CiliumClusterwideNetworkPolicy
cilium.io / v2
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: example
apiVersion
string
APIVersion defines the versioned schema of this representation of an object.
Servers should convert recognized schemas to the latest internal value, and
may reject unrecognized values.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
kind
string
Kind is a string value representing the REST resource this object represents.
Servers may infer this from the endpoint the client submits requests to.
Cannot be updated.
In CamelCase.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
metadata
object required
spec object
Spec is the desired Cilium specific rule specification.
description
string
Description is a free form string, it can be used by the creator of
the rule to store human readable explanation of the purpose of this
rule. Rules cannot be identified by comment.
egress []object
Egress is a list of EgressRule which are enforced at egress.
If omitted or empty, this rule does not apply at egress.
authentication object
Authentication is the required authentication type for the allowed traffic, if any.
mode
string required
Mode is the required authentication mode for the allowed traffic, if any.
enum:
disabled, required, test-always-failicmps []object
ICMPs is a list of ICMP rule identified by type number
which the endpoint subject to the rule is allowed to connect to.
Example:
Any endpoint with the label "app=httpd" is allowed to initiate
type 8 ICMP connections.
fields []object
Fields is a list of ICMP fields.
maxItems:
40
family
string
Family is a IP address version.
Currently, we support `IPv4` and `IPv6`.
`IPv4` is set as default.
enum:
IPv4, IPv6
type
string | integer required
Type is a ICMP-type.
It should be an 8bit code (0-255), or it's CamelCase name (for example, "EchoReply").
Allowed ICMP types are:
Ipv4: EchoReply | DestinationUnreachable | Redirect | Echo | EchoRequest |
RouterAdvertisement | RouterSelection | TimeExceeded | ParameterProblem |
Timestamp | TimestampReply | Photuris | ExtendedEcho Request | ExtendedEcho Reply
Ipv6: DestinationUnreachable | PacketTooBig | TimeExceeded | ParameterProblem |
EchoRequest | EchoReply | MulticastListenerQuery| MulticastListenerReport |
MulticastListenerDone | RouterSolicitation | RouterAdvertisement | NeighborSolicitation |
NeighborAdvertisement | RedirectMessage | RouterRenumbering | ICMPNodeInformationQuery |
ICMPNodeInformationResponse | InverseNeighborDiscoverySolicitation | InverseNeighborDiscoveryAdvertisement |
HomeAgentAddressDiscoveryRequest | HomeAgentAddressDiscoveryReply | MobilePrefixSolicitation |
MobilePrefixAdvertisement | DuplicateAddressRequestCodeSuffix | DuplicateAddressConfirmationCodeSuffix |
ExtendedEchoRequest | ExtendedEchoReply
string pattern:
string pattern: ^([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]|EchoReply|DestinationUnreachable|Redirect|Echo|RouterAdvertisement|Rout...
^([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]|EchoReply|DestinationUnreachable|Redirect|Echo|RouterAdvertisement|RouterSelection|TimeExceeded|ParameterProblem|Timestamp|TimestampReply|Photuris|ExtendedEchoRequest|ExtendedEcho Reply|PacketTooBig|ParameterProblem|EchoRequest|MulticastListenerQuery|MulticastListenerReport|MulticastListenerDone|RouterSolicitation|RouterAdvertisement|NeighborSolicitation|NeighborAdvertisement|RedirectMessage|RouterRenumbering|ICMPNodeInformationQuery|ICMPNodeInformationResponse|InverseNeighborDiscoverySolicitation|InverseNeighborDiscoveryAdvertisement|HomeAgentAddressDiscoveryRequest|HomeAgentAddressDiscoveryReply|MobilePrefixSolicitation|MobilePrefixAdvertisement|DuplicateAddressRequestCodeSuffix|DuplicateAddressConfirmationCodeSuffix)$
toCIDR
[]string
ToCIDR is a list of IP blocks which the endpoint subject to the rule
is allowed to initiate connections. Only connections destined for
outside of the cluster and not targeting the host will be subject
to CIDR rules. This will match on the destination IP address of
outgoing connections. Adding a prefix into ToCIDR or into ToCIDRSet
with no ExcludeCIDRs is equivalent. Overlaps are allowed between
ToCIDR and ToCIDRSet.
Example:
Any endpoint with the label "app=database-proxy" is allowed to
initiate connections to 10.2.3.0/24
toCIDRSet []object
ToCIDRSet is a list of IP blocks which the endpoint subject to the rule
is allowed to initiate connections to in addition to connections
which are allowed via ToEndpoints, along with a list of subnets contained
within their corresponding IP block to which traffic should not be
allowed. This will match on the destination IP address of outgoing
connections. Adding a prefix into ToCIDR or into ToCIDRSet with no
ExcludeCIDRs is equivalent. Overlaps are allowed between ToCIDR and
ToCIDRSet.
Example:
Any endpoint with the label "app=database-proxy" is allowed to
initiate connections to 10.2.3.0/24 except from IPs in subnet 10.2.3.0/28.
cidr
string
CIDR is a CIDR prefix / IP Block.
format:
cidr
cidrGroupRef
string
CIDRGroupRef is a reference to a CiliumCIDRGroup object.
A CiliumCIDRGroup contains a list of CIDRs that the endpoint, subject to
the rule, can (Ingress/Egress) or cannot (IngressDeny/EgressDeny) receive
connections from.
pattern:
^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$maxLength:
253cidrGroupSelector object
CIDRGroupSelector selects CiliumCIDRGroups by their labels,
rather than by name.
matchExpressions []object
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key
string required
key is the label key that the selector applies to.
operator
string required
operator represents a key's relationship to a set of values.
Valid operators are In, NotIn, Exists and DoesNotExist.
enum:
In, NotIn, Exists, DoesNotExist
values
[]string
values is an array of string values. If the operator is In or NotIn,
the values array must be non-empty. If the operator is Exists or DoesNotExist,
the values array must be empty. This array is replaced during a strategic
merge patch.
matchLabels
object
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
map is equivalent to an element of matchExpressions, whose key field is "key", the
operator is "In", and the values array contains only "value". The requirements are ANDed.
except
[]string
ExceptCIDRs is a list of IP blocks which the endpoint subject to the rule
is not allowed to initiate connections to. These CIDR prefixes should be
contained within Cidr, using ExceptCIDRs together with CIDRGroupRef is not
supported yet.
These exceptions are only applied to the Cidr in this CIDRRule, and do not
apply to any other CIDR prefixes in any other CIDRRules.
toEndpoints []object
ToEndpoints is a list of endpoints identified by an EndpointSelector to
which the endpoints subject to the rule are allowed to communicate.
Example:
Any endpoint with the label "role=frontend" can communicate with any
endpoint carrying the label "role=backend".
Note that while an empty non-nil ToEndpoints does not select anything,
nil ToEndpoints is implicitly treated as a wildcard selector if ToPorts
are also specified.
To select everything, use one EndpointSelector without any match requirements.
matchExpressions []object
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key
string required
key is the label key that the selector applies to.
operator
string required
operator represents a key's relationship to a set of values.
Valid operators are In, NotIn, Exists and DoesNotExist.
enum:
In, NotIn, Exists, DoesNotExist
values
[]string
values is an array of string values. If the operator is In or NotIn,
the values array must be non-empty. If the operator is Exists or DoesNotExist,
the values array must be empty. This array is replaced during a strategic
merge patch.
matchLabels
object
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
map is equivalent to an element of matchExpressions, whose key field is "key", the
operator is "In", and the values array contains only "value". The requirements are ANDed.
toEntities
[]string
ToEntities is a list of special entities to which the endpoint subject
to the rule is allowed to initiate connections. Supported entities are
`world`, `cluster`, `host`, `remote-node`, `kube-apiserver`, `ingress`, `init`,
`health`, `unmanaged`, `none` and `all`.
toFQDNs []object
ToFQDN allows whitelisting DNS names in place of IPs. The IPs that result
from DNS resolution of `ToFQDN.MatchName`s are added to the same
EgressRule object as ToCIDRSet entries, and behave accordingly. Any L4 and
L7 rules within this EgressRule will also apply to these IPs.
The DNS -> IP mapping is re-resolved periodically from within the
cilium-agent, and the IPs in the DNS response are effected in the policy
for selected pods as-is (i.e. the list of IPs is not modified in any way).
Note: An explicit rule to allow for DNS traffic is needed for the pods, as
ToFQDN counts as an egress rule and will enforce egress policy when
PolicyEnforcment=default.
Note: If the resolved IPs are IPs within the kubernetes cluster, the
ToFQDN rule will not apply to that IP.
Note: ToFQDN cannot occur in the same policy as other To* rules.
matchName
string
MatchName matches literal DNS names. A trailing "." is automatically added
when missing.
pattern:
^([-a-zA-Z0-9_]+[.]?)+$maxLength:
255
matchPattern
string
MatchPattern allows using wildcards to match DNS names. All wildcards are
case insensitive. The wildcards are:
- "*" matches 0 or more DNS valid characters, and may occur anywhere in
the pattern. As a special case a "*" as the leftmost character, without a
following "." matches all subdomains as well as the name to the right.
A trailing "." is automatically added when missing.
- "**." is a special prefix which matches all multilevel subdomains in the prefix.
Examples:
1. `*.cilium.io` matches subdomains of cilium at that level
www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
2. `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
except those containing "." separator, subcilium.io and sub-cilium.io match,
www.cilium.io and blog.cilium.io does not
3. `sub*.cilium.io` matches subdomains of cilium where the subdomain component
begins with "sub". sub.cilium.io and subdomain.cilium.io match while www.cilium.io,
blog.cilium.io, cilium.io and google.com do not
4. `**.cilium.io` matches all multilevel subdomains of cilium.io.
"app.cilium.io" and "test.app.cilium.io" match but not "cilium.io"
pattern:
^([-a-zA-Z0-9_*]+[.]?)+$maxLength:
255toGroups []object
ToGroups allows policies to reference CIDRs provided by external integrations.
Currently, only AWS is supported, and the rule can select by multiple sub directives.
ToGroups entries are functionally equivalent to toCIDR, and have the same
limitiations. They cannot select traffic originating from within the cluster.
Example:
toGroups:
- aws:
securityGroupsIds:
- 'sg-XXXXXXXXXXXXX'
aws object
AWSGroup is an structure that can be used to whitelisting information from AWS integration
labels
object
Labels selects AWS ENIs by labels.
Multiple labels are AND-ed together.
region
string
Deprecated: Region is unused.
securityGroupsIds
[]string
SecurityGroupsIds selects VPC SecurityGroups by IDs.
If multiple IDs are specified, they are OR-ed together.
Note that this may be AND-ed with any Names specified. Specifying both
IDs and Names is not recommended.
securityGroupsNames
[]string
SecurityGroupsNames selects VPC SecurityGroups by name.
If multiple names are specified, they are OR-ed together.
Note that this may be AND-ed with any IDs specified. Specifying both
IDs and Names is not recommended.
toNodes []object
ToNodes is a list of nodes identified by an
EndpointSelector to which endpoints subject to the rule is allowed to communicate.
matchExpressions []object
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key
string required
key is the label key that the selector applies to.
operator
string required
operator represents a key's relationship to a set of values.
Valid operators are In, NotIn, Exists and DoesNotExist.
enum:
In, NotIn, Exists, DoesNotExist
values
[]string
values is an array of string values. If the operator is In or NotIn,
the values array must be non-empty. If the operator is Exists or DoesNotExist,
the values array must be empty. This array is replaced during a strategic
merge patch.
matchLabels
object
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
map is equivalent to an element of matchExpressions, whose key field is "key", the
operator is "In", and the values array contains only "value". The requirements are ANDed.
toPorts []object
ToPorts is a list of destination ports identified by port number and
protocol which the endpoint subject to the rule is allowed to
connect to.
Example:
Any endpoint with the label "role=frontend" is allowed to initiate
connections to destination port 8080/tcp
listener object
listener specifies the name of a custom Envoy listener to which this traffic should be
redirected to.
envoyConfig object required
EnvoyConfig is a reference to the CEC or CCEC resource in which
the listener is defined.
kind
string
Kind is the resource type being referred to. Defaults to CiliumEnvoyConfig or
CiliumClusterwideEnvoyConfig for CiliumNetworkPolicy and CiliumClusterwideNetworkPolicy,
respectively. The only case this is currently explicitly needed is when referring to a
CiliumClusterwideEnvoyConfig from CiliumNetworkPolicy, as using a namespaced listener
from a cluster scoped policy is not allowed.
enum:
CiliumEnvoyConfig, CiliumClusterwideEnvoyConfig
name
string required
Name is the resource name of the CiliumEnvoyConfig or CiliumClusterwideEnvoyConfig where
the listener is defined in.
minLength:
1
name
string required
Name is the name of the listener.
minLength:
1
priority
integer
Priority for this Listener that is used when multiple rules would apply different
listeners to a policy map entry. Behavior of this is implementation dependent.
minimum:
1maximum:
100originatingTLS object
OriginatingTLS is the TLS context for the connections originated by
the L7 proxy. For egress policy this specifies the client-side TLS
parameters for the upstream connection originating from the L7 proxy
to the remote destination. For ingress policy this specifies the
client-side TLS parameters for the connection from the L7 proxy to
the local endpoint.
certificate
string
Certificate is the file name or k8s secret item name for the certificate
chain. If omitted, 'tls.crt' is assumed, if it exists. If given, the
item must exist.
privateKey
string
PrivateKey is the file name or k8s secret item name for the private key
matching the certificate chain. If omitted, 'tls.key' is assumed, if it
exists. If given, the item must exist.
secret object required
Secret is the secret that contains the certificates and private key for
the TLS context.
By default, Cilium will search in this secret for the following items:
- 'ca.crt' - Which represents the trusted CA to verify remote source.
- 'tls.crt' - Which represents the public key certificate.
- 'tls.key' - Which represents the private key matching the public key
certificate.
name
string required
Name is the name of the secret.
namespace
string
Namespace is the namespace in which the secret exists. Context of use
determines the default value if left out (e.g., "default").
trustedCA
string
TrustedCA is the file name or k8s secret item name for the trusted CA.
If omitted, 'ca.crt' is assumed, if it exists. If given, the item must
exist.
ports []object
Ports is a list of L4 port/protocol
maxItems:
40
endPort
integer
EndPort can only be an L4 port number.
format:
int32minimum:
0maximum:
65535
port
string
Port can be an L4 port number, or a name in the form of "http"
or "http-8080".
pattern:
^(6553[0-5]|655[0-2][0-9]|65[0-4][0-9]{2}|6[0-4][0-9]{3}|[1-5][0-9]{4}|[0-9]{1,4})|([a-zA-Z0-9]-?)*[a-zA-Z](-?[a-zA-Z0-9])*$
protocol
string
Protocol is the L4 protocol. If "ANY", omitted or empty, any protocols
with transport ports (TCP, UDP, SCTP) match.
Accepted values: "TCP", "UDP", "SCTP", "VRRP", "IGMP", "GRE", "IPIP",
"IPV6", "ESP", "AH", "ANY"
Tunnel/encapsulation protocols (GRE, IPIP, IPV6, ESP, AH) and other
extended IP protocols (VRRP, IGMP) require the --enable-extended-ip-protocols
flag to be set. These protocols do not use transport-layer ports.
Matching on ICMP is not supported.
Named port specified for a container may narrow this down, but may not
contradict this.
enum:
TCP, UDP, SCTP, VRRP, IGMP, GRE, IPIP, IPV6, ESP, AH, ANYrules object
Rules is a list of additional port level rules which must be met in
order for the PortRule to allow the traffic. If omitted or empty,
no layer 7 rules are enforced.
dns []object
DNS-specific rules.
matchName
string
MatchName matches literal DNS names. A trailing "." is automatically added
when missing.
pattern:
^([-a-zA-Z0-9_]+[.]?)+$maxLength:
255
matchPattern
string
MatchPattern allows using wildcards to match DNS names. All wildcards are
case insensitive. The wildcards are:
- "*" matches 0 or more DNS valid characters, and may occur anywhere in
the pattern. As a special case a "*" as the leftmost character, without a
following "." matches all subdomains as well as the name to the right.
