BahriyaBAHRIYAby Mamluk

Deploy Network Policies with Reis (YAML Mode)

Network policies let you control which projects can reach a workload, and which external networks that workload is allowed to reach. Declare them in your bahriya.yml under the networking section and apply with reis apply.

Updated 9 Jul 20261 min read

Network policies let you control which projects can reach a workload, and which external networks that workload is allowed to reach. Declare them in your bahriya.yml under the networking section and apply with reis apply.

YAML structure

networking:
  network_policies:
    web-tier:
      name: Web tier ingress
      ingress_peers:
        - frontend
        - gateway
      egress_cidrs:
        - 10.0.0.0/8
        - 203.0.113.0/24
  • ingress_peers — handles of other projects in your organisation that are allowed to reach the workloads this policy is attached to.
  • egress_cidrs — outbound IP ranges the workloads are allowed to reach. Adding any range switches the workload to deny-by-default for outbound traffic; name resolution stays allowed.
  • egress_fqdns — domain-based outbound rules. Restricts outbound HTTPS to the listed domains. Setting any domain turns on application-layer (L7) controls, billed per container replica in each region the policy is applied to.
  • enable_l7 — true/false. Turn on application-layer (L7) controls explicitly. Automatically enabled when egress_fqdns is set.
Note

Application-layer (L7) controls carry a per-replica charge because each container the policy applies to runs a lightweight proxy. Layer 3/4 rules (ingress peers, egress CIDRs, ports) do not — they are billed only per attachment.

Attaching to a project

projects:
  production:
    attachments:
      networking:
        network_policies: [web-tier]

Scoping to a single workload

Reference the policy in a container definition to apply it to just that workload rather than the whole project:

containers:
  api:
    project: production
    image: ghcr.io/myorg/api:latest
    networking:
      network_policies: [web-tier]

Optional port scoping

Restrict the rules to specific ports and protocols:

networking:
  network_policies:
    web-tier:
      name: Web tier ingress
      ingress_peers: [frontend]
      ports:
        - port: 443
          protocol: TCP
        - port: 8080
          protocol: TCP

See also