20 top-level fields · unchanged since Cilium 1.6.0
CIDR is a CIDR prefix / IP Block.
CIDRRule is a rule that specifies a CIDR prefix to/from which outside communication is allowed, along with an optional list of subnets within that CIDR prefix to/from which outside communication is not allowed.
CIDR is a CIDR prefix / IP Block.
ExceptCIDRs is a list of IP blocks which the endpoint subject to the rule is not allowed to initiate connections to. These CIDR prefixes should be contained within Cidr. These exceptions are only applied to the Cidr in this CIDRRule, and do not apply to any other CIDR prefixes in any other CIDRRules.
EgressRule contains all rule types which can be applied at egress, i.e. network traffic that originates inside the endpoint and exits the endpoint selected by the endpointSelector. - All members of this structure are optional. If omitted or empty, the member will have no effect on the rule. - For now, combining ToPorts and ToCIDR in the same rule is not supported and such rules will be rejected. In the future, this will be supported and if if multiple members of the structure are specified, then all members must match in order for the rule to take effect.
ToCIDR is a list of IP blocks which the endpoint subject to the rule is allowed to initiate connections. This will match on the destination IP address of outgoing connections. Adding a prefix into ToCIDR or into ToCIDRSet with no ExcludeCIDRs is equivalent. Overlaps are allowed between ToCIDR and ToCIDRSet. Example: Any endpoint with the label "app=database-proxy" is allowed to initiate connections to 10.2.3.0/24
ToCIDRSet is a list of IP blocks which the endpoint subject to the rule is allowed to initiate connections to in addition to connections which are allowed via FromEndpoints, along with a list of subnets contained within their corresponding IP block to which traffic should not be allowed. This will match on the destination IP address of outgoing connections. Adding a prefix into ToCIDR or into ToCIDRSet with no ExcludeCIDRs is equivalent. Overlaps are allowed between ToCIDR and ToCIDRSet. Example: Any endpoint with the label "app=database-proxy" is allowed to initiate connections to 10.2.3.0/24 except from IPs in subnet 10.2.3.0/28.
CIDR is a CIDR prefix / IP Block.
ExceptCIDRs is a list of IP blocks which the endpoint subject to the rule is not allowed to initiate connections to. These CIDR prefixes should be contained within Cidr. These exceptions are only applied to the Cidr in this CIDRRule, and do not apply to any other CIDR prefixes in any other CIDRRules.
ToEndpoints is a list of endpoints identified by an EndpointSelector to which the endpoint subject to the ruleis allowed to communicate. Example: Any endpoint with the label "role=frontend" can be consumed by any endpoint carrying the label "role=backend".
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key is the label key that the selector applies to.
operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
ToEntities is a list of special entities to which the endpoint subject to the rule is allowed to initiate connections. Supported entities are `world`, `cluster` and `host`
ToGroups is a list of constraints that will gather data from third-party providers and create a new derived policy.
Region is the key that will filter the AWS EC2 instances in the given region
SecurityGroupsIds is the list of AWS security group IDs that will filter the instances IPs from the AWS API
SecurityGroupsNames is the list of AWS security group names that will filter the instances IPs from the AWS API
ToPorts is a list of destination ports identified by port number and protocol which the endpoint subject to the rule is allowed to connect to. Example: Any endpoint with the label "role=frontend" is allowed to initiate connections to destination port 8080/tcp
Ports is a list of L4 port/protocol If omitted or empty but RedirectPort is set, then all ports of the endpoint subject to either the ingress or egress rule are being redirected.
Port is an L4 port number. For now the string will be strictly parsed as a single uint16. In the future, this field may support ranges in the form "1024-2048
Protocol is the L4 protocol. If omitted or empty, any protocol matches. Accepted values: "TCP", "UDP", ""/"ANY"\n\nMatching on ICMP is not supported.
RedirectPort is the L4 port which, if set, all traffic matching the Ports is being redirected to. Whatever listener behind that port becomes responsible to enforce the port rules and is also responsible to reinject all traffic back and ensure it reaches its original destination.
Rules is a list of additional port level rules which must be met in order for the PortRule to allow the traffic. If omitted or empty, no layer 7 rules are enforced.
HTTP specific rules.
Headers is a list of HTTP headers which must be present in the request. If omitted or empty, requests are allowed regardless of headers present.
Host is an extended POSIX regex matched against the host header of a request, e.g. "foo.com" If omitted or empty, the value of the host header is ignored.
Method is an extended POSIX regex matched against the method of a request, e.g. "GET", "POST", "PUT", "PATCH", "DELETE", ... If omitted or empty, all methods are allowed.
Path is an extended POSIX regex matched against the path of a request. Currently it can contain characters disallowed from the conventional "path" part of a URL as defined by RFC 3986. If omitted or empty, all paths are all allowed.
Kafka-specific rules.
APIKey is a case-insensitive string matched against the key of a request, e.g. "produce", "fetch", "createtopic", "deletetopic", et al Reference: https://kafka.apache.org/protocol#protocol_api_keys If omitted or empty, all keys are allowed.
APIVersion is the version matched against the api version of the Kafka message. If set, it has to be a string representing a positive integer. If omitted or empty, all versions are allowed.
ClientID is the client identifier as provided in the request. From Kafka protocol documentation: This is a user supplied identifier for the client application. The user can use any identifier they like and it will be used when logging errors, monitoring aggregates, etc. For example, one might want to monitor not just the requests per second overall, but the number coming from each client application (each of which could reside on multiple servers). This id acts as a logical grouping across all requests from a particular client. If omitted or empty, all client identifiers are allowed.
Role is a case-insensitive string and describes a group of API keysnecessary to perform certain higher level Kafka operations such as"produce" or "consume". An APIGroup automatically expands into all APIKeysrequired to perform the specified higher level operation.The following values are supported:- "produce": Allow producing to the topics specified in the rule- "consume": Allow consuming from the topics specified in the ruleThis field is incompatible with the APIKey field, either APIKey or Rolemay be specified. If omitted or empty, the field has no effect and the logic of the APIKey field applies.
Topic is the topic name contained in the message. If a Kafka request contains multiple topics, then all topics must be allowed or the message will be rejected. This constraint is ignored if the matched request message type doesn't contain any topic. Maximum size of Topic can be 249 characters as per recent Kafka spec and allowed characters are a-z, A-Z, 0-9, -, . and _ Older Kafka versions had longer topic lengths of 255, but in Kafka 0.10 version the length was changed from 255 to 249. For compatibility reasons we are using 255 If omitted or empty, all topics are allowed.
Generic Key-Value pair rules.
Parser type name that uses Key-Value pair rules.
ToRequires is a list of additional constraints which must be met in order for the selected endpoints to be able to reach other endpoints. These additional constraints do not by themselves grant access privileges and must always be accompanied with at least one matching FromEndpoints. Example: Any Endpoint with the label "team=A" requires any endpoint to which it communicates to also carry the label "team=A".
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key is the label key that the selector applies to.
operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
ToServices is a list of services to which the endpoint subject to the rule is allowed to initiate connections. Example: Any endpoint with the label "app=backend-app" is allowed to initiate connections to all cidrs backing the "external-service" service
K8sServiceNamespace is an abstraction for the k8s service + namespace types.
K8sServiceSelector selects services by k8s labels. Not supported yet
A label selector is a label query over a set of resources. The result of matchLabels and matchExpressions are ANDed. An empty label selector matches all objects. A null label selector matches no objects.
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key is the label key that the selector applies to.
operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
A label selector is a label query over a set of resources. The result of matchLabels and matchExpressions are ANDed. An empty label selector matches all objects. A null label selector matches no objects.
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key is the label key that the selector applies to.
operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
IngressRule contains all rule types which can be applied at ingress, i.e. network traffic that originates outside of the endpoint and is entering the endpoint selected by the endpointSelector. - All members of this structure are optional. If omitted or empty, the member will have no effect on the rule. - If multiple members are set, all of them need to match in order for the rule to take effect. The exception to this rule is FromRequires field; the effects of any Requires field in any rule will apply to all other rules as well. - For now, combining ToPorts, FromCIDR, and FromEndpoints in the same rule is not supported and any such rules will be rejected. In the future, this will be supported and if multiple members of this structure are specified, then all members must match in order for the rule to take effect. The exception to this rule is the Requires field, the effects of any Requires field in any rule will apply to all other rules as well.
