Skip to main content
Version: main 🚧

Network policies

Supported Configurations
Running the control plane as a container with:

By default, this is disabled.

Sync NetworkPolicy resources from the tenant cluster to the control plane cluster. This ensures correct policies are created in the control plane cluster to achieve the desired traffic behavior between pods.

Sync NetworkPolicies from the tenant to control plane cluster​

sync:
  toHost:
    networkPolicies:
      enabled: true
info

NetworkPolicy resources inside tenant clusters rely on the control plane cluster's support for this feature. Make sure that your control plane cluster satisfies the Network Policy prerequisites.

Patches​

Use sync.toHost.networkPolicies.patches to transform NetworkPolicy fields while syncing to the control plane cluster. See Patching synced resources for syntax, directionality, and examples.

Config reference​

networkPolicies object ​

NetworkPolicies defines if network policies created within the virtual cluster should get synced to the host cluster.

enabled boolean false ​

Enabled defines if this option should be enabled.

patches object[] ​

Patches patch the resource according to the provided specification.

path required string ​

Path is the path within the patch to target. If the path is not found within the patch, the patch is not applied.

expression string ​

Expression transforms the value according to the given JavaScript expression.

reverseExpression string ​

ReverseExpression transforms the value according to the given JavaScript expression.

reference object ​

Reference treats the path value as a reference to another object and will rewrite it based on the chosen mode automatically. In single-namespace mode this will translate the name to "vxxxxxxxxx" to avoid conflicts with other names, in multi-namespace mode this will not translate the name.

apiVersion required string ​

APIVersion is the apiVersion of the referenced object.

apiVersionPath string ​

APIVersionPath is optional relative path to use to determine the kind. If APIVersionPath is not found, will fallback to apiVersion.

kind required string ​

Kind is the kind of the referenced object.

kindPath string ​

KindPath is the optional relative path to use to determine the kind. If KindPath is not found, will fallback to kind.

namePath string ​

NamePath is the optional relative path to the reference name within the object.

namespacePath string ​

NamespacePath is the optional relative path to the reference namespace within the object. If omitted or not found, namespacePath equals to the metadata.namespace path of the object.

labels object ​

Labels treats the path value as a labels selector.