A trailing "." is automatically added when missing.
- "**." is a special prefix which matches all multilevel subdomains in the prefix.
Examples:
1. `*.cilium.io` matches subdomains of cilium at that level
www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
2. `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
except those containing "." separator, subcilium.io and sub-cilium.io match,
www.cilium.io and blog.cilium.io does not
3. `sub*.cilium.io` matches subdomains of cilium where the subdomain component
begins with "sub". sub.cilium.io and subdomain.cilium.io match while www.cilium.io,
blog.cilium.io, cilium.io and google.com do not
4. `**.cilium.io` matches all multilevel subdomains of cilium.io.
"app.cilium.io" and "test.app.cilium.io" match but not "cilium.io"
pattern:
^([-a-zA-Z0-9_*]+[.]?)+$maxLength:
255http []object
HTTP specific rules.
headerMatches []object
HeaderMatches is a list of HTTP headers which must be
present and match against the given values. Mismatch field can be used
to specify what to do when there is no match.
mismatch
string
Mismatch identifies what to do in case there is no match. The default is
to drop the request. Otherwise the overall rule is still considered as
matching, but the mismatches are logged in the access log.
enum:
LOG, ADD, DELETE, REPLACE
name
string required
Name identifies the header.
minLength:
1secret object
Secret refers to a secret that contains the value to be matched against.
The secret must only contain one entry. If the referred secret does not
exist, and there is no "Value" specified, the match will fail.
name
string required
Name is the name of the secret.
namespace
string
Namespace is the namespace in which the secret exists. Context of use
determines the default value if left out (e.g., "default").
value
string
Value matches the exact value of the header. Can be specified either
alone or together with "Secret"; will be used as the header value if the
secret can not be found in the latter case.
headers
[]string
Headers is a list of HTTP headers which must be present in the
request. If omitted or empty, requests are allowed regardless of
headers present.
host
string
Host is an extended POSIX regex matched against the host header of a
request. Examples:
- foo.bar.com will match the host fooXbar.com or foo-bar.com
- foo\.bar\.com will only match the host foo.bar.com
If omitted or empty, the value of the host header is ignored.
format:
idn-hostname
method
string
Method is an extended POSIX regex matched against the method of a
request, e.g. "GET", "POST", "PUT", "PATCH", "DELETE", ...
If omitted or empty, all methods are allowed.
path
string
Path is an extended POSIX regex matched against the path of a
request. Currently it can contain characters disallowed from the
conventional "path" part of a URL as defined by RFC 3986.
If omitted or empty, all paths are all allowed.
serverNames
[]string
ServerNames is a list of allowed TLS SNI values. If not empty, then
TLS must be present and one of the provided SNIs must be indicated in the
TLS handshake.
minItems:
1terminatingTLS object
TerminatingTLS is the TLS context for the connection terminated by
the L7 proxy. For egress policy this specifies the server-side TLS
parameters to be applied on the connections originated from the local
endpoint and terminated by the L7 proxy. For ingress policy this specifies
the server-side TLS parameters to be applied on the connections
originated from a remote source and terminated by the L7 proxy.
certificate
string
Certificate is the file name or k8s secret item name for the certificate
chain. If omitted, 'tls.crt' is assumed, if it exists. If given, the
item must exist.
privateKey
string
PrivateKey is the file name or k8s secret item name for the private key
matching the certificate chain. If omitted, 'tls.key' is assumed, if it
exists. If given, the item must exist.
secret object required
Secret is the secret that contains the certificates and private key for
the TLS context.
By default, Cilium will search in this secret for the following items:
- 'ca.crt' - Which represents the trusted CA to verify remote source.
- 'tls.crt' - Which represents the public key certificate.
- 'tls.key' - Which represents the private key matching the public key
certificate.
name
string required
Name is the name of the secret.
namespace
string
Namespace is the namespace in which the secret exists. Context of use
determines the default value if left out (e.g., "default").
trustedCA
string
TrustedCA is the file name or k8s secret item name for the trusted CA.
If omitted, 'ca.crt' is assumed, if it exists. If given, the item must
exist.
toRequires
[]string
Deprecated.
maxItems:
0toServices []object
ToServices is a list of services to which the endpoint subject
to the rule is allowed to initiate connections.
Currently Cilium only supports toServices for K8s services.
k8sService object
K8sService selects service by name and namespace pair
namespace
string
serviceName
string
k8sServiceSelector object
K8sServiceSelector selects services by k8s labels and namespace
namespace
string
selector object required
ServiceSelector is a label selector for k8s services
matchExpressions []object
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key
string required
key is the label key that the selector applies to.
operator
string required
operator represents a key's relationship to a set of values.
Valid operators are In, NotIn, Exists and DoesNotExist.
enum:
In, NotIn, Exists, DoesNotExist
values
[]string
values is an array of string values. If the operator is In or NotIn,
the values array must be non-empty. If the operator is Exists or DoesNotExist,
the values array must be empty. This array is replaced during a strategic
merge patch.
matchLabels
object
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
map is equivalent to an element of matchExpressions, whose key field is "key", the
operator is "In", and the values array contains only "value". The requirements are ANDed.
egressDeny []object
EgressDeny is a list of EgressDenyRule which are enforced at egress.
Any rule inserted here will be denied regardless of the allowed egress
rules in the 'egress' field.
If omitted or empty, this rule does not apply at egress.
icmps []object
ICMPs is a list of ICMP rule identified by type number
which the endpoint subject to the rule is not allowed to connect to.
Example:
Any endpoint with the label "app=httpd" is not allowed to initiate
type 8 ICMP connections.
fields []object
Fields is a list of ICMP fields.
maxItems:
40
family
string
Family is a IP address version.
Currently, we support `IPv4` and `IPv6`.
`IPv4` is set as default.
enum:
IPv4, IPv6
type
string | integer required
Type is a ICMP-type.
It should be an 8bit code (0-255), or it's CamelCase name (for example, "EchoReply").
Allowed ICMP types are:
Ipv4: EchoReply | DestinationUnreachable | Redirect | Echo | EchoRequest |
RouterAdvertisement | RouterSelection | TimeExceeded | ParameterProblem |
Timestamp | TimestampReply | Photuris | ExtendedEcho Request | ExtendedEcho Reply
Ipv6: DestinationUnreachable | PacketTooBig | TimeExceeded | ParameterProblem |
EchoRequest | EchoReply | MulticastListenerQuery| MulticastListenerReport |
MulticastListenerDone | RouterSolicitation | RouterAdvertisement | NeighborSolicitation |
NeighborAdvertisement | RedirectMessage | RouterRenumbering | ICMPNodeInformationQuery |
ICMPNodeInformationResponse | InverseNeighborDiscoverySolicitation | InverseNeighborDiscoveryAdvertisement |
HomeAgentAddressDiscoveryRequest | HomeAgentAddressDiscoveryReply | MobilePrefixSolicitation |
MobilePrefixAdvertisement | DuplicateAddressRequestCodeSuffix | DuplicateAddressConfirmationCodeSuffix |
ExtendedEchoRequest | ExtendedEchoReply
string pattern:
string pattern: ^([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]|EchoReply|DestinationUnreachable|Redirect|Echo|RouterAdvertisement|Rout...
^([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]|EchoReply|DestinationUnreachable|Redirect|Echo|RouterAdvertisement|RouterSelection|TimeExceeded|ParameterProblem|Timestamp|TimestampReply|Photuris|ExtendedEchoRequest|ExtendedEcho Reply|PacketTooBig|ParameterProblem|EchoRequest|MulticastListenerQuery|MulticastListenerReport|MulticastListenerDone|RouterSolicitation|RouterAdvertisement|NeighborSolicitation|NeighborAdvertisement|RedirectMessage|RouterRenumbering|ICMPNodeInformationQuery|ICMPNodeInformationResponse|InverseNeighborDiscoverySolicitation|InverseNeighborDiscoveryAdvertisement|HomeAgentAddressDiscoveryRequest|HomeAgentAddressDiscoveryReply|MobilePrefixSolicitation|MobilePrefixAdvertisement|DuplicateAddressRequestCodeSuffix|DuplicateAddressConfirmationCodeSuffix)$
toCIDR
[]string
ToCIDR is a list of IP blocks which the endpoint subject to the rule
is allowed to initiate connections. Only connections destined for
outside of the cluster and not targeting the host will be subject
to CIDR rules. This will match on the destination IP address of
outgoing connections. Adding a prefix into ToCIDR or into ToCIDRSet
with no ExcludeCIDRs is equivalent. Overlaps are allowed between
ToCIDR and ToCIDRSet.
Example:
Any endpoint with the label "app=database-proxy" is allowed to
initiate connections to 10.2.3.0/24
toCIDRSet []object
ToCIDRSet is a list of IP blocks which the endpoint subject to the rule
is allowed to initiate connections to in addition to connections
which are allowed via ToEndpoints, along with a list of subnets contained
within their corresponding IP block to which traffic should not be
allowed. This will match on the destination IP address of outgoing
connections. Adding a prefix into ToCIDR or into ToCIDRSet with no
ExcludeCIDRs is equivalent. Overlaps are allowed between ToCIDR and
ToCIDRSet.
Example:
Any endpoint with the label "app=database-proxy" is allowed to
initiate connections to 10.2.3.0/24 except from IPs in subnet 10.2.3.0/28.
cidr
string
CIDR is a CIDR prefix / IP Block.
format:
cidr
cidrGroupRef
string
CIDRGroupRef is a reference to a CiliumCIDRGroup object.
A CiliumCIDRGroup contains a list of CIDRs that the endpoint, subject to
the rule, can (Ingress/Egress) or cannot (IngressDeny/EgressDeny) receive
connections from.
pattern:
^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$maxLength:
253cidrGroupSelector object
CIDRGroupSelector selects CiliumCIDRGroups by their labels,
rather than by name.
matchExpressions []object
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key
string required
key is the label key that the selector applies to.
operator
string required
operator represents a key's relationship to a set of values.
Valid operators are In, NotIn, Exists and DoesNotExist.
enum:
In, NotIn, Exists, DoesNotExist
values
[]string
values is an array of string values. If the operator is In or NotIn,
the values array must be non-empty. If the operator is Exists or DoesNotExist,
the values array must be empty. This array is replaced during a strategic
merge patch.
matchLabels
object
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
map is equivalent to an element of matchExpressions, whose key field is "key", the
operator is "In", and the values array contains only "value". The requirements are ANDed.
except
[]string
ExceptCIDRs is a list of IP blocks which the endpoint subject to the rule
is not allowed to initiate connections to. These CIDR prefixes should be
contained within Cidr, using ExceptCIDRs together with CIDRGroupRef is not
supported yet.
These exceptions are only applied to the Cidr in this CIDRRule, and do not
apply to any other CIDR prefixes in any other CIDRRules.
toEndpoints []object
ToEndpoints is a list of endpoints identified by an EndpointSelector to
which the endpoints subject to the rule are allowed to communicate.
Example:
Any endpoint with the label "role=frontend" can communicate with any
endpoint carrying the label "role=backend".
Note that while an empty non-nil ToEndpoints does not select anything,
nil ToEndpoints is implicitly treated as a wildcard selector if ToPorts
are also specified.
To select everything, use one EndpointSelector without any match requirements.
matchExpressions []object
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key
string required
key is the label key that the selector applies to.
operator
string required
operator represents a key's relationship to a set of values.
Valid operators are In, NotIn, Exists and DoesNotExist.
enum:
In, NotIn, Exists, DoesNotExist
values
[]string
values is an array of string values. If the operator is In or NotIn,
the values array must be non-empty. If the operator is Exists or DoesNotExist,
the values array must be empty. This array is replaced during a strategic
merge patch.
matchLabels
object
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
map is equivalent to an element of matchExpressions, whose key field is "key", the
operator is "In", and the values array contains only "value". The requirements are ANDed.
toEntities
[]string
ToEntities is a list of special entities to which the endpoint subject
to the rule is allowed to initiate connections. Supported entities are
`world`, `cluster`, `host`, `remote-node`, `kube-apiserver`, `ingress`, `init`,
`health`, `unmanaged`, `none` and `all`.
toGroups []object
ToGroups allows policies to reference CIDRs provided by external integrations.
Currently, only AWS is supported, and the rule can select by multiple sub directives.
ToGroups entries are functionally equivalent to toCIDR, and have the same
limitiations. They cannot select traffic originating from within the cluster.
Example:
toGroups:
- aws:
securityGroupsIds:
- 'sg-XXXXXXXXXXXXX'
aws object
AWSGroup is an structure that can be used to whitelisting information from AWS integration
labels
object
Labels selects AWS ENIs by labels.
Multiple labels are AND-ed together.
region
string
Deprecated: Region is unused.
securityGroupsIds
[]string
SecurityGroupsIds selects VPC SecurityGroups by IDs.
If multiple IDs are specified, they are OR-ed together.
Note that this may be AND-ed with any Names specified. Specifying both
IDs and Names is not recommended.
securityGroupsNames
[]string
SecurityGroupsNames selects VPC SecurityGroups by name.
If multiple names are specified, they are OR-ed together.
Note that this may be AND-ed with any IDs specified. Specifying both
IDs and Names is not recommended.
toNodes []object
ToNodes is a list of nodes identified by an
EndpointSelector to which endpoints subject to the rule is allowed to communicate.
matchExpressions []object
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key
string required
key is the label key that the selector applies to.
operator
string required
operator represents a key's relationship to a set of values.
Valid operators are In, NotIn, Exists and DoesNotExist.
enum:
In, NotIn, Exists, DoesNotExist
values
[]string
values is an array of string values. If the operator is In or NotIn,
the values array must be non-empty. If the operator is Exists or DoesNotExist,
the values array must be empty. This array is replaced during a strategic
merge patch.
matchLabels
object
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
map is equivalent to an element of matchExpressions, whose key field is "key", the
operator is "In", and the values array contains only "value". The requirements are ANDed.
toPorts []object
ToPorts is a list of destination ports identified by port number and
protocol which the endpoint subject to the rule is not allowed to connect
to.
Example:
Any endpoint with the label "role=frontend" is not allowed to initiate
connections to destination port 8080/tcp
ports []object
Ports is a list of L4 port/protocol
endPort
integer
EndPort can only be an L4 port number.
format:
int32minimum:
0maximum:
65535
port
string
Port can be an L4 port number, or a name in the form of "http"
or "http-8080".
pattern:
^(6553[0-5]|655[0-2][0-9]|65[0-4][0-9]{2}|6[0-4][0-9]{3}|[1-5][0-9]{4}|[0-9]{1,4})|([a-zA-Z0-9]-?)*[a-zA-Z](-?[a-zA-Z0-9])*$
protocol
string
Protocol is the L4 protocol. If "ANY", omitted or empty, any protocols
with transport ports (TCP, UDP, SCTP) match.
Accepted values: "TCP", "UDP", "SCTP", "VRRP", "IGMP", "GRE", "IPIP",
"IPV6", "ESP", "AH", "ANY"
Tunnel/encapsulation protocols (GRE, IPIP, IPV6, ESP, AH) and other
extended IP protocols (VRRP, IGMP) require the --enable-extended-ip-protocols
flag to be set. These protocols do not use transport-layer ports.
Matching on ICMP is not supported.
Named port specified for a container may narrow this down, but may not
contradict this.
enum:
TCP, UDP, SCTP, VRRP, IGMP, GRE, IPIP, IPV6, ESP, AH, ANY
toRequires
[]string
Deprecated.
maxItems:
0toServices []object
ToServices is a list of services to which the endpoint subject
to the rule is allowed to initiate connections.
