networkpolicies

networkPolicy objects to be generated by the chart. Additional networkPolicies can be added by adding a dictionary key similar to the ‘main’ networkPolicy.

Type

object

Usage

Keys are identifiers for networkpolicies instances.

networkpolicies:
  main:
    enabled: true
    # ... configuration

  secondary:
    enabled: true
    # ... configuration

Examples

networkpolicies:
  ciliumClusterwide:
    type: ciliumClusterwide
    nodeSelector:
      matchLabels:
        kubernetes.io/os: linux
    ingress:
      - fromEntities:
          - cluster

Type Variants

cilium

CiliumNetworkPolicy implementation to render.

Property	Type	Required	Default	Description
annotations	object / null	No	-	Annotations to set on the item. Keys and values support H…
controller	string	No	-	Controller this CiliumNetworkPolicy should target. Mutual…
controllers	array	No	-	Controllers this CiliumNetworkPolicy should target. Each …
description	string	No	-	Human-readable description of the policy.
egress	array	No	-	Egress allow rules. At most one peer selector may be set…
egressDeny	array	No	-	Egress deny rules. At most one peer selector may be set. …
enableDefaultDeny	object	No	-	Configure whether the selected endpoints enter default-de…
enabled	boolean	No	true	Set to false to disable the CiliumNetworkPolicy.
endpointSelector	object	No	-	Custom endpointSelector for the CiliumNetworkPolicy. Mutu…
extraSelectorLabels	object	No	-	Additional match labels to add to the endpoint selector. …
forceRename	string	No	-	Override the default resource name. Mutually exclusive wi…
ingress	array	Yes	-	Ingress allow rules. At most one peer selector may be set…
ingressDeny	array	No	-	Ingress deny rules. At most one peer selector may be set…
labels	object / null	No	-	Labels to set on the item. Keys and values support Helm t…
log	string	No	-	Free-form value included in Hubble flows matching this po…
nodeSelector	object	No	-	Node selector for a CiliumClusterwideNetworkPolicy.
prefix	string	No	“	Prefix to prepend to the resource name. Mutually exclusiv…
suffix	string	No	-	Suffix to append to the resource name. Defaults to the re…

Property details

annotations

Annotations to set on the item. Keys and values support Helm templating.

controller

Controller this CiliumNetworkPolicy should target. Mutually exclusive with controllers and endpointSelector.

controllers

Controllers this CiliumNetworkPolicy should target. Each entry can be an exact controller identifier or a regular expression. Mutually exclusive with controller and endpointSelector.

egress

Egress allow rules. At most one peer selector may be set. toPorts may be combined with a peer selector; icmps may not.

egressDeny

Egress deny rules. At most one peer selector may be set. toPorts may be combined with a peer selector; icmps may not.

enableDefaultDeny

Configure whether the selected endpoints enter default-deny mode for ingress and egress traffic.

endpointSelector

Custom endpointSelector for the CiliumNetworkPolicy. Mutually exclusive with controller and controllers.

extraSelectorLabels

Additional match labels to add to the endpoint selector. These are merged with labels derived from the controller selection.

forceRename

Override the default resource name. Mutually exclusive with prefix and suffix.

ingress

Ingress allow rules. At most one peer selector may be set. toPorts may be combined with a peer selector; icmps may not.

ingressDeny

Ingress deny rules. At most one peer selector may be set. toPorts may be combined with a peer selector; icmps may not.

labels

Labels to set on the item. Keys and values support Helm templating.

log

Free-form value included in Hubble flows matching this policy.

prefix

Prefix to prepend to the resource name. Mutually exclusive with forceRename.

suffix

Suffix to append to the resource name. Defaults to the resource identifier if there are multiple items, otherwise empty. Mutually exclusive with forceRename.

ciliumClusterwide

Cluster-scoped CiliumClusterwideNetworkPolicy implementation to render. The resource is rendered without metadata.namespace.

networkpolicies:
  ciliumClusterwide:
    type: ciliumClusterwide
    nodeSelector:
      matchLabels:
        kubernetes.io/os: linux
    ingress:
      - fromEntities:
          - cluster

