Configure workspace network isolation

Turn on network isolation for a workspace, then open the ingress and egress paths its agents need.

Prerequisites

• A workspace.
• A cluster whose CNI enforces NetworkPolicy.

Enable isolation

1. Set isolate in the Workspace spec.

   spec:
     networkPolicy:
       isolate: true

The controller creates the policy in the workspace namespace. The rules the policy contains by default are in the Workspace reference.

Open a path

Add rules under the same networkPolicy block. Each rule is a list of peers and an optional list of ports.

1. Allow ingress from an ingress controller.

   spec:
     networkPolicy:
       isolate: true
       allowFrom:
         - peers:
             - namespaceSelector:
                 matchLabels:
                   kubernetes.io/metadata.name: ingress-nginx

2. Allow egress to an internal service. The CIDR and ports below are examples.

   spec:
     networkPolicy:
       isolate: true
       allowTo:
         - peers:
             - ipBlock:
                 cidr: 10.0.0.0/8
           ports:
             - protocol: TCP
               port: 5432

Restrict external access

To drop the rule that lets agents reach public addresses, set allowExternalAPIs: false, then list the destinations that remain. The CIDR below is an example.

spec:
  networkPolicy:
    isolate: true
    allowExternalAPIs: false
    allowTo:
      - peers:
          - ipBlock:
              cidr: 104.18.0.0/16
        ports:
          - protocol: TCP
            port: 443

With allowExternalAPIs: false, agents cannot reach their LLM provider unless you add its address under allowTo.

Reach private networks in development

To let agents call a service on a private network, such as a local Ollama, set allowPrivateNetworks: true. It removes the 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16 exclusions from the external rule. Link-local 169.254.0.0/16, where the node’s cloud metadata service answers, stays excluded either way.

spec:
  networkPolicy:
    isolate: true
    allowPrivateNetworks: true

In production, use an allowTo rule for each service instead.

Turn isolation off

Set isolate: false or remove the networkPolicy block. The controller deletes the NetworkPolicy.

Verify

Confirm the controller created the policy.

kubectl get networkpolicy -n omnia-customer-support

The list contains workspace-customer-support-isolation. The name is workspace-<workspace name>-isolation.

Troubleshooting

Agents cannot reach an API or service

1. Confirm the policy exists and read its rules.

   kubectl describe networkpolicy workspace-customer-support-isolation -n omnia-customer-support

2. Check whether allowExternalAPIs: false removed the rule you were relying on.

3. Add an allowTo rule for the destination.

4. Test from inside the namespace.

   kubectl run -n omnia-customer-support debug --rm -it --image=busybox -- sh

Ingress traffic does not reach agents

1. Add the ingress controller’s namespace to allowFrom, as above.
2. Confirm that namespace carries the label your matchLabels selects. Kubernetes sets kubernetes.io/metadata.name on every namespace.
3. If you set ports on the rule, confirm they include the port the agent listens on.

Related pages

• Manage workspaces
• Workspace reference: every field and the rule structures
• Multi-tenancy architecture: why the policy is shaped this way