Skip to main content
Version: v0.28

Network policy

Limited vCluster Tenancy Configuration Support

This feature is only available when using the following worker node types:

  • Host Nodes
note

This feature is disabled by default.

Workloads created by vCluster are able to communicate with other workloads in the host cluster through their cluster IPs. Configure network policies when you want to isolate namespaces and do not want the pods running inside the virtual cluster to have access to other workloads in the host cluster.

Enable network isolation​

Set policies.networkPolicy.enabled to create NetworkPolicies that isolate the virtual cluster:

vcluster.yaml
policies:
  networkPolicy:
    enabled: true

This creates NetworkPolicies in the host namespace that:

  • Allow traffic between pods within the virtual cluster
  • Block traffic from other namespaces
  • Permit DNS and API server communication

Example configurations​

Basic isolation​

The simplest configuration enables network isolation with default settings:

vcluster.yaml
policies:
  networkPolicy:
    enabled: true

Custom egress rules​

Control outbound traffic with specific CIDR blocks:

vcluster.yaml
policies:
  networkPolicy:
    enabled: true
    outgoingConnections:
      ipBlock:
        cidr: 0.0.0.0/0
        except:
          - 169.254.0.0/16  # AWS metadata service
          - 10.0.0.0/8      # Private network ranges
          - 172.16.0.0/12
          - 192.168.0.0/16

Add custom labels​

Apply labels to generated NetworkPolicies for easier management:

vcluster.yaml
policies:
  networkPolicy:
    enabled: true
    labels:
      environment: production
      team: platform
    annotations:
      description: "Network isolation for production vCluster"
DNS Port in vCluster

vCluster uses port 1053 for DNS queries, not the standard port 53. When creating custom NetworkPolicies for pods inside vCluster, ensure DNS rules target port 1053:

ports:
  - port: 1053
    protocol: UDP

Project-scoped isolation with Platform​

For Platform users needing project-level network boundaries, combine policies.networkPolicy with VirtualClusterTemplates:

project-isolated-template.yaml
apiVersion: management.loft.sh/v1
kind: VirtualClusterTemplate
metadata:
  name: project-isolated
spec:
  template:
    helmRelease:
      chart:
        version: 0.26.0
      values: |
        policies:
          networkPolicy:
            enabled: true
            labels:
              vcluster.io/project: "{{ .Values.loft.project }}"

This automatically:

  • Isolates virtual clusters by project
  • Allows communication within the same project
  • Enforces network boundaries for CI/CD pipelines

Config reference​

networkPolicy required object ​

NetworkPolicy specifies network policy options.

enabled required boolean false ​

Enabled defines if the network policy should be deployed by vCluster.

annotations required object {} ​

Annotations are extra annotations for this resource.

labels required object {} ​

Labels are extra labels for this resource.

fallbackDns required string 8.8.8.8 ​

FallbackDNS is the fallback DNS server to use if the virtual cluster does not have a DNS server.

controlPlane required object ​

ControlPlane network policy rules

ingress required object[] ​

Ingress rules for the vCluster control plane.

ports required object[] ​

ports is a list of ports which should be made accessible on the pods selected for this rule. Each item in this list is combined using a logical OR. If this field is empty or missing, this rule matches all ports (traffic not restricted by port). If this field is present and contains at least one item, then this rule allows traffic only if the traffic matches at least one port in the list.

protocol required string ​

protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. If not specified, this field defaults to TCP.

port required object ​

port represents the port on the given protocol. This can either be a numerical or named port on a pod. If this field is not provided, this matches all port names and numbers. If present, only traffic on the specified protocol AND port will be matched.

endPort required integer ​

endPort indicates that the range of ports from port to endPort if set, inclusive, should be allowed by the policy. This field cannot be defined if the port field is not defined or if the port field is defined as a named (string) port. The endPort must be equal or greater than port.

from required object[] ​

from is a list of sources which should be able to access the pods selected for this rule. Items in this list are combined using a logical OR operation. If this field is empty or missing, this rule matches all sources (traffic not restricted by source). If this field is present and contains at least one item, this rule allows traffic only if the traffic matches at least one item in the from list.

podSelector required object ​

podSelector is a label selector which selects pods. This field follows standard label selector semantics; if present but empty, it selects all pods.

If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects the pods matching podSelector in the policy's own namespace.

matchLabels required object ​
matchExpressions required object[] ​
key required string ​
operator required string ​
values required string[] ​
namespaceSelector required object ​

namespaceSelector selects namespaces using cluster-scoped labels. This field follows standard label selector semantics; if present but empty, it selects all namespaces.

If podSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the namespaces selected by namespaceSelector. Otherwise it selects all pods in the namespaces selected by namespaceSelector.

matchLabels required object ​
matchExpressions required object[] ​
key required string ​
operator required string ​
values required string[] ​
ipBlock required object ​

ipBlock defines policy on a particular IPBlock. If this field is set then neither of the other fields can be.

cidr required string ​

CIDR defines the allowed workload public egress destination. Valid examples are "0.0.0.0/0", "192.168.1.0/24" or "2001:db8::/64"

except required string[] ​

Except is a slice of CIDRs that should not be included. Items outside the cidr range will be rejected. Valid examples are "192.168.1.0/24" or "2001:db8::/64".

egress required object[] ​

Egress rules for the vCluster control plane.

ports required object[] ​

ports is a list of destination ports for outgoing traffic. Each item in this list is combined using a logical OR. If this field is empty or missing, this rule matches all ports (traffic not restricted by port). If this field is present and contains at least one item, then this rule allows traffic only if the traffic matches at least one port in the list.

protocol required string ​

protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. If not specified, this field defaults to TCP.

port required object ​

port represents the port on the given protocol. This can either be a numerical or named port on a pod. If this field is not provided, this matches all port names and numbers. If present, only traffic on the specified protocol AND port will be matched.

endPort required integer ​

endPort indicates that the range of ports from port to endPort if set, inclusive, should be allowed by the policy. This field cannot be defined if the port field is not defined or if the port field is defined as a named (string) port. The endPort must be equal or greater than port.

to required object[] ​

to is a list of destinations for outgoing traffic of pods selected for this rule. Items in this list are combined using a logical OR operation. If this field is empty or missing, this rule matches all destinations (traffic not restricted by destination). If this field is present and contains at least one item, this rule allows traffic only if the traffic matches at least one item in the to list.

podSelector required object ​

podSelector is a label selector which selects pods. This field follows standard label selector semantics; if present but empty, it selects all pods.

If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects the pods matching podSelector in the policy's own namespace.

matchLabels required object ​
matchExpressions required object[] ​
key required string ​
operator required string ​
values required string[] ​
namespaceSelector required object ​

namespaceSelector selects namespaces using cluster-scoped labels. This field follows standard label selector semantics; if present but empty, it selects all namespaces.

If podSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the namespaces selected by namespaceSelector. Otherwise it selects all pods in the namespaces selected by namespaceSelector.

matchLabels required object ​
matchExpressions required object[] ​
key required string ​
operator required string ​
values required string[] ​
ipBlock required object ​

ipBlock defines policy on a particular IPBlock. If this field is set then neither of the other fields can be.

cidr required string ​

CIDR defines the allowed workload public egress destination. Valid examples are "0.0.0.0/0", "192.168.1.0/24" or "2001:db8::/64"

except required string[] ​

Except is a slice of CIDRs that should not be included. Items outside the cidr range will be rejected. Valid examples are "192.168.1.0/24" or "2001:db8::/64".

workload required object ​

Workload network policy rules

publicEgress required object ​

PublicEgress holds the public outgoing connections options for the vCluster workloads.

enabled required boolean ​

Enabled defines if the workload public egress should be enabled or disabled.

cidr required string ​

CIDR defines the allowed workload public egress destination. Valid examples are "0.0.0.0/0", "192.168.1.0/24" or "2001:db8::/64"

except required string[] ​

Except is a slice of CIDRs that should not be included. Items outside the cidr range will be rejected. Valid examples are "192.168.1.0/24" or "2001:db8::/64".

ingress required object[] ​

Ingress rules for the vCluster workloads.

ports required object[] ​

ports is a list of ports which should be made accessible on the pods selected for this rule. Each item in this list is combined using a logical OR. If this field is empty or missing, this rule matches all ports (traffic not restricted by port). If this field is present and contains at least one item, then this rule allows traffic only if the traffic matches at least one port in the list.

protocol required string ​

protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. If not specified, this field defaults to TCP.

port required object ​

port represents the port on the given protocol. This can either be a numerical or named port on a pod. If this field is not provided, this matches all port names and numbers. If present, only traffic on the specified protocol AND port will be matched.

endPort required integer ​

endPort indicates that the range of ports from port to endPort if set, inclusive, should be allowed by the policy. This field cannot be defined if the port field is not defined or if the port field is defined as a named (string) port. The endPort must be equal or greater than port.

from required object[] ​

from is a list of sources which should be able to access the pods selected for this rule. Items in this list are combined using a logical OR operation. If this field is empty or missing, this rule matches all sources (traffic not restricted by source). If this field is present and contains at least one item, this rule allows traffic only if the traffic matches at least one item in the from list.

podSelector required object ​

podSelector is a label selector which selects pods. This field follows standard label selector semantics; if present but empty, it selects all pods.

If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects the pods matching podSelector in the policy's own namespace.

matchLabels required object ​
matchExpressions required object[] ​
key required string ​
operator required string ​
values required string[] ​
namespaceSelector required object ​

namespaceSelector selects namespaces using cluster-scoped labels. This field follows standard label selector semantics; if present but empty, it selects all namespaces.

If podSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the namespaces selected by namespaceSelector. Otherwise it selects all pods in the namespaces selected by namespaceSelector.

matchLabels required object ​
matchExpressions required object[] ​
key required string ​
operator required string ​
values required string[] ​
ipBlock required object ​

ipBlock defines policy on a particular IPBlock. If this field is set then neither of the other fields can be.

cidr required string ​

CIDR defines the allowed workload public egress destination. Valid examples are "0.0.0.0/0", "192.168.1.0/24" or "2001:db8::/64"

except required string[] ​

Except is a slice of CIDRs that should not be included. Items outside the cidr range will be rejected. Valid examples are "192.168.1.0/24" or "2001:db8::/64".

egress required object[] ​

Egress rules for the vCluster workloads.

ports required object[] ​

ports is a list of destination ports for outgoing traffic. Each item in this list is combined using a logical OR. If this field is empty or missing, this rule matches all ports (traffic not restricted by port). If this field is present and contains at least one item, then this rule allows traffic only if the traffic matches at least one port in the list.

protocol required string ​

protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match. If not specified, this field defaults to TCP.

port required object ​

port represents the port on the given protocol. This can either be a numerical or named port on a pod. If this field is not provided, this matches all port names and numbers. If present, only traffic on the specified protocol AND port will be matched.

endPort required integer ​

endPort indicates that the range of ports from port to endPort if set, inclusive, should be allowed by the policy. This field cannot be defined if the port field is not defined or if the port field is defined as a named (string) port. The endPort must be equal or greater than port.

to required object[] ​

to is a list of destinations for outgoing traffic of pods selected for this rule. Items in this list are combined using a logical OR operation. If this field is empty or missing, this rule matches all destinations (traffic not restricted by destination). If this field is present and contains at least one item, this rule allows traffic only if the traffic matches at least one item in the to list.

podSelector required object ​

podSelector is a label selector which selects pods. This field follows standard label selector semantics; if present but empty, it selects all pods.

If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the Namespaces selected by NamespaceSelector. Otherwise it selects the pods matching podSelector in the policy's own namespace.

matchLabels required object ​
matchExpressions required object[] ​
key required string ​
operator required string ​
values required string[] ​
namespaceSelector required object ​

namespaceSelector selects namespaces using cluster-scoped labels. This field follows standard label selector semantics; if present but empty, it selects all namespaces.

If podSelector is also set, then the NetworkPolicyPeer as a whole selects the pods matching podSelector in the namespaces selected by namespaceSelector. Otherwise it selects all pods in the namespaces selected by namespaceSelector.

matchLabels required object ​
matchExpressions required object[] ​
key required string ​
operator required string ​
values required string[] ​
ipBlock required object ​

ipBlock defines policy on a particular IPBlock. If this field is set then neither of the other fields can be.

cidr required string ​

CIDR defines the allowed workload public egress destination. Valid examples are "0.0.0.0/0", "192.168.1.0/24" or "2001:db8::/64"

except required string[] ​

Except is a slice of CIDRs that should not be included. Items outside the cidr range will be rejected. Valid examples are "192.168.1.0/24" or "2001:db8::/64".