Optional: Installing network policies

The CP4BA operators do not create network policies, but you can use the utility script cp4a-network-policies.sh to retrieve and install network policy templates to restrict network access.

shared_configuration.sc_generate_sample_network_policies: true

sh ./cp4a-network-policies.sh --help
Usage:
cp4a-network-policies.sh -m [modeType] -n [cp4ba_namespace]
Options:
  -h  Display help
  -m  Required: The valid mode types are: [generate], [install], [delete]
  -n  Required: The target namespace of the CP4BA deployment.
                If CP4BA is deployed using separate namespaces for operators and operands/services, the value is the namespace where CP4BA operands/services are deployed.
Additional Information:
   STEP 1: Run the script in [generate] mode. This copies the sample network policy templates to folder [cert-kubernetes/scripts/network-policies/<namespace>/templates]
   STEP 2: Review and modify (if needed) the network policy templates based on your cluster environment.
   STEP 3: Apply the network policies in you cluster manually or optionally run the script in [install] mode to apply templates in the path [cert-kubernetes/scripts/network-policies/<namespace>/templates]

network-policies
└── <cp4ba-namespace>
    ├── logs
    └── templates
        ├── Content
        │   └── both
        |   └── egress
        |   └── ingress
        ├── CP4BA
        |   └── egress
        |   └── ingress
.....

1. Log in to the cluster as the <cluster-admin> user.

   Using the Red Hat OpenShift CLI, run the following command.

   oc login https://<cluster-ip>:<port> -u <cluster-admin> -p <password>

   On ROKS, if you are not already logged in, run the following command.

   oc login --token=<token> --server=https://<cluster-ip>:<port>

2. Make sure that you are in the scripts folder under cert-kubernetes on the client machine you used to connect to the cluster.

   cd $PATH_TO_EXTRACTED_FILES/cert-kubernetes/scripts

3. Create an environment variable to locate the target CP4BA namespace (cp4ba-project).

   export NAMESPACE=<cp4ba-project>

   Note: If you chose to separate duties of the CP4BA operators and operands, use the project that you set for the $CP4A_OPERAND_NAMESPACE.
4. Run the cp4a-network-policies.sh script in generate mode to copy the network policies from the operators to the network-policies subfolder on the local machine.

   ./cp4a-network-policies.sh -m generate -n $NAMESPACE

5. Use the comments in the sample files to review, modify (if necessary), and complete necessary information. Enter values in all the fields that contain the placeholder value of <Required>.

   Run the following command to find all the occurrences of <Required>.

   grep -ir "required" <script_path>/network-policies/$NAMESPACE/templates

   Where <script_path> is the path to the cp4a-network-policies.sh file.

   The following example shows the comments that are generated in the egress/templates/dpe/ folder.

   # This network policy is for Document Processing backend to communicate to the database(s).
   # This network policy is specific to the dc_ca_datasource section of the CR.
   # You may adjust the egress' section to fit your requirement.  For example, if your database is container-base and deployed in the same cluster but in a different ns, you may want to try to use
   # egress:
   #   - to:
   #     - podSelector: {}
   #       namespaceSelector:
   #         matchExpressions:
   #           - key: kubernetes.io/metadata.name
   #             operator: In
   #             values:
   #               - "<DB namespace>"
   # Below is the sample network policy that based on cidr range.  
   # DO NOT modify the podSelector as it may affect the communication. 
   kind: NetworkPolicy
   apiVersion: networking.k8s.io/v1
   metadata:
     namespace: "$CP4A_OPERAND_NAMESPACE"
     name: '$META_NAME-aca-netpol-db'
     labels:
       app.kubernetes.io/name: "$META_NAME-aca"
       app.kubernetes.io/component: "ACA"
       app.kubernetes.io/instance: "$META_NAME-aca"
       app.kubernetes.io/version: "25.0.0"
   spec:
     podSelector:
       matchExpressions:
         - key: app.kubernetes.io/name
           operator: In
           values:
             - '$META_NAME-aca'
             - 'ibm-dpe-operator'
     egress:
     - to:
       - ipBlock:
           cidr: "" #<Required> Fill out the database cidr range such as 1.2.3.4/32
       ports:
         - protocol: TCP  
           port: #<Required> Fill out the port number for database
   
     policyTypes:
     - Egress

6. Run the script in the "install" mode.

   ./cp4a-network-policies.sh -m install -n $NAMESPACE

   Note: If your IBM Cloud Pak® for Business Automation deployment includes IBM Business Automation Workflow, restart the pods to maintain successful connectivity with the Business Automation Workflow database.
7. Install network policies for Cloud Pak foundational services. For more information, see Installing network policies for foundational services .

   If a network policy restriction is in place, the Cloud Pak foundational services might have connectivity issues.

./cp4a-network-policies.sh -m delete -n $NAMESPACE