BahriyaBAHRIYAby Mamluk

Deploy Network Policies with Reis (YAML Mode)

Network policies let you control which projects can reach a workload, and which external networks that workload is allowed to reach. Declare them in your bahriya.yml under the networking section and apply with reis apply.

Updated 16 Jul 20261 min read

Network policies let you control which projects can reach a workload, and which external networks that workload is allowed to reach. Declare them in your bahriya.yml under the networking section and apply with reis apply.

YAML structure

networking:
  network_policies:
    web-tier:
      name: Web tier ingress
      ingress_peers:
        - frontend
        - gateway
      egress_cidrs:
        - 10.0.0.0/8
        - 203.0.113.0/24
  • ingress_peers — handles of other projects in your organisation that are allowed to reach the workloads this policy is attached to.
  • egress_cidrs — outbound IP ranges the workloads are allowed to reach. Adding any range switches the workload to deny-by-default for outbound traffic; name resolution stays allowed.
  • egress_fqdns — domain-based outbound rules. Restricts outbound HTTPS to the listed domains. Setting any domain turns on application-layer (L7) controls, billed per container replica in each region the policy is applied to.
  • enable_l7 — true/false. Turn on application-layer (L7) controls explicitly. Automatically enabled when egress_fqdns is set.
Note

Application-layer (L7) controls carry a per-replica charge because each container the policy applies to runs a lightweight proxy. Layer 3/4 rules (ingress peers, egress CIDRs, ports) do not — they are billed only per attachment.

Attaching to a project

projects:
  production:
    attachments:
      networking:
        network_policies: [web-tier]

Scoping to a single workload

Reference the policy in a container definition to apply it to just that workload rather than the whole project:

containers:
  api:
    project: production
    image: ghcr.io/myorg/api:latest
    networking:
      network_policies: [web-tier]

Optional port scoping

Restrict the rules to specific ports and protocols:

networking:
  network_policies:
    web-tier:
      name: Web tier ingress
      ingress_peers: [frontend]
      ports:
        - port: 443
          protocol: TCP
        - port: 8080
          protocol: TCP

See also