NAME
IO::K8s::Cilium::V2::EgressRule - EgressRule contains all rule types which can be applied at egress, i.e.
VERSION
version 1.108
authentication
Authentication is the required authentication type for the allowed traffic, if any.
icmps
ICMPs is a list of ICMP rule identified by type number which the endpoint subject to the rule is allowed to connect to.
Example: Any endpoint with the label "app=httpd" is allowed to initiate type 8 ICMP connections.
toCIDR
ToCIDR is a list of IP blocks which the endpoint subject to the rule is allowed to initiate connections. Only connections destined for outside of the cluster and not targeting the host will be subject to CIDR rules. This will match on the destination IP address of outgoing connections. Adding a prefix into ToCIDR or into ToCIDRSet with no ExcludeCIDRs is equivalent. Overlaps are allowed between ToCIDR and ToCIDRSet.
Example: Any endpoint with the label "app=database-proxy" is allowed to initiate connections to 10.2.3.0/24
toCIDRSet
ToCIDRSet is a list of IP blocks which the endpoint subject to the rule is allowed to initiate connections to in addition to connections which are allowed via ToEndpoints, along with a list of subnets contained within their corresponding IP block to which traffic should not be allowed. This will match on the destination IP address of outgoing connections. Adding a prefix into ToCIDR or into ToCIDRSet with no ExcludeCIDRs is equivalent. Overlaps are allowed between ToCIDR and ToCIDRSet.
Example: Any endpoint with the label "app=database-proxy" is allowed to initiate connections to 10.2.3.0/24 except from IPs in subnet 10.2.3.0/28.
toEndpoints
ToEndpoints is a list of endpoints identified by an EndpointSelector to which the endpoints subject to the rule are allowed to communicate.
Example: Any endpoint with the label "role=frontend" can communicate with any endpoint carrying the label "role=backend".
Note that while an empty non-nil ToEndpoints does not select anything, nil ToEndpoints is implicitly treated as a wildcard selector if ToPorts are also specified. To select everything, use one EndpointSelector without any match requirements.
toEntities
ToEntities is a list of special entities to which the endpoint subject to the rule is allowed to initiate connections. Supported entities are `world`, `cluster`, `cluster-mesh`, `host`, `remote-node`, `kube-apiserver`, `ingress`, `init`, `health`, `unmanaged`, `none` and `all`.
toFQDNs
ToFQDN allows whitelisting DNS names in place of IPs. The IPs that result from DNS resolution of `ToFQDN.MatchName`s are added to the same EgressRule object as ToCIDRSet entries, and behave accordingly. Any L4 and L7 rules within this EgressRule will also apply to these IPs. The DNS -> IP mapping is re-resolved periodically from within the cilium-agent, and the IPs in the DNS response are effected in the policy for selected pods as-is (i.e. the list of IPs is not modified in any way). Note: An explicit rule to allow for DNS traffic is needed for the pods, as ToFQDN counts as an egress rule and will enforce egress policy when PolicyEnforcment=default. Note: If the resolved IPs are IPs within the kubernetes cluster, the ToFQDN rule will not apply to that IP. Note: ToFQDN cannot occur in the same policy as other To* rules.
toGroups
ToGroups allows policies to reference CIDRs provided by external integrations. Currently, only AWS is supported, and the rule can select by multiple sub directives. ToGroups entries are functionally equivalent to toCIDR, and have the same limitiations. They cannot select traffic originating from within the cluster.
Example: toGroups: - aws: securityGroupsIds: - 'sg-XXXXXXXXXXXXX'
toNodes
ToNodes is a list of nodes identified by an EndpointSelector to which endpoints subject to the rule is allowed to communicate.
toPorts
ToPorts is a list of destination ports identified by port number and protocol which the endpoint subject to the rule is allowed to connect to.
Example: Any endpoint with the label "role=frontend" is allowed to initiate connections to destination port 8080/tcp
toRequires
Deprecated.
toServices
ToServices is a list of services to which the endpoint subject to the rule is allowed to initiate connections. Currently Cilium only supports toServices for K8s services.
SUPPORT
Issues
Please report bugs and feature requests on GitHub at https://github.com/pplu/io-k8s-p5/issues.
CONTRIBUTING
Contributions are welcome! Please fork the repository and submit a pull request.
AUTHORS
Torsten Raudssus <getty@cpan.org>
Jose Luis Martinez Torres <jlmartin@cpan.org>
COPYRIGHT AND LICENSE
This software is Copyright (c) 2018-2026 by Jose Luis Martinez Torres <jlmartin@cpan.org>.
This is free software, licensed under:
The Apache License, Version 2.0, January 2004