Skip to main content
logoTetrate Service BridgeVersion: next

Segmentation Rules

Segmentation Rules define an Access Control Lists (ACLs) that can be applied to resources to control access between them. Rules define the llowed communication paths between resources. These rules are based on defined Segmentation Policies and Zones.

apiVersion: segmentation.tsb.tetrate.io/v1
kind: SegmentationRules
metadata:
organization: myorg
name: ring-policies
spec:
rules:
# ingress -\> yellow
- from: [ring/ingress]
to: [ring/yellow]
# yellow -\> amber
- from: [ring/yellow]
to: [ring/amber]
# amber -\> red
- from: [ring/amber]
to: [ring/red]
Enforcement

Segmentation Rules act as whitelists for allowed communication patterns to the resources protected by the policies. This means that for any resource that belongs to a zone that is captured by a rule, a "deny all" default policy is configured and only communications explicitly specified in a rule will be allowed.

SegmentationRules

Segmentation Rules define an Access Control Lists (ACLs) that can be applied to resources to control access between them. Rules define the llowed communication paths between resources. These rules are based on defined Segmentation Policies and Zones.

Enforcement

Segmentation Rules act as whitelists for allowed communication patterns to the resources protected by the policies. This means that for any resource that belongs to a zone that is captured by a rule, a "deny all" default policy is configured and only communications explicitly specified in a rule will be allowed.

FieldDescriptionValidation Rule

rules

List of tetrateio.api.tsb.segmentation.v1.SegmentationRules.Rule
List of rules that define the allowed communication paths between resources.

Rule

A rule is a single entry in an Access Control List (ACL).

FieldDescriptionValidation Rule

from

List of string
REQUIRED
The source of the communication path. This must be an existing value in a Segmentation Policy. The format of the field is: <segmentation policy>/<zone>. The special syntax . can be used in the \<zone\> part to represent "the same zone" in the segmentation policy.

repeated = {
  min_items: 1
  items: {string:{pattern:^.+/.+$}}
}

to

List of string
REQUIRED
The destination of the communication path. This must be an existing value in a Segmentation Policy. The format of the field is: <segmentation policy>/<zone>. The special syntax . can be used in the \<zone\> part to represent "the same zone" in the segmentation policy.

repeated = {
  min_items: 1
  items: {string:{pattern:^.+/.+$}}
}