Help Center/ Cloud Container Engine/ User Guide/ Old Console/ Namespaces/ Configuring a Namespace-level Network Policy
Updated on 2024-11-11 GMT+08:00
View PDF

Configuring a Namespace-level Network Policy

You can configure a namespace-level network policy after enabling network isolation.

By default, Network Isolation is disabled for namespaces. For example, if network isolation is off for namespace default, all workloads in the current cluster can access the workloads in namespace default.

To prevent other workloads from accessing the workloads in namespace default, perform the following steps:

Only clusters that use the tunnel network model support network isolation.

Prerequisites

Procedure

  1. Log in to the CCE console. In the navigation pane, choose Resource Management > Namespaces.
  2. Select the cluster to which the namespace belongs from the Clusters drop-down list.
  3. At the row of a namespace (for example, default), switch on Network Isolation.

    After network isolation is enabled, workloads in namespace default can access each other but they cannot be accessed by workloads in other namespaces.

    Figure 1 Setting network isolation for a namespace

Network Isolation Description

Enabling network isolation is to create a network policy in a namespace. The network policy selects all pods in the namespace and prevents pods in other namespaces from accessing.

kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
    name: deny-default
    namespace: default
spec:
    ingress:
        - from:
          - podSelector: {}
    podSelector: {}                     # {} indicates that all pods are selected.

You can also customize a network policy. For details, see Configuring Network Policies to Restrict Pod Access.

Parent Topic: Namespaces