[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-04(UTC)"],[[["\u003cp\u003eThis guide outlines how to configure intra-project traffic network policies within Google Distributed Cloud (GDC) air-gapped environments.\u003c/p\u003e\n"],["\u003cp\u003eBy default, GDC projects have a predefined intra-project policy that permits communication between workloads within the same project, with no inherent egress policy, which means that outbound traffic is allowed.\u003c/p\u003e\n"],["\u003cp\u003eRemoving the default intra-project policy denies all intra-project communication for services and workloads in the project.\u003c/p\u003e\n"],["\u003cp\u003eSetting an egress policy restricts outbound traffic to only what the policy specifies and requires a separate policy to permit intra-project outbound traffic if data exfiltration prevention is disabled.\u003c/p\u003e\n"],["\u003cp\u003eYou can create a global egress policy to apply the project network policy to all zones within the universe, allowing management across multiple zones.\u003c/p\u003e\n"]]],[],null,["# Create intra-project traffic network policies\n\nThis page provides instructions to configure intra-project traffic network policies in Google Distributed Cloud (GDC) air-gapped.\n\nProject network policies define either ingress or egress rules. You can you define policies that allow communication within projects, between projects, and to external IP addresses.\n\nIf intra-project traffic enforcement is needed within a single zone, see [Create workload-level network policies](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/pnp/workload-level-network-policies).\n\nBefore you begin\n----------------\n\nTo configure intra-project traffic network policies, you must have the following:\n\n- The necessary identity and access roles. For more information, see [Prepare predefined roles and access](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/pnp/pnp-overview#prepare-predefined-roles-and-access).\n- An existing project. For more information, see [Create a project](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/create-a-project).\n\nCreate an intra-project traffic policy\n--------------------------------------\n\nFor traffic within a project, GDC applies a predefined\nproject network policy, the intra-project policy, to each project by default.\nBy default, workloads in a project namespace have the ability to communicate\nwith each other without exposing anything to external resources.\n\nBy default, there is no egress policy, so outbound traffic is allowed for all\nintra-project traffic. However, when you set a single egress policy, only the\ntraffic that the policy specifies is allowed.\n\n### Ingress intra-project traffic network policy\n\nWhen you create a project, you implicitly create a default base\n`ProjectNetworkPolicy` resource that allows intra-project communication. This policy\nallows inbound traffic from other workloads in the same project.\n\nYou can remove the default policy, but be aware that this removal results in denying intra-project communication for\nall services and workloads within the project.\n\n### Create a global egress intra-project traffic network policy\n\nSpecify a global policy to apply this project network policy to all zones in the universe. For more information on global resources in a GDC universe, see\n[Multi-zone overview](/distributed-cloud/hosted/docs/latest/gdch/resources/multi-zone/mz-overview).\n\nWhen you disable data exfiltration prevention\nand apply a `ProjectNetworkPolicy` egress policy to the project, such as\npreventing access to an external resource, use the following required policy to allow\nintra-project outbound traffic: \n\n kubectl --kubeconfig \u003cvar translate=\"no\"\u003eGLOBAL_API_SERVER\u003c/var\u003e apply -f - \u003c\u003cEOF\n apiVersion: networking.global.gdc.goog/v1\n kind: ProjectNetworkPolicy\n metadata:\n namespace: \u003cvar translate=\"no\"\u003ePROJECT\u003c/var\u003e\n name: allow-intra-project-outbound-traffic\n spec:\n policyType: Egress\n egress:\n - to:\n - projectSelector:\n projects:\n matchNames:\n - \u003cvar translate=\"no\"\u003ePROJECT\u003c/var\u003e\n EOF\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eGLOBAL_API_SERVER\u003c/var\u003e: the global API server's kubeconfig path. For more information, see [Global and zonal API servers](/distributed-cloud/hosted/docs/latest/gdch/resources/multi-zone/api-servers). If you have not yet generated a kubeconfig file for the API server, see [Sign in](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/iam/sign-in#cli) for details.\n- \u003cvar translate=\"no\"\u003ePROJECT\u003c/var\u003e: the name of the project where you want to allow intra-project outbound traffic."]]