Currently Cilium only supports toServices for K8s services.
k8sService object
K8sService selects service by name and namespace pair
namespace
string
serviceName
string
k8sServiceSelector object
K8sServiceSelector selects services by k8s labels and namespace
namespace
string
selector object required
ServiceSelector is a label selector for k8s services
matchExpressions []object
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key
string required
key is the label key that the selector applies to.
operator
string required
operator represents a key's relationship to a set of values.
Valid operators are In, NotIn, Exists and DoesNotExist.
enum:
In, NotIn, Exists, DoesNotExist
values
[]string
values is an array of string values. If the operator is In or NotIn,
the values array must be non-empty. If the operator is Exists or DoesNotExist,
the values array must be empty. This array is replaced during a strategic
merge patch.
matchLabels
object
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
map is equivalent to an element of matchExpressions, whose key field is "key", the
operator is "In", and the values array contains only "value". The requirements are ANDed.
enableDefaultDeny object
EnableDefaultDeny determines whether this policy configures the
subject endpoint(s) to have a default deny mode. If enabled,
this causes all traffic not explicitly allowed by a network policy
to be dropped.
If not specified, the default is true for each traffic direction
that has rules, and false otherwise. For example, if a policy
only has Ingress or IngressDeny rules, then the default for
ingress is true and egress is false.
If multiple policies apply to an endpoint, that endpoint's default deny
will be enabled if any policy requests it.
This is useful for creating broad-based network policies that will not
cause endpoints to enter default-deny mode.
egress
boolean
Whether or not the endpoint should have a default-deny rule applied
to egress traffic.
ingress
boolean
Whether or not the endpoint should have a default-deny rule applied
to ingress traffic.
endpointSelector object
EndpointSelector selects all endpoints which should be subject to
this rule. EndpointSelector and NodeSelector cannot be both empty and
are mutually exclusive.
matchExpressions []object
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key
string required
key is the label key that the selector applies to.
operator
string required
operator represents a key's relationship to a set of values.
Valid operators are In, NotIn, Exists and DoesNotExist.
enum:
In, NotIn, Exists, DoesNotExist
values
[]string
values is an array of string values. If the operator is In or NotIn,
the values array must be non-empty. If the operator is Exists or DoesNotExist,
the values array must be empty. This array is replaced during a strategic
merge patch.
matchLabels
object
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
map is equivalent to an element of matchExpressions, whose key field is "key", the
operator is "In", and the values array contains only "value". The requirements are ANDed.
ingress []object
Ingress is a list of IngressRule which are enforced at ingress.
If omitted or empty, this rule does not apply at ingress.
authentication object
Authentication is the required authentication type for the allowed traffic, if any.
mode
string required
Mode is the required authentication mode for the allowed traffic, if any.
enum:
disabled, required, test-always-fail
fromCIDR
[]string
FromCIDR is a list of IP blocks which the endpoint subject to the
rule is allowed to receive connections from. Only connections which
do *not* originate from the cluster or from the local host are subject
to CIDR rules. In order to allow in-cluster connectivity, use the
FromEndpoints field. This will match on the source IP address of
incoming connections. Adding a prefix into FromCIDR or into
FromCIDRSet with no ExcludeCIDRs is equivalent. Overlaps are
allowed between FromCIDR and FromCIDRSet.
Example:
Any endpoint with the label "app=my-legacy-pet" is allowed to receive
connections from 10.3.9.1
fromCIDRSet []object
FromCIDRSet is a list of IP blocks which the endpoint subject to the
rule is allowed to receive connections from in addition to FromEndpoints,
along with a list of subnets contained within their corresponding IP block
from which traffic should not be allowed.
This will match on the source IP address of incoming connections. Adding
a prefix into FromCIDR or into FromCIDRSet with no ExcludeCIDRs is
equivalent. Overlaps are allowed between FromCIDR and FromCIDRSet.
Example:
Any endpoint with the label "app=my-legacy-pet" is allowed to receive
connections from 10.0.0.0/8 except from IPs in subnet 10.96.0.0/12.
cidr
string
CIDR is a CIDR prefix / IP Block.
format:
cidr
cidrGroupRef
string
CIDRGroupRef is a reference to a CiliumCIDRGroup object.
A CiliumCIDRGroup contains a list of CIDRs that the endpoint, subject to
the rule, can (Ingress/Egress) or cannot (IngressDeny/EgressDeny) receive
connections from.
pattern:
^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$maxLength:
253cidrGroupSelector object
CIDRGroupSelector selects CiliumCIDRGroups by their labels,
rather than by name.
matchExpressions []object
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key
string required
key is the label key that the selector applies to.
operator
string required
operator represents a key's relationship to a set of values.
Valid operators are In, NotIn, Exists and DoesNotExist.
enum:
In, NotIn, Exists, DoesNotExist
values
[]string
values is an array of string values. If the operator is In or NotIn,
the values array must be non-empty. If the operator is Exists or DoesNotExist,
the values array must be empty. This array is replaced during a strategic
merge patch.
matchLabels
object
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
map is equivalent to an element of matchExpressions, whose key field is "key", the
operator is "In", and the values array contains only "value". The requirements are ANDed.
except
[]string
ExceptCIDRs is a list of IP blocks which the endpoint subject to the rule
is not allowed to initiate connections to. These CIDR prefixes should be
contained within Cidr, using ExceptCIDRs together with CIDRGroupRef is not
supported yet.
These exceptions are only applied to the Cidr in this CIDRRule, and do not
apply to any other CIDR prefixes in any other CIDRRules.
fromEndpoints []object
FromEndpoints is a list of endpoints identified by an
EndpointSelector which are allowed to communicate with the endpoint
subject to the rule.
Example:
Any endpoint with the label "role=backend" can be consumed by any
endpoint carrying the label "role=frontend".
Note that while an empty non-nil FromEndpoints does not select anything,
nil FromEndpoints is implicitly treated as a wildcard selector if ToPorts
are also specified.
To select everything, use one EndpointSelector without any match requirements.
matchExpressions []object
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key
string required
key is the label key that the selector applies to.
operator
string required
operator represents a key's relationship to a set of values.
Valid operators are In, NotIn, Exists and DoesNotExist.
enum:
In, NotIn, Exists, DoesNotExist
values
[]string
values is an array of string values. If the operator is In or NotIn,
the values array must be non-empty. If the operator is Exists or DoesNotExist,
the values array must be empty. This array is replaced during a strategic
merge patch.
matchLabels
object
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
map is equivalent to an element of matchExpressions, whose key field is "key", the
operator is "In", and the values array contains only "value". The requirements are ANDed.
fromEntities
[]string
FromEntities is a list of special entities which the endpoint subject
to the rule is allowed to receive connections from. Supported entities are
`world`, `cluster`, `host`, `remote-node`, `kube-apiserver`, `ingress`, `init`,
`health`, `unmanaged`, `none` and `all`.
fromGroups []object
FromGroups allows policies to reference CIDRs provided by external integrations.
Currently, only AWS is supported, and the rule can select by multiple sub directives.
FromGroups entries are functionally equivalent to FromCIDR, and have the same
limitiations. They cannot select traffic originating from within the cluster.
Example:
fromGroups:
- aws:
securityGroupsIds:
- 'sg-XXXXXXXXXXXXX'
aws object
AWSGroup is an structure that can be used to whitelisting information from AWS integration
labels
object
Labels selects AWS ENIs by labels.
Multiple labels are AND-ed together.
region
string
Deprecated: Region is unused.
securityGroupsIds
[]string
SecurityGroupsIds selects VPC SecurityGroups by IDs.
If multiple IDs are specified, they are OR-ed together.
Note that this may be AND-ed with any Names specified. Specifying both
IDs and Names is not recommended.
securityGroupsNames
[]string
SecurityGroupsNames selects VPC SecurityGroups by name.
If multiple names are specified, they are OR-ed together.
Note that this may be AND-ed with any IDs specified. Specifying both
IDs and Names is not recommended.
fromNodes []object
FromNodes is a list of nodes identified by an
EndpointSelector which are allowed to communicate with the endpoint
subject to the rule.
matchExpressions []object
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key
string required
key is the label key that the selector applies to.
operator
string required
operator represents a key's relationship to a set of values.
Valid operators are In, NotIn, Exists and DoesNotExist.
enum:
In, NotIn, Exists, DoesNotExist
values
[]string
values is an array of string values. If the operator is In or NotIn,
the values array must be non-empty. If the operator is Exists or DoesNotExist,
the values array must be empty. This array is replaced during a strategic
merge patch.
matchLabels
object
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
map is equivalent to an element of matchExpressions, whose key field is "key", the
operator is "In", and the values array contains only "value". The requirements are ANDed.
fromRequires
[]string
Deprecated.
maxItems:
0icmps []object
ICMPs is a list of ICMP rule identified by type number
which the endpoint subject to the rule is allowed to
receive connections on.
Example:
Any endpoint with the label "app=httpd" can only accept incoming
type 8 ICMP connections.
fields []object
Fields is a list of ICMP fields.
maxItems:
40
family
string
Family is a IP address version.
Currently, we support `IPv4` and `IPv6`.
`IPv4` is set as default.
enum:
IPv4, IPv6
type
string | integer required
Type is a ICMP-type.
It should be an 8bit code (0-255), or it's CamelCase name (for example, "EchoReply").
Allowed ICMP types are:
Ipv4: EchoReply | DestinationUnreachable | Redirect | Echo | EchoRequest |
RouterAdvertisement | RouterSelection | TimeExceeded | ParameterProblem |
Timestamp | TimestampReply | Photuris | ExtendedEcho Request | ExtendedEcho Reply
Ipv6: DestinationUnreachable | PacketTooBig | TimeExceeded | ParameterProblem |
EchoRequest | EchoReply | MulticastListenerQuery| MulticastListenerReport |
MulticastListenerDone | RouterSolicitation | RouterAdvertisement | NeighborSolicitation |
NeighborAdvertisement | RedirectMessage | RouterRenumbering | ICMPNodeInformationQuery |
ICMPNodeInformationResponse | InverseNeighborDiscoverySolicitation | InverseNeighborDiscoveryAdvertisement |
HomeAgentAddressDiscoveryRequest | HomeAgentAddressDiscoveryReply | MobilePrefixSolicitation |
MobilePrefixAdvertisement | DuplicateAddressRequestCodeSuffix | DuplicateAddressConfirmationCodeSuffix |
ExtendedEchoRequest | ExtendedEchoReply
string pattern:
string pattern: ^([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]|EchoReply|DestinationUnreachable|Redirect|Echo|RouterAdvertisement|Rout...
^([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]|EchoReply|DestinationUnreachable|Redirect|Echo|RouterAdvertisement|RouterSelection|TimeExceeded|ParameterProblem|Timestamp|TimestampReply|Photuris|ExtendedEchoRequest|ExtendedEcho Reply|PacketTooBig|ParameterProblem|EchoRequest|MulticastListenerQuery|MulticastListenerReport|MulticastListenerDone|RouterSolicitation|RouterAdvertisement|NeighborSolicitation|NeighborAdvertisement|RedirectMessage|RouterRenumbering|ICMPNodeInformationQuery|ICMPNodeInformationResponse|InverseNeighborDiscoverySolicitation|InverseNeighborDiscoveryAdvertisement|HomeAgentAddressDiscoveryRequest|HomeAgentAddressDiscoveryReply|MobilePrefixSolicitation|MobilePrefixAdvertisement|DuplicateAddressRequestCodeSuffix|DuplicateAddressConfirmationCodeSuffix)$
toPorts []object
ToPorts is a list of destination ports identified by port number and
protocol which the endpoint subject to the rule is allowed to
receive connections on.
Example:
Any endpoint with the label "app=httpd" can only accept incoming
connections on port 80/tcp.
listener object
listener specifies the name of a custom Envoy listener to which this traffic should be
redirected to.
envoyConfig object required
EnvoyConfig is a reference to the CEC or CCEC resource in which
the listener is defined.
kind
string
Kind is the resource type being referred to. Defaults to CiliumEnvoyConfig or
CiliumClusterwideEnvoyConfig for CiliumNetworkPolicy and CiliumClusterwideNetworkPolicy,
respectively. The only case this is currently explicitly needed is when referring to a
CiliumClusterwideEnvoyConfig from CiliumNetworkPolicy, as using a namespaced listener
from a cluster scoped policy is not allowed.
enum:
CiliumEnvoyConfig, CiliumClusterwideEnvoyConfig
name
string required
Name is the resource name of the CiliumEnvoyConfig or CiliumClusterwideEnvoyConfig where
the listener is defined in.
minLength:
1
name
string required
Name is the name of the listener.
minLength:
1
priority
integer
Priority for this Listener that is used when multiple rules would apply different
listeners to a policy map entry. Behavior of this is implementation dependent.
minimum:
1maximum:
100originatingTLS object
OriginatingTLS is the TLS context for the connections originated by
the L7 proxy. For egress policy this specifies the client-side TLS
parameters for the upstream connection originating from the L7 proxy
to the remote destination. For ingress policy this specifies the
client-side TLS parameters for the connection from the L7 proxy to
the local endpoint.
certificate
string
Certificate is the file name or k8s secret item name for the certificate
chain. If omitted, 'tls.crt' is assumed, if it exists. If given, the
item must exist.
privateKey
string
PrivateKey is the file name or k8s secret item name for the private key
matching the certificate chain. If omitted, 'tls.key' is assumed, if it
exists. If given, the item must exist.
secret object required
Secret is the secret that contains the certificates and private key for
the TLS context.
By default, Cilium will search in this secret for the following items:
- 'ca.crt' - Which represents the trusted CA to verify remote source.
- 'tls.crt' - Which represents the public key certificate.
- 'tls.key' - Which represents the private key matching the public key
certificate.
name
string required
Name is the name of the secret.
namespace
string
Namespace is the namespace in which the secret exists. Context of use
determines the default value if left out (e.g., "default").
trustedCA
string
TrustedCA is the file name or k8s secret item name for the trusted CA.
If omitted, 'ca.crt' is assumed, if it exists. If given, the item must
exist.
ports []object
Ports is a list of L4 port/protocol
maxItems:
40
endPort
integer
EndPort can only be an L4 port number.
format:
int32minimum:
0maximum:
65535
port
string
Port can be an L4 port number, or a name in the form of "http"
or "http-8080".
pattern:
^(6553[0-5]|655[0-2][0-9]|65[0-4][0-9]{2}|6[0-4][0-9]{3}|[1-5][0-9]{4}|[0-9]{1,4})|([a-zA-Z0-9]-?)*[a-zA-Z](-?[a-zA-Z0-9])*$
protocol
string
Protocol is the L4 protocol. If "ANY", omitted or empty, any protocols
with transport ports (TCP, UDP, SCTP) match.
Accepted values: "TCP", "UDP", "SCTP", "VRRP", "IGMP", "GRE", "IPIP",
"IPV6", "ESP", "AH", "ANY"
Tunnel/encapsulation protocols (GRE, IPIP, IPV6, ESP, AH) and other
extended IP protocols (VRRP, IGMP) require the --enable-extended-ip-protocols
flag to be set. These protocols do not use transport-layer ports.
Matching on ICMP is not supported.
Named port specified for a container may narrow this down, but may not
contradict this.
enum:
TCP, UDP, SCTP, VRRP, IGMP, GRE, IPIP, IPV6, ESP, AH, ANYrules object
Rules is a list of additional port level rules which must be met in
order for the PortRule to allow the traffic. If omitted or empty,
no layer 7 rules are enforced.
dns []object
DNS-specific rules.
matchName
string
MatchName matches literal DNS names. A trailing "." is automatically added
when missing.
pattern:
^([-a-zA-Z0-9_]+[.]?)+$maxLength:
255
matchPattern
string
MatchPattern allows using wildcards to match DNS names. All wildcards are
case insensitive. The wildcards are:
- "*" matches 0 or more DNS valid characters, and may occur anywhere in
the pattern. As a special case a "*" as the leftmost character, without a
following "." matches all subdomains as well as the name to the right.
A trailing "." is automatically added when missing.
- "**." is a special prefix which matches all multilevel subdomains in the prefix.
Examples:
1. `*.cilium.io` matches subdomains of cilium at that level
www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
2. `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
except those containing "." separator, subcilium.io and sub-cilium.io match,
www.cilium.io and blog.cilium.io does not
3. `sub*.cilium.io` matches subdomains of cilium where the subdomain component
begins with "sub". sub.cilium.io and subdomain.cilium.io match while www.cilium.io,
blog.cilium.io, cilium.io and google.com do not
4. `**.cilium.io` matches all multilevel subdomains of cilium.io.
"app.cilium.io" and "test.app.cilium.io" match but not "cilium.io"
pattern:
^([-a-zA-Z0-9_*]+[.]?)+$maxLength:
255http []object
HTTP specific rules.
headerMatches []object
HeaderMatches is a list of HTTP headers which must be
present and match against the given values. Mismatch field can be used
to specify what to do when there is no match.
mismatch
string
Mismatch identifies what to do in case there is no match. The default is
to drop the request. Otherwise the overall rule is still considered as
matching, but the mismatches are logged in the access log.
enum:
LOG, ADD, DELETE, REPLACE
name
string required
Name identifies the header.
minLength:
1secret object
Secret refers to a secret that contains the value to be matched against.
The secret must only contain one entry. If the referred secret does not
exist, and there is no "Value" specified, the match will fail.
name
string required
Name is the name of the secret.
namespace
string
Namespace is the namespace in which the secret exists. Context of use
determines the default value if left out (e.g., "default").
value
string
Value matches the exact value of the header. Can be specified either
alone or together with "Secret"; will be used as the header value if the
secret can not be found in the latter case.
headers
[]string
Headers is a list of HTTP headers which must be present in the
request. If omitted or empty, requests are allowed regardless of
headers present.
host
string
Host is an extended POSIX regex matched against the host header of a
request. Examples:
- foo.bar.com will match the host fooXbar.com or foo-bar.com
- foo\.bar\.com will only match the host foo.bar.com
If omitted or empty, the value of the host header is ignored.
format:
idn-hostname
method
string
Method is an extended POSIX regex matched against the method of a
request, e.g. "GET", "POST", "PUT", "PATCH", "DELETE", ...
If omitted or empty, all methods are allowed.
path
string
Path is an extended POSIX regex matched against the path of a
request. Currently it can contain characters disallowed from the
conventional "path" part of a URL as defined by RFC 3986.
If omitted or empty, all paths are all allowed.
serverNames
[]string
ServerNames is a list of allowed TLS SNI values. If not empty, then
TLS must be present and one of the provided SNIs must be indicated in the
TLS handshake.
minItems:
1terminatingTLS object
TerminatingTLS is the TLS context for the connection terminated by
the L7 proxy. For egress policy this specifies the server-side TLS
parameters to be applied on the connections originated from the local
endpoint and terminated by the L7 proxy. For ingress policy this specifies
the server-side TLS parameters to be applied on the connections
originated from a remote source and terminated by the L7 proxy.
certificate
string
Certificate is the file name or k8s secret item name for the certificate
chain. If omitted, 'tls.crt' is assumed, if it exists. If given, the
item must exist.
privateKey
string
PrivateKey is the file name or k8s secret item name for the private key
matching the certificate chain. If omitted, 'tls.key' is assumed, if it
exists. If given, the item must exist.
secret object required
Secret is the secret that contains the certificates and private key for
the TLS context.
By default, Cilium will search in this secret for the following items:
- 'ca.crt' - Which represents the trusted CA to verify remote source.
- 'tls.crt' - Which represents the public key certificate.
- 'tls.key' - Which represents the private key matching the public key
certificate.
name
string required
Name is the name of the secret.
namespace
string
Namespace is the namespace in which the secret exists. Context of use
determines the default value if left out (e.g., "default").
trustedCA
string
TrustedCA is the file name or k8s secret item name for the trusted CA.
If omitted, 'ca.crt' is assumed, if it exists. If given, the item must
exist.
ingressDeny []object
IngressDeny is a list of IngressDenyRule which are enforced at ingress.
Any rule inserted here will be denied regardless of the allowed ingress
rules in the 'ingress' field.
If omitted or empty, this rule does not apply at ingress.
fromCIDR
[]string
FromCIDR is a list of IP blocks which the endpoint subject to the
rule is allowed to receive connections from. Only connections which
do *not* originate from the cluster or from the local host are subject
to CIDR rules. In order to allow in-cluster connectivity, use the
FromEndpoints field. This will match on the source IP address of
incoming connections. Adding a prefix into FromCIDR or into
FromCIDRSet with no ExcludeCIDRs is equivalent. Overlaps are
allowed between FromCIDR and FromCIDRSet.
Example:
Any endpoint with the label "app=my-legacy-pet" is allowed to receive
connections from 10.3.9.1
fromCIDRSet []object
FromCIDRSet is a list of IP blocks which the endpoint subject to the
rule is allowed to receive connections from in addition to FromEndpoints,
along with a list of subnets contained within their corresponding IP block
from which traffic should not be allowed.
This will match on the source IP address of incoming connections. Adding
a prefix into FromCIDR or into FromCIDRSet with no ExcludeCIDRs is
equivalent. Overlaps are allowed between FromCIDR and FromCIDRSet.
Example:
Any endpoint with the label "app=my-legacy-pet" is allowed to receive
connections from 10.0.0.0/8 except from IPs in subnet 10.96.0.0/12.
cidr
string
CIDR is a CIDR prefix / IP Block.
format:
cidr
cidrGroupRef
string
CIDRGroupRef is a reference to a CiliumCIDRGroup object.
A CiliumCIDRGroup contains a list of CIDRs that the endpoint, subject to
the rule, can (Ingress/Egress) or cannot (IngressDeny/EgressDeny) receive
connections from.
pattern:
^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$maxLength:
253cidrGroupSelector object
CIDRGroupSelector selects CiliumCIDRGroups by their labels,
rather than by name.
matchExpressions []object
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key
string required
key is the label key that the selector applies to.
operator
string required
operator represents a key's relationship to a set of values.
Valid operators are In, NotIn, Exists and DoesNotExist.
enum:
In, NotIn, Exists, DoesNotExist
values
[]string
values is an array of string values. If the operator is In or NotIn,
the values array must be non-empty. If the operator is Exists or DoesNotExist,
the values array must be empty. This array is replaced during a strategic
merge patch.
matchLabels
object
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
map is equivalent to an element of matchExpressions, whose key field is "key", the
operator is "In", and the values array contains only "value". The requirements are ANDed.
except
[]string
ExceptCIDRs is a list of IP blocks which the endpoint subject to the rule
is not allowed to initiate connections to. These CIDR prefixes should be
contained within Cidr, using ExceptCIDRs together with CIDRGroupRef is not
supported yet.
These exceptions are only applied to the Cidr in this CIDRRule, and do not
apply to any other CIDR prefixes in any other CIDRRules.
fromEndpoints []object
FromEndpoints is a list of endpoints identified by an
EndpointSelector which are allowed to communicate with the endpoint
subject to the rule.
Example:
Any endpoint with the label "role=backend" can be consumed by any
endpoint carrying the label "role=frontend".
Note that while an empty non-nil FromEndpoints does not select anything,
nil FromEndpoints is implicitly treated as a wildcard selector if ToPorts
are also specified.
To select everything, use one EndpointSelector without any match requirements.
matchExpressions []object
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key
string required
key is the label key that the selector applies to.
operator
string required
operator represents a key's relationship to a set of values.
Valid operators are In, NotIn, Exists and DoesNotExist.
enum:
In, NotIn, Exists, DoesNotExist
values
[]string
values is an array of string values. If the operator is In or NotIn,
the values array must be non-empty. If the operator is Exists or DoesNotExist,
the values array must be empty. This array is replaced during a strategic
merge patch.
matchLabels
object
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
map is equivalent to an element of matchExpressions, whose key field is "key", the
operator is "In", and the values array contains only "value". The requirements are ANDed.
fromEntities
[]string
FromEntities is a list of special entities which the endpoint subject
to the rule is allowed to receive connections from. Supported entities are
`world`, `cluster`, `host`, `remote-node`, `kube-apiserver`, `ingress`, `init`,
`health`, `unmanaged`, `none` and `all`.
fromGroups []object
FromGroups allows policies to reference CIDRs provided by external integrations.
Currently, only AWS is supported, and the rule can select by multiple sub directives.
FromGroups entries are functionally equivalent to FromCIDR, and have the same
limitiations. They cannot select traffic originating from within the cluster.
Example:
fromGroups:
- aws:
securityGroupsIds:
- 'sg-XXXXXXXXXXXXX'
aws object
AWSGroup is an structure that can be used to whitelisting information from AWS integration
labels
object
Labels selects AWS ENIs by labels.
Multiple labels are AND-ed together.
region
string
Deprecated: Region is unused.
securityGroupsIds
[]string
SecurityGroupsIds selects VPC SecurityGroups by IDs.
If multiple IDs are specified, they are OR-ed together.
Note that this may be AND-ed with any Names specified. Specifying both
IDs and Names is not recommended.
securityGroupsNames
[]string
SecurityGroupsNames selects VPC SecurityGroups by name.
If multiple names are specified, they are OR-ed together.
Note that this may be AND-ed with any IDs specified. Specifying both
IDs and Names is not recommended.
fromNodes []object
FromNodes is a list of nodes identified by an
EndpointSelector which are allowed to communicate with the endpoint
subject to the rule.
matchExpressions []object
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key
string required
key is the label key that the selector applies to.
operator
string required
operator represents a key's relationship to a set of values.
Valid operators are In, NotIn, Exists and DoesNotExist.
enum:
In, NotIn, Exists, DoesNotExist
values
[]string
values is an array of string values. If the operator is In or NotIn,
the values array must be non-empty. If the operator is Exists or DoesNotExist,
the values array must be empty. This array is replaced during a strategic
merge patch.
matchLabels
object
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
map is equivalent to an element of matchExpressions, whose key field is "key", the
operator is "In", and the values array contains only "value". The requirements are ANDed.
fromRequires
[]string
Deprecated.
maxItems:
0icmps []object
ICMPs is a list of ICMP rule identified by type number
which the endpoint subject to the rule is not allowed to
receive connections on.
Example:
Any endpoint with the label "app=httpd" can not accept incoming
type 8 ICMP connections.
fields []object
Fields is a list of ICMP fields.
maxItems:
40
family
string
Family is a IP address version.
Currently, we support `IPv4` and `IPv6`.
`IPv4` is set as default.
enum:
IPv4, IPv6
type
string | integer required
Type is a ICMP-type.
It should be an 8bit code (0-255), or it's CamelCase name (for example, "EchoReply").
Allowed ICMP types are:
Ipv4: EchoReply | DestinationUnreachable | Redirect | Echo | EchoRequest |
RouterAdvertisement | RouterSelection | TimeExceeded | ParameterProblem |
Timestamp | TimestampReply | Photuris | ExtendedEcho Request | ExtendedEcho Reply
Ipv6: DestinationUnreachable | PacketTooBig | TimeExceeded | ParameterProblem |
EchoRequest | EchoReply | MulticastListenerQuery| MulticastListenerReport |
MulticastListenerDone | RouterSolicitation | RouterAdvertisement | NeighborSolicitation |
NeighborAdvertisement | RedirectMessage | RouterRenumbering | ICMPNodeInformationQuery |
ICMPNodeInformationResponse | InverseNeighborDiscoverySolicitation | InverseNeighborDiscoveryAdvertisement |
HomeAgentAddressDiscoveryRequest | HomeAgentAddressDiscoveryReply | MobilePrefixSolicitation |
MobilePrefixAdvertisement | DuplicateAddressRequestCodeSuffix | DuplicateAddressConfirmationCodeSuffix |
ExtendedEchoRequest | ExtendedEchoReply
string pattern:
string pattern: ^([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]|EchoReply|DestinationUnreachable|Redirect|Echo|RouterAdvertisement|Rout...
^([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]|EchoReply|DestinationUnreachable|Redirect|Echo|RouterAdvertisement|RouterSelection|TimeExceeded|ParameterProblem|Timestamp|TimestampReply|Photuris|ExtendedEchoRequest|ExtendedEcho Reply|PacketTooBig|ParameterProblem|EchoRequest|MulticastListenerQuery|MulticastListenerReport|MulticastListenerDone|RouterSolicitation|RouterAdvertisement|NeighborSolicitation|NeighborAdvertisement|RedirectMessage|RouterRenumbering|ICMPNodeInformationQuery|ICMPNodeInformationResponse|InverseNeighborDiscoverySolicitation|InverseNeighborDiscoveryAdvertisement|HomeAgentAddressDiscoveryRequest|HomeAgentAddressDiscoveryReply|MobilePrefixSolicitation|MobilePrefixAdvertisement|DuplicateAddressRequestCodeSuffix|DuplicateAddressConfirmationCodeSuffix)$
toPorts []object
ToPorts is a list of destination ports identified by port number and
protocol which the endpoint subject to the rule is not allowed to
receive connections on.
Example:
Any endpoint with the label "app=httpd" can not accept incoming
connections on port 80/tcp.
ports []object
Ports is a list of L4 port/protocol
endPort
integer
EndPort can only be an L4 port number.
format:
int32minimum:
0maximum:
65535
port
string
Port can be an L4 port number, or a name in the form of "http"
or "http-8080".
pattern:
^(6553[0-5]|655[0-2][0-9]|65[0-4][0-9]{2}|6[0-4][0-9]{3}|[1-5][0-9]{4}|[0-9]{1,4})|([a-zA-Z0-9]-?)*[a-zA-Z](-?[a-zA-Z0-9])*$
protocol
string
Protocol is the L4 protocol. If "ANY", omitted or empty, any protocols
with transport ports (TCP, UDP, SCTP) match.
Accepted values: "TCP", "UDP", "SCTP", "VRRP", "IGMP", "GRE", "IPIP",
"IPV6", "ESP", "AH", "ANY"
Tunnel/encapsulation protocols (GRE, IPIP, IPV6, ESP, AH) and other
extended IP protocols (VRRP, IGMP) require the --enable-extended-ip-protocols
flag to be set. These protocols do not use transport-layer ports.
Matching on ICMP is not supported.
Named port specified for a container may narrow this down, but may not
contradict this.
enum:
TCP, UDP, SCTP, VRRP, IGMP, GRE, IPIP, IPV6, ESP, AH, ANYlabels []object
Labels is a list of optional strings which can be used to
re-identify the rule or to store metadata. It is possible to lookup
or delete strings based on labels. Labels are not required to be
unique, multiple rules can have overlapping or identical labels.
key
string required
source
string
Source can be one of the above values (e.g.: LabelSourceK8s).
value
string
log object
Log specifies custom policy-specific Hubble logging configuration.
value
string
Value is a free-form string that is included in Hubble flows
that match this policy. The string is limited to 32 printable characters.
pattern:
^\PC*$maxLength:
32nodeSelector object
NodeSelector selects all nodes which should be subject to this rule.
EndpointSelector and NodeSelector cannot be both empty and are mutually
exclusive. Can only be used in CiliumClusterwideNetworkPolicies.
matchExpressions []object
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key
string required
key is the label key that the selector applies to.
operator
string required
operator represents a key's relationship to a set of values.
Valid operators are In, NotIn, Exists and DoesNotExist.
enum:
In, NotIn, Exists, DoesNotExist
values
[]string
values is an array of string values. If the operator is In or NotIn,
the values array must be non-empty. If the operator is Exists or DoesNotExist,
the values array must be empty. This array is replaced during a strategic
merge patch.
matchLabels
object
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
map is equivalent to an element of matchExpressions, whose key field is "key", the
operator is "In", and the values array contains only "value". The requirements are ANDed.
specs []object
Specs is a list of desired Cilium specific rule specification.
description
string
Description is a free form string, it can be used by the creator of
the rule to store human readable explanation of the purpose of this
rule. Rules cannot be identified by comment.
egress []object
Egress is a list of EgressRule which are enforced at egress.
If omitted or empty, this rule does not apply at egress.
authentication object
Authentication is the required authentication type for the allowed traffic, if any.
mode
string required
Mode is the required authentication mode for the allowed traffic, if any.
enum:
disabled, required, test-always-failicmps []object
ICMPs is a list of ICMP rule identified by type number
which the endpoint subject to the rule is allowed to connect to.
Example:
Any endpoint with the label "app=httpd" is allowed to initiate
type 8 ICMP connections.
fields []object
Fields is a list of ICMP fields.
maxItems:
40
family
string
Family is a IP address version.
Currently, we support `IPv4` and `IPv6`.
`IPv4` is set as default.
enum:
IPv4, IPv6
type
string | integer required
Type is a ICMP-type.
It should be an 8bit code (0-255), or it's CamelCase name (for example, "EchoReply").
Allowed ICMP types are:
Ipv4: EchoReply | DestinationUnreachable | Redirect | Echo | EchoRequest |
RouterAdvertisement | RouterSelection | TimeExceeded | ParameterProblem |
Timestamp | TimestampReply | Photuris | ExtendedEcho Request | ExtendedEcho Reply
Ipv6: DestinationUnreachable | PacketTooBig | TimeExceeded | ParameterProblem |
EchoRequest | EchoReply | MulticastListenerQuery| MulticastListenerReport |
MulticastListenerDone | RouterSolicitation | RouterAdvertisement | NeighborSolicitation |
NeighborAdvertisement | RedirectMessage | RouterRenumbering | ICMPNodeInformationQuery |
ICMPNodeInformationResponse | InverseNeighborDiscoverySolicitation | InverseNeighborDiscoveryAdvertisement |
HomeAgentAddressDiscoveryRequest | HomeAgentAddressDiscoveryReply | MobilePrefixSolicitation |
MobilePrefixAdvertisement | DuplicateAddressRequestCodeSuffix | DuplicateAddressConfirmationCodeSuffix |
ExtendedEchoRequest | ExtendedEchoReply
string pattern:
string pattern: ^([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]|EchoReply|DestinationUnreachable|Redirect|Echo|RouterAdvertisement|Rout...
^([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]|EchoReply|DestinationUnreachable|Redirect|Echo|RouterAdvertisement|RouterSelection|TimeExceeded|ParameterProblem|Timestamp|TimestampReply|Photuris|ExtendedEchoRequest|ExtendedEcho Reply|PacketTooBig|ParameterProblem|EchoRequest|MulticastListenerQuery|MulticastListenerReport|MulticastListenerDone|RouterSolicitation|RouterAdvertisement|NeighborSolicitation|NeighborAdvertisement|RedirectMessage|RouterRenumbering|ICMPNodeInformationQuery|ICMPNodeInformationResponse|InverseNeighborDiscoverySolicitation|InverseNeighborDiscoveryAdvertisement|HomeAgentAddressDiscoveryRequest|HomeAgentAddressDiscoveryReply|MobilePrefixSolicitation|MobilePrefixAdvertisement|DuplicateAddressRequestCodeSuffix|DuplicateAddressConfirmationCodeSuffix)$
toCIDR
[]string
ToCIDR is a list of IP blocks which the endpoint subject to the rule
is allowed to initiate connections. Only connections destined for
outside of the cluster and not targeting the host will be subject
to CIDR rules. This will match on the destination IP address of
outgoing connections. Adding a prefix into ToCIDR or into ToCIDRSet
with no ExcludeCIDRs is equivalent. Overlaps are allowed between
ToCIDR and ToCIDRSet.
Example:
Any endpoint with the label "app=database-proxy" is allowed to
initiate connections to 10.2.3.0/24
toCIDRSet []object
ToCIDRSet is a list of IP blocks which the endpoint subject to the rule
is allowed to initiate connections to in addition to connections
which are allowed via ToEndpoints, along with a list of subnets contained
within their corresponding IP block to which traffic should not be
allowed. This will match on the destination IP address of outgoing
connections. Adding a prefix into ToCIDR or into ToCIDRSet with no
ExcludeCIDRs is equivalent. Overlaps are allowed between ToCIDR and
ToCIDRSet.
Example:
Any endpoint with the label "app=database-proxy" is allowed to
initiate connections to 10.2.3.0/24 except from IPs in subnet 10.2.3.0/28.
cidr
string
CIDR is a CIDR prefix / IP Block.
format:
cidr
cidrGroupRef
string
CIDRGroupRef is a reference to a CiliumCIDRGroup object.
A CiliumCIDRGroup contains a list of CIDRs that the endpoint, subject to
the rule, can (Ingress/Egress) or cannot (IngressDeny/EgressDeny) receive
connections from.
pattern:
^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$maxLength:
253cidrGroupSelector object
CIDRGroupSelector selects CiliumCIDRGroups by their labels,
rather than by name.
matchExpressions []object
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key
string required
key is the label key that the selector applies to.
operator
string required
operator represents a key's relationship to a set of values.
Valid operators are In, NotIn, Exists and DoesNotExist.
enum:
In, NotIn, Exists, DoesNotExist
values
[]string
values is an array of string values. If the operator is In or NotIn,
the values array must be non-empty. If the operator is Exists or DoesNotExist,
the values array must be empty. This array is replaced during a strategic
merge patch.
matchLabels
object
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
map is equivalent to an element of matchExpressions, whose key field is "key", the
operator is "In", and the values array contains only "value". The requirements are ANDed.
except
[]string
ExceptCIDRs is a list of IP blocks which the endpoint subject to the rule
is not allowed to initiate connections to. These CIDR prefixes should be
contained within Cidr, using ExceptCIDRs together with CIDRGroupRef is not
supported yet.
These exceptions are only applied to the Cidr in this CIDRRule, and do not
apply to any other CIDR prefixes in any other CIDRRules.
toEndpoints []object
ToEndpoints is a list of endpoints identified by an EndpointSelector to
which the endpoints subject to the rule are allowed to communicate.
Example:
Any endpoint with the label "role=frontend" can communicate with any
endpoint carrying the label "role=backend".
Note that while an empty non-nil ToEndpoints does not select anything,
nil ToEndpoints is implicitly treated as a wildcard selector if ToPorts
are also specified.
To select everything, use one EndpointSelector without any match requirements.
matchExpressions []object
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key
string required
key is the label key that the selector applies to.
operator
string required
operator represents a key's relationship to a set of values.
Valid operators are In, NotIn, Exists and DoesNotExist.
enum:
In, NotIn, Exists, DoesNotExist
values
[]string
values is an array of string values. If the operator is In or NotIn,
the values array must be non-empty. If the operator is Exists or DoesNotExist,
the values array must be empty. This array is replaced during a strategic
merge patch.
matchLabels
object
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
map is equivalent to an element of matchExpressions, whose key field is "key", the
operator is "In", and the values array contains only "value". The requirements are ANDed.
toEntities
[]string
ToEntities is a list of special entities to which the endpoint subject
to the rule is allowed to initiate connections. Supported entities are
`world`, `cluster`, `host`, `remote-node`, `kube-apiserver`, `ingress`, `init`,
`health`, `unmanaged`, `none` and `all`.
toFQDNs []object
ToFQDN allows whitelisting DNS names in place of IPs. The IPs that result
from DNS resolution of `ToFQDN.MatchName`s are added to the same
EgressRule object as ToCIDRSet entries, and behave accordingly. Any L4 and
L7 rules within this EgressRule will also apply to these IPs.
The DNS -> IP mapping is re-resolved periodically from within the
cilium-agent, and the IPs in the DNS response are effected in the policy
for selected pods as-is (i.e. the list of IPs is not modified in any way).
Note: An explicit rule to allow for DNS traffic is needed for the pods, as
ToFQDN counts as an egress rule and will enforce egress policy when
PolicyEnforcment=default.
Note: If the resolved IPs are IPs within the kubernetes cluster, the
ToFQDN rule will not apply to that IP.
Note: ToFQDN cannot occur in the same policy as other To* rules.
matchName
string
MatchName matches literal DNS names. A trailing "." is automatically added
when missing.
pattern:
^([-a-zA-Z0-9_]+[.]?)+$maxLength:
255
matchPattern
string
MatchPattern allows using wildcards to match DNS names. All wildcards are
case insensitive. The wildcards are:
- "*" matches 0 or more DNS valid characters, and may occur anywhere in
the pattern. As a special case a "*" as the leftmost character, without a
following "." matches all subdomains as well as the name to the right.
A trailing "." is automatically added when missing.
- "**." is a special prefix which matches all multilevel subdomains in the prefix.
Examples:
1. `*.cilium.io` matches subdomains of cilium at that level
www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
2. `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
except those containing "." separator, subcilium.io and sub-cilium.io match,
www.cilium.io and blog.cilium.io does not
3. `sub*.cilium.io` matches subdomains of cilium where the subdomain component
begins with "sub". sub.cilium.io and subdomain.cilium.io match while www.cilium.io,
blog.cilium.io, cilium.io and google.com do not
4. `**.cilium.io` matches all multilevel subdomains of cilium.io.
"app.cilium.io" and "test.app.cilium.io" match but not "cilium.io"
pattern:
^([-a-zA-Z0-9_*]+[.]?)+$maxLength:
255toGroups []object
ToGroups allows policies to reference CIDRs provided by external integrations.
Currently, only AWS is supported, and the rule can select by multiple sub directives.
ToGroups entries are functionally equivalent to toCIDR, and have the same
limitiations. They cannot select traffic originating from within the cluster.
Example:
toGroups:
- aws:
securityGroupsIds:
- 'sg-XXXXXXXXXXXXX'
aws object
AWSGroup is an structure that can be used to whitelisting information from AWS integration
labels
object
Labels selects AWS ENIs by labels.
Multiple labels are AND-ed together.
region
string
Deprecated: Region is unused.
securityGroupsIds
[]string
SecurityGroupsIds selects VPC SecurityGroups by IDs.
If multiple IDs are specified, they are OR-ed together.
Note that this may be AND-ed with any Names specified. Specifying both
IDs and Names is not recommended.
securityGroupsNames
[]string
SecurityGroupsNames selects VPC SecurityGroups by name.
If multiple names are specified, they are OR-ed together.
Note that this may be AND-ed with any IDs specified. Specifying both
IDs and Names is not recommended.
toNodes []object
ToNodes is a list of nodes identified by an
EndpointSelector to which endpoints subject to the rule is allowed to communicate.
matchExpressions []object
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key
string required
key is the label key that the selector applies to.
operator
string required
operator represents a key's relationship to a set of values.
Valid operators are In, NotIn, Exists and DoesNotExist.
enum:
In, NotIn, Exists, DoesNotExist
values
[]string
values is an array of string values. If the operator is In or NotIn,
the values array must be non-empty. If the operator is Exists or DoesNotExist,
the values array must be empty. This array is replaced during a strategic
merge patch.
matchLabels
object
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
map is equivalent to an element of matchExpressions, whose key field is "key", the
operator is "In", and the values array contains only "value". The requirements are ANDed.
toPorts []object
ToPorts is a list of destination ports identified by port number and
protocol which the endpoint subject to the rule is allowed to
connect to.
Example:
Any endpoint with the label "role=frontend" is allowed to initiate
connections to destination port 8080/tcp
listener object
listener specifies the name of a custom Envoy listener to which this traffic should be
redirected to.
envoyConfig object required
EnvoyConfig is a reference to the CEC or CCEC resource in which
the listener is defined.
kind
string
Kind is the resource type being referred to. Defaults to CiliumEnvoyConfig or
CiliumClusterwideEnvoyConfig for CiliumNetworkPolicy and CiliumClusterwideNetworkPolicy,
respectively. The only case this is currently explicitly needed is when referring to a
CiliumClusterwideEnvoyConfig from CiliumNetworkPolicy, as using a namespaced listener
from a cluster scoped policy is not allowed.
enum:
CiliumEnvoyConfig, CiliumClusterwideEnvoyConfig
name
string required
Name is the resource name of the CiliumEnvoyConfig or CiliumClusterwideEnvoyConfig where
the listener is defined in.
minLength:
1
name
string required
Name is the name of the listener.
minLength:
1
priority
integer
Priority for this Listener that is used when multiple rules would apply different
listeners to a policy map entry. Behavior of this is implementation dependent.
minimum:
1maximum:
100originatingTLS object
OriginatingTLS is the TLS context for the connections originated by
the L7 proxy. For egress policy this specifies the client-side TLS
parameters for the upstream connection originating from the L7 proxy
to the remote destination. For ingress policy this specifies the
client-side TLS parameters for the connection from the L7 proxy to
the local endpoint.
certificate
string
Certificate is the file name or k8s secret item name for the certificate
chain. If omitted, 'tls.crt' is assumed, if it exists. If given, the
item must exist.
privateKey
string
PrivateKey is the file name or k8s secret item name for the private key
matching the certificate chain. If omitted, 'tls.key' is assumed, if it
exists. If given, the item must exist.
secret object required
Secret is the secret that contains the certificates and private key for
the TLS context.
By default, Cilium will search in this secret for the following items:
- 'ca.crt' - Which represents the trusted CA to verify remote source.
- 'tls.crt' - Which represents the public key certificate.
- 'tls.key' - Which represents the private key matching the public key
certificate.
name
string required
Name is the name of the secret.
namespace
string
Namespace is the namespace in which the secret exists. Context of use
determines the default value if left out (e.g., "default").
trustedCA
string
TrustedCA is the file name or k8s secret item name for the trusted CA.
If omitted, 'ca.crt' is assumed, if it exists. If given, the item must
exist.
ports []object
Ports is a list of L4 port/protocol
maxItems:
40
endPort
integer
EndPort can only be an L4 port number.
format:
int32minimum:
0maximum:
65535
port
string
Port can be an L4 port number, or a name in the form of "http"
or "http-8080".
pattern:
^(6553[0-5]|655[0-2][0-9]|65[0-4][0-9]{2}|6[0-4][0-9]{3}|[1-5][0-9]{4}|[0-9]{1,4})|([a-zA-Z0-9]-?)*[a-zA-Z](-?[a-zA-Z0-9])*$
protocol
string
Protocol is the L4 protocol. If "ANY", omitted or empty, any protocols
with transport ports (TCP, UDP, SCTP) match.
Accepted values: "TCP", "UDP", "SCTP", "VRRP", "IGMP", "GRE", "IPIP",
"IPV6", "ESP", "AH", "ANY"
Tunnel/encapsulation protocols (GRE, IPIP, IPV6, ESP, AH) and other
extended IP protocols (VRRP, IGMP) require the --enable-extended-ip-protocols
flag to be set. These protocols do not use transport-layer ports.
Matching on ICMP is not supported.
Named port specified for a container may narrow this down, but may not
contradict this.
enum:
TCP, UDP, SCTP, VRRP, IGMP, GRE, IPIP, IPV6, ESP, AH, ANYrules object
Rules is a list of additional port level rules which must be met in
order for the PortRule to allow the traffic. If omitted or empty,
no layer 7 rules are enforced.
dns []object
DNS-specific rules.
matchName
string
MatchName matches literal DNS names. A trailing "." is automatically added
when missing.
pattern:
^([-a-zA-Z0-9_]+[.]?)+$maxLength:
255
matchPattern
string
MatchPattern allows using wildcards to match DNS names. All wildcards are
case insensitive. The wildcards are:
- "*" matches 0 or more DNS valid characters, and may occur anywhere in
the pattern. As a special case a "*" as the leftmost character, without a
following "." matches all subdomains as well as the name to the right.
A trailing "." is automatically added when missing.
- "**." is a special prefix which matches all multilevel subdomains in the prefix.
