Create organization network policies

An organization network policy defines the network access control for organization-level managed services exposed through Google Distributed Cloud (GDC) air-gapped. You can define these access controls using the OrganizationNetworkPolicy resource from the Networking API.

To get the permissions you need to configure the organization network policy, ask your Organization Identity and Access Management (IAM) Admin to grant you the Org Network Policy Admin (org-network-policy-admin) role.

You can define an organization network policy for access controls for the following GDC managed services:

• All services
• GDC console
• Distributed Cloud CLI
• Global API server
• Key Management Systems (KMS)
• Object storage
• Vertex AI
  • Services within Vertex AI that a policy supports include the Optical Character Recognition API, Speech-to-Text API, Translation API, and Workbench.

Default policy

By default, the following GDC managed services have the following principles:

Example organization network policy

The following is an example of an OrganizationNetworkPolicy resource that allows traffic from an IP address to access a GDC managed service.

   kubectl --kubeconfig MANAGEMENT_API_SERVER apply -f - <<EOF
   apiVersion: networking.gdc.goog/v1
   kind: OrganizationNetworkPolicy
   metadata:
     name: POLICY_NAME
     namespace: platform
   spec:
     subject:
       services:
         matchTypes:
         - "SERVICE_NAME"
     ingress:
       - from:
         - ipBlock:
             cidr: IP_ADDRESS
         - ipBlock:
             cidr: IP_ADDRESS
   EOF

Replace the following variables: