Update from code changes: document sandbox egress allowlists - #437
Open
mintlify[bot] wants to merge 4 commits into
Open
Update from code changes: document sandbox egress allowlists#437mintlify[bot] wants to merge 4 commits into
mintlify[bot] wants to merge 4 commits into
Conversation
Contributor
Author
|
Preview deployment for your docs. Learn more about Mintlify Previews.
|
Contributor
Author
|
Update from code changes updated this PR. Added note about the cluster egress enforcement toggle in Sandbox settings Source PRs
|
Contributor
Author
|
Update from code changes updated this PR. Removed duplicate egress section and updated SDK references for Service entries Source PRs
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Documents the sandbox
egressAPI that restricts a sandbox's outbound traffic to an allowlist of destinations, the cluster-level toggle in the Porter Dashboard that turns enforcement on, and the in-cluster Service entry form that lets a restricted sandbox reach another workload on the same cluster. The allowlist accepts hostnames, wildcards, IP literals, CIDR ranges, and Service DNS names (name.namespace.svc.cluster.local), and is enforced transparently at the network layer so any client and protocol works without proxy configuration. Sandbox networking already documented that outbound traffic to in-cluster services and private address space is denied by default; this shipped adds the ability to further narrow outbound to a specific set of destinations and to selectively grant in-cluster access.Changes
sandboxes/networking.mdxcovering the cluster-level enforcement toggle, the destination kinds table (including the in-cluster Service form), and Python and TypeScript examples.egressparameter row in the Python and TypeScript SDK references to mention in-cluster Service DNS names and link to the current section anchor.Update history
egressAPI surface (networking page + Python and TypeScript SDK references). Source: https://github.com/porter-dev/code/pull/7215.egresson a sandbox isn't enforced until it's turned on. Source: https://github.com/porter-dev/code/pull/7245.