Skip to main content

In 23R1, if you were asked by your IT SecOps team, what exactly does ifscore.networkpolicy.enabled do?

 

The documentation just repeats the name of the parameter.

 

https://docs.ifs.com/techdocs/21r1/foundation1/020_installation/200_installing_ifs_cloud/035_ifs_cloud_ifsinstaller/030_installation_parameters/

“Set to true to activate network policy”

 

https://docs.ifs.com/techdocs/21r2/020_installation/200_installing_ifs_cloud/035_ifs_cloud_ifsinstaller/030_installation_parameters/

“Set to true to activate network policy”

 

https://docs.ifs.com/techdocs/22r1/070_remote_deploy/010_installing_fresh_system/200_installing_ifs_cloud/035_ifs_cloud_ifsinstaller/030_installation_parameters/

(This parameter isn’t listed here.)

 

https://docs.ifs.com/techdocs/22r2/070_remote_deploy/010_installing_fresh_system/200_installing_ifs_cloud/035_ifs_cloud_ifsinstaller/030_installation_parameters/

(This parameter isn’t listed here.)

 

https://docs.ifs.com/techdocs/23r1/070_remote_deploy/010_installing_fresh_system/200_installing_ifs_cloud/035_ifs_cloud_ifsinstaller/030_installation_parameters/

“Set to true to activate network policy”

The easiest way to confirm a Helm setting is to verify the Helm chart definitions.
From the Windows Management PC (the below assumes that the JFrog IFSCloud repository has already been added from a previous installation):

mkdir tmp
cd tmp
helm repo list
helm repo update
helm search repo ifs
helm pull ifscloud/ifs-cloud --untar

In tmp\ifs-cloud\charts\ifscore\templates\network.yaml, there is a Helm if block for when "networkpolicy.enabled" is set.
There are multiple Kubernetes NetworkPolicy resources, each applied to specific matching resources.
They allow / disallow specific traffic: ingress, egress, ports, TCP/UDP, IP range etc.
See Kubernetes documentation for NetworkPolicy for complete details:https://kubernetes.io/docs/concepts/services-networking/network-policies/

You can then list all of the NetworkPolicy resources in your cluster:

kubectl get networkpolicy -A

You can select one of them to view the actual definition and confirm the details in the above NetworkPolicy documentation.

kubectl get networkpolicy/<networkpolicy resource> -n <namespace> -o yaml

You can remove the tmp folder to cleanup if you wish.

Best regards, Ben


Reply