Segmentation Rules

Alpha early access

The segmentation feature is in an early access alpha state. Before trying this in a non production environment, please reach out to Tetrate first.

Segmentation Rules define an Access Control Lists (ACLs) that can be applied to resources to control access between them. Rules define the llowed communication paths between resources. These rules are based on defined Segmentation Policies and Zones.

apiVersion: segmentation.tsb.tetrate.io/v1
kind: SegmentationRules
metadata:
  organization: myorg
  name: ring-policies
spec:
  rules:
    # ingress -\> yellow
    - from: [ring/ingress]
      to:   [ring/yellow]
    # yellow -\> amber
    - from: [ring/yellow]
      to:   [ring/amber]
    # amber -\> red
    - from: [ring/amber]
      to:   [ring/red]

Enforcement

Segmentation Rules act as whitelists for allowed communication patterns to the resources protected by the policies. This means that for any resource that belongs to a zone that is captured by a rule, a "deny all" default policy is configured and only communications explicitly specified in a rule will be allowed.

SegmentationRules

Segmentation Rules define an Access Control Lists (ACLs) that can be applied to resources to control access between them. Rules define the llowed communication paths between resources. These rules are based on defined Segmentation Policies and Zones.

Enforcement

Segmentation Rules act as whitelists for allowed communication patterns to the resources protected by the policies. This means that for any resource that belongs to a zone that is captured by a rule, a "deny all" default policy is configured and only communications explicitly specified in a rule will be allowed.

Field	Description	Validation Rule
rules	List of tetrateio.api.tsb.segmentation.v1.SegmentationRules.Rule List of rules that define the allowed communication paths between resources.	–

Rule

A rule is a single entry in an Access Control List (ACL).

Field	Description	Validation Rule
from	List of string REQUIRED The source of the communication path. This must be an existing value in a Segmentation Policy. The format of the field is: <segmentation policy>/<zone>. The special syntax . can be used in the \<zone\> part to represent "the same zone" in the segmentation policy.	repeated = {   min_items: 1   items: {string:{pattern:^.+/.+$}} }
to	List of string REQUIRED The destination of the communication path. This must be an existing value in a Segmentation Policy. The format of the field is: <segmentation policy>/<zone>. The special syntax . can be used in the \<zone\> part to represent "the same zone" in the segmentation policy.	repeated = {   min_items: 1   items: {string:{pattern:^.+/.+$}} }