FromCIDR is a list of IP blocks which the endpoint subject to the rule is allowed to receive connections from. This will match on the source IP address of incoming connections. Adding a prefix into FromCIDR or into FromCIDRSet with no ExcludeCIDRs is equivalent. Overlaps are allowed between FromCIDR and FromCIDRSet. Example: Any endpoint with the label "app=my-legacy-pet" is allowed to receive connections from 10.3.9.1
FromCIDRSet is a list of IP blocks which the endpoint subject to the rule is allowed to receive connections from in addition to FromEndpoints, along with a list of subnets contained within their corresponding IP block from which traffic should not be allowed. This will match on the source IP address of incoming connections. Adding a prefix into FromCIDR or into FromCIDRSet with no ExcludeCIDRs is equivalent. Overlaps are allowed between FromCIDR and FromCIDRSet. Example: Any endpoint with the label "app=my-legacy-pet" is allowed to receive connections from 10.0.0.0/8 except from IPs in subnet 10.96.0.0/12.
CIDR is a CIDR prefix / IP Block.
ExceptCIDRs is a list of IP blocks which the endpoint subject to the rule is not allowed to initiate connections to. These CIDR prefixes should be contained within Cidr. These exceptions are only applied to the Cidr in this CIDRRule, and do not apply to any other CIDR prefixes in any other CIDRRules.
FromEndpoints is a list of endpoints identified by an EndpointSelector which are allowed to communicate with the endpoint subject to the rule. Example: Any endpoint with the label "role=backend" can be consumed by any endpoint carrying the label "role=frontend".
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key is the label key that the selector applies to.
operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
FromEntities is a list of special entities which the endpoint subject to the rule is allowed to receive connections from. Supported entities are `world`, `cluster`, `host`, and `init`
FromRequires is a list of additional constraints which must be met in order for the selected endpoints to be reachable. These additional constraints do no by itself grant access privileges and must always be accompanied with at least one matching FromEndpoints. Example: Any Endpoint with the label "team=A" requires consuming endpoint to also carry the label "team=A".
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key is the label key that the selector applies to.
operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
ToPorts is a list of destination ports identified by port number and protocol which the endpoint subject to the rule is allowed to receive connections on. Example: Any endpoint with the label "app=httpd" can only accept incoming connections on port 80/tcp.
Ports is a list of L4 port/protocol If omitted or empty but RedirectPort is set, then all ports of the endpoint subject to either the ingress or egress rule are being redirected.
Port is an L4 port number. For now the string will be strictly parsed as a single uint16. In the future, this field may support ranges in the form "1024-2048
Protocol is the L4 protocol. If omitted or empty, any protocol matches. Accepted values: "TCP", "UDP", ""/"ANY"\n\nMatching on ICMP is not supported.
RedirectPort is the L4 port which, if set, all traffic matching the Ports is being redirected to. Whatever listener behind that port becomes responsible to enforce the port rules and is also responsible to reinject all traffic back and ensure it reaches its original destination.
Rules is a list of additional port level rules which must be met in order for the PortRule to allow the traffic. If omitted or empty, no layer 7 rules are enforced.
HTTP specific rules.
Headers is a list of HTTP headers which must be present in the request. If omitted or empty, requests are allowed regardless of headers present.
Host is an extended POSIX regex matched against the host header of a request, e.g. "foo.com" If omitted or empty, the value of the host header is ignored.
Method is an extended POSIX regex matched against the method of a request, e.g. "GET", "POST", "PUT", "PATCH", "DELETE", ... If omitted or empty, all methods are allowed.
Path is an extended POSIX regex matched against the path of a request. Currently it can contain characters disallowed from the conventional "path" part of a URL as defined by RFC 3986. If omitted or empty, all paths are all allowed.
Kafka-specific rules.
APIKey is a case-insensitive string matched against the key of a request, e.g. "produce", "fetch", "createtopic", "deletetopic", et al Reference: https://kafka.apache.org/protocol#protocol_api_keys If omitted or empty, all keys are allowed.
APIVersion is the version matched against the api version of the Kafka message. If set, it has to be a string representing a positive integer. If omitted or empty, all versions are allowed.
ClientID is the client identifier as provided in the request. From Kafka protocol documentation: This is a user supplied identifier for the client application. The user can use any identifier they like and it will be used when logging errors, monitoring aggregates, etc. For example, one might want to monitor not just the requests per second overall, but the number coming from each client application (each of which could reside on multiple servers). This id acts as a logical grouping across all requests from a particular client. If omitted or empty, all client identifiers are allowed.
Role is a case-insensitive string and describes a group of API keysnecessary to perform certain higher level Kafka operations such as"produce" or "consume". An APIGroup automatically expands into all APIKeysrequired to perform the specified higher level operation.The following values are supported:- "produce": Allow producing to the topics specified in the rule- "consume": Allow consuming from the topics specified in the ruleThis field is incompatible with the APIKey field, either APIKey or Rolemay be specified. If omitted or empty, the field has no effect and the logic of the APIKey field applies.
Topic is the topic name contained in the message. If a Kafka request contains multiple topics, then all topics must be allowed or the message will be rejected. This constraint is ignored if the matched request message type doesn't contain any topic. Maximum size of Topic can be 249 characters as per recent Kafka spec and allowed characters are a-z, A-Z, 0-9, -, . and _ Older Kafka versions had longer topic lengths of 255, but in Kafka 0.10 version the length was changed from 255 to 249. For compatibility reasons we are using 255 If omitted or empty, all topics are allowed.
Generic Key-Value pair rules.
Parser type name that uses Key-Value pair rules.
K8sServiceNamespace is an abstraction for the k8s service + namespace types.
L7Rules is a union of port level rule types. Mixing of different port level rule types is disallowed, so exactly one of the following must be set. If none are specified, then no additional port level rules are applied.
HTTP specific rules.
Headers is a list of HTTP headers which must be present in the request. If omitted or empty, requests are allowed regardless of headers present.
Host is an extended POSIX regex matched against the host header of a request, e.g. "foo.com" If omitted or empty, the value of the host header is ignored.
Method is an extended POSIX regex matched against the method of a request, e.g. "GET", "POST", "PUT", "PATCH", "DELETE", ... If omitted or empty, all methods are allowed.
Path is an extended POSIX regex matched against the path of a request. Currently it can contain characters disallowed from the conventional "path" part of a URL as defined by RFC 3986. If omitted or empty, all paths are all allowed.
Kafka-specific rules.
APIKey is a case-insensitive string matched against the key of a request, e.g. "produce", "fetch", "createtopic", "deletetopic", et al Reference: https://kafka.apache.org/protocol#protocol_api_keys If omitted or empty, all keys are allowed.
APIVersion is the version matched against the api version of the Kafka message. If set, it has to be a string representing a positive integer. If omitted or empty, all versions are allowed.
ClientID is the client identifier as provided in the request. From Kafka protocol documentation: This is a user supplied identifier for the client application. The user can use any identifier they like and it will be used when logging errors, monitoring aggregates, etc. For example, one might want to monitor not just the requests per second overall, but the number coming from each client application (each of which could reside on multiple servers). This id acts as a logical grouping across all requests from a particular client. If omitted or empty, all client identifiers are allowed.
Role is a case-insensitive string and describes a group of API keysnecessary to perform certain higher level Kafka operations such as"produce" or "consume". An APIGroup automatically expands into all APIKeysrequired to perform the specified higher level operation.The following values are supported:- "produce": Allow producing to the topics specified in the rule- "consume": Allow consuming from the topics specified in the ruleThis field is incompatible with the APIKey field, either APIKey or Rolemay be specified. If omitted or empty, the field has no effect and the logic of the APIKey field applies.
