BahriyaBAHRIYAby Mamluk

Manage Network Policies with Reis (Flag Mode)

Network policies control which projects can reach your workloads, and which external networks your workloads are allowed to reach. Create and manage them directly from the command line.

Updated 9 Jul 20262 min read

Network policies control which projects can reach your workloads, and which external networks your workloads are allowed to reach. Create and manage them directly from the command line.

Create a network policy

reis network_policy:create \
  --name "Web tier ingress" \
  --handle web-tier \
  --ingress_peers frontend \
  --ingress_peers gateway \
  --egress_cidrs 10.0.0.0/8 \
  --egress_cidrs 203.0.113.0/24
  • --name and --handle are required. The handle must be DNS-1123 compliant (lowercase alphanumeric and hyphens, max 63 characters).
  • --ingress_peers (repeatable) — handles of other projects in your organisation that are allowed to reach the workloads this policy is attached to.
  • --egress_cidrs (repeatable) — outbound IP ranges the workloads are allowed to reach. Adding any range switches outbound traffic to deny-by-default; name resolution stays allowed.
  • --egress_fqdns (repeatable) — domain-based outbound rules. Restricts outbound HTTPS to the listed domains. Setting any domain turns on application-layer (L7) controls, which are billed per container replica in each region the policy is applied to.
  • --enable_l7 — turn on application-layer (L7) controls explicitly. Automatically enabled when you set --egress_fqdns. L7 controls are billed per container replica in each region the policy is applied to.
  • --ports (repeatable) — optional port/protocol scoping for the rules above. Omit to allow all ports.
Note

Application-layer (L7) controls carry a per-replica charge because each container the policy applies to runs a lightweight proxy. Layer 3/4 rules (ingress peers, egress CIDRs, ports) do not — they are billed only per attachment.

List network policies

reis network_policy:list

Shows a table with the ID, handle, name, and the number of ingress peers and egress CIDRs for each policy.

Show details

reis network_policy:show <policy-id>

Update a network policy

reis network_policy:update <policy-id> \
  --egress_cidrs 10.0.0.0/8 \
  --egress_cidrs 192.168.0.0/16

A flag you pass replaces that field; fields you leave out are kept as they were.

Delete a network policy

reis network_policy:delete <policy-id>

Add --force to skip the confirmation prompt.

Attach to a project

reis project:attach <project-id> network_policies web-tier

The singular alias network_policy is also accepted. The project-id is the UUID Reis returns from project:list or project:show.

Detach from a project

reis project:detach <project-id> network_policies web-tier

See also