[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[[["\u003cp\u003eProject network policies in Google Distributed Cloud (GDC) air-gapped define either ingress or egress rules, with a default intra-project policy isolating services within a project.\u003c/p\u003e\n"],["\u003cp\u003eCommunication between services in different project namespaces, or with services outside the organization, requires explicit cross-project or cross-organization traffic network policies, with data exfiltration protection needing to be disabled for external connections.\u003c/p\u003e\n"],["\u003cp\u003eGDC project network policies are additive, meaning traffic is allowed if it matches at least one rule across all policies applied to a workload, but all unspecified traffic is denied once a policy is applied.\u003c/p\u003e\n"],["\u003cp\u003eGlobal project network policies can span multiple GDC zones and regions within a universe, while zonal policies are confined to the zones specified during their creation.\u003c/p\u003e\n"],["\u003cp\u003eWorkload-level network policies provide fine-grained access control for individual VMs and pods, enhancing security by managing traffic flow based on labels.\u003c/p\u003e\n"]]],[],null,["# Overview\n\nThis page provides an overview of project network policies in\nGoogle Distributed Cloud (GDC) air-gapped.\n\nProject network policies define either ingress or egress rules. Unlike Kubernetes network policies, you can only specify one policy type for a policy.\n\nFor traffic within a project, GDC applies a predefined project network policy, the intra-project policy, to each project by default.\n\nServices and workloads in a project are isolated from external services and workloads by default. However, services and workloads from different project namespaces and within the same organization can communicate with each other by applying cross-project traffic network policies.\n\nSimilarly, connecting services and workloads to a destination outside of your project in a different organization requires explicit approval. You must disable data exfiltration protection to allow cross-organization traffic.\n\nIngress and egress firewall rules are the main components of project network policies and determine which types of traffic are allowed in and out of your network. To set firewall rules for your project namespace in GDC, use the GDC console.\n\nSecurity and connectivity\n-------------------------\n\nBy default, services and workloads in a project are isolated within that\nproject. They cannot communicate with external services and workloads without\nconfiguring a network policy.\n\nTo set a network policy for your project namespace\nin GDC, use the `ProjectNetworkPolicy` resource. This resource\nlets you define policies, which allow communication within projects,\nbetween projects, to external IP addresses, and from external IP addresses. Also, you can transfer workloads out from a project only if you [disable data exfiltration protection for the project](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/data-exfiltration#prevent-data-exfiltration).\n\nGDC project network policies are additive. The resulting enforcement for a\nworkload is an *any* match for the traffic flow against the union of all\npolicies applied to that workload. When multiple policies are present, the rules for each\npolicy are additively combined, allowing traffic if it matches at least one of the\nrules.\n\nFurthermore, after you apply a single policy,\nall traffic you don't specify is denied. Therefore, when you apply one or more\npolicies that select a workload as the subject, only the traffic that a policy specifies\nis allowed.\n\nWhen you use a well-known IP address you allocate for the project, it performs a\nsource network address translation (NAT) on the outbound traffic from the\norganization.\n\nGlobal project network policies\n-------------------------------\n\nYou can create global project network policies. The scope of global project network policies span across a GDC universe. Each\nGDC universe can consist of multiple\nGDC zones organized into regions that are interconnected\nand share a control plane. For example, a universe consisting two regions with\nthree zones each might look like: `us-virginia1-a`, `us-virginia1-b`,\n`us-virginia1-c` and `eu-ams1-a`, `eu-ams1-b`, `eu-ams1-c`.\n\nThe scope of zonal project network policies is limited to the zones specified at the time\nof creation. Each zone is an independent disaster domain. A zone manages\ninfrastructure, services, APIs, and tooling that use a local control plane.\n\nFor more information on global resources in a GDC universe, see\n[Multi-zone overview](/distributed-cloud/hosted/docs/latest/gdch/resources/multi-zone/mz-overview).\n\nYou can create global project network policies using the [Networking Kubernetes Resource Model (KRM) API](/distributed-cloud/hosted/docs/latest/gdch/apis/service/networking/v1/networking-v1). Use the API version `networking.global.gdc.goog` to create global resources.\n\nYou can create zonal project network policies using the KRM API or the GDC console. Use the API version `networking.gdc.goog` to create zonal resources.\n\nAllow-all network policies\n--------------------------\n\nYou can create allow-all network policies to establish broad, default access rules for a project.\n\nYou can configure the following types of allow-all network policies:\n\n- Allow-all Traffic Policy: Allows traffic to and from any source, which includes other projects and external IPs.\n- Allow-all-external Traffic Policy: Allows traffic to and from IP addresses external to the organization.\n- Allow-all-projects Traffic Policy: Allows traffic to and from all projects within the organization.\n\nFor more information, see [Create allow-all traffic network policies](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/pnp/allow-all-traffic).\n\nWorkload-level network policies\n-------------------------------\n\nYou can create workload-level network policies to define fine-grained access control for individual VMs and pods within a project. These policies act like firewalls for your workloads, controlling traffic flow based on labels to enhance security and isolate applications. This granularity allows stricter control over which workloads can communicate with each other within and across projects.\n\nWorkload-level network policies also provide the capability to enforce PNP along a single zone.\n\nFor more information, see [Create workload-level network policies](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/pnp/workload-level-network-policies).\n\nPrepare predefined roles and access\n-----------------------------------\n\nTo configure project network policies, you must have the necessary identity and access roles:\n\n- Project NetworkPolicy Admin: manages project network policies in the project namespace. Ask your Organization IAM Admin to grant you the Project NetworkPolicy Admin (`project-networkpolicy-admin`) cluster role.\n- Global PNP Admin: has write permissions on all multi-zone PNP resources in global project namespace. Ask your Organization IAM Admin to grant you the Global PNP Admin (`global-project-networkpolicy-admin`) role. For more information, see [Predefined role descriptions](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/iam/role-descriptions).\n\nWhat's next\n-----------\n\n- [Create intra-project traffic network policies](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/pnp/intra-project-traffic)\n- [Create cross-project traffic network policies](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/pnp/cross-project-traffic)\n- [Create workload-level network policies](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/pnp/workload-level-network-policies)\n- [Create cross-organization traffic network policies](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/pnp/cross-organization-traffic)\n- [Create project network policies for managed services](/distributed-cloud/hosted/docs/latest/gdch/platform/pa-user/pnp/policy-managed-service)"]]
