Cloudeka Guard

A network policy (firewall rule) for your namespace. spec is a standard Cilium policy rule (endpointSelector, ingress, egress, etc.) — the platform projects it into a real network policy object and keeps it in sync as you edit the guard.

kubectl get guard -n <your-namespace>
kubectl get guard -n <your-namespace> -o yaml

You can add this script.

apiVersion: tenants.cloudeka.ai/v1alpha2
kind: CloudekaGuard
metadata:
  name: allow-frontend-to-backend
  namespace: <your-namespace>
spec:
  endpointSelector:
    matchLabels:
      app: backend
  ingress:
    - fromEndpoints:
        - matchLabels:
            app: frontend

kubectl apply -f my-guard.yaml

Field	Meaning
spec.endpointSelector	Which Pods (by label) this rule applies to
spec.ingress	Allowed inbound traffic rules
spec.egress	Allowed outbound traffic rules

Good To Know

• By default (no guards), traffic within your namespace follows the VPC's default network policy. Add guards to tighten or open specific paths.

• Editing a guard's spec is picked up automatically and reflected in the live policy.

• Deleting a guard removes its policy cleanly — no manual cleanup needed.