Installing new or updating network policies

After you applied the updated custom resource, you can install new network policies.

Before you begin

Generating and installing network policies is not supported if Cloud Pak for Business Automation is installed in All Namespaces.

About this task

During the upgrade of your CP4BA deployment, the shared_configuration.sc_generate_sample_network_policies parameter is added to the custom resource, and the value is set to false by default. If you want to generate new network policies, then you need to set the parameter value to true.

After you set the sc_generate_sample_network_policies parameter value to true, you must wait for the operators to complete reconcile before you can retrieve the network policy templates. You can check the status in the CP4BA custom resource (CR) to make sure that the deployment is complete (Ready).

The cp4a-network-policies.sh script can be found in the cert-kubernetes repository. The script helps you to install the network policies for your CP4BA production deployment.

The cert-kubernetes/scripts/cp4a-network-policies.sh script has three modes for a production deployment type:

generate: The generate mode copies the network policy files from the operators to the local subfolder named "network-policies".
Note: Network policy files are generated only for the capabilities that are included in your deployment. Some operators do not have network policy templates.
install: The install mode installs the network policies on your cluster.
delete: The delete mode removes the network policies from your cluster.

The script can be run with the following options:

sh ./cp4a-network-policies.sh --help
Usage:
cp4a-network-policies.sh -m [modeType] -n [cp4ba_namespace]
Options:
  -h  Display help
  -m  Required: The valid mode types are: [generate], [install], [delete]
  -n  Required: The target namespace of the CP4BA deployment.
                If CP4BA is deployed using separate namespaces for operators and operands/services, the value is the namespace where CP4BA operands/services are deployed.
Additional Information:
   STEP 1: Run the script in [generate] mode. This copies the sample network policy templates to folder [cert-kubernetes/scripts/network-policies/<namespace>/templates]
   STEP 2: Review and modify (if needed) the network policy templates based on your cluster environment.
   STEP 3: Apply the network policies in you cluster manually or optionally run the script in [install] mode to apply templates in the path [cert-kubernetes/scripts/network-policies/<namespace>/templates]

Run the script in generate mode to create files in the following structure.

Tip: The folder names match the component names that are defined in the CP4BA CR.

network-policies
└── <cp4ba-namespace>
    ├── logs
    └── templates
        ├── Content
        │   └── both
        |   └── egress
        |   └── ingress
        ├── CP4BA
        |   └── egress
        |   └── ingress
.....

Attention: The network policy templates might not work in all environments. You might need to adjust ingress or egress rules to make them work in your environment. For more information, see Configuring cluster security.

Use the following steps to install network policies for your CP4BA deployment on your cluster.

Procedure

oc login https://<CLUSTERIP>:<port> -u <ADMINISTRATOR>

Make sure that you are in the scripts folder under cert-kubernetes on the client machine you used to connect to the cluster.
```
cd $PATH_TO_EXTRACTED_FILES/cert-kubernetes/scripts
```
Create an environment variable to locate the target CP4BA namespace (cp4ba-project).
```
export NAMESPACE=<cp4ba-project>
```
Where <cp4ba-project> is the target namespace.

Note: If you chose to separate duties of the CP4BA operators and operands, use the project that you set for the $CP4A_OPERAND_NAMESPACE.
Run the cp4a-network-policies.sh script in generate mode to copy the network policies from the operators to the network-policies subfolder on the local machine.
```
./cp4a-network-policies.sh -m generate -n $NAMESPACE
```
Use the comments in the sample files to review, modify (if necessary), and complete necessary information. Enter values in all the fields that contain the placeholder value of <Required>.
Run the following command to find all the occurrences of <Required>.
```
grep -ir "required" <script_path>/network-policies/$NAMESPACE/templates
```
Where <script_path> is the path to the cp4a-network-policies.sh file.
Run the script in the install mode.
```
./cp4a-network-policies.sh -m install -n $NAMESPACE
```
Note: If your IBM Cloud Pak® for Business Automation deployment includes IBM Business Automation Workflow, restart the pods to maintain successful connectivity with the Business Automation Workflow database.
Install network policies for Cloud Pak foundational services. For more information, see Installing network policies for foundational services .

If a network policy restriction is in place, the Cloud Pak foundational services might have connectivity issues.

What to do next

If you need to delete the network policies for any reason, run the cp4a-network-policies.sh script in delete mode.

./cp4a-network-policies.sh -m delete -n $NAMESPACE

The script deletes only the network policies that are created by the CP4BA operators and found in the cert-kubernetes/scripts/network-policies/<namespace>/templates folder. Any other network policies that you created are not deleted.

To uninstall the network policies of the Cloud Pak foundational services, see Uninstalling network policies for foundational services External link opens a new window or tab .

Attention: If you plan to modify the CR after you installed the network policies, the update might need new network policies. Therefore, re-run the cp4a-network-policies.sh script with the generate and install modes to apply the new network policies. Always wait for the reconciliation to complete successfully before you run the script again. Confirm that all the components in the CR are successfully installed and can be retrieved by checking the status section of the applied CR file.