress.ports

A list of one or more destination ports on which to accept traffic.

View network policies using the CLI¶

You can examine the network policies in a namespace.

Prerequisites

• You installed the OpenShift CLI (oc).
• You are logged in to the cluster with a user with admin privileges.
• You are working in the namespace where the network policy exists.

Procedure

1. List network policies in a namespace.
   1. To view network policy objects defined in a namespace enter the following command:
      terminal

      $ oc get networkpolicy

   2. Optional: To examine a specific network policy enter the following command:
      terminal

      $ oc describe networkpolicy <policy_name> -n <namespace>

      where:

      <policy_name>

      Specifies the name of the network policy to inspect.

      <namespace>

      Optional: Specifies the namespace if the object is defined in a different namespace than the current namespace.

      terminal

      $ oc describe networkpolicy allow-same-namespace

      text

      Name:         allow-same-namespace
      Namespace:    ns1
      Created on:   2021-05-24 22:28:56 -0400 EDT
      Labels:       <none>
      Annotations:  <none>
      Spec:
        PodSelector:     <none> (Allowing the specific traffic to all pods in this namespace)
        Allowing ingress traffic:
          To Port: <any> (traffic allowed to all ports)
          From:
            PodSelector: <none>
        Not affecting egress traffic
        Policy Types: Ingress