Purpose of Automatically Created Network Policies

Oct 13, 2025 by pinkandtrash.com 74 views

Introduction

In Rancher, network policies are automatically created for NodePort services when project network isolation is enabled. This behavior was introduced in Rancher version 2.9.3, and it has been observed that these policies allow traffic across namespaces in different projects. In this article, we will explore the rationale behind this behavior, discuss the impact on cluster security and functionality, and examine options for customization.

Purpose of Automatically Created Network Policies

The automatic creation of network policies for NodePort services was introduced in Rancher version 2.9.3 through a pull request on GitHub (https://github.com/rancher/rancher/pull/11932). The purpose of these policies is to allow traffic from any namespace to the NodePort service, as long as the incoming traffic is on the specified port.

The intended benefit of these policies is to enable communication between the NodePort service and other pods in the cluster, regardless of the namespace they belong to. However, this behavior conflicts with the requirement to restrict traffic between namespaces in different projects, which is a critical security requirement for many environments.

Disabling Automatic Network Policy Creation

Currently, there is no configuration setting or method to disable the automatic creation of NodePort network policies in Rancher. However, it is possible to modify the default behavior of these policies to maintain namespace isolation.

To achieve this, you can create a custom network policy that restricts traffic between namespaces in different projects. This policy can be applied to the NodePort service to override the default behavior of the automatically created policy.

Customizing Automatically Created Network Policies

The current network policies allow traffic across namespaces in different projects, which conflicts with the requirement to restrict traffic between namespaces in different projects. To modify the default behavior of these policies, you can create a custom network policy that restricts traffic between namespaces in different projects.

Here is an example of a custom network policy that restricts traffic between namespaces in different projects:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: np-default
spec:
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          field.cattle.io/projectId: p-hzjmf
    - namespaceSelector:
        matchLabels:
          field.cattle.io/projectId: p-8bth6
  podSelector: {}
  policyTypes:
  - Ingress

This policy restricts traffic from namespaces in different projects, except for the System project and the project with ID p-hzjmf.

Steps to Reproduce

To reproduce the issue, follow these steps:

Enable project network isolation.
Create a new project. A network policy similar to the one above will be created to restrict traffic only from namespaces in the same project or the System project.
Deploy a sample app and a NodePort service. A network policy similar to the one above will be created.
Note that this new policy will open traffic from any namespace as long as the incoming traffic is on port 8080.

Expected Behavior

We expect to have control over network policy creation to ensure that our security requirements are met, specifically maintaining strict traffic restrictions between namespaces in different projects.

Conclusion

In conclusion, the automatic creation of network policies for NodePort services in Rancher is a feature that allows traffic from any namespace to the NodePort service, as long as the incoming traffic is on the specified port. While this behavior is intended to enable communication between the NodePort service and other pods in the cluster, it conflicts with the requirement to restrict traffic between namespaces in different projects.

To customize this behavior, you can create a custom network policy that restricts traffic between namespaces in different projects. However, currently, there is no configuration setting or method to disable the automatic creation of NodePort network policies in Rancher.

Future Development

We hope that future releases of Rancher will introduce a configuration setting or method to disable the automatic creation of NodePort network policies, allowing users to customize this behavior to meet their specific security requirements.

Additional Information

If you have any additional information that you would like to provide, please let us know. We are committed to helping you resolve this issue and ensuring that your security requirements are met.

References

https://github.com/rancher/rancher/pull/11932
https://kubernetes.io/docs/concepts/services-networking/network-policies/
Automatically Created Network Policies for NodePort Services: Q&A ====================================================================

Q: What is the purpose of automatically created network policies for NodePort services in Rancher?

A: The purpose of these policies is to allow traffic from any namespace to the NodePort service, as long as the incoming traffic is on the specified port. This is intended to enable communication between the NodePort service and other pods in the cluster, regardless of the namespace they belong to.

Q: Why does Rancher automatically create network policies for NodePort services?

A: Rancher automatically creates network policies for NodePort services to ensure that the service can receive traffic from any namespace in the cluster. This is a default behavior that can be customized by creating a custom network policy.

Q: Can I disable the automatic creation of network policies for NodePort services?

A: Currently, there is no configuration setting or method to disable the automatic creation of NodePort network policies in Rancher. However, you can create a custom network policy that restricts traffic between namespaces in different projects.

Q: How do I customize the automatically created network policies for NodePort services?

A: To customize the automatically created network policies for NodePort services, you can create a custom network policy that restricts traffic between namespaces in different projects. This policy can be applied to the NodePort service to override the default behavior of the automatically created policy.

Q: What is the impact of automatically created network policies for NodePort services on cluster security and functionality?

A: The automatically created network policies for NodePort services can have a significant impact on cluster security and functionality. By allowing traffic from any namespace to the NodePort service, these policies can potentially introduce security risks and compromise the isolation between namespaces in different projects.

Q: Can I use a custom network policy to restrict traffic between namespaces in different projects?

A: Yes, you can use a custom network policy to restrict traffic between namespaces in different projects. This policy can be applied to the NodePort service to override the default behavior of the automatically created policy.

Q: How do I create a custom network policy to restrict traffic between namespaces in different projects?

A: To create a custom network policy to restrict traffic between namespaces in different projects, you can use the following YAML file:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: np-default
spec:
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          field.cattle.io/projectId: p-hzjmf
    - namespaceSelector:
        matchLabels:
          field.cattle.io/projectId: p-8bth6
  podSelector: {}
  policyTypes:
  - Ingress

This policy restricts traffic from namespaces in different projects, except for the System project and the project with ID p-hzjmf.

Q: What are the benefits of customizing the automatically created network policies for NodePort services?

A: The benefits of customizing the automatically created network policies for NodePort services include:

Improved security: By restricting traffic between namespaces in different projects, you can improve the security of your cluster.
Better isolation: By isolating namespaces in different projects, you can ensure that each project has its own isolated environment.
Customization: By customizing the automatically created network policies, you can tailor the behavior of the NodePort service to meet your specific needs.

Q: What are the potential risks of not customizing the automatically created network policies for NodePort services?

A: The potential risks of not customizing the automatically created network policies for NodePort services include:

Security risks: By allowing traffic from any namespace to the NodePort service, you may introduce security risks and compromise the isolation between namespaces in different projects.
Performance issues: By allowing traffic from any namespace to the NodePort service, you may experience performance issues and decreased cluster performance.
Compliance issues: By not customizing the automatically created network policies, you may not be in compliance with your organization's security policies and procedures.