Networking

builder(): NetworkPolicyBuilder

none(): NetworkPolicy

allowAll(): NetworkPolicy

fromProfiles(profiles: Iterable<NetworkProfile>): NetworkPolicy

interface Rule {
  readonly direction: Direction;
  readonly destination: Destination;
  readonly protocols: readonly Protocol[]; // empty = any
  readonly ports: readonly PortRange[];    // empty = any
  readonly action: Action;
}

allowEgress(destination: Destination): Rule

denyEgress(destination: Destination): Rule

allowIngress(destination: Destination): Rule

denyIngress(destination: Destination): Rule

allowAny(destination: Destination): Rule

denyAny(destination: Destination): Rule

allowDns(): Rule

denyDns(): Rule

type Destination =
  | { kind: "any" }
  | { kind: "cidr"; cidr: string }
  | { kind: "domain"; domain: string }
  | { kind: "domainSuffix"; suffix: string }
  | { kind: "group"; group: DestinationGroup };

any(): Destination

cidr(cidr: string): Destination

domain(domain: string): Destination

domainSuffix(suffix: string): Destination

group(group: DestinationGroup): Destination

interface PortRange {
  readonly start: number;
  readonly end: number;
}

single(port: number): PortRange

range(start: number, end: number): PortRange

policy(policy: NetworkPolicy | NetworkPolicyBuilder): this

port(host: number, guest: number): this

portBind(bind: string, host: number, guest: number): this

portUdp(host: number, guest: number): this

portUdpBind(bind: string, host: number, guest: number): this

dns(configure: (b: DnsBuilder) => DnsBuilder): this

tls(configure: (b: TlsBuilder) => TlsBuilder): this

trustHostCAs(enabled: boolean): this

maxConnections(max: number): this

rateLimiter(configure: (r: NetworkRateLimiterBuilder) => NetworkRateLimiterBuilder): this

ipv4Pool(pool: string): this

ipv6Pool(pool: string): this

interface(configure: (b: InterfaceOverridesBuilder) => InterfaceOverridesBuilder): this

enabled(enabled: boolean): this

onSecretViolation(configure: (b: ViolationActionBuilder) => ViolationActionBuilder): this

secret(configure: (b: SecretBuilder) => SecretBuilder): this

secretEnv(envVar: string, value: string, placeholder: string, allowedHost: string): this

secretEnvSimple(envVar: string, value: string, allowedHost: string): this

build(): NetworkConfig

defaultDeny(): this

defaultAllow(): this

defaultEgress(action: "allow" | "deny"): this

defaultIngress(action: "allow" | "deny"): this

egress(configure: (rb: RuleBuilder) => RuleBuilder): this

ingress(configure: (rb: RuleBuilder) => RuleBuilder): this

any(configure: (rb: RuleBuilder) => RuleBuilder): this

rule(configure: (rb: RuleBuilder) => RuleBuilder): this

build(): NetworkPolicy

egress(): this

ingress(): this

any(): this

tcp(): this

udp(): this

icmpv4(): this

icmpv6(): this

port(port: number): this

portRange(lo: number, hi: number): this

ports(ports: number[]): this

allowPublic(): this

denyPublic(): this

allowPrivate(): this

denyPrivate(): this

allowLoopback(): this

denyLoopback(): this

allowLinkLocal(): this

denyLinkLocal(): this

allowMeta(): this

denyMeta(): this

allowMulticast(): this

denyMulticast(): this

allowHost(): this

denyHost(): this

allowLocal(): this

denyLocal(): this

allowDomain(name: string): this

denyDomain(name: string): this

allowDomains(names: string[]): this

denyDomains(names: string[]): this

allowDomainSuffix(suffix: string): this

denyDomainSuffix(suffix: string): this

allowDomainSuffixes(suffixes: string[]): this

denyDomainSuffixes(suffixes: string[]): this

NetworkPolicy.builder()
  .egress((r) =>
    r
      .tcp().port(443).allow((d) => d.domain("api.example.com"))
      .deny((d) => d.cidr("198.51.100.0/24")),
  )
  .build();

allow(configure: (d: RuleDestinationBuilder) => RuleDestinationBuilder): this

deny(configure: (d: RuleDestinationBuilder) => RuleDestinationBuilder): this

ip(ip: string): this

cidr(cidr: string): this

domain(domain: string): this

domainSuffix(suffix: string): this

group(group: string): this

any(): this

rebindProtection(enabled: boolean): this

nameservers(servers: string[]): this

queryTimeoutMs(ms: number): this

bypass(pattern: string): this

verifyUpstream(verify: boolean): this

verifyUpstreamFor(pattern: string, verify: boolean): this

interceptedPorts(ports: number[]): this

blockQuic(block: boolean): this

interceptCaCert(path: string): this

interceptCaKey(path: string): this

upstreamCaCert(path: string): this

upstreamCaCertFor(pattern: string, path: string): this

block(): this

blockAndLog(): this

blockAndTerminate(): this

passthroughHost(host: string): this

passthroughHostPattern(pattern: string): this

passthroughAllHosts(iUnderstand: boolean): this

egress(configure: (r: RateLimiterBuilder) => RateLimiterBuilder): this

ingress(configure: (r: RateLimiterBuilder) => RateLimiterBuilder): this

bandwidth(sizeBytes: number, refillTimeMs: number): this

bandwidthBurst(sizeBytes: number): this

ops(count: number, refillTimeMs: number): this

opsBurst(count: number): this

.mac(mac)

.mtu(mtu)

.ipv4(address)

.ipv6(address)

type NetworkProfile = "public" | "private" | "host";

type Action = "allow" | "deny";

type Direction = "egress" | "ingress" | "any";

type DestinationGroup =
  | "public"
  | "loopback"
  | "private"
  | "link-local"
  | "metadata"
  | "multicast"
  | "host";

type Protocol = "tcp" | "udp" | "icmpv4" | "icmpv6";

interface PublishedPort {
  readonly hostPort: number;
  readonly guestPort: number;
  readonly protocol: "tcp" | "udp";
  readonly hostBind: string;
}

interface NetworkRateLimiterConfig {
  readonly egress?: RateLimiterConfig;
  readonly ingress?: RateLimiterConfig;
}

interface RateLimiterConfig {
  readonly bandwidth?: TokenBucketConfig;
  readonly ops?: TokenBucketConfig;
}

interface TokenBucketConfig {
  readonly size: number;
  readonly refillTimeMs: number;
  readonly oneTimeBurst: number;
}