# Okteto Webhook network policy for GKE private clusters

**URL:** <https://community.okteto.com/t/okteto-webhook-network-policy-for-gke-private-clusters/538>\
**Category:** Okteto Self-Hosted\
**Created:** [January 11, 2023, 5:38pm UTC](https://community.okteto.com/t/okteto-webhook-network-policy-for-gke-private-clusters/538 "2023-01-11T17:38:44Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![provecho](https://sea1.discourse-cdn.com/flex019/user_avatar/community.okteto.com/provecho/32/45_2.png) [@provecho](https://community.okteto.com/u/provecho)\
**Post date:** [January 11, 2023, 5:38pm UTC](https://community.okteto.com/t/okteto-webhook-network-policy-for-gke-private-clusters/538/1 "2023-01-11T17:38:44Z")

</div>

When installing Okteto Self-Hosted on a GKE private cluster, with network policies enabled and having a default empty `ingress` network policy for all pods in the `okteto` namespace, allowing ingress traffic to a specific component is required.

Okteto ships a Validation/Mutation webhook deployed in a pod inside the `okteto` namespace, which listens to requests sent by the Kubernetes control plane.

When using a GKE private cluster, the Kubernetes control plane lives in a specific network subnet, and its value is readable with the following command:

```bash
gcloud container clusters describe \
  --format='get(privateClusterConfig.masterIpv4CidrBlock)' \
  ${CLUSTER_NAME}

```

Note: replace `${CLUSTER_NAME}` appropriately. Check `gcloud container clusters describe --help` for additional flags.

The returned value should be similar to `10.127.255.240/28`.

Now, create the following network policy:

```yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: ingress-controlplane-to-webhook
  namespace: okteto
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/component: webhook
      app.kubernetes.io/part-of: okteto
  ingress:
    - ports:
        - protocol: TCP
          port: 443
      from:
        - ipBlock:
            cidr: GKE_CONTROLPLANE_CIDR
  policyTypes:
    - Ingress

```

Note: replace `GKE_CONTROLPLANE_CIDR` with the value from the previous command. Ingress port must match `.Values.webhook.port`, which defaults to `443`.