Topic is the topic name contained in the message. If a Kafka request contains multiple topics, then all topics must be allowed or the message will be rejected. This constraint is ignored if the matched request message type doesn't contain any topic. Maximum size of Topic can be 249 characters as per recent Kafka spec and allowed characters are a-z, A-Z, 0-9, -, . and _ Older Kafka versions had longer topic lengths of 255, but in Kafka 0.10 version the length was changed from 255 to 249. For compatibility reasons we are using 255 If omitted or empty, all topics are allowed.
Generic Key-Value pair rules.
Parser type name that uses Key-Value pair rules.
Label is the cilium's representation of a container label.
Source can be one of the values present in const.go (e.g.: LabelSourceContainer)
A label selector is a label query over a set of resources. The result of matchLabels and matchExpressions are ANDed. An empty label selector matches all objects. A null label selector matches no objects.
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key is the label key that the selector applies to.
operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.
key is the label key that the selector applies to.
operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
PortProtocol specifies an L4 port with an optional transport protocol
Port is an L4 port number. For now the string will be strictly parsed as a single uint16. In the future, this field may support ranges in the form "1024-2048
Protocol is the L4 protocol. If omitted or empty, any protocol matches. Accepted values: "TCP", "UDP", ""/"ANY"\n\nMatching on ICMP is not supported.
PortRule is a list of ports/protocol combinations with optional Layer 7 rules which must be met.
Ports is a list of L4 port/protocol If omitted or empty but RedirectPort is set, then all ports of the endpoint subject to either the ingress or egress rule are being redirected.
Port is an L4 port number. For now the string will be strictly parsed as a single uint16. In the future, this field may support ranges in the form "1024-2048
Protocol is the L4 protocol. If omitted or empty, any protocol matches. Accepted values: "TCP", "UDP", ""/"ANY"\n\nMatching on ICMP is not supported.
RedirectPort is the L4 port which, if set, all traffic matching the Ports is being redirected to. Whatever listener behind that port becomes responsible to enforce the port rules and is also responsible to reinject all traffic back and ensure it reaches its original destination.
Rules is a list of additional port level rules which must be met in order for the PortRule to allow the traffic. If omitted or empty, no layer 7 rules are enforced.
HTTP specific rules.
Headers is a list of HTTP headers which must be present in the request. If omitted or empty, requests are allowed regardless of headers present.
Host is an extended POSIX regex matched against the host header of a request, e.g. "foo.com" If omitted or empty, the value of the host header is ignored.
Method is an extended POSIX regex matched against the method of a request, e.g. "GET", "POST", "PUT", "PATCH", "DELETE", ... If omitted or empty, all methods are allowed.
Path is an extended POSIX regex matched against the path of a request. Currently it can contain characters disallowed from the conventional "path" part of a URL as defined by RFC 3986. If omitted or empty, all paths are all allowed.
Kafka-specific rules.
APIKey is a case-insensitive string matched against the key of a request, e.g. "produce", "fetch", "createtopic", "deletetopic", et al Reference: https://kafka.apache.org/protocol#protocol_api_keys If omitted or empty, all keys are allowed.
APIVersion is the version matched against the api version of the Kafka message. If set, it has to be a string representing a positive integer. If omitted or empty, all versions are allowed.
ClientID is the client identifier as provided in the request. From Kafka protocol documentation: This is a user supplied identifier for the client application. The user can use any identifier they like and it will be used when logging errors, monitoring aggregates, etc. For example, one might want to monitor not just the requests per second overall, but the number coming from each client application (each of which could reside on multiple servers). This id acts as a logical grouping across all requests from a particular client. If omitted or empty, all client identifiers are allowed.
Role is a case-insensitive string and describes a group of API keysnecessary to perform certain higher level Kafka operations such as"produce" or "consume". An APIGroup automatically expands into all APIKeysrequired to perform the specified higher level operation.The following values are supported:- "produce": Allow producing to the topics specified in the rule- "consume": Allow consuming from the topics specified in the ruleThis field is incompatible with the APIKey field, either APIKey or Rolemay be specified. If omitted or empty, the field has no effect and the logic of the APIKey field applies.
Topic is the topic name contained in the message. If a Kafka request contains multiple topics, then all topics must be allowed or the message will be rejected. This constraint is ignored if the matched request message type doesn't contain any topic. Maximum size of Topic can be 249 characters as per recent Kafka spec and allowed characters are a-z, A-Z, 0-9, -, . and _ Older Kafka versions had longer topic lengths of 255, but in Kafka 0.10 version the length was changed from 255 to 249. For compatibility reasons we are using 255 If omitted or empty, all topics are allowed.
Generic Key-Value pair rules.
Parser type name that uses Key-Value pair rules.
PortRuleHTTP is a list of HTTP protocol constraints. All fields are optional, if all fields are empty or missing, the rule does not have any effect. All fields of this type are extended POSIX regex as defined by IEEE Std 1003.1, (i.e this follows the egrep/unix syntax, not the perl syntax) matched against the path of an incoming request. Currently it can contain characters disallowed from the conventional "path" part of a URL as defined by RFC 3986.
Headers is a list of HTTP headers which must be present in the request. If omitted or empty, requests are allowed regardless of headers present.
Host is an extended POSIX regex matched against the host header of a request, e.g. "foo.com" If omitted or empty, the value of the host header is ignored.
Method is an extended POSIX regex matched against the method of a request, e.g. "GET", "POST", "PUT", "PATCH", "DELETE", ... If omitted or empty, all methods are allowed.
Path is an extended POSIX regex matched against the path of a request. Currently it can contain characters disallowed from the conventional "path" part of a URL as defined by RFC 3986. If omitted or empty, all paths are all allowed.
PortRuleKafka is a list of Kafka protocol constraints. All fields are optional, if all fields are empty or missing, the rule will match all Kafka messages.
APIKey is a case-insensitive string matched against the key of a request, e.g. "produce", "fetch", "createtopic", "deletetopic", et al Reference: https://kafka.apache.org/protocol#protocol_api_keys If omitted or empty, all keys are allowed.
APIVersion is the version matched against the api version of the Kafka message. If set, it has to be a string representing a positive integer. If omitted or empty, all versions are allowed.
ClientID is the client identifier as provided in the request. From Kafka protocol documentation: This is a user supplied identifier for the client application. The user can use any identifier they like and it will be used when logging errors, monitoring aggregates, etc. For example, one might want to monitor not just the requests per second overall, but the number coming from each client application (each of which could reside on multiple servers). This id acts as a logical grouping across all requests from a particular client. If omitted or empty, all client identifiers are allowed.
Role is a case-insensitive string and describes a group of API keysnecessary to perform certain higher level Kafka operations such as"produce" or "consume". An APIGroup automatically expands into all APIKeysrequired to perform the specified higher level operation.The following values are supported:- "produce": Allow producing to the topics specified in the rule- "consume": Allow consuming from the topics specified in the ruleThis field is incompatible with the APIKey field, either APIKey or Rolemay be specified. If omitted or empty, the field has no effect and the logic of the APIKey field applies.
Topic is the topic name contained in the message. If a Kafka request contains multiple topics, then all topics must be allowed or the message will be rejected. This constraint is ignored if the matched request message type doesn't contain any topic. Maximum size of Topic can be 249 characters as per recent Kafka spec and allowed characters are a-z, A-Z, 0-9, -, . and _ Older Kafka versions had longer topic lengths of 255, but in Kafka 0.10 version the length was changed from 255 to 249. For compatibility reasons we are using 255 If omitted or empty, all topics are allowed.
PortRuleL7 is a map of {key,value} pairs which is passed to the parser referenced in l7proto. It is up to the parser to define what to do with the map data. If omitted or empty, all requests are allowed. Both keys and values must be strings.
Rule is a policy rule which must be applied to all endpoints which match the labels contained in the endpointSelector Each rule is split into an ingress section which contains all rules applicable at ingress, and an egress section applicable at egress. For rule types such as `L4Rule` and `CIDR` which can be applied at both ingress and egress, both ingress and egress side have to either specifically allow the connection or one side has to be omitted. Either ingress, egress, or both can be provided. If both ingress and egress are omitted, the rule has no effect.
