1"use strict";(self.webpackChunktigera_docs=self.webpackChunktigera_docs||[]).push([["2745"],{57552(e,i,n){n.r(i),n.d(i,{metadata:()=>l,default:()=>d,frontMatter:()=>t,contentTitle:()=>r,toc:()=>s,assets:()=>c});var l=JSON.parse('{"id":"network-policy/application-layer-policies/alp","title":"Enable and enforce application layer policies","description":"Enforce application layer policies in your cluster to configure access controls based on L7 attributes.","source":"@site/calico-enterprise_versioned_docs/version-3.20-2/network-policy/application-layer-policies/alp.mdx","sourceDirName":"network-policy/application-layer-policies","slug":"/network-policy/application-layer-policies/alp","permalink":"/calico-enterprise/3.20/network-policy/application-layer-policies/alp","draft":false,"unlisted":false,"editUrl":"https://github.com/tigera/docs/edit/main/calico-enterprise_versioned_docs/version-3.20-2/network-policy/application-layer-policies/alp.mdx","tags":[],"version":"3.20-2","frontMatter":{"description":"Enforce application layer policies in your cluster to configure access controls based on L7 attributes."},"sidebar":"calicoEnterpriseSidebar","previous":{"title":"Application layer policies to control ingress traffic","permalink":"/calico-enterprise/3.20/network-policy/application-layer-policies/"},"next":{"title":"Application layer policy tutorial","permalink":"/calico-enterprise/3.20/network-policy/application-layer-policies/alp-tutorial"}}'),o=n(70689),a=n(3413);
1let t={description:"Enforce application layer policies in your cluster to configure access controls based on L7 attributes."},r="Enable and enforce application layer policies",c={},s=[{value:"Before you begin",id:"before-you-begin",level:2},{value:"Limitations",id:"limitations",level:3},{value:"Enable application layer policy (ALP)",id:"enable-application-layer-policy-alp",level:3},{value:"Enforce application layer policies for ingress traffic",id:"enforce-application-layer-policies-for-ingress-traffic",level:3},{value:"Disable application layer policies",id:"disable-application-layer-policies",level:3}];function p(e){let i={a:"a",admonition:"admonition",code:"code",em:"em",h1:"h1",h2:"h2",h3:"h3",header:"header",li:"li",p:"p",pre:"pre",ul:"ul",...(0,a.R)(),...e.components};return(0,o.jsxs)(o.Fragment,{children:[(0,o.jsx)(i.header,{children:(0,o.jsx)(i.h1,{id:"enable-and-enforce-application-layer-policies",children:"Enable and enforce application layer policies"})}),"\n",(0,o.jsx)(i.p,{children:"Application layer policies let you configure access controls based on L7 attributes."}),"\n",(0,o.jsx)(i.h2,{id:"before-you-begin",children:"Before you begin"}),"\n",(0,o.jsx)(i.h3,{id:"limitations",children:"Limitations"}),"\n",(0,o.jsxs)(i.ul,{children:["\n",(0,o.jsx)(i.li,{children:"Application layer policy is not compatible with a service mesh such as Istio."}),"\n",(0,o.jsxs)(i.li,{children:["Application layer policy can restrict only ",(0,o.jsx)(i.em,{children:"ingress"})," traffic.\nIt can not restrict egress traffic."]}),"\n",(0,o.jsx)(i.li,{children:"Support for L7 attributes is limited to HTTP method and URL exact/prefix path."}),"\n",(0,o.jsx)(i.li,{children:"Supported protocols are limited to TCP-based protocols (for example, HTTP, HTTPS, or gRPC)."}),"\n",(0,o.jsx)(i.li,{children:"Application layer policies apply to the entire cluster.\nThey can not be namespaced."}),"\n",(0,o.jsxs)(i.li,{children:["Logs for application layer polices are not included with other L7 logs in Service Graph.\nTo view logs for application layer policies, you must ",(0,o.jsx)(i.a,{href:"/calico-enterprise/3.20/observability/elastic/l7/configure#kibana",children:"view them in Kibana"}),"."]}),"\n",(0,o.jsx)(i.li,{children:"Application layer policy is supported only on Kubernetes 1.29 and later."