<commit_before>// Module included in the following assemblies:
//
// * networking/network_policy/multitenant-network-policy.adoc
// * post_installation_configuration/network-configuration.adoc

ifeval::[{product-version} >= 4.6]
:ovn:
endif::[]

[id="nw-networkpolicy-multitenant-isolation_{context}"]
= Configuring multitenant isolation by using network policy

You can configure your project to isolate it from pods and services in other
project namespaces.

.Prerequisites

* Your cluster uses a cluster network provider that supports `NetworkPolicy` objects, such as
ifndef::ovn[]
the OpenShift SDN network provider with `mode: NetworkPolicy` set.
endif::ovn[]
ifdef::ovn[]
the OVN-Kubernetes network provider or the OpenShift SDN network provider with `mode: NetworkPolicy` set.
endif::ovn[]
This mode is the default for OpenShift SDN.
* You installed the OpenShift CLI (`oc`).
* You are logged in to the cluster with a user with `admin` privileges.

.Procedure

. Create the following `NetworkPolicy` objects:
.. A policy named `allow-from-openshift-ingress`.
+
[source,terminal]
----
$ cat << EOF| oc create -f -
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-from-openshift-ingress
spec:
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          network.openshift.io/policy-group: ingress
  podSelector: {}
  policyTypes:
  - Ingress
EOF
----

.. A policy named `allow-from-openshift-monitoring`:
+
[source,terminal]
----
$ cat << EOF| oc create -f -
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-from-openshift-monitoring
spec:
  ingress:<commit_msg>Update matchLabels parameter in network-policy<commit_after>// Module included in the following assemblies:
//
// * networking/network_policy/multitenant-network-policy.adoc
// * post_installation_configuration/network-configuration.adoc

ifeval::[{product-version} >= 4.6]
:ovn:
endif::[]

[id="nw-networkpolicy-multitenant-isolation_{context}"]
= Configuring multitenant isolation by using network policy

You can configure your project to isolate it from pods and services in other
project namespaces.

.Prerequisites

* Your cluster uses a cluster network provider that supports `NetworkPolicy` objects, such as
ifndef::ovn[]
the OpenShift SDN network provider with `mode: NetworkPolicy` set.
endif::ovn[]
ifdef::ovn[]
the OVN-Kubernetes network provider or the OpenShift SDN network provider with `mode: NetworkPolicy` set.
endif::ovn[]
This mode is the default for OpenShift SDN.
* You installed the OpenShift CLI (`oc`).
* You are logged in to the cluster with a user with `admin` privileges.

.Procedure

. Create the following `NetworkPolicy` objects:
.. A policy named `allow-from-openshift-ingress`.
+
[source,terminal]
----
$ cat << EOF| oc create -f -
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-from-openshift-ingress
spec:
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          policy-group.network.openshift.io/ingress="" 
  podSelector: {}
  policyTypes:
  - Ingress
EOF
----
+
[NOTE]
====
`policy-group.network.openshift.io/ingress=""` is the preferred namespace selector label for OpenShift SDN. You can use the `network.openshift.io/policy-group: ingress` namespace selector label, but this is a legacy label. 
====
.. A policy named `allow-from-openshift-monitoring`:
+
[source,terminal]
----
$ cat << EOF| oc create -f -
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-from-openshift-monitoring
spec:
  ingress:
{'fraction_non_alphanumeric': 0.11276715410573679, 'fraction_numerical': 0.003374578177727784, 'mean_word_length': 4.365007541478129, 'pattern_counts': {'":': 0, '<': 11, '<?xml version=': 0, '>': 5, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '4621442', 'n_tokens_mistral': 1114, 'n_tokens_neox': 1065, 'n_words': 344}