Property	Type	Required	Default	Description
annotations	object / null	No	-	Annotations to set on the item. Keys and values support H…
controller	string	No	-	Controller this CiliumNetworkPolicy should target. Mutual…
controllers	array	No	-	Controllers this CiliumNetworkPolicy should target. Each …
description	string	No	-	Human-readable description of the policy.
egress	array	No	-	Egress allow rules. At most one peer selector may be set…
egressDeny	array	No	-	Egress deny rules. At most one peer selector may be set. …
enableDefaultDeny	object	No	-	Configure whether the selected endpoints enter default-de…
enabled	boolean	No	true	Set to false to disable the CiliumNetworkPolicy.
endpointSelector	object	No	-	Custom endpointSelector for the CiliumNetworkPolicy. Mutu…
extraSelectorLabels	object	No	-	Additional match labels to add to the endpoint selector. …
forceRename	string	No	-	Override the default resource name. Mutually exclusive wi…
ingress	array	Yes	-	Ingress allow rules. At most one peer selector may be set…
ingressDeny	array	No	-	Ingress deny rules. At most one peer selector may be set…
labels	object / null	No	-	Labels to set on the item. Keys and values support Helm t…
log	string	No	-	Free-form value included in Hubble flows matching this po…
nodeSelector	object	No	-	Node selector for a CiliumClusterwideNetworkPolicy.
prefix	string	No	“	Prefix to prepend to the resource name. Mutually exclusiv…
suffix	string	No	-	Suffix to append to the resource name. Defaults to the re…

Property details

annotations

Annotations to set on the item. Keys and values support Helm templating.

controller

Controller this CiliumNetworkPolicy should target. Mutually exclusive with controllers and endpointSelector.

controllers

Controllers this CiliumNetworkPolicy should target. Each entry can be an exact controller identifier or a regular expression. Mutually exclusive with controller and endpointSelector.

egress

Egress allow rules. At most one peer selector may be set. toPorts may be combined with a peer selector; icmps may not.

egressDeny

Egress deny rules. At most one peer selector may be set. toPorts may be combined with a peer selector; icmps may not.

enableDefaultDeny

Configure whether the selected endpoints enter default-deny mode for ingress and egress traffic.

endpointSelector

Custom endpointSelector for the CiliumNetworkPolicy. Mutually exclusive with controller and controllers.

extraSelectorLabels

Additional match labels to add to the endpoint selector. These are merged with labels derived from the controller selection.

forceRename

Override the default resource name. Mutually exclusive with prefix and suffix.

ingress

Ingress allow rules. At most one peer selector may be set. toPorts may be combined with a peer selector; icmps may not.

ingressDeny

Ingress deny rules. At most one peer selector may be set. toPorts may be combined with a peer selector; icmps may not.

labels

Labels to set on the item. Keys and values support Helm templating.

log

Free-form value included in Hubble flows matching this policy.

prefix

Prefix to prepend to the resource name. Mutually exclusive with forceRename.

suffix

Suffix to append to the resource name. Defaults to the resource identifier if there are multiple items, otherwise empty. Mutually exclusive with forceRename.

Instance Properties

Common properties:

Property	Type	Required	Default	Description
annotations	object / null	No	-	Annotations to set on the item. Keys and values support H…
controller	string	No	-	Controller this NetworkPolicy should target. Mutually exc…
controllers	array	No	-	Controllers this NetworkPolicy should target. Each entry …
enabled	boolean	No	true	Set to false to disable the NetworkPolicy.
extraSelectorLabels	object	No	-	Additional match labels to add to the pod selector. These…
forceRename	string	No	-	Override the default resource name. Mutually exclusive wi…
labels	object / null	No	-	Labels to set on the item. Keys and values support Helm t…
podSelector	any	No	-	Custom podSelector for the NetworkPolicy. Mutually exclus…
policyTypes	array	Yes	-	Policy types for the NetworkPolicy.
prefix	string	No	“	Prefix to prepend to the resource name. Mutually exclusiv…
rules	object	Yes	-	Ingress and egress rules for the NetworkPolicy. See https…
suffix	string	No	-	Suffix to append to the resource name. Defaults to the re…
type	string	No	-	Resource implementation to render. Set type to native, ci…

Property Details

annotations

Annotations to set on the item. Keys and values support Helm templating.

controller

Controller this NetworkPolicy should target. Mutually exclusive with controllers and podSelector.

controllers

Controllers this NetworkPolicy should target. Each entry can be an exact controller identifier or a regular expression. Mutually exclusive with controller and podSelector.

extraSelectorLabels

Additional match labels to add to the pod selector. These are merged with labels derived from the controller selection.

forceRename

Override the default resource name. Mutually exclusive with prefix and suffix.

labels

Labels to set on the item. Keys and values support Helm templating.

podSelector

Custom podSelector for the NetworkPolicy. Mutually exclusive with controller and controllers.

prefix

Prefix to prepend to the resource name. Mutually exclusive with forceRename.

suffix

Suffix to append to the resource name. Defaults to the resource identifier if there are multiple items, otherwise empty. Mutually exclusive with forceRename.

type

Resource implementation to render. Set type to native, cilium, or ciliumClusterwide.

Allowed values: native, cilium, ciliumClusterwide

Related Pages

• rules