Create organization network policies

An organization network policy defines the network access control for organization-level managed services exposed through Google Distributed Cloud (GDC) air-gapped. You can define these access controls using the OrganizationNetworkPolicy resource from the Networking API .

To get the permissions you need to configure the organization network policy, ask your Organization Identity and Access Management (IAM) Admin to grant you the Org Network Policy Admin ( org-network-policy-admin ) role.

You can define an organization network policy for access controls for the following GDC managed services:

• All services
• GDC console
• Distributed Cloud CLI
• Global API server
• Key Management Systems (KMS)
• Object storage
• Vertex AI
  • Services within Vertex AI that a policy supports include the Optical Character Recognition API , Speech-to-Text API , Translation API , and Workbench .

Default policy

By default, the following GDC managed services have the following principles:

Example organization network policy

The following is an example of an OrganizationNetworkPolicy resource that allows traffic from an IP address to access a GDC managed service.

 kubectl  
--kubeconfig  
 MANAGEMENT_API_SERVER 
  
apply  
-f  
-  
<<EOF
apiVersion:  
networking.gdc.goog/v1
kind:  
OrganizationNetworkPolicy
metadata:  
name:  
 POLICY_NAME 
  
namespace:  
platform
spec:  
subject:  
services:  
matchTypes:  
-  
 " SERVICE_NAME 
" 
  
ingress:  
-  
from:  
-  
ipBlock:  
cidr:  
 IP_ADDRESS 
  
-  
ipBlock:  
cidr:  
 IP_ADDRESS 
EOF 

Replace the following variables: