Network rules

​

EgressRule

class EgressRule(*, dns_name: str | None = None, cidr: CidrBlock | Mapping[str, Any] | str | None = None, tenant: TenantScope | str | None = None, any: bool = False, selector: SelectorBlock | Mapping[str, Any] | None = None, ports: Sequence[PortRange | Mapping[str, Any] | int] | None = None, dns_name_except: Sequence[str] | None = None)

• dns_name (str | None) : Hostname to grant for HTTPS (TCP 443).
• cidr (CidrBlock | Mapping[str, Any] | str | None) : IP range (CidrBlock, dict, or CIDR string).
• tenant (TenantScope | str | None) : Other sandboxes selected relationally.
• any (bool) : All destinations except platform-internal ranges. Default: False.
• selector (SelectorBlock | Mapping[str, Any] | None) : Cluster workloads selected by pod/namespace labels.
• ports (Sequence[PortRange | Mapping[str, Any] | int] | None) : Optional destination port filter. Empty = all ports on non-DNS rules. DNS-name grants omit ports or set exactly TCP 443.
• dns_name_except (Sequence[str] | None) : Policy-only carve-outs. Rejected on this create-time type.

​

IngressRule

class IngressRule(*, cidr: CidrBlock | Mapping[str, Any] | str | None = None, tenant: TenantScope | str | None = None, any: bool = False, ports: Sequence[PortRange | Mapping[str, Any] | int] | None = None)

• cidr (CidrBlock | Mapping[str, Any] | str | None) : Source IP range.
• tenant (TenantScope | str | None) : Other sandboxes selected relationally.
• any (bool) : Any source, including the public internet. Default: False.
• ports (Sequence[PortRange | Mapping[str, Any] | int] | None) : Optional port filter. Empty = all CUSTOM-visibility ports.

​

CidrBlock

class CidrBlock(*, cidr: str, except_cidrs: Sequence[str] = ())

• except_cidrs (Sequence[str]) : Default: ().

​

PortRange

class PortRange(*, port: int, end_port: int | None = None, protocol: str | None = None)

• end_port (int | None)
• protocol (str | None)

​

SelectorBlock

class SelectorBlock(*, pod_labels: Mapping[str, str], namespace_labels: Mapping[str, str] | None = None)

• namespace_labels (Mapping[str, str] | None)

​

TenantScope

class TenantScope

• UNSPECIFIED = 'unspecified'
• SAME_USER = 'same_user'
• SAME_ORG = 'same_org'
• SANDBOX_NETWORK = 'sandbox_network'