Network policies

Cluster Network Policies are responsible for managing access control rules at the project level. When this feature is enabled, different projects are, by default, isolated from each other, and computing components within different projects cannot communicate over the network. Communication can be achieved by adding rules for Access between Projects or Access Using IP Addresses.

After the cluster network policies are configured, the configuration will be synchronized to the namespaces under the cluster. Developers can view the cluster network policies in the network policy module of the container platform.

Cautions

• Whether the cluster network policies take effect depends on whether the network plugin used by the cluster supports network policies.

  • Kube-OVN and Calico support network policies.

  • Flannel does not support network policies.

  • When accessing the cluster or using a custom network plugin, you can refer to relevant documents to confirm the support status.

• This feature is in alpha maturity in Kube-OVN network mode.

Procedure

1. In the left navigation bar, click Networking > Network Policies.

2. Click Configure Now.

3. Refer to the following instructions to complete the configuration.

   Configuration Item	Description
   Isolation between Projects	Indicates whether to enable the switch for full isolation between projects. The switch is enabled by default and can be turned off by clicking it. After the switch is turned on, network isolation is implemented between all projects on the current cluster, and other resources cannot access any project in the cluster (for example, external IP addresses and load balancers). This does not affect the access of projects to resources outside the cluster.
   Access between Projects	This parameter is only valid when the Isolation between Projects switch is turned on. Configure the Source and Target that are allowed for one-way access. Click the Add button to add a configuration record, and multiple records can be added. Click the Source drop-down box to select a project or all projects that the target project can be accessed; click the Target drop-down box to select the target project that is being accessed.
   Access Using IP Addresses	This parameter is only valid when the Isolation between Projects switch is turned on. Configure the specific IP/Network Segment and Target that are allowed for one-way access. Click the Add button to add a configuration record, and multiple records can be added. In the Source IP Segment input box, enter the IP or CIDR network segment of the target project to be accessed; click the Target drop-down box to select the target project that is being accessed.

4. Click Configuration.