Description is a free form string, it can be used by the creator of the rule to store human readable explanation of the purpose of this rule. Rules cannot be identified by comment.
Egress is a list of EgressRule which are enforced at egress. If omitted or empty, this rule does not apply at egress.
ToCIDR is a list of IP blocks which the endpoint subject to the rule is allowed to initiate connections. This will match on the destination IP address of outgoing connections. Adding a prefix into ToCIDR or into ToCIDRSet with no ExcludeCIDRs is equivalent. Overlaps are allowed between ToCIDR and ToCIDRSet. Example: Any endpoint with the label "app=database-proxy" is allowed to initiate connections to 10.2.3.0/24
ToCIDRSet is a list of IP blocks which the endpoint subject to the rule is allowed to initiate connections to in addition to connections which are allowed via FromEndpoints, along with a list of subnets contained within their corresponding IP block to which traffic should not be allowed. This will match on the destination IP address of outgoing connections. Adding a prefix into ToCIDR or into ToCIDRSet with no ExcludeCIDRs is equivalent. Overlaps are allowed between ToCIDR and ToCIDRSet. Example: Any endpoint with the label "app=database-proxy" is allowed to initiate connections to 10.2.3.0/24 except from IPs in subnet 10.2.3.0/28.
CIDR is a CIDR prefix / IP Block.
ExceptCIDRs is a list of IP blocks which the endpoint subject to the rule is not allowed to initiate connections to. These CIDR prefixes should be contained within Cidr. These exceptions are only applied to the Cidr in this CIDRRule, and do not apply to any other CIDR prefixes in any other CIDRRules.
ToEndpoints is a list of endpoints identified by an EndpointSelector to which the endpoint subject to the ruleis allowed to communicate. Example: Any endpoint with the label "role=frontend" can be consumed by any endpoint carrying the label "role=backend".
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key is the label key that the selector applies to.
operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
ToEntities is a list of special entities to which the endpoint subject to the rule is allowed to initiate connections. Supported entities are `world`, `cluster` and `host`
ToGroups is a list of constraints that will gather data from third-party providers and create a new derived policy.
Region is the key that will filter the AWS EC2 instances in the given region
SecurityGroupsIds is the list of AWS security group IDs that will filter the instances IPs from the AWS API
SecurityGroupsNames is the list of AWS security group names that will filter the instances IPs from the AWS API
ToPorts is a list of destination ports identified by port number and protocol which the endpoint subject to the rule is allowed to connect to. Example: Any endpoint with the label "role=frontend" is allowed to initiate connections to destination port 8080/tcp
Ports is a list of L4 port/protocol If omitted or empty but RedirectPort is set, then all ports of the endpoint subject to either the ingress or egress rule are being redirected.
Port is an L4 port number. For now the string will be strictly parsed as a single uint16. In the future, this field may support ranges in the form "1024-2048
Protocol is the L4 protocol. If omitted or empty, any protocol matches. Accepted values: "TCP", "UDP", ""/"ANY"\n\nMatching on ICMP is not supported.
RedirectPort is the L4 port which, if set, all traffic matching the Ports is being redirected to. Whatever listener behind that port becomes responsible to enforce the port rules and is also responsible to reinject all traffic back and ensure it reaches its original destination.
Rules is a list of additional port level rules which must be met in order for the PortRule to allow the traffic. If omitted or empty, no layer 7 rules are enforced.
HTTP specific rules.
Headers is a list of HTTP headers which must be present in the request. If omitted or empty, requests are allowed regardless of headers present.
Host is an extended POSIX regex matched against the host header of a request, e.g. "foo.com" If omitted or empty, the value of the host header is ignored.
Method is an extended POSIX regex matched against the method of a request, e.g. "GET", "POST", "PUT", "PATCH", "DELETE", ... If omitted or empty, all methods are allowed.
Path is an extended POSIX regex matched against the path of a request. Currently it can contain characters disallowed from the conventional "path" part of a URL as defined by RFC 3986. If omitted or empty, all paths are all allowed.
Kafka-specific rules.
APIKey is a case-insensitive string matched against the key of a request, e.g. "produce", "fetch", "createtopic", "deletetopic", et al Reference: https://kafka.apache.org/protocol#protocol_api_keys If omitted or empty, all keys are allowed.
APIVersion is the version matched against the api version of the Kafka message. If set, it has to be a string representing a positive integer. If omitted or empty, all versions are allowed.
ClientID is the client identifier as provided in the request. From Kafka protocol documentation: This is a user supplied identifier for the client application. The user can use any identifier they like and it will be used when logging errors, monitoring aggregates, etc. For example, one might want to monitor not just the requests per second overall, but the number coming from each client application (each of which could reside on multiple servers). This id acts as a logical grouping across all requests from a particular client. If omitted or empty, all client identifiers are allowed.
Role is a case-insensitive string and describes a group of API keysnecessary to perform certain higher level Kafka operations such as"produce" or "consume". An APIGroup automatically expands into all APIKeysrequired to perform the specified higher level operation.The following values are supported:- "produce": Allow producing to the topics specified in the rule- "consume": Allow consuming from the topics specified in the ruleThis field is incompatible with the APIKey field, either APIKey or Rolemay be specified. If omitted or empty, the field has no effect and the logic of the APIKey field applies.
Topic is the topic name contained in the message. If a Kafka request contains multiple topics, then all topics must be allowed or the message will be rejected. This constraint is ignored if the matched request message type doesn't contain any topic. Maximum size of Topic can be 249 characters as per recent Kafka spec and allowed characters are a-z, A-Z, 0-9, -, . and _ Older Kafka versions had longer topic lengths of 255, but in Kafka 0.10 version the length was changed from 255 to 249. For compatibility reasons we are using 255 If omitted or empty, all topics are allowed.
Generic Key-Value pair rules.
Parser type name that uses Key-Value pair rules.
ToRequires is a list of additional constraints which must be met in order for the selected endpoints to be able to reach other endpoints. These additional constraints do not by themselves grant access privileges and must always be accompanied with at least one matching FromEndpoints. Example: Any Endpoint with the label "team=A" requires any endpoint to which it communicates to also carry the label "team=A".
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key is the label key that the selector applies to.
operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
ToServices is a list of services to which the endpoint subject to the rule is allowed to initiate connections. Example: Any endpoint with the label "app=backend-app" is allowed to initiate connections to all cidrs backing the "external-service" service
K8sServiceNamespace is an abstraction for the k8s service + namespace types.
K8sServiceSelector selects services by k8s labels. Not supported yet
A label selector is a label query over a set of resources. The result of matchLabels and matchExpressions are ANDed. An empty label selector matches all objects. A null label selector matches no objects.
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key is the label key that the selector applies to.
operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
EndpointSelector selects all endpoints which should be subject to this rule. Cannot be empty.
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key is the label key that the selector applies to.
operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
Ingress is a list of IngressRule which are enforced at ingress. If omitted or empty, this rule does not apply at ingress.
FromCIDR is a list of IP blocks which the endpoint subject to the rule is allowed to receive connections from. This will match on the source IP address of incoming connections. Adding a prefix into FromCIDR or into FromCIDRSet with no ExcludeCIDRs is equivalent. Overlaps are allowed between FromCIDR and FromCIDRSet. Example: Any endpoint with the label "app=my-legacy-pet" is allowed to receive connections from 10.3.9.1
FromCIDRSet is a list of IP blocks which the endpoint subject to the rule is allowed to receive connections from in addition to FromEndpoints, along with a list of subnets contained within their corresponding IP block from which traffic should not be allowed. This will match on the source IP address of incoming connections. Adding a prefix into FromCIDR or into FromCIDRSet with no ExcludeCIDRs is equivalent. Overlaps are allowed between FromCIDR and FromCIDRSet. Example: Any endpoint with the label "app=my-legacy-pet" is allowed to receive connections from 10.0.0.0/8 except from IPs in subnet 10.96.0.0/12.
