Skip to main content

​
Method

func (c *Client) CreateNetworkPolicy(ctx context.Context, policy types.CreateNetworkPolicy) (types.NetworkPolicyCreated, error)
Creates a new network policy that controls network access for agents. Network policies can be scoped at different levels (system global, global, repo, workflow, cluster, or node) and define rules for CIDR ranges and domain names.

​
Parameters

​
ctx
context.Context
required
Context for the API request
​
policy
types.CreateNetworkPolicy
required
The network policy configuration to create

​
Response

​
id
string
The unique identifier of the created network policy
​
created_at
time.Time
Timestamp when the policy was created
​
updated_at
time.Time
Timestamp when the policy was last updated

​
Example

​
Create a global network policy

import (
    "context"
    "github.com/garnet-org/api/client"
    "github.com/garnet-org/api/types"
)

func main() {
    c := client.New("https://api.garnet.ai", "your-token")
    ctx := context.Background()

    policy := types.CreateNetworkPolicy{
        Scope: types.NetworkPolicyScopeGlobal,
        Config: types.NetworkPolicyConfig{
            CIDRMode:      types.NetworkPolicyCIDRModeEnforce,
            CIDRPolicy:    types.NetworkPolicyTypeAllow,
            ResolveMode:   types.NetworkPolicyResolveModeStrict,
            ResolvePolicy: types.NetworkPolicyTypeAllow,
        },
        Rules: []types.CreateNetworkPolicyRule{
            {
                Type:   types.NetworkPolicyRuleTypeCIDR,
                Value:  "10.0.0.0/8",
                Action: types.NetworkPolicyTypeAllow,
            },
        },
    }

    created, err := c.CreateNetworkPolicy(ctx, policy)
    if err != nil {
        panic(err)
    }

    fmt.Printf("Created policy: %s\n", created.ID)
}

​
Create a workflow-specific policy

policy := types.CreateNetworkPolicy{
    Scope:        types.NetworkPolicyScopeWorkflow,
    RepositoryID: "repo-123",
    WorkflowName: "ci.yml",
    Config: types.NetworkPolicyConfig{
        CIDRMode:      types.NetworkPolicyCIDRModeEnforce,
        CIDRPolicy:    types.NetworkPolicyTypeDeny,
        ResolveMode:   types.NetworkPolicyResolveModePermissive,
        ResolvePolicy: types.NetworkPolicyTypeAllow,
    },
    Rules: []types.CreateNetworkPolicyRule{
        {
            Type:   types.NetworkPolicyRuleTypeDomain,
            Value:  "api.github.com",
            Action: types.NetworkPolicyTypeAllow,
        },
        {
            Type:   types.NetworkPolicyRuleTypeDomain,
            Value:  "*.npmjs.org",
            Action: types.NetworkPolicyTypeAllow,
        },
    },
}

created, err := c.CreateNetworkPolicy(ctx, policy)

​
Create a Kubernetes cluster policy

policy := types.CreateNetworkPolicy{
    Scope:       types.NetworkPolicyScopeCluster,
    ClusterName: "prod-cluster",
    Config: types.NetworkPolicyConfig{
        CIDRMode:      types.NetworkPolicyCIDRModeEnforce,
        CIDRPolicy:    types.NetworkPolicyTypeAllow,
        ResolveMode:   types.NetworkPolicyResolveModeStrict,
        ResolvePolicy: types.NetworkPolicyTypeAllow,
    },
}

created, err := c.CreateNetworkPolicy(ctx, policy)

​
NetworkPolicyScope Values

The scope determines where and how the policy applies:
  • system_global - System-wide policy that applies across all projects (admin only)
  • global - Project-wide policy that applies to all agents in the project
  • repo - Repository-specific policy for GitHub context
  • workflow - Workflow-specific policy for GitHub Actions
  • cluster - Kubernetes cluster-specific policy
  • node - Kubernetes node-specific policy
Policies are merged hierarchically with more specific scopes overriding broader scopes.

​
Errors

  • ErrInvalidNetworkPolicyScope - Invalid or missing scope
  • ErrInvalidNetworkPolicyRepositoryID - Missing repository ID for repo/workflow scope
  • ErrInvalidNetworkPolicyWorkflowName - Missing workflow name for workflow scope
  • ErrInvalidNetworkPolicyClusterName - Missing cluster name for cluster/node scope
  • ErrInvalidNetworkPolicyNodeName - Missing node name for node scope
  • ErrInvalidNetworkPolicyCIDRMode - Invalid CIDR mode
  • ErrInvalidNetworkPolicyCIDRPolicy - Invalid CIDR policy
  • ErrNetworkPolicyAlreadyExists - Policy already exists for this scope
  • ErrUnauthorizedNetworkPolicy - Permission denied

Build docs developers (and LLMs) love

Get started for freeTalk to us