Examples:
1. `*.cilium.io` matches subdomains of cilium at that level
www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
2. `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
except those containing "." separator, subcilium.io and sub-cilium.io match,
www.cilium.io and blog.cilium.io does not
3. `sub*.cilium.io` matches subdomains of cilium where the subdomain component
begins with "sub". sub.cilium.io and subdomain.cilium.io match while www.cilium.io,
blog.cilium.io, cilium.io and google.com do not
4. `**.cilium.io` matches all multilevel subdomains of cilium.io.
"app.cilium.io" and "test.app.cilium.io" match but not "cilium.io"
pattern:
^([-a-zA-Z0-9_*]+[.]?)+$maxLength:
255http []object
HTTP specific rules.
headerMatches []object
HeaderMatches is a list of HTTP headers which must be
present and match against the given values. Mismatch field can be used
to specify what to do when there is no match.
mismatch
string
Mismatch identifies what to do in case there is no match. The default is
to drop the request. Otherwise the overall rule is still considered as
matching, but the mismatches are logged in the access log.
enum:
LOG, ADD, DELETE, REPLACE
name
string required
Name identifies the header.
minLength:
1secret object
Secret refers to a secret that contains the value to be matched against.
The secret must only contain one entry. If the referred secret does not
exist, and there is no "Value" specified, the match will fail.
name
string required
Name is the name of the secret.
namespace
string
Namespace is the namespace in which the secret exists. Context of use
determines the default value if left out (e.g., "default").
value
string
Value matches the exact value of the header. Can be specified either
alone or together with "Secret"; will be used as the header value if the
secret can not be found in the latter case.
headers
[]string
Headers is a list of HTTP headers which must be present in the
request. If omitted or empty, requests are allowed regardless of
headers present.
host
string
Host is an extended POSIX regex matched against the host header of a
request. Examples:
- foo.bar.com will match the host fooXbar.com or foo-bar.com
- foo\.bar\.com will only match the host foo.bar.com
If omitted or empty, the value of the host header is ignored.
format:
idn-hostname
method
string
Method is an extended POSIX regex matched against the method of a
request, e.g. "GET", "POST", "PUT", "PATCH", "DELETE", ...
If omitted or empty, all methods are allowed.
path
string
Path is an extended POSIX regex matched against the path of a
request. Currently it can contain characters disallowed from the
conventional "path" part of a URL as defined by RFC 3986.
If omitted or empty, all paths are all allowed.
serverNames
[]string
ServerNames is a list of allowed TLS SNI values. If not empty, then
TLS must be present and one of the provided SNIs must be indicated in the
TLS handshake.
minItems:
1terminatingTLS object
TerminatingTLS is the TLS context for the connection terminated by
the L7 proxy. For egress policy this specifies the server-side TLS
parameters to be applied on the connections originated from the local
endpoint and terminated by the L7 proxy. For ingress policy this specifies
the server-side TLS parameters to be applied on the connections
originated from a remote source and terminated by the L7 proxy.
certificate
string
Certificate is the file name or k8s secret item name for the certificate
chain. If omitted, 'tls.crt' is assumed, if it exists. If given, the
item must exist.
privateKey
string
PrivateKey is the file name or k8s secret item name for the private key
matching the certificate chain. If omitted, 'tls.key' is assumed, if it
exists. If given, the item must exist.
secret object required
Secret is the secret that contains the certificates and private key for
the TLS context.
By default, Cilium will search in this secret for the following items:
- 'ca.crt' - Which represents the trusted CA to verify remote source.
- 'tls.crt' - Which represents the public key certificate.
- 'tls.key' - Which represents the private key matching the public key
certificate.
name
string required
Name is the name of the secret.
namespace
string
Namespace is the namespace in which the secret exists. Context of use
determines the default value if left out (e.g., "default").
trustedCA
string
TrustedCA is the file name or k8s secret item name for the trusted CA.
If omitted, 'ca.crt' is assumed, if it exists. If given, the item must
exist.
toRequires
[]string
Deprecated.
maxItems:
0toServices []object
ToServices is a list of services to which the endpoint subject
to the rule is allowed to initiate connections.
Currently Cilium only supports toServices for K8s services.
k8sService object
K8sService selects service by name and namespace pair
namespace
string
serviceName
string
k8sServiceSelector object
K8sServiceSelector selects services by k8s labels and namespace
namespace
string
selector object required
ServiceSelector is a label selector for k8s services
matchExpressions []object
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key
string required
key is the label key that the selector applies to.
operator
string required
operator represents a key's relationship to a set of values.
Valid operators are In, NotIn, Exists and DoesNotExist.
enum:
In, NotIn, Exists, DoesNotExist
values
[]string
values is an array of string values. If the operator is In or NotIn,
the values array must be non-empty. If the operator is Exists or DoesNotExist,
the values array must be empty. This array is replaced during a strategic
merge patch.
matchLabels
object
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
map is equivalent to an element of matchExpressions, whose key field is "key", the
operator is "In", and the values array contains only "value". The requirements are ANDed.
egressDeny []object
EgressDeny is a list of EgressDenyRule which are enforced at egress.
Any rule inserted here will be denied regardless of the allowed egress
rules in the 'egress' field.
If omitted or empty, this rule does not apply at egress.
icmps []object
ICMPs is a list of ICMP rule identified by type number
which the endpoint subject to the rule is not allowed to connect to.
Example:
Any endpoint with the label "app=httpd" is not allowed to initiate
type 8 ICMP connections.
fields []object
Fields is a list of ICMP fields.
maxItems:
40
family
string
Family is a IP address version.
Currently, we support `IPv4` and `IPv6`.
`IPv4` is set as default.
enum:
IPv4, IPv6
type
string | integer required
Type is a ICMP-type.
It should be an 8bit code (0-255), or it's CamelCase name (for example, "EchoReply").
Allowed ICMP types are:
Ipv4: EchoReply | DestinationUnreachable | Redirect | Echo | EchoRequest |
RouterAdvertisement | RouterSelection | TimeExceeded | ParameterProblem |
Timestamp | TimestampReply | Photuris | ExtendedEcho Request | ExtendedEcho Reply
Ipv6: DestinationUnreachable | PacketTooBig | TimeExceeded | ParameterProblem |
EchoRequest | EchoReply | MulticastListenerQuery| MulticastListenerReport |
MulticastListenerDone | RouterSolicitation | RouterAdvertisement | NeighborSolicitation |
NeighborAdvertisement | RedirectMessage | RouterRenumbering | ICMPNodeInformationQuery |
ICMPNodeInformationResponse | InverseNeighborDiscoverySolicitation | InverseNeighborDiscoveryAdvertisement |
HomeAgentAddressDiscoveryRequest | HomeAgentAddressDiscoveryReply | MobilePrefixSolicitation |
MobilePrefixAdvertisement | DuplicateAddressRequestCodeSuffix | DuplicateAddressConfirmationCodeSuffix |
ExtendedEchoRequest | ExtendedEchoReply
string pattern:
string pattern: ^([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]|EchoReply|DestinationUnreachable|Redirect|Echo|RouterAdvertisement|Rout...
^([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]|EchoReply|DestinationUnreachable|Redirect|Echo|RouterAdvertisement|RouterSelection|TimeExceeded|ParameterProblem|Timestamp|TimestampReply|Photuris|ExtendedEchoRequest|ExtendedEcho Reply|PacketTooBig|ParameterProblem|EchoRequest|MulticastListenerQuery|MulticastListenerReport|MulticastListenerDone|RouterSolicitation|RouterAdvertisement|NeighborSolicitation|NeighborAdvertisement|RedirectMessage|RouterRenumbering|ICMPNodeInformationQuery|ICMPNodeInformationResponse|InverseNeighborDiscoverySolicitation|InverseNeighborDiscoveryAdvertisement|HomeAgentAddressDiscoveryRequest|HomeAgentAddressDiscoveryReply|MobilePrefixSolicitation|MobilePrefixAdvertisement|DuplicateAddressRequestCodeSuffix|DuplicateAddressConfirmationCodeSuffix)$
toCIDR
[]string
ToCIDR is a list of IP blocks which the endpoint subject to the rule
is allowed to initiate connections. Only connections destined for
outside of the cluster and not targeting the host will be subject
to CIDR rules. This will match on the destination IP address of
outgoing connections. Adding a prefix into ToCIDR or into ToCIDRSet
with no ExcludeCIDRs is equivalent. Overlaps are allowed between
ToCIDR and ToCIDRSet.
Example:
Any endpoint with the label "app=database-proxy" is allowed to
initiate connections to 10.2.3.0/24
toCIDRSet []object
ToCIDRSet is a list of IP blocks which the endpoint subject to the rule
is allowed to initiate connections to in addition to connections
which are allowed via ToEndpoints, along with a list of subnets contained
within their corresponding IP block to which traffic should not be
allowed. This will match on the destination IP address of outgoing
connections. Adding a prefix into ToCIDR or into ToCIDRSet with no
ExcludeCIDRs is equivalent. Overlaps are allowed between ToCIDR and
ToCIDRSet.
Example:
Any endpoint with the label "app=database-proxy" is allowed to
initiate connections to 10.2.3.0/24 except from IPs in subnet 10.2.3.0/28.
cidr
string
CIDR is a CIDR prefix / IP Block.
format:
cidr
cidrGroupRef
string
CIDRGroupRef is a reference to a CiliumCIDRGroup object.
A CiliumCIDRGroup contains a list of CIDRs that the endpoint, subject to
the rule, can (Ingress/Egress) or cannot (IngressDeny/EgressDeny) receive
connections from.
pattern:
^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$maxLength:
253cidrGroupSelector object
CIDRGroupSelector selects CiliumCIDRGroups by their labels,
rather than by name.
matchExpressions []object
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key
string required
key is the label key that the selector applies to.
operator
string required
operator represents a key's relationship to a set of values.
Valid operators are In, NotIn, Exists and DoesNotExist.
enum:
In, NotIn, Exists, DoesNotExist
values
[]string
values is an array of string values. If the operator is In or NotIn,
the values array must be non-empty. If the operator is Exists or DoesNotExist,
the values array must be empty. This array is replaced during a strategic
merge patch.
matchLabels
object
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
map is equivalent to an element of matchExpressions, whose key field is "key", the
operator is "In", and the values array contains only "value". The requirements are ANDed.
except
[]string
ExceptCIDRs is a list of IP blocks which the endpoint subject to the rule
is not allowed to initiate connections to. These CIDR prefixes should be
contained within Cidr, using ExceptCIDRs together with CIDRGroupRef is not
supported yet.
These exceptions are only applied to the Cidr in this CIDRRule, and do not
apply to any other CIDR prefixes in any other CIDRRules.
toEndpoints []object
ToEndpoints is a list of endpoints identified by an EndpointSelector to
which the endpoints subject to the rule are allowed to communicate.
Example:
Any endpoint with the label "role=frontend" can communicate with any
endpoint carrying the label "role=backend".
Note that while an empty non-nil ToEndpoints does not select anything,
nil ToEndpoints is implicitly treated as a wildcard selector if ToPorts
are also specified.
To select everything, use one EndpointSelector without any match requirements.
matchExpressions []object
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key
string required
key is the label key that the selector applies to.
operator
string required
operator represents a key's relationship to a set of values.
Valid operators are In, NotIn, Exists and DoesNotExist.
enum:
In, NotIn, Exists, DoesNotExist
values
[]string
values is an array of string values. If the operator is In or NotIn,
the values array must be non-empty. If the operator is Exists or DoesNotExist,
the values array must be empty. This array is replaced during a strategic
merge patch.
matchLabels
object
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
map is equivalent to an element of matchExpressions, whose key field is "key", the
operator is "In", and the values array contains only "value". The requirements are ANDed.
toEntities
[]string
ToEntities is a list of special entities to which the endpoint subject
to the rule is allowed to initiate connections. Supported entities are
`world`, `cluster`, `host`, `remote-node`, `kube-apiserver`, `ingress`, `init`,
`health`, `unmanaged`, `none` and `all`.
toGroups []object
ToGroups allows policies to reference CIDRs provided by external integrations.
Currently, only AWS is supported, and the rule can select by multiple sub directives.
ToGroups entries are functionally equivalent to toCIDR, and have the same
limitiations. They cannot select traffic originating from within the cluster.
Example:
toGroups:
- aws:
securityGroupsIds:
- 'sg-XXXXXXXXXXXXX'
aws object
AWSGroup is an structure that can be used to whitelisting information from AWS integration
labels
object
Labels selects AWS ENIs by labels.
Multiple labels are AND-ed together.
region
string
Deprecated: Region is unused.
securityGroupsIds
[]string
SecurityGroupsIds selects VPC SecurityGroups by IDs.
If multiple IDs are specified, they are OR-ed together.
Note that this may be AND-ed with any Names specified. Specifying both
IDs and Names is not recommended.
securityGroupsNames
[]string
SecurityGroupsNames selects VPC SecurityGroups by name.
If multiple names are specified, they are OR-ed together.
Note that this may be AND-ed with any IDs specified. Specifying both
IDs and Names is not recommended.
toNodes []object
ToNodes is a list of nodes identified by an
EndpointSelector to which endpoints subject to the rule is allowed to communicate.
matchExpressions []object
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key
string required
key is the label key that the selector applies to.
operator
string required
operator represents a key's relationship to a set of values.
Valid operators are In, NotIn, Exists and DoesNotExist.
enum:
In, NotIn, Exists, DoesNotExist
values
[]string
values is an array of string values. If the operator is In or NotIn,
the values array must be non-empty. If the operator is Exists or DoesNotExist,
the values array must be empty. This array is replaced during a strategic
merge patch.
matchLabels
object
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
map is equivalent to an element of matchExpressions, whose key field is "key", the
operator is "In", and the values array contains only "value". The requirements are ANDed.
toPorts []object
ToPorts is a list of destination ports identified by port number and
protocol which the endpoint subject to the rule is not allowed to connect
to.
Example:
Any endpoint with the label "role=frontend" is not allowed to initiate
connections to destination port 8080/tcp
ports []object
Ports is a list of L4 port/protocol
endPort
integer
EndPort can only be an L4 port number.
format:
int32minimum:
0maximum:
65535
port
string
Port can be an L4 port number, or a name in the form of "http"
or "http-8080".
pattern:
^(6553[0-5]|655[0-2][0-9]|65[0-4][0-9]{2}|6[0-4][0-9]{3}|[1-5][0-9]{4}|[0-9]{1,4})|([a-zA-Z0-9]-?)*[a-zA-Z](-?[a-zA-Z0-9])*$
protocol
string
Protocol is the L4 protocol. If "ANY", omitted or empty, any protocols
with transport ports (TCP, UDP, SCTP) match.
Accepted values: "TCP", "UDP", "SCTP", "VRRP", "IGMP", "GRE", "IPIP",
"IPV6", "ESP", "AH", "ANY"
Tunnel/encapsulation protocols (GRE, IPIP, IPV6, ESP, AH) and other
extended IP protocols (VRRP, IGMP) require the --enable-extended-ip-protocols
flag to be set. These protocols do not use transport-layer ports.
Matching on ICMP is not supported.
Named port specified for a container may narrow this down, but may not
contradict this.
enum:
TCP, UDP, SCTP, VRRP, IGMP, GRE, IPIP, IPV6, ESP, AH, ANY
toRequires
[]string
Deprecated.
maxItems:
0toServices []object
ToServices is a list of services to which the endpoint subject
to the rule is allowed to initiate connections.
Currently Cilium only supports toServices for K8s services.
k8sService object
K8sService selects service by name and namespace pair
namespace
string
serviceName
string
k8sServiceSelector object
K8sServiceSelector selects services by k8s labels and namespace
namespace
string
selector object required
ServiceSelector is a label selector for k8s services
matchExpressions []object
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key
string required
key is the label key that the selector applies to.
operator
string required
operator represents a key's relationship to a set of values.