CIDR is a CIDR prefix / IP Block.
ExceptCIDRs is a list of IP blocks which the endpoint subject to the rule is not allowed to initiate connections to. These CIDR prefixes should be contained within Cidr. These exceptions are only applied to the Cidr in this CIDRRule, and do not apply to any other CIDR prefixes in any other CIDRRules.
FromEndpoints is a list of endpoints identified by an EndpointSelector which are allowed to communicate with the endpoint subject to the rule. Example: Any endpoint with the label "role=backend" can be consumed by any endpoint carrying the label "role=frontend".
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key is the label key that the selector applies to.
operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
FromEntities is a list of special entities which the endpoint subject to the rule is allowed to receive connections from. Supported entities are `world`, `cluster`, `host`, and `init`
FromRequires is a list of additional constraints which must be met in order for the selected endpoints to be reachable. These additional constraints do no by itself grant access privileges and must always be accompanied with at least one matching FromEndpoints. Example: Any Endpoint with the label "team=A" requires consuming endpoint to also carry the label "team=A".
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key is the label key that the selector applies to.
operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
ToPorts is a list of destination ports identified by port number and protocol which the endpoint subject to the rule is allowed to receive connections on. Example: Any endpoint with the label "app=httpd" can only accept incoming connections on port 80/tcp.
Ports is a list of L4 port/protocol If omitted or empty but RedirectPort is set, then all ports of the endpoint subject to either the ingress or egress rule are being redirected.
Port is an L4 port number. For now the string will be strictly parsed as a single uint16. In the future, this field may support ranges in the form "1024-2048
Protocol is the L4 protocol. If omitted or empty, any protocol matches. Accepted values: "TCP", "UDP", ""/"ANY"\n\nMatching on ICMP is not supported.
RedirectPort is the L4 port which, if set, all traffic matching the Ports is being redirected to. Whatever listener behind that port becomes responsible to enforce the port rules and is also responsible to reinject all traffic back and ensure it reaches its original destination.
Rules is a list of additional port level rules which must be met in order for the PortRule to allow the traffic. If omitted or empty, no layer 7 rules are enforced.
HTTP specific rules.
Headers is a list of HTTP headers which must be present in the request. If omitted or empty, requests are allowed regardless of headers present.
Host is an extended POSIX regex matched against the host header of a request, e.g. "foo.com" If omitted or empty, the value of the host header is ignored.
Method is an extended POSIX regex matched against the method of a request, e.g. "GET", "POST", "PUT", "PATCH", "DELETE", ... If omitted or empty, all methods are allowed.
Path is an extended POSIX regex matched against the path of a request. Currently it can contain characters disallowed from the conventional "path" part of a URL as defined by RFC 3986. If omitted or empty, all paths are all allowed.
Kafka-specific rules.
APIKey is a case-insensitive string matched against the key of a request, e.g. "produce", "fetch", "createtopic", "deletetopic", et al Reference: https://kafka.apache.org/protocol#protocol_api_keys If omitted or empty, all keys are allowed.
APIVersion is the version matched against the api version of the Kafka message. If set, it has to be a string representing a positive integer. If omitted or empty, all versions are allowed.
ClientID is the client identifier as provided in the request. From Kafka protocol documentation: This is a user supplied identifier for the client application. The user can use any identifier they like and it will be used when logging errors, monitoring aggregates, etc. For example, one might want to monitor not just the requests per second overall, but the number coming from each client application (each of which could reside on multiple servers). This id acts as a logical grouping across all requests from a particular client. If omitted or empty, all client identifiers are allowed.
Role is a case-insensitive string and describes a group of API keysnecessary to perform certain higher level Kafka operations such as"produce" or "consume". An APIGroup automatically expands into all APIKeysrequired to perform the specified higher level operation.The following values are supported:- "produce": Allow producing to the topics specified in the rule- "consume": Allow consuming from the topics specified in the ruleThis field is incompatible with the APIKey field, either APIKey or Rolemay be specified. If omitted or empty, the field has no effect and the logic of the APIKey field applies.
Topic is the topic name contained in the message. If a Kafka request contains multiple topics, then all topics must be allowed or the message will be rejected. This constraint is ignored if the matched request message type doesn't contain any topic. Maximum size of Topic can be 249 characters as per recent Kafka spec and allowed characters are a-z, A-Z, 0-9, -, . and _ Older Kafka versions had longer topic lengths of 255, but in Kafka 0.10 version the length was changed from 255 to 249. For compatibility reasons we are using 255 If omitted or empty, all topics are allowed.
Generic Key-Value pair rules.
Parser type name that uses Key-Value pair rules.
Labels is a list of optional strings which can be used to re-identify the rule or to store metadata. It is possible to lookup or delete strings based on labels. Labels are not required to be unique, multiple rules can have overlapping or identical labels.
Source can be one of the values present in const.go (e.g.: LabelSourceContainer)
Service wraps around selectors for services
K8sServiceNamespace is an abstraction for the k8s service + namespace types.
K8sServiceSelector selects services by k8s labels. Not supported yet
A label selector is a label query over a set of resources. The result of matchLabels and matchExpressions are ANDed. An empty label selector matches all objects. A null label selector matches no objects.
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key is the label key that the selector applies to.
operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
ServiceSelector is a label selector for k8s services
A label selector is a label query over a set of resources. The result of matchLabels and matchExpressions are ANDed. An empty label selector matches all objects. A null label selector matches no objects.
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key is the label key that the selector applies to.
operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
Rule is a policy rule which must be applied to all endpoints which match the labels contained in the endpointSelector Each rule is split into an ingress section which contains all rules applicable at ingress, and an egress section applicable at egress. For rule types such as `L4Rule` and `CIDR` which can be applied at both ingress and egress, both ingress and egress side have to either specifically allow the connection or one side has to be omitted. Either ingress, egress, or both can be provided. If both ingress and egress are omitted, the rule has no effect.
Description is a free form string, it can be used by the creator of the rule to store human readable explanation of the purpose of this rule. Rules cannot be identified by comment.
Egress is a list of EgressRule which are enforced at egress. If omitted or empty, this rule does not apply at egress.
ToCIDR is a list of IP blocks which the endpoint subject to the rule is allowed to initiate connections. This will match on the destination IP address of outgoing connections. Adding a prefix into ToCIDR or into ToCIDRSet with no ExcludeCIDRs is equivalent. Overlaps are allowed between ToCIDR and ToCIDRSet. Example: Any endpoint with the label "app=database-proxy" is allowed to initiate connections to 10.2.3.0/24
ToCIDRSet is a list of IP blocks which the endpoint subject to the rule is allowed to initiate connections to in addition to connections which are allowed via FromEndpoints, along with a list of subnets contained within their corresponding IP block to which traffic should not be allowed. This will match on the destination IP address of outgoing connections. Adding a prefix into ToCIDR or into ToCIDRSet with no ExcludeCIDRs is equivalent. Overlaps are allowed between ToCIDR and ToCIDRSet. Example: Any endpoint with the label "app=database-proxy" is allowed to initiate connections to 10.2.3.0/24 except from IPs in subnet 10.2.3.0/28.
CIDR is a CIDR prefix / IP Block.
ExceptCIDRs is a list of IP blocks which the endpoint subject to the rule is not allowed to initiate connections to. These CIDR prefixes should be contained within Cidr. These exceptions are only applied to the Cidr in this CIDRRule, and do not apply to any other CIDR prefixes in any other CIDRRules.
ToEndpoints is a list of endpoints identified by an EndpointSelector to which the endpoint subject to the ruleis allowed to communicate. Example: Any endpoint with the label "role=frontend" can be consumed by any endpoint carrying the label "role=backend".
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key is the label key that the selector applies to.
operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
ToEntities is a list of special entities to which the endpoint subject to the rule is allowed to initiate connections. Supported entities are `world`, `cluster` and `host`
ToGroups is a list of constraints that will gather data from third-party providers and create a new derived policy.
