NewESFromK8sLabelSelector returns a new endpoint selector from the label where it the given srcPrefix will be encoded in the label's keys.

NewESFromLabels creates a new endpoint selector from the given labels.

Allowed means that reachability is allowed.

Denied means that reachability is denied.

Undecided means that we have not come to a decision yet.

CIDR specifies a block of IP addresses.

EgressRule contains all rule types which can be applied at egress, i.e.

EndpointSelector is a wrapper for k8s LabelSelector.

IngressRule contains all rule types which can be applied at ingress, i.e.

L7Rules is a union of port level rule types.

PortProtocol specifies an L4 port with an optional transport protocol.

PortRule is a list of ports/protocol combinations with optional Layer 7 rules which must be met.

PortRuleHTTP is a list of HTTP protocol constraints.

Rule is a policy rule which must be applied to all endpoints which match the labels contained in the endpointSelector Each rule is split into an ingress section which contains all rules applicable at ingress, and an egress section applicable at egress.

Decision is a reachability policy decision.

Rules is a collection of api.Rule.