}),"\n"]}),"\n",(0,o.jsx)(i.admonition,{type:"important",children:(0,o.jsx)(i.p,{children:"When you enable application layer policy for a deployment, all of that deployment's pods will restart\nActive connections may be disrupted."})}),"\n",(0,o.jsx)(i.h3,{id:"enable-application-layer-policy-alp",children:"Enable application layer policy (ALP)"}),"\n",(0,o.jsxs)(i.p,{children:["In the ApplicationLayer custom resource, set the ",(0,o.jsx)(i.code,{children:"sidecarInjection"})," field to ",(0,o.jsx)(i.code,{children:"Enabled"}),":"]}),"\n",(0,o.jsx)(i.pre,{children:(0,o.jsx)(i.code,{className:"language-yaml",children:"apiVersion: operator.tigera.io/v1\nkind: ApplicationLayer\nmetadata:\n name: tigera-secure\nspec:\n sidecarInjection: Enabled\n"})}),"\n",(0,o.jsx)(i.p,{children:"Then, wait for the Tigera APIServer deployment and Log collection daemonset to progress to ready."}),"\n",(0,o.jsx)(i.pre,{children:(0,o.jsx)(i.code,{className:"language-bash",children:"kubectl rollout status -n tigera-system deployment/tigera-apiserver --timeout=120s\nkubectl rollout status -n calico-system ds/l7-log-collector --timeout=120s\n"})}),"\n",(0,o.jsx)(i.p,{children:"Patch your deployments by running the following command:"}),"\n",(0,o.jsx)(i.pre,{children:(0,o.jsx)(i.code,{className:"language-bash",children:'kubectl patch deployment <deployment-name> -n <deployment-namespace> -p \'{"spec":{"template":{"metadata":{"labels":{"applicationlayer.projectcalico.org/sidecar":"true"},"annotations":{"applicationlayer.projectcalico.org/policy":"Enabled"}}}}}\'\n'})}),"\n",(0,o.jsx)(i.h3,{id:"enforce-application-layer-policies-for-ingress-traffic",children:"Enforce application layer policies for ingress traffic"}),"\n",(0,o.jsxs)(i.p,{children:["You can restrict ingress traffic using HTTP match criteria using Global network policy.\nFor a list of all HTTP match parameters, see ",(0,o.jsx)(i.a,{href:"/calico-enterprise/3.20/reference/resources/globalnetworkpolicy",children:"Global network policy"}),"."]}),"\n",(0,o.jsx)(i.p,{children:"In the following example, the trading app is allowed ingress traffic only for HTTP GET requests that match the exact path /projects/calico, or that begins with the prefix, /users."}
1),"\n",(0,o.jsx)(i.pre,{children:(0,o.jsx)(i.code,{className:"language-yaml",children:'apiVersion: projectcalico.org/v3\nkind: GlobalNetworkPolicy\nmetadata:\n name: customer\nspec:\n selector: app == \'tradingapp\'\n ingress:\n - action: Allow\n http:\n methods: ["GET"]\n paths:\n - exact: "/projects/calico"\n - prefix: "/users"\n egress:\n - action: Allow\n'})}),"\n",(0,o.jsx)(i.h3,{id:"disable-application-layer-policies",children:"Disable application layer policies"}),"\n",(0,o.jsx)(i.p,{children:"To disable the policies, do one of the following steps:"}),"\n",(0,o.jsxs)(i.ul,{children:["\n",(0,o.jsx)(i.li,{children:"Recreate your application pods without the sidecar label and annotations."}),"\n",(0,o.jsxs)(i.li,{children:["Remove the ",(0,o.jsx)(i.code,{children:"applicationLayerPolicy"})," field entirely."]}),"\n",(0,o.jsxs)(i.li,{children:["Remove the ",(0,o.jsx)(i.code,{children:"sidecarInjection"})," field entirely, if sidecar mode was being used only for ALP."]}),"\n",(0,o.jsx)(i.li,{children:"Delete the ApplicationLayer` custom resource if only ALP was enabled on it."}),"\n"]})]})}function d(e={}){let{wrapper:i}={...(0,a.R)(),...e.components};return i?(0,o.jsx)(i,{...e,children:(0,o.jsx)(p,{...e})}):p(e)}},3413(e,i,n){n.d(i,{R:()=>t,x:()=>r});var l=n(16645);let o={},a=l.createContext(o);function t(e){let i=l.useContext(a);return l.useMemo(function(){return"function"==typeof e?e(i):{...i,...e}},[i,e])}function r(e){let i;return i=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:t(e.components),l.createElement(a.Provider,{value:i},e.children)}}}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.