# Install

## What Will You Do  
In this exercise,

- You will create a Network Policy addon and use it in a custom cluster blueprint, the Network Policy will allow all traffic within the namespace it is applied as well as to/from another namespace. It will deny all traffic to/from any other namespace.
- You will then apply this cluster blueprint to a managed cluster.
- For this exercise we will use two namespaces called **namespace-a** and **namespace-b**.

Important  
This tutorial describes the steps to create and use a custom cluster blueprint using the Web Console. The entire workflow can also be fully automated and embedded into an automation pipeline.

## Assumptions  
- You have already provisioned an upstream Kubernetes cluster (bare metal or VM based).

## Step 1: Create NetworkPolicy Yaml  
- Create the file **npolicy-namespace-a.yaml** and copy the contents below. This policy uses a namespaceSelector to allow traffic to/from other namespaces that have the matching labels. Additional rules such as ports, protocols, and IPBlocks can be added to further secure your pods.

```
---
kind: Namespace
apiVersion: v1
metadata:
  name: namespace-a
  labels:
    ns-policy: namespace-a
---
kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
  name: np-allow-ns-a-b
spec:
  podSelector:
    matchLabels: {}
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          ns-policy: namespace-b
    - namespaceSelector:
        matchLabels:
          ns-policy: namespace-a
  egress:
  - to:
    - namespaceSelector:
        matchLabels:
          ns-policy: namespace-b
    - namespaceSelector:
        matchLabels:
          ns-policy: namespace-a
```

## Step 2: Create Namespace Yaml  
- Create the file **ns-labels-b.yaml** and copy the contents below. This will be applied to **namespace-b** and will set the labels needed to be used in the namespaceSelector defined above.

```
kind: Namespace
apiVersion: v1
metadata:
  name: namespace-b
  labels:
    ns-policy: namespace-b
```

## Step 3: Create NetworkPolicy Addons  
- Under Infrastructure, select "Namespaces" and create two new namespaces called **namespace-a** and **namespace-b**.
- Select "Addons" and "Create" a new Addon called **np-allow-ns-b** by selecting the "+ New Add-On" button.
- Ensure that you select "k8s YAML" for type and select the namespace as **namespace-a**.
- Provide the **npolicy-namespace-a.yaml** from the step 1 and select "CREATE".
- Click on "+ New Version".
- Enter "v1.0" for the Version Name and "UPLOAD" the k8s Yaml File downloaded in step 1.
- Select "Save Changes".

- Select "Addons" and "Create" a new Addon called **ns-b-labels** by selecting the "+ New Add-On" button.
- Ensure that you select "k8s YAML" for type and select the namespace as **namespace-b**.
- Provide the **ns-labels-b.yaml** from step 2 and select "CREATE".
- Click on "+ New Version".
- Enter "v1.0" for the Version Name and "UPLOAD" the k8s Yaml File created in step 2.
- Select "Save Changes".

## Step 4: Create Blueprint  
Now, we are ready to assemble a custom cluster blueprint using the addons.
- Under Infrastructure, select "Blueprints".
- Create a new blueprint and give it a name such as **np-ns-a-allow-ns-b**.
- Create a new version of the blueprint by selecting "+ New Version".
- Enter a version name such as "1.0" and add the **np-allow-ns-b**, and **ns-b-labels** addons.

Once the blueprint is created, ensure you publish it and optionally provide a version so that it can be tracked.

## Step 5: Apply Blueprint  
Now, we are ready to apply this custom blueprint to a cluster.
- Click on Options for the target Cluster in the Web Console.
- Select "Update Blueprint" and select the **np-ns-a-allow-ns-b** blueprint and appropriate version we created from the list.

Click on "Save and Publish". This will start the deployment of the addons configured in the **np-ns-a-allow-ns-b** blueprint to the targeted cluster. The blueprint sync process can take a few minutes. Once complete, the cluster will display the current cluster blueprint details and whether the sync was successful or not.

## Step 6: Verify Deployment  
Users can optionally verify whether the correct resources have been created on the cluster.
- Click on the Kubectl button on the cluster to open a virtual terminal.
- We will verify the network policy in the **namespace-a** namespace. We will also verify the appropriate labels have been set. You should see something like the example below.

```
kubectl get networkpolicies -n namespace-a

NAME            POD-SELECTOR   AGE
np-allow-ns-b   <none>         54s

kubectl get namespaces -l ns-policy=namespace-b
NAME          STATUS   AGE
namespace-b   Active   6d
```

## Recap  
Congratulations! You have successfully created a custom cluster blueprint defining a network policy and applied it to a cluster. You can now use this blueprint on as many clusters as you require.