Region is the key that will filter the AWS EC2 instances in the given region
SecurityGroupsIds is the list of AWS security group IDs that will filter the instances IPs from the AWS API
SecurityGroupsNames is the list of AWS security group names that will filter the instances IPs from the AWS API
ToPorts is a list of destination ports identified by port number and protocol which the endpoint subject to the rule is allowed to connect to. Example: Any endpoint with the label "role=frontend" is allowed to initiate connections to destination port 8080/tcp
Ports is a list of L4 port/protocol If omitted or empty but RedirectPort is set, then all ports of the endpoint subject to either the ingress or egress rule are being redirected.
Port is an L4 port number. For now the string will be strictly parsed as a single uint16. In the future, this field may support ranges in the form "1024-2048
Protocol is the L4 protocol. If omitted or empty, any protocol matches. Accepted values: "TCP", "UDP", ""/"ANY"\n\nMatching on ICMP is not supported.
RedirectPort is the L4 port which, if set, all traffic matching the Ports is being redirected to. Whatever listener behind that port becomes responsible to enforce the port rules and is also responsible to reinject all traffic back and ensure it reaches its original destination.
L7Rules is a union of port level rule types. Mixing of different port level rule types is disallowed, so exactly one of the following must be set. If none are specified, then no additional port level rules are applied.
HTTP specific rules.
Headers is a list of HTTP headers which must be present in the request. If omitted or empty, requests are allowed regardless of headers present.
Host is an extended POSIX regex matched against the host header of a request, e.g. "foo.com" If omitted or empty, the value of the host header is ignored.
Method is an extended POSIX regex matched against the method of a request, e.g. "GET", "POST", "PUT", "PATCH", "DELETE", ... If omitted or empty, all methods are allowed.
Path is an extended POSIX regex matched against the path of a request. Currently it can contain characters disallowed from the conventional "path" part of a URL as defined by RFC 3986. If omitted or empty, all paths are all allowed.
Kafka-specific rules.
APIKey is a case-insensitive string matched against the key of a request, e.g. "produce", "fetch", "createtopic", "deletetopic", et al Reference: https://kafka.apache.org/protocol#protocol_api_keys If omitted or empty, all keys are allowed.
APIVersion is the version matched against the api version of the Kafka message. If set, it has to be a string representing a positive integer. If omitted or empty, all versions are allowed.
ClientID is the client identifier as provided in the request. From Kafka protocol documentation: This is a user supplied identifier for the client application. The user can use any identifier they like and it will be used when logging errors, monitoring aggregates, etc. For example, one might want to monitor not just the requests per second overall, but the number coming from each client application (each of which could reside on multiple servers). This id acts as a logical grouping across all requests from a particular client. If omitted or empty, all client identifiers are allowed.
Role is a case-insensitive string and describes a group of API keysnecessary to perform certain higher level Kafka operations such as"produce" or "consume". An APIGroup automatically expands into all APIKeysrequired to perform the specified higher level operation.The following values are supported:- "produce": Allow producing to the topics specified in the rule- "consume": Allow consuming from the topics specified in the ruleThis field is incompatible with the APIKey field, either APIKey or Rolemay be specified. If omitted or empty, the field has no effect and the logic of the APIKey field applies.
Topic is the topic name contained in the message. If a Kafka request contains multiple topics, then all topics must be allowed or the message will be rejected. This constraint is ignored if the matched request message type doesn't contain any topic. Maximum size of Topic can be 249 characters as per recent Kafka spec and allowed characters are a-z, A-Z, 0-9, -, . and _ Older Kafka versions had longer topic lengths of 255, but in Kafka 0.10 version the length was changed from 255 to 249. For compatibility reasons we are using 255 If omitted or empty, all topics are allowed.
Generic Key-Value pair rules.
Parser type name that uses Key-Value pair rules.
ToRequires is a list of additional constraints which must be met in order for the selected endpoints to be able to reach other endpoints. These additional constraints do not by themselves grant access privileges and must always be accompanied with at least one matching FromEndpoints. Example: Any Endpoint with the label "team=A" requires any endpoint to which it communicates to also carry the label "team=A".
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key is the label key that the selector applies to.
operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
ToServices is a list of services to which the endpoint subject to the rule is allowed to initiate connections. Example: Any endpoint with the label "app=backend-app" is allowed to initiate connections to all cidrs backing the "external-service" service
K8sServiceNamespace is an abstraction for the k8s service + namespace types.
ServiceSelector is a label selector for k8s services
A label selector is a label query over a set of resources. The result of matchLabels and matchExpressions are ANDed. An empty label selector matches all objects. A null label selector matches no objects.
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key is the label key that the selector applies to.
operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
A label selector is a label query over a set of resources. The result of matchLabels and matchExpressions are ANDed. An empty label selector matches all objects. A null label selector matches no objects.
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key is the label key that the selector applies to.
operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
Ingress is a list of IngressRule which are enforced at ingress. If omitted or empty, this rule does not apply at ingress.
FromCIDR is a list of IP blocks which the endpoint subject to the rule is allowed to receive connections from. This will match on the source IP address of incoming connections. Adding a prefix into FromCIDR or into FromCIDRSet with no ExcludeCIDRs is equivalent. Overlaps are allowed between FromCIDR and FromCIDRSet. Example: Any endpoint with the label "app=my-legacy-pet" is allowed to receive connections from 10.3.9.1
FromCIDRSet is a list of IP blocks which the endpoint subject to the rule is allowed to receive connections from in addition to FromEndpoints, along with a list of subnets contained within their corresponding IP block from which traffic should not be allowed. This will match on the source IP address of incoming connections. Adding a prefix into FromCIDR or into FromCIDRSet with no ExcludeCIDRs is equivalent. Overlaps are allowed between FromCIDR and FromCIDRSet. Example: Any endpoint with the label "app=my-legacy-pet" is allowed to receive connections from 10.0.0.0/8 except from IPs in subnet 10.96.0.0/12.
CIDR is a CIDR prefix / IP Block.
ExceptCIDRs is a list of IP blocks which the endpoint subject to the rule is not allowed to initiate connections to. These CIDR prefixes should be contained within Cidr. These exceptions are only applied to the Cidr in this CIDRRule, and do not apply to any other CIDR prefixes in any other CIDRRules.
FromEndpoints is a list of endpoints identified by an EndpointSelector which are allowed to communicate with the endpoint subject to the rule. Example: Any endpoint with the label "role=backend" can be consumed by any endpoint carrying the label "role=frontend".
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key is the label key that the selector applies to.
operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
FromEntities is a list of special entities which the endpoint subject to the rule is allowed to receive connections from. Supported entities are `world`, `cluster`, `host`, and `init`
FromRequires is a list of additional constraints which must be met in order for the selected endpoints to be reachable. These additional constraints do no by itself grant access privileges and must always be accompanied with at least one matching FromEndpoints. Example: Any Endpoint with the label "team=A" requires consuming endpoint to also carry the label "team=A".
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key is the label key that the selector applies to.
operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
ToPorts is a list of destination ports identified by port number and protocol which the endpoint subject to the rule is allowed to receive connections on. Example: Any endpoint with the label "app=httpd" can only accept incoming connections on port 80/tcp.
Ports is a list of L4 port/protocol If omitted or empty but RedirectPort is set, then all ports of the endpoint subject to either the ingress or egress rule are being redirected.
Port is an L4 port number. For now the string will be strictly parsed as a single uint16. In the future, this field may support ranges in the form "1024-2048
Protocol is the L4 protocol. If omitted or empty, any protocol matches. Accepted values: "TCP", "UDP", ""/"ANY"\n\nMatching on ICMP is not supported.
RedirectPort is the L4 port which, if set, all traffic matching the Ports is being redirected to. Whatever listener behind that port becomes responsible to enforce the port rules and is also responsible to reinject all traffic back and ensure it reaches its original destination.
L7Rules is a union of port level rule types. Mixing of different port level rule types is disallowed, so exactly one of the following must be set. If none are specified, then no additional port level rules are applied.
HTTP specific rules.