Valid operators are In, NotIn, Exists and DoesNotExist.
enum:
In, NotIn, Exists, DoesNotExist
values
[]string
values is an array of string values. If the operator is In or NotIn,
the values array must be non-empty. If the operator is Exists or DoesNotExist,
the values array must be empty. This array is replaced during a strategic
merge patch.
matchLabels
object
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
map is equivalent to an element of matchExpressions, whose key field is "key", the
operator is "In", and the values array contains only "value". The requirements are ANDed.
enableDefaultDeny object
EnableDefaultDeny determines whether this policy configures the
subject endpoint(s) to have a default deny mode. If enabled,
this causes all traffic not explicitly allowed by a network policy
to be dropped.
If not specified, the default is true for each traffic direction
that has rules, and false otherwise. For example, if a policy
only has Ingress or IngressDeny rules, then the default for
ingress is true and egress is false.
If multiple policies apply to an endpoint, that endpoint's default deny
will be enabled if any policy requests it.
This is useful for creating broad-based network policies that will not
cause endpoints to enter default-deny mode.
egress
boolean
Whether or not the endpoint should have a default-deny rule applied
to egress traffic.
ingress
boolean
Whether or not the endpoint should have a default-deny rule applied
to ingress traffic.
endpointSelector object
EndpointSelector selects all endpoints which should be subject to
this rule. EndpointSelector and NodeSelector cannot be both empty and
are mutually exclusive.
matchExpressions []object
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key
string required
key is the label key that the selector applies to.
operator
string required
operator represents a key's relationship to a set of values.
Valid operators are In, NotIn, Exists and DoesNotExist.
enum:
In, NotIn, Exists, DoesNotExist
values
[]string
values is an array of string values. If the operator is In or NotIn,
the values array must be non-empty. If the operator is Exists or DoesNotExist,
the values array must be empty. This array is replaced during a strategic
merge patch.
matchLabels
object
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
map is equivalent to an element of matchExpressions, whose key field is "key", the
operator is "In", and the values array contains only "value". The requirements are ANDed.
ingress []object
Ingress is a list of IngressRule which are enforced at ingress.
If omitted or empty, this rule does not apply at ingress.
authentication object
Authentication is the required authentication type for the allowed traffic, if any.
mode
string required
Mode is the required authentication mode for the allowed traffic, if any.
enum:
disabled, required, test-always-fail
fromCIDR
[]string
FromCIDR is a list of IP blocks which the endpoint subject to the
rule is allowed to receive connections from. Only connections which
do *not* originate from the cluster or from the local host are subject
to CIDR rules. In order to allow in-cluster connectivity, use the
FromEndpoints field. This will match on the source IP address of
incoming connections. Adding a prefix into FromCIDR or into
FromCIDRSet with no ExcludeCIDRs is equivalent. Overlaps are
allowed between FromCIDR and FromCIDRSet.
Example:
Any endpoint with the label "app=my-legacy-pet" is allowed to receive
connections from 10.3.9.1
fromCIDRSet []object
FromCIDRSet is a list of IP blocks which the endpoint subject to the
rule is allowed to receive connections from in addition to FromEndpoints,
along with a list of subnets contained within their corresponding IP block
from which traffic should not be allowed.
This will match on the source IP address of incoming connections. Adding
a prefix into FromCIDR or into FromCIDRSet with no ExcludeCIDRs is
equivalent. Overlaps are allowed between FromCIDR and FromCIDRSet.
Example:
Any endpoint with the label "app=my-legacy-pet" is allowed to receive
connections from 10.0.0.0/8 except from IPs in subnet 10.96.0.0/12.
cidr
string
CIDR is a CIDR prefix / IP Block.
format:
cidr
cidrGroupRef
string
CIDRGroupRef is a reference to a CiliumCIDRGroup object.
A CiliumCIDRGroup contains a list of CIDRs that the endpoint, subject to
the rule, can (Ingress/Egress) or cannot (IngressDeny/EgressDeny) receive
connections from.
pattern:
^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$maxLength:
253cidrGroupSelector object
CIDRGroupSelector selects CiliumCIDRGroups by their labels,
rather than by name.
matchExpressions []object
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key
string required
key is the label key that the selector applies to.
operator
string required
operator represents a key's relationship to a set of values.
Valid operators are In, NotIn, Exists and DoesNotExist.
enum:
In, NotIn, Exists, DoesNotExist
values
[]string
values is an array of string values. If the operator is In or NotIn,
the values array must be non-empty. If the operator is Exists or DoesNotExist,
the values array must be empty. This array is replaced during a strategic
merge patch.
matchLabels
object
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
map is equivalent to an element of matchExpressions, whose key field is "key", the
operator is "In", and the values array contains only "value". The requirements are ANDed.
except
[]string
ExceptCIDRs is a list of IP blocks which the endpoint subject to the rule
is not allowed to initiate connections to. These CIDR prefixes should be
contained within Cidr, using ExceptCIDRs together with CIDRGroupRef is not
supported yet.
These exceptions are only applied to the Cidr in this CIDRRule, and do not
apply to any other CIDR prefixes in any other CIDRRules.
fromEndpoints []object
FromEndpoints is a list of endpoints identified by an
EndpointSelector which are allowed to communicate with the endpoint
subject to the rule.
Example:
Any endpoint with the label "role=backend" can be consumed by any
endpoint carrying the label "role=frontend".
Note that while an empty non-nil FromEndpoints does not select anything,
nil FromEndpoints is implicitly treated as a wildcard selector if ToPorts
are also specified.
To select everything, use one EndpointSelector without any match requirements.
matchExpressions []object
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key
string required
key is the label key that the selector applies to.
operator
string required
operator represents a key's relationship to a set of values.
Valid operators are In, NotIn, Exists and DoesNotExist.
enum:
In, NotIn, Exists, DoesNotExist
values
[]string
values is an array of string values. If the operator is In or NotIn,
the values array must be non-empty. If the operator is Exists or DoesNotExist,
the values array must be empty. This array is replaced during a strategic
merge patch.
matchLabels
object
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
map is equivalent to an element of matchExpressions, whose key field is "key", the
operator is "In", and the values array contains only "value". The requirements are ANDed.
fromEntities
[]string
FromEntities is a list of special entities which the endpoint subject
to the rule is allowed to receive connections from. Supported entities are
`world`, `cluster`, `host`, `remote-node`, `kube-apiserver`, `ingress`, `init`,
`health`, `unmanaged`, `none` and `all`.
fromGroups []object
FromGroups allows policies to reference CIDRs provided by external integrations.
Currently, only AWS is supported, and the rule can select by multiple sub directives.
FromGroups entries are functionally equivalent to FromCIDR, and have the same
limitiations. They cannot select traffic originating from within the cluster.
Example:
fromGroups:
- aws:
securityGroupsIds:
- 'sg-XXXXXXXXXXXXX'
aws object
AWSGroup is an structure that can be used to whitelisting information from AWS integration
labels
object
Labels selects AWS ENIs by labels.
Multiple labels are AND-ed together.
region
string
Deprecated: Region is unused.
securityGroupsIds
[]string
SecurityGroupsIds selects VPC SecurityGroups by IDs.
If multiple IDs are specified, they are OR-ed together.
Note that this may be AND-ed with any Names specified. Specifying both
IDs and Names is not recommended.
securityGroupsNames
[]string
SecurityGroupsNames selects VPC SecurityGroups by name.
If multiple names are specified, they are OR-ed together.
Note that this may be AND-ed with any IDs specified. Specifying both
IDs and Names is not recommended.
fromNodes []object
FromNodes is a list of nodes identified by an
EndpointSelector which are allowed to communicate with the endpoint
subject to the rule.
matchExpressions []object
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key
string required
key is the label key that the selector applies to.
operator
string required
operator represents a key's relationship to a set of values.
Valid operators are In, NotIn, Exists and DoesNotExist.
enum:
In, NotIn, Exists, DoesNotExist
values
[]string
values is an array of string values. If the operator is In or NotIn,
the values array must be non-empty. If the operator is Exists or DoesNotExist,
the values array must be empty. This array is replaced during a strategic
merge patch.
matchLabels
object
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
map is equivalent to an element of matchExpressions, whose key field is "key", the
operator is "In", and the values array contains only "value". The requirements are ANDed.
fromRequires
[]string
Deprecated.
maxItems:
0icmps []object
ICMPs is a list of ICMP rule identified by type number
which the endpoint subject to the rule is allowed to
receive connections on.
Example:
Any endpoint with the label "app=httpd" can only accept incoming
type 8 ICMP connections.
fields []object
Fields is a list of ICMP fields.
maxItems:
40
family
string
Family is a IP address version.
Currently, we support `IPv4` and `IPv6`.
`IPv4` is set as default.
enum:
IPv4, IPv6
type
string | integer required
Type is a ICMP-type.
It should be an 8bit code (0-255), or it's CamelCase name (for example, "EchoReply").
Allowed ICMP types are:
Ipv4: EchoReply | DestinationUnreachable | Redirect | Echo | EchoRequest |
RouterAdvertisement | RouterSelection | TimeExceeded | ParameterProblem |
Timestamp | TimestampReply | Photuris | ExtendedEcho Request | ExtendedEcho Reply
Ipv6: DestinationUnreachable | PacketTooBig | TimeExceeded | ParameterProblem |
EchoRequest | EchoReply | MulticastListenerQuery| MulticastListenerReport |
MulticastListenerDone | RouterSolicitation | RouterAdvertisement | NeighborSolicitation |
NeighborAdvertisement | RedirectMessage | RouterRenumbering | ICMPNodeInformationQuery |
ICMPNodeInformationResponse | InverseNeighborDiscoverySolicitation | InverseNeighborDiscoveryAdvertisement |
HomeAgentAddressDiscoveryRequest | HomeAgentAddressDiscoveryReply | MobilePrefixSolicitation |
MobilePrefixAdvertisement | DuplicateAddressRequestCodeSuffix | DuplicateAddressConfirmationCodeSuffix |
ExtendedEchoRequest | ExtendedEchoReply
string pattern:
string pattern: ^([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]|EchoReply|DestinationUnreachable|Redirect|Echo|RouterAdvertisement|Rout...
^([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]|EchoReply|DestinationUnreachable|Redirect|Echo|RouterAdvertisement|RouterSelection|TimeExceeded|ParameterProblem|Timestamp|TimestampReply|Photuris|ExtendedEchoRequest|ExtendedEcho Reply|PacketTooBig|ParameterProblem|EchoRequest|MulticastListenerQuery|MulticastListenerReport|MulticastListenerDone|RouterSolicitation|RouterAdvertisement|NeighborSolicitation|NeighborAdvertisement|RedirectMessage|RouterRenumbering|ICMPNodeInformationQuery|ICMPNodeInformationResponse|InverseNeighborDiscoverySolicitation|InverseNeighborDiscoveryAdvertisement|HomeAgentAddressDiscoveryRequest|HomeAgentAddressDiscoveryReply|MobilePrefixSolicitation|MobilePrefixAdvertisement|DuplicateAddressRequestCodeSuffix|DuplicateAddressConfirmationCodeSuffix)$
toPorts []object
ToPorts is a list of destination ports identified by port number and
protocol which the endpoint subject to the rule is allowed to
receive connections on.
Example:
Any endpoint with the label "app=httpd" can only accept incoming
connections on port 80/tcp.
listener object
listener specifies the name of a custom Envoy listener to which this traffic should be
redirected to.
envoyConfig object required
EnvoyConfig is a reference to the CEC or CCEC resource in which
the listener is defined.
kind
string
Kind is the resource type being referred to. Defaults to CiliumEnvoyConfig or
CiliumClusterwideEnvoyConfig for CiliumNetworkPolicy and CiliumClusterwideNetworkPolicy,
respectively. The only case this is currently explicitly needed is when referring to a
CiliumClusterwideEnvoyConfig from CiliumNetworkPolicy, as using a namespaced listener
from a cluster scoped policy is not allowed.
enum:
CiliumEnvoyConfig, CiliumClusterwideEnvoyConfig
name
string required
Name is the resource name of the CiliumEnvoyConfig or CiliumClusterwideEnvoyConfig where
the listener is defined in.
minLength:
1
name
string required
Name is the name of the listener.
minLength:
1
priority
integer
Priority for this Listener that is used when multiple rules would apply different
listeners to a policy map entry. Behavior of this is implementation dependent.
minimum:
1maximum:
100originatingTLS object
OriginatingTLS is the TLS context for the connections originated by
the L7 proxy. For egress policy this specifies the client-side TLS
parameters for the upstream connection originating from the L7 proxy
to the remote destination. For ingress policy this specifies the
client-side TLS parameters for the connection from the L7 proxy to
the local endpoint.
certificate
string
Certificate is the file name or k8s secret item name for the certificate
chain. If omitted, 'tls.crt' is assumed, if it exists. If given, the
item must exist.
privateKey
string
PrivateKey is the file name or k8s secret item name for the private key
matching the certificate chain. If omitted, 'tls.key' is assumed, if it
exists. If given, the item must exist.
secret object required
Secret is the secret that contains the certificates and private key for
the TLS context.
By default, Cilium will search in this secret for the following items:
- 'ca.crt' - Which represents the trusted CA to verify remote source.
- 'tls.crt' - Which represents the public key certificate.
- 'tls.key' - Which represents the private key matching the public key
certificate.
name
string required
Name is the name of the secret.
namespace
string
Namespace is the namespace in which the secret exists. Context of use
determines the default value if left out (e.g., "default").
trustedCA
string
TrustedCA is the file name or k8s secret item name for the trusted CA.
If omitted, 'ca.crt' is assumed, if it exists. If given, the item must
exist.
ports []object
Ports is a list of L4 port/protocol
maxItems:
40
endPort
integer
EndPort can only be an L4 port number.
format:
int32minimum:
0maximum:
65535
port
string
Port can be an L4 port number, or a name in the form of "http"
or "http-8080".
pattern:
^(6553[0-5]|655[0-2][0-9]|65[0-4][0-9]{2}|6[0-4][0-9]{3}|[1-5][0-9]{4}|[0-9]{1,4})|([a-zA-Z0-9]-?)*[a-zA-Z](-?[a-zA-Z0-9])*$
protocol
string
Protocol is the L4 protocol. If "ANY", omitted or empty, any protocols
with transport ports (TCP, UDP, SCTP) match.
Accepted values: "TCP", "UDP", "SCTP", "VRRP", "IGMP", "GRE", "IPIP",
"IPV6", "ESP", "AH", "ANY"
Tunnel/encapsulation protocols (GRE, IPIP, IPV6, ESP, AH) and other
extended IP protocols (VRRP, IGMP) require the --enable-extended-ip-protocols
flag to be set. These protocols do not use transport-layer ports.
Matching on ICMP is not supported.
Named port specified for a container may narrow this down, but may not
contradict this.
enum:
TCP, UDP, SCTP, VRRP, IGMP, GRE, IPIP, IPV6, ESP, AH, ANYrules object
Rules is a list of additional port level rules which must be met in
order for the PortRule to allow the traffic. If omitted or empty,
no layer 7 rules are enforced.
dns []object
DNS-specific rules.
matchName
string
MatchName matches literal DNS names. A trailing "." is automatically added
when missing.
pattern:
^([-a-zA-Z0-9_]+[.]?)+$maxLength:
255
matchPattern
string
MatchPattern allows using wildcards to match DNS names. All wildcards are
case insensitive. The wildcards are:
- "*" matches 0 or more DNS valid characters, and may occur anywhere in
the pattern. As a special case a "*" as the leftmost character, without a
following "." matches all subdomains as well as the name to the right.
A trailing "." is automatically added when missing.
- "**." is a special prefix which matches all multilevel subdomains in the prefix.
Examples:
1. `*.cilium.io` matches subdomains of cilium at that level
www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
2. `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
except those containing "." separator, subcilium.io and sub-cilium.io match,
www.cilium.io and blog.cilium.io does not
3. `sub*.cilium.io` matches subdomains of cilium where the subdomain component
begins with "sub". sub.cilium.io and subdomain.cilium.io match while www.cilium.io,
blog.cilium.io, cilium.io and google.com do not
4. `**.cilium.io` matches all multilevel subdomains of cilium.io.
