Egress network policies
Manage org-, project-, and system-scoped egress network policies with @tektona/sdk.
tek.egressNetworkPolicy manages egress network policies at project and
org scope, and reads the built-in system policies. A policy controls
which domains and CIDR ranges a sandbox may reach.
Project methods resolve both an org and a project (from the client scope or a
per-call { org, project }); org methods resolve only an org. System policies
are read-only and top-level.
Project scope
list returns one Page; listAll walks every
page.
const page = await tek.egressNetworkPolicy.list({ limit: 50 });
for await (const p of tek.egressNetworkPolicy.listAll()) console.log(p.name);const policy = await tek.egressNetworkPolicy.create({
name: 'ci',
allowed_domains: ['github.com', '*.npmjs.org'],
// allowed_cidrs: ['10.0.0.0/8'],
// denied_domains: ['*.tracker.net'],
// denied_cidrs: ['169.254.0.0/16'],
// display_name: 'CI policy',
// extends: 'tektona/dev',
});
await tek.egressNetworkPolicy.get('ci');
await tek.egressNetworkPolicy.update('ci', { allowed_domains: ['github.com'] });
await tek.egressNetworkPolicy.delete('ci'); // idempotent: a missing policy resolves cleanlySubmit the returned policy's reference (e.g. project/ci) when setting a
sandbox or project default policy.
Org scope
The same operations at org scope use the *OrgScoped methods:
await tek.egressNetworkPolicy.listOrgScoped({ org: 'acme' });
await tek.egressNetworkPolicy.createOrgScoped({ name: 'base', allowed_domains: ['github.com'] }, { org: 'acme' });
await tek.egressNetworkPolicy.getOrgScoped('base', { org: 'acme' });
await tek.egressNetworkPolicy.updateOrgScoped('base', { display_name: 'Base' });
await tek.egressNetworkPolicy.deleteOrgScoped('base');listAllOrgScoped is the auto-paging iterator for org policies.
System scope
The built-in system policies (and the platform-wide deny list) are read-only:
const { items, system_denies } = await tek.egressNetworkPolicy.listSystem();
const dev = await tek.egressNetworkPolicy.getSystem('tektona/dev');