Enforcing Kubernetes NetworkPolicy for Db2 Operator Version 2 workloads by using Kyverno (Enforce mode)

You can enforce Kubernetes NetworkPolicy for Db2 Operator Version 2 (V2) workloads by using Kyverno. This approach automatically generates network policies to restrict pod‑to‑pod traffic and enforce network isolation.

Before you begin

Important: This task applies only to restricted‑v2 Db2uInstance deployments.
Before you begin, ensure the following prerequisites are met:
  • Db2 Operator V2 must be installed with kyverno.enabled=true to ensure compatibility with clusters where Kyverno generate policies create Kubernetes NetworkPolicy resources.
  • Kyverno installed in the cluster.
  • Kyverno policies applied and configured to run in Enforce mode.
  • The cluster uses a container network interface (CNI) plug-in that supports Kubernetes NetworkPolicy.

About this task

By default, Kubernetes allows network communication between all pods in a cluster. To restrict pod‑to‑pod communication, you must use Kubernetes NetworkPolicy resources together with a compatible CNI plug-in.

You can use Kyverno generate policies to enforce network isolation for Db2 Operator V2 workloads. These policies automatically generate NetworkPolicy resources, including a default‑deny policy, for namespaces that host restricted‑v2 Db2 Operator V2 workloads. This ensures that only explicitly allowed network traffic is permitted.

Procedure

To enforce network isolation for Db2 Operator V2 workloads using Kyverno generate policies:

  1. Apply the Kyverno generate policy that creates a default‑deny NetworkPolicy: 
    oc apply -f https://raw.githubusercontent.com/kyverno/policies/main/best-practices/add-network-policy/add-network-policy.yaml
  2. Apply the Kyverno generate policy that allows DNS traffic: 
    oc apply -f https://raw.githubusercontent.com/kyverno/policies/main/best-practices/add-networkpolicy-dns/add-networkpolicy-dns.yaml
  3. Deploy a restricted‑v2 Db2uInstance.
  4. Deploy a valid Db2uInstance custom resource that uses the restricted‑v2 profile.
  5. Verify that the network policies were generated by confirming the following:
    • A default‑deny NetworkPolicy exists in the Db2 Operator V2 namespace.
    • A DNS‑allowing NetworkPolicy exists in the Db2 Operator V2 namespace.
    • Network traffic to and from Db2 Operator V2 workloads is restricted according to the generated policies.

Results

After enforcing network isolation, the following is true:
  • Kyverno generate policies automatically creates network policies for the Db2 Operator V2 namespace.
  • Network traffic to and from Db2 Operator V2 workloads is restricted by default.
  • Only explicitly allowed traffic, such as DNS, is permitted.
  • Db2 Operator V2 workloads run with enforced network isolation.