openshift/openshift-docs
1
0
Fork 0
mirror of https://github.com/openshift/openshift-docs.git synced 2026-02-05 12:46:18 +01:00
Code Issues Releases Activity

Merge pull request #93023 from openshift-cherrypick-robot/cherry-pick-92799-to-enterprise-4.19

Browse Source 
[enterprise-4.19] OSDOCS-14395:adds note about legacy behavior for nil selector in netpol
This commit is contained in:
Joe Aldinger
2025-05-06 08:22:49 -04:00
committed by GitHub
parent 01d420904e 9a2b37a01d
commit dd7a779361
1 changed files with 6 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
modules/nw-networkpolicy-about.adoc
View File

@@ -10,13 +10,16 @@ By default, all pods in a project are accessible from other pods and network end
If a pod is matched by selectors in one or more `NetworkPolicy` objects, then the pod will accept only connections that are allowed by at least one of those `NetworkPolicy` objects. A pod that is not selected by any `NetworkPolicy` objects is fully accessible.
A network policy applies to only the TCP, UDP, ICMP, and SCTP protocols. Other protocols are not affected.
A network policy applies to only the Transmission Control Protocol (TCP), User Datagram Protocol (UDP), Internet Control Message Protocol (ICMP), and Stream Control Transmission Protocol (SCTP) protocols. Other protocols are not affected.
[WARNING]
====
Network policy does not apply to the host network namespace. Pods with host networking enabled are unaffected by network policy rules. However, pods connecting to the host-networked pods might be affected by the network policy rules.
* A network policy does not apply to the host network namespace. Pods with host networking enabled are unaffected by network policy rules. However, pods connecting to the host-networked pods might be affected by the network policy rules.
Network policies cannot block traffic from localhost or from their resident nodes.
* Using the `namespaceSelector` field without the `podSelector` field set to `{}` will not include `hostNetwork` pods. You must use the `podSelector` set to `{}` with the `namespaceSelector` field in order to target `hostNetwork` pods when creating network policies.
* Network policies cannot block traffic from localhost or from their resident nodes.
====
The following example `NetworkPolicy` objects demonstrate supporting different scenarios: