OpenShift Day 3 Guide

Networking

OpenShift ships a full software-defined networking stack. Day 3 networking means Routes, Services, Ingress, NetworkPolicies, and egress controls.

Services

A Service is a stable virtual IP that load-balances across Pod replicas. Choose the right type for your access pattern.

apiVersion: v1
kind: Service
metadata:
  name: api-server
  namespace: mission-ops
spec:
  selector:
    app: api-server
  ports:
  - name: http
    port: 80
    targetPort: 8080
  - name: https
    port: 443
    targetPort: 8443
  type: ClusterIP

Routes (OpenShift-native Ingress)

Routes are OpenShift's native way to expose services externally through the HAProxy-based router. More feature-rich than standard Ingress objects.

apiVersion: route.openshift.io/v1
kind: Route
metadata:
  name: api-server
  namespace: mission-ops
spec:
  host: api.example.com
  to:
    kind: Service
    name: api-server
    weight: 100
  port:
    targetPort: http
  tls:
    termination: edge               # edge | passthrough | reencrypt
    insecureEdgeTerminationPolicy: Redirect
  wildcardPolicy: None

NetworkPolicy

NetworkPolicies are the firewall rules of your cluster. By default all Pods can talk to all other Pods — a deny-all baseline plus explicit allows is best practice for production.

# Step 1: deny all ingress in the namespace
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-ingress
  namespace: mission-ops
spec:
  podSelector: {}
  policyTypes:
  - Ingress
---
# Step 2: allow ingress only from the ingress controller
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-from-router
  namespace: mission-ops
spec:
  podSelector:
    matchLabels:
      app: api-server
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          network.openshift.io/policy-group: ingress
---
# Step 3: allow inter-service traffic within the namespace
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-same-namespace
  namespace: mission-ops
spec:
  podSelector: {}
  ingress:
  - from:
    - podSelector: {}

Egress Controls

Control outbound traffic with EgressNetworkPolicy or EgressFirewall (OVN-Kubernetes). Use to restrict which external IPs namespaces can reach.

apiVersion: k8s.ovn.org/v1
kind: EgressFirewall
metadata:
  name: egress-rules
  namespace: mission-ops
spec:
  egress:
  - type: Allow
    to:
      dnsName: api.external-service.com
  - type: Allow
    to:
      cidrSelector: 10.0.0.0/8      # Allow RFC1918 (on-prem)
  - type: Deny
    to:
      cidrSelector: 0.0.0.0/0       # Block everything else