Headers is a list of HTTP headers which must be present in the request. If omitted or empty, requests are allowed regardless of headers present.
Host is an extended POSIX regex matched against the host header of a request, e.g. "foo.com" If omitted or empty, the value of the host header is ignored.
Method is an extended POSIX regex matched against the method of a request, e.g. "GET", "POST", "PUT", "PATCH", "DELETE", ... If omitted or empty, all methods are allowed.
Path is an extended POSIX regex matched against the path of a request. Currently it can contain characters disallowed from the conventional "path" part of a URL as defined by RFC 3986. If omitted or empty, all paths are all allowed.
Kafka-specific rules.
APIKey is a case-insensitive string matched against the key of a request, e.g. "produce", "fetch", "createtopic", "deletetopic", et al Reference: https://kafka.apache.org/protocol#protocol_api_keys If omitted or empty, all keys are allowed.
APIVersion is the version matched against the api version of the Kafka message. If set, it has to be a string representing a positive integer. If omitted or empty, all versions are allowed.
ClientID is the client identifier as provided in the request. From Kafka protocol documentation: This is a user supplied identifier for the client application. The user can use any identifier they like and it will be used when logging errors, monitoring aggregates, etc. For example, one might want to monitor not just the requests per second overall, but the number coming from each client application (each of which could reside on multiple servers). This id acts as a logical grouping across all requests from a particular client. If omitted or empty, all client identifiers are allowed.
Role is a case-insensitive string and describes a group of API keysnecessary to perform certain higher level Kafka operations such as"produce" or "consume". An APIGroup automatically expands into all APIKeysrequired to perform the specified higher level operation.The following values are supported:- "produce": Allow producing to the topics specified in the rule- "consume": Allow consuming from the topics specified in the ruleThis field is incompatible with the APIKey field, either APIKey or Rolemay be specified. If omitted or empty, the field has no effect and the logic of the APIKey field applies.
Topic is the topic name contained in the message. If a Kafka request contains multiple topics, then all topics must be allowed or the message will be rejected. This constraint is ignored if the matched request message type doesn't contain any topic. Maximum size of Topic can be 249 characters as per recent Kafka spec and allowed characters are a-z, A-Z, 0-9, -, . and _ Older Kafka versions had longer topic lengths of 255, but in Kafka 0.10 version the length was changed from 255 to 249. For compatibility reasons we are using 255 If omitted or empty, all topics are allowed.
Generic Key-Value pair rules.
Parser type name that uses Key-Value pair rules.
Labels is a list of optional strings which can be used to re-identify the rule or to store metadata. It is possible to lookup or delete strings based on labels. Labels are not required to be unique, multiple rules can have overlapping or identical labels.
Source can be one of the values present in const.go (e.g.: LabelSourceContainer)
Specs is a list of desired Cilium specific rule specification.
Description is a free form string, it can be used by the creator of the rule to store human readable explanation of the purpose of this rule. Rules cannot be identified by comment.
Egress is a list of EgressRule which are enforced at egress. If omitted or empty, this rule does not apply at egress.
ToCIDR is a list of IP blocks which the endpoint subject to the rule is allowed to initiate connections. This will match on the destination IP address of outgoing connections. Adding a prefix into ToCIDR or into ToCIDRSet with no ExcludeCIDRs is equivalent. Overlaps are allowed between ToCIDR and ToCIDRSet. Example: Any endpoint with the label "app=database-proxy" is allowed to initiate connections to 10.2.3.0/24
ToCIDRSet is a list of IP blocks which the endpoint subject to the rule is allowed to initiate connections to in addition to connections which are allowed via FromEndpoints, along with a list of subnets contained within their corresponding IP block to which traffic should not be allowed. This will match on the destination IP address of outgoing connections. Adding a prefix into ToCIDR or into ToCIDRSet with no ExcludeCIDRs is equivalent. Overlaps are allowed between ToCIDR and ToCIDRSet. Example: Any endpoint with the label "app=database-proxy" is allowed to initiate connections to 10.2.3.0/24 except from IPs in subnet 10.2.3.0/28.
CIDR is a CIDR prefix / IP Block.
ExceptCIDRs is a list of IP blocks which the endpoint subject to the rule is not allowed to initiate connections to. These CIDR prefixes should be contained within Cidr. These exceptions are only applied to the Cidr in this CIDRRule, and do not apply to any other CIDR prefixes in any other CIDRRules.
ToEndpoints is a list of endpoints identified by an EndpointSelector to which the endpoint subject to the ruleis allowed to communicate. Example: Any endpoint with the label "role=frontend" can be consumed by any endpoint carrying the label "role=backend".
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key is the label key that the selector applies to.
operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
ToEntities is a list of special entities to which the endpoint subject to the rule is allowed to initiate connections. Supported entities are `world`, `cluster` and `host`
ToGroups is a list of constraints that will gather data from third-party providers and create a new derived policy.
Region is the key that will filter the AWS EC2 instances in the given region
SecurityGroupsIds is the list of AWS security group IDs that will filter the instances IPs from the AWS API
SecurityGroupsNames is the list of AWS security group names that will filter the instances IPs from the AWS API
ToPorts is a list of destination ports identified by port number and protocol which the endpoint subject to the rule is allowed to connect to. Example: Any endpoint with the label "role=frontend" is allowed to initiate connections to destination port 8080/tcp
Ports is a list of L4 port/protocol If omitted or empty but RedirectPort is set, then all ports of the endpoint subject to either the ingress or egress rule are being redirected.
Port is an L4 port number. For now the string will be strictly parsed as a single uint16. In the future, this field may support ranges in the form "1024-2048
Protocol is the L4 protocol. If omitted or empty, any protocol matches. Accepted values: "TCP", "UDP", ""/"ANY"\n\nMatching on ICMP is not supported.
RedirectPort is the L4 port which, if set, all traffic matching the Ports is being redirected to. Whatever listener behind that port becomes responsible to enforce the port rules and is also responsible to reinject all traffic back and ensure it reaches its original destination.
L7Rules is a union of port level rule types. Mixing of different port level rule types is disallowed, so exactly one of the following must be set. If none are specified, then no additional port level rules are applied.
HTTP specific rules.
Headers is a list of HTTP headers which must be present in the request. If omitted or empty, requests are allowed regardless of headers present.
Host is an extended POSIX regex matched against the host header of a request, e.g. "foo.com" If omitted or empty, the value of the host header is ignored.
Method is an extended POSIX regex matched against the method of a request, e.g. "GET", "POST", "PUT", "PATCH", "DELETE", ... If omitted or empty, all methods are allowed.
Path is an extended POSIX regex matched against the path of a request. Currently it can contain characters disallowed from the conventional "path" part of a URL as defined by RFC 3986. If omitted or empty, all paths are all allowed.
Kafka-specific rules.
APIKey is a case-insensitive string matched against the key of a request, e.g. "produce", "fetch", "createtopic", "deletetopic", et al Reference: https://kafka.apache.org/protocol#protocol_api_keys If omitted or empty, all keys are allowed.
APIVersion is the version matched against the api version of the Kafka message. If set, it has to be a string representing a positive integer. If omitted or empty, all versions are allowed.
ClientID is the client identifier as provided in the request. From Kafka protocol documentation: This is a user supplied identifier for the client application. The user can use any identifier they like and it will be used when logging errors, monitoring aggregates, etc. For example, one might want to monitor not just the requests per second overall, but the number coming from each client application (each of which could reside on multiple servers). This id acts as a logical grouping across all requests from a particular client. If omitted or empty, all client identifiers are allowed.
Role is a case-insensitive string and describes a group of API keysnecessary to perform certain higher level Kafka operations such as"produce" or "consume". An APIGroup automatically expands into all APIKeysrequired to perform the specified higher level operation.The following values are supported:- "produce": Allow producing to the topics specified in the rule- "consume": Allow consuming from the topics specified in the ruleThis field is incompatible with the APIKey field, either APIKey or Rolemay be specified. If omitted or empty, the field has no effect and the logic of the APIKey field applies.