"app.cilium.io" and "test.app.cilium.io" match but not "cilium.io"
pattern:
^([-a-zA-Z0-9_*]+[.]?)+$maxLength:
255http []object
HTTP specific rules.
headerMatches []object
HeaderMatches is a list of HTTP headers which must be
present and match against the given values. Mismatch field can be used
to specify what to do when there is no match.
mismatch
string
Mismatch identifies what to do in case there is no match. The default is
to drop the request. Otherwise the overall rule is still considered as
matching, but the mismatches are logged in the access log.
enum:
LOG, ADD, DELETE, REPLACE
name
string required
Name identifies the header.
minLength:
1secret object
Secret refers to a secret that contains the value to be matched against.
The secret must only contain one entry. If the referred secret does not
exist, and there is no "Value" specified, the match will fail.
name
string required
Name is the name of the secret.
namespace
string
Namespace is the namespace in which the secret exists. Context of use
determines the default value if left out (e.g., "default").
value
string
Value matches the exact value of the header. Can be specified either
alone or together with "Secret"; will be used as the header value if the
secret can not be found in the latter case.
headers
[]string
Headers is a list of HTTP headers which must be present in the
request. If omitted or empty, requests are allowed regardless of
headers present.
host
string
Host is an extended POSIX regex matched against the host header of a
request. Examples:
- foo.bar.com will match the host fooXbar.com or foo-bar.com
- foo\.bar\.com will only match the host foo.bar.com
If omitted or empty, the value of the host header is ignored.
format:
idn-hostname
method
string
Method is an extended POSIX regex matched against the method of a
request, e.g. "GET", "POST", "PUT", "PATCH", "DELETE", ...
If omitted or empty, all methods are allowed.
path
string
Path is an extended POSIX regex matched against the path of a
request. Currently it can contain characters disallowed from the
conventional "path" part of a URL as defined by RFC 3986.
If omitted or empty, all paths are all allowed.
serverNames
[]string
ServerNames is a list of allowed TLS SNI values. If not empty, then
TLS must be present and one of the provided SNIs must be indicated in the
TLS handshake.
minItems:
1terminatingTLS object
TerminatingTLS is the TLS context for the connection terminated by
the L7 proxy. For egress policy this specifies the server-side TLS
parameters to be applied on the connections originated from the local
endpoint and terminated by the L7 proxy. For ingress policy this specifies
the server-side TLS parameters to be applied on the connections
originated from a remote source and terminated by the L7 proxy.
certificate
string
Certificate is the file name or k8s secret item name for the certificate
chain. If omitted, 'tls.crt' is assumed, if it exists. If given, the
item must exist.
privateKey
string
PrivateKey is the file name or k8s secret item name for the private key
matching the certificate chain. If omitted, 'tls.key' is assumed, if it
exists. If given, the item must exist.
secret object required
Secret is the secret that contains the certificates and private key for
the TLS context.
By default, Cilium will search in this secret for the following items:
- 'ca.crt' - Which represents the trusted CA to verify remote source.
- 'tls.crt' - Which represents the public key certificate.
- 'tls.key' - Which represents the private key matching the public key
certificate.
name
string required
Name is the name of the secret.
namespace
string
Namespace is the namespace in which the secret exists. Context of use
determines the default value if left out (e.g., "default").
trustedCA
string
TrustedCA is the file name or k8s secret item name for the trusted CA.
If omitted, 'ca.crt' is assumed, if it exists. If given, the item must
exist.
ingressDeny []object
IngressDeny is a list of IngressDenyRule which are enforced at ingress.
Any rule inserted here will be denied regardless of the allowed ingress
rules in the 'ingress' field.
If omitted or empty, this rule does not apply at ingress.
fromCIDR
[]string
FromCIDR is a list of IP blocks which the endpoint subject to the
rule is allowed to receive connections from. Only connections which
do *not* originate from the cluster or from the local host are subject
to CIDR rules. In order to allow in-cluster connectivity, use the
FromEndpoints field. This will match on the source IP address of
incoming connections. Adding a prefix into FromCIDR or into
FromCIDRSet with no ExcludeCIDRs is equivalent. Overlaps are
allowed between FromCIDR and FromCIDRSet.
Example:
Any endpoint with the label "app=my-legacy-pet" is allowed to receive
connections from 10.3.9.1
fromCIDRSet []object
FromCIDRSet is a list of IP blocks which the endpoint subject to the
rule is allowed to receive connections from in addition to FromEndpoints,
along with a list of subnets contained within their corresponding IP block
from which traffic should not be allowed.
This will match on the source IP address of incoming connections. Adding
a prefix into FromCIDR or into FromCIDRSet with no ExcludeCIDRs is
equivalent. Overlaps are allowed between FromCIDR and FromCIDRSet.
Example:
Any endpoint with the label "app=my-legacy-pet" is allowed to receive
connections from 10.0.0.0/8 except from IPs in subnet 10.96.0.0/12.
cidr
string
CIDR is a CIDR prefix / IP Block.
format:
cidr
cidrGroupRef
string
CIDRGroupRef is a reference to a CiliumCIDRGroup object.
A CiliumCIDRGroup contains a list of CIDRs that the endpoint, subject to
the rule, can (Ingress/Egress) or cannot (IngressDeny/EgressDeny) receive
connections from.
pattern:
^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$maxLength:
253cidrGroupSelector object
CIDRGroupSelector selects CiliumCIDRGroups by their labels,
rather than by name.
matchExpressions []object
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key
string required
key is the label key that the selector applies to.
operator
string required
operator represents a key's relationship to a set of values.
Valid operators are In, NotIn, Exists and DoesNotExist.
enum:
In, NotIn, Exists, DoesNotExist
values
[]string
values is an array of string values. If the operator is In or NotIn,
the values array must be non-empty. If the operator is Exists or DoesNotExist,
the values array must be empty. This array is replaced during a strategic
merge patch.
matchLabels
object
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
map is equivalent to an element of matchExpressions, whose key field is "key", the
operator is "In", and the values array contains only "value". The requirements are ANDed.
except
[]string
ExceptCIDRs is a list of IP blocks which the endpoint subject to the rule
is not allowed to initiate connections to. These CIDR prefixes should be
contained within Cidr, using ExceptCIDRs together with CIDRGroupRef is not
supported yet.
These exceptions are only applied to the Cidr in this CIDRRule, and do not
apply to any other CIDR prefixes in any other CIDRRules.
fromEndpoints []object
FromEndpoints is a list of endpoints identified by an
EndpointSelector which are allowed to communicate with the endpoint
subject to the rule.
Example:
Any endpoint with the label "role=backend" can be consumed by any
endpoint carrying the label "role=frontend".
Note that while an empty non-nil FromEndpoints does not select anything,
nil FromEndpoints is implicitly treated as a wildcard selector if ToPorts
are also specified.
To select everything, use one EndpointSelector without any match requirements.
matchExpressions []object
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key
string required
key is the label key that the selector applies to.
operator
string required
operator represents a key's relationship to a set of values.
Valid operators are In, NotIn, Exists and DoesNotExist.
enum:
In, NotIn, Exists, DoesNotExist
values
[]string
values is an array of string values. If the operator is In or NotIn,
the values array must be non-empty. If the operator is Exists or DoesNotExist,
the values array must be empty. This array is replaced during a strategic
merge patch.
matchLabels
object
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
map is equivalent to an element of matchExpressions, whose key field is "key", the
operator is "In", and the values array contains only "value". The requirements are ANDed.
fromEntities
[]string
FromEntities is a list of special entities which the endpoint subject
to the rule is allowed to receive connections from. Supported entities are
`world`, `cluster`, `host`, `remote-node`, `kube-apiserver`, `ingress`, `init`,
`health`, `unmanaged`, `none` and `all`.
fromGroups []object
FromGroups allows policies to reference CIDRs provided by external integrations.
Currently, only AWS is supported, and the rule can select by multiple sub directives.
FromGroups entries are functionally equivalent to FromCIDR, and have the same
limitiations. They cannot select traffic originating from within the cluster.
Example:
fromGroups:
- aws:
securityGroupsIds:
- 'sg-XXXXXXXXXXXXX'
aws object
AWSGroup is an structure that can be used to whitelisting information from AWS integration
labels
object
Labels selects AWS ENIs by labels.
Multiple labels are AND-ed together.
region
string
Deprecated: Region is unused.
securityGroupsIds
[]string
SecurityGroupsIds selects VPC SecurityGroups by IDs.
If multiple IDs are specified, they are OR-ed together.
Note that this may be AND-ed with any Names specified. Specifying both
IDs and Names is not recommended.
securityGroupsNames
[]string
SecurityGroupsNames selects VPC SecurityGroups by name.
If multiple names are specified, they are OR-ed together.
Note that this may be AND-ed with any IDs specified. Specifying both
IDs and Names is not recommended.
fromNodes []object
FromNodes is a list of nodes identified by an
EndpointSelector which are allowed to communicate with the endpoint
subject to the rule.
matchExpressions []object
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key
string required
key is the label key that the selector applies to.
operator
string required
operator represents a key's relationship to a set of values.
Valid operators are In, NotIn, Exists and DoesNotExist.
enum:
In, NotIn, Exists, DoesNotExist
values
[]string
values is an array of string values. If the operator is In or NotIn,
the values array must be non-empty. If the operator is Exists or DoesNotExist,
the values array must be empty. This array is replaced during a strategic
merge patch.
matchLabels
object
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
map is equivalent to an element of matchExpressions, whose key field is "key", the
operator is "In", and the values array contains only "value". The requirements are ANDed.
fromRequires
[]string
Deprecated.
maxItems:
0icmps []object
ICMPs is a list of ICMP rule identified by type number
which the endpoint subject to the rule is not allowed to
receive connections on.
Example:
Any endpoint with the label "app=httpd" can not accept incoming
type 8 ICMP connections.
fields []object
Fields is a list of ICMP fields.
maxItems:
40
family
string
Family is a IP address version.
Currently, we support `IPv4` and `IPv6`.
`IPv4` is set as default.
enum:
IPv4, IPv6
type
string | integer required
Type is a ICMP-type.
It should be an 8bit code (0-255), or it's CamelCase name (for example, "EchoReply").
Allowed ICMP types are:
Ipv4: EchoReply | DestinationUnreachable | Redirect | Echo | EchoRequest |
RouterAdvertisement | RouterSelection | TimeExceeded | ParameterProblem |
Timestamp | TimestampReply | Photuris | ExtendedEcho Request | ExtendedEcho Reply
Ipv6: DestinationUnreachable | PacketTooBig | TimeExceeded | ParameterProblem |
EchoRequest | EchoReply | MulticastListenerQuery| MulticastListenerReport |
MulticastListenerDone | RouterSolicitation | RouterAdvertisement | NeighborSolicitation |
NeighborAdvertisement | RedirectMessage | RouterRenumbering | ICMPNodeInformationQuery |
ICMPNodeInformationResponse | InverseNeighborDiscoverySolicitation | InverseNeighborDiscoveryAdvertisement |
HomeAgentAddressDiscoveryRequest | HomeAgentAddressDiscoveryReply | MobilePrefixSolicitation |
MobilePrefixAdvertisement | DuplicateAddressRequestCodeSuffix | DuplicateAddressConfirmationCodeSuffix |
ExtendedEchoRequest | ExtendedEchoReply
string pattern:
string pattern: ^([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]|EchoReply|DestinationUnreachable|Redirect|Echo|RouterAdvertisement|Rout...
^([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]|EchoReply|DestinationUnreachable|Redirect|Echo|RouterAdvertisement|RouterSelection|TimeExceeded|ParameterProblem|Timestamp|TimestampReply|Photuris|ExtendedEchoRequest|ExtendedEcho Reply|PacketTooBig|ParameterProblem|EchoRequest|MulticastListenerQuery|MulticastListenerReport|MulticastListenerDone|RouterSolicitation|RouterAdvertisement|NeighborSolicitation|NeighborAdvertisement|RedirectMessage|RouterRenumbering|ICMPNodeInformationQuery|ICMPNodeInformationResponse|InverseNeighborDiscoverySolicitation|InverseNeighborDiscoveryAdvertisement|HomeAgentAddressDiscoveryRequest|HomeAgentAddressDiscoveryReply|MobilePrefixSolicitation|MobilePrefixAdvertisement|DuplicateAddressRequestCodeSuffix|DuplicateAddressConfirmationCodeSuffix)$
toPorts []object
ToPorts is a list of destination ports identified by port number and
protocol which the endpoint subject to the rule is not allowed to
receive connections on.
Example:
Any endpoint with the label "app=httpd" can not accept incoming
connections on port 80/tcp.
ports []object
Ports is a list of L4 port/protocol
endPort
integer
EndPort can only be an L4 port number.
format:
int32minimum:
0maximum:
65535
port
string
Port can be an L4 port number, or a name in the form of "http"
or "http-8080".
pattern:
^(6553[0-5]|655[0-2][0-9]|65[0-4][0-9]{2}|6[0-4][0-9]{3}|[1-5][0-9]{4}|[0-9]{1,4})|([a-zA-Z0-9]-?)*[a-zA-Z](-?[a-zA-Z0-9])*$
protocol
string
Protocol is the L4 protocol. If "ANY", omitted or empty, any protocols
with transport ports (TCP, UDP, SCTP) match.
Accepted values: "TCP", "UDP", "SCTP", "VRRP", "IGMP", "GRE", "IPIP",
"IPV6", "ESP", "AH", "ANY"
Tunnel/encapsulation protocols (GRE, IPIP, IPV6, ESP, AH) and other
extended IP protocols (VRRP, IGMP) require the --enable-extended-ip-protocols
flag to be set. These protocols do not use transport-layer ports.
Matching on ICMP is not supported.
Named port specified for a container may narrow this down, but may not
contradict this.
enum:
TCP, UDP, SCTP, VRRP, IGMP, GRE, IPIP, IPV6, ESP, AH, ANYlabels []object
Labels is a list of optional strings which can be used to
re-identify the rule or to store metadata. It is possible to lookup
or delete strings based on labels. Labels are not required to be
unique, multiple rules can have overlapping or identical labels.
key
string required
source
string
Source can be one of the above values (e.g.: LabelSourceK8s).
value
string
log object
Log specifies custom policy-specific Hubble logging configuration.
value
string
Value is a free-form string that is included in Hubble flows
that match this policy. The string is limited to 32 printable characters.
pattern:
^\PC*$maxLength:
32nodeSelector object
NodeSelector selects all nodes which should be subject to this rule.
EndpointSelector and NodeSelector cannot be both empty and are mutually
exclusive. Can only be used in CiliumClusterwideNetworkPolicies.
matchExpressions []object
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key
string required
key is the label key that the selector applies to.
operator
string required
operator represents a key's relationship to a set of values.
Valid operators are In, NotIn, Exists and DoesNotExist.
enum:
In, NotIn, Exists, DoesNotExist
values
[]string
values is an array of string values. If the operator is In or NotIn,
the values array must be non-empty. If the operator is Exists or DoesNotExist,
the values array must be empty. This array is replaced during a strategic
merge patch.
matchLabels
object
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
map is equivalent to an element of matchExpressions, whose key field is "key", the
operator is "In", and the values array contains only "value". The requirements are ANDed.
status object
Status is the status of the Cilium policy rule.
The reason this field exists in this structure is due a bug in the k8s
code-generator that doesn't create a `UpdateStatus` method because the
field does not exist in the structure.
conditions []object
lastTransitionTime
string
The last time the condition transitioned from one status to another.
format:
date-time
message
string
A human readable message indicating details about the transition.
reason
string
The reason for the condition's last transition.
status
string required
The status of the condition, one of True, False, or Unknown
type
string required
The type of the policy condition
derivativePolicies
object
DerivativePolicies is the status of all policies derived from the Cilium
policy
No matches. Try .spec.description for an exact path