Define custom egress network policy for Data Product Hub

You can define custom egress network policies for DataProduct API pods to enable controlled outbound traffic to external IP addresses and ports by setting up the externalEgress configuration.

The configuration is useful for:

  • Allowing access to external databases
  • Enabling connections to external APIs
  • Configuring access to cloud services
  • Implementing network security policies

Prerequisites

  • Access to OpenShift cluster with appropriate permissions
  • DataProduct operator that is installed and running
  • Existing DataProduct CR or the ability to create one
  • Understanding of CIDR notation and network policies

Follow these steps to configure the externalEgress field in the DataProduct Custom Resource (CR) for external network egress management in an OpenShift cluster.

Step 1: Plan Your External Egress Rules

Identify your external egress rules before you configure externalEgress in DataProduct Custom Resource:

  1. External Services: What external services need to be accessed?
  2. IP Ranges: What are the CIDR blocks for these services?
  3. Protocols: TCP or UDP?
  4. Ports: Which ports are required?

Planning Table Example

Service CIDR Block Protocol Port Purpose
External DB 10.0.0.0/24 TCP 5432 PostgreSQL database
External API 192.168.1.0/24 TCP 443, 8443 REST API endpoints
Cloud Service 172.16.0.0/16 TCP 443 Cloud provider services

Step 2: Configure externalEgress in DataProduct Custom Resource

The following code block shows a basic configuration example to configure externalEgress in DataProduct Custom Resource:

apiVersion: data-product.cpd.ibm.com/v1beta1
kind: DataProduct
metadata:
  name: dataproduct-cr
  namespace: cpd-instance
  labels:
    app.kubernetes.io/instance: ibm-cpd-data-product-controller-manager
    app.kubernetes.io/managed-by: ibm-cpd-data-product-controller-manager
    app.kubernetes.io/name: ibm-cpd-data-product-controller-manager
spec:
  version: "5.3.0"
  scaleConfig: "small"
  storageClass: "managed-nfs-storage"
  license:
    accept: true
    license: Enterprise
  
  # External Egress Configuration
  externalEgress:
    cidrConfig:
      # Rule 1: External database access
      - ipBlock:
          cidr: 10.0.0.0/24
        ports:
          - protocol: TCP
            port: 5432
          - protocol: TCP
            port: 3306
      
      # Rule 2: External API endpoints
      - ipBlock:
          cidr: 192.168.1.0/24
        ports:
          - protocol: TCP
            port: 443
          - protocol: TCP
            port: 8443
      
      # Rule 3: Cloud services
      - ipBlock:
          cidr: 172.16.0.0/16
        ports:
          - protocol: TCP
            port: 443

Step 3: Apply the Configuration

Add or modify the externalEgress section in the spec.

oc edit dataproduct dataproduct-cr -n <namespace>

Step 4: Verify the Configuration

  1. Check the DataProduct CR:
oc get dataproduct dataproduct-cr -n <namespace> -o yaml

  1. Look for the externalEgress section in the spec:
  spec:
    externalEgress:
      cidrConfig:
        - ipBlock:
            cidr: 10.0.0.0/24
          ports:
            - protocol: TCP
              port: 443

  1. Extract externalEgress configuration only:
oc get dataproduct dataproduct-cr -n <namespace> -o jsonpath='{.spec.externalEgress}' | jq

Step 5: Verify NetworkPolicy Update

  1. The DataProduct operator automatically creates or updates the NetworkPolicy based on the externalEgress configuration.
  • List NetworkPolicies
    oc get networkpolicy -n <namespace> | grep dataproduct

  • Describe the NetworkPolicy 
  oc describe networkpolicy dataproduct-api-network-policy -n <namespace>

  1. The expected output shows egress rules to match your configuration:
    Spec:
      PodSelector:     app=dataproduct-api
      Allowing egress traffic:
        To:
          IPBlock:
            CIDR: 10.0.0.0/24
          Ports:
            Protocol: TCP
            Port: 5432
            Protocol: TCP
            Port: 3306
        To:
          IPBlock:
            CIDR: 192.168.1.0/24
          Ports:
            Protocol: TCP
            Port: 443
            Protocol: TCP
            Port: 8443

  1. View your NetworkPolicy YAML
  oc get networkpolicy dataproduct-api-network-policy -n <namespace> -o yaml

Step 6: Test Connectivity

Test the connectivity from the DataProduct API Pod:

  1. Get the pod name:
    oc get pods -n <namespace> | grep dataproduct-api

  1. Test connectivity to external service:
    # Test TCP connection
    oc exec -it <dataproduct-api-pod-name> -n <namespace> -- curl -v telnet://10.0.0.5:5432

    # Test HTTPS endpoint
    oc exec -it <dataproduct-api-pod-name> -n <namespace> -- curl -v https://192.168.1.10:443

    # Test with timeout
    oc exec -it <dataproduct-api-pod-name> -n <namespace> -- timeout 5 bash -c 'cat < /dev/null > /dev/tcp/10.0.0.5/5432'

Step 7: Monitor and troubleshoot

  1. Check the operator logs:
  # Find operator pod
  oc get pods -n <operator-namespace> | grep data-product-operator

  # View logs
  oc logs -f <operator-pod-name> -n <operator-namespace>

  1. Check the DataProduct Custom Resource status:
  oc get dataproduct dataproduct-cr -n <namespace> -w

The outputs of your status fields look like this:

  • Status: Completed
  • Reconciled: Your version
  • Percent: 100%

Configuration Examples

Example 1: Single External Database

externalEgress:
  cidrConfig:
    - ipBlock:
        cidr: 10.20.30.0/24
      ports:
        - protocol: TCP
          port: 5432

Example 2: Specific External API Endpoints

externalEgress:
  cidrConfig:
    - ipBlock:
        cidr: 203.0.113.0/24  # External API server range
      ports:
        - protocol: TCP
          port: 443
        - protocol: TCP
          port: 8443
        - protocol: TCP
          port: 9443

Learn more

Administering Data Product Hub