Topic is the topic name contained in the message. If a Kafka request contains multiple topics, then all topics must be allowed or the message will be rejected. This constraint is ignored if the matched request message type doesn't contain any topic. Maximum size of Topic can be 249 characters as per recent Kafka spec and allowed characters are a-z, A-Z, 0-9, -, . and _ Older Kafka versions had longer topic lengths of 255, but in Kafka 0.10 version the length was changed from 255 to 249. For compatibility reasons we are using 255 If omitted or empty, all topics are allowed.
Generic Key-Value pair rules.
Parser type name that uses Key-Value pair rules.
ToRequires is a list of additional constraints which must be met in order for the selected endpoints to be able to reach other endpoints. These additional constraints do not by themselves grant access privileges and must always be accompanied with at least one matching FromEndpoints. Example: Any Endpoint with the label "team=A" requires any endpoint to which it communicates to also carry the label "team=A".
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key is the label key that the selector applies to.
operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
ToServices is a list of services to which the endpoint subject to the rule is allowed to initiate connections. Example: Any endpoint with the label "app=backend-app" is allowed to initiate connections to all cidrs backing the "external-service" service
K8sServiceNamespace is an abstraction for the k8s service + namespace types.
ServiceSelector is a label selector for k8s services
A label selector is a label query over a set of resources. The result of matchLabels and matchExpressions are ANDed. An empty label selector matches all objects. A null label selector matches no objects.
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key is the label key that the selector applies to.
operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
A label selector is a label query over a set of resources. The result of matchLabels and matchExpressions are ANDed. An empty label selector matches all objects. A null label selector matches no objects.
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key is the label key that the selector applies to.
operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
Ingress is a list of IngressRule which are enforced at ingress. If omitted or empty, this rule does not apply at ingress.
FromCIDR is a list of IP blocks which the endpoint subject to the rule is allowed to receive connections from. This will match on the source IP address of incoming connections. Adding a prefix into FromCIDR or into FromCIDRSet with no ExcludeCIDRs is equivalent. Overlaps are allowed between FromCIDR and FromCIDRSet. Example: Any endpoint with the label "app=my-legacy-pet" is allowed to receive connections from 10.3.9.1
FromCIDRSet is a list of IP blocks which the endpoint subject to the rule is allowed to receive connections from in addition to FromEndpoints, along with a list of subnets contained within their corresponding IP block from which traffic should not be allowed. This will match on the source IP address of incoming connections. Adding a prefix into FromCIDR or into FromCIDRSet with no ExcludeCIDRs is equivalent. Overlaps are allowed between FromCIDR and FromCIDRSet. Example: Any endpoint with the label "app=my-legacy-pet" is allowed to receive connections from 10.0.0.0/8 except from IPs in subnet 10.96.0.0/12.
CIDR is a CIDR prefix / IP Block.
ExceptCIDRs is a list of IP blocks which the endpoint subject to the rule is not allowed to initiate connections to. These CIDR prefixes should be contained within Cidr. These exceptions are only applied to the Cidr in this CIDRRule, and do not apply to any other CIDR prefixes in any other CIDRRules.
FromEndpoints is a list of endpoints identified by an EndpointSelector which are allowed to communicate with the endpoint subject to the rule. Example: Any endpoint with the label "role=backend" can be consumed by any endpoint carrying the label "role=frontend".
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key is the label key that the selector applies to.
operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
FromEntities is a list of special entities which the endpoint subject to the rule is allowed to receive connections from. Supported entities are `world`, `cluster`, `host`, and `init`
FromRequires is a list of additional constraints which must be met in order for the selected endpoints to be reachable. These additional constraints do no by itself grant access privileges and must always be accompanied with at least one matching FromEndpoints. Example: Any Endpoint with the label "team=A" requires consuming endpoint to also carry the label "team=A".
matchExpressions is a list of label selector requirements. The requirements are ANDed.
key is the label key that the selector applies to.
operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
ToPorts is a list of destination ports identified by port number and protocol which the endpoint subject to the rule is allowed to receive connections on. Example: Any endpoint with the label "app=httpd" can only accept incoming connections on port 80/tcp.
Ports is a list of L4 port/protocol If omitted or empty but RedirectPort is set, then all ports of the endpoint subject to either the ingress or egress rule are being redirected.
Port is an L4 port number. For now the string will be strictly parsed as a single uint16. In the future, this field may support ranges in the form "1024-2048
Protocol is the L4 protocol. If omitted or empty, any protocol matches. Accepted values: "TCP", "UDP", ""/"ANY"\n\nMatching on ICMP is not supported.
RedirectPort is the L4 port which, if set, all traffic matching the Ports is being redirected to. Whatever listener behind that port becomes responsible to enforce the port rules and is also responsible to reinject all traffic back and ensure it reaches its original destination.
L7Rules is a union of port level rule types. Mixing of different port level rule types is disallowed, so exactly one of the following must be set. If none are specified, then no additional port level rules are applied.
HTTP specific rules.
Headers is a list of HTTP headers which must be present in the request. If omitted or empty, requests are allowed regardless of headers present.
Host is an extended POSIX regex matched against the host header of a request, e.g. "foo.com" If omitted or empty, the value of the host header is ignored.
Method is an extended POSIX regex matched against the method of a request, e.g. "GET", "POST", "PUT", "PATCH", "DELETE", ... If omitted or empty, all methods are allowed.
Path is an extended POSIX regex matched against the path of a request. Currently it can contain characters disallowed from the conventional "path" part of a URL as defined by RFC 3986. If omitted or empty, all paths are all allowed.
Kafka-specific rules.
APIKey is a case-insensitive string matched against the key of a request, e.g. "produce", "fetch", "createtopic", "deletetopic", et al Reference: https://kafka.apache.org/protocol#protocol_api_keys If omitted or empty, all keys are allowed.
APIVersion is the version matched against the api version of the Kafka message. If set, it has to be a string representing a positive integer. If omitted or empty, all versions are allowed.
ClientID is the client identifier as provided in the request. From Kafka protocol documentation: This is a user supplied identifier for the client application. The user can use any identifier they like and it will be used when logging errors, monitoring aggregates, etc. For example, one might want to monitor not just the requests per second overall, but the number coming from each client application (each of which could reside on multiple servers). This id acts as a logical grouping across all requests from a particular client. If omitted or empty, all client identifiers are allowed.
Role is a case-insensitive string and describes a group of API keysnecessary to perform certain higher level Kafka operations such as"produce" or "consume". An APIGroup automatically expands into all APIKeysrequired to perform the specified higher level operation.The following values are supported:- "produce": Allow producing to the topics specified in the rule- "consume": Allow consuming from the topics specified in the ruleThis field is incompatible with the APIKey field, either APIKey or Rolemay be specified. If omitted or empty, the field has no effect and the logic of the APIKey field applies.
Topic is the topic name contained in the message. If a Kafka request contains multiple topics, then all topics must be allowed or the message will be rejected. This constraint is ignored if the matched request message type doesn't contain any topic. Maximum size of Topic can be 249 characters as per recent Kafka spec and allowed characters are a-z, A-Z, 0-9, -, . and _ Older Kafka versions had longer topic lengths of 255, but in Kafka 0.10 version the length was changed from 255 to 249. For compatibility reasons we are using 255 If omitted or empty, all topics are allowed.
Generic Key-Value pair rules.
Parser type name that uses Key-Value pair rules.
Labels is a list of optional strings which can be used to re-identify the rule or to store metadata. It is possible to lookup or delete strings based on labels. Labels are not required to be unique, multiple rules can have overlapping or identical labels.
Source can be one of the values present in const.go (e.g.: LabelSourceContainer)
Source: ciliumnetworkpolicies.yaml
Changes to CiliumNetworkPolicy (cilium.io/v2) in each Cilium version, compared to the version before it.
CiliumNetworkPolicy was already present in this version of Cilium, the oldest one on kubespec.dev
Released · View CiliumNetworkPolicy in 1.6.0
No examples of CiliumNetworkPolicy yet. Contribute one on GitHub.
kubespec.dev