xcsh_network_policy_view (Data Source)

Retrieves information about a Network Policy View resource in F5 Distributed Cloud for network policy view specification. configuration. This is a read-only data source.

~> Note: For more information, see the F5 Distributed Cloud API documentation.

Example Usage

# NetworkPolicyView Data Source Example

terraform {
  required_version = ">= 1.0"

  required_providers {
    xcsh = {
      source  = "f5-sales-demo/xcsh"
      version = ">= 0.1.0"
    }
  }
}

# Look up an existing NetworkPolicyView by name
data "xcsh_network_policy_view" "example" {
  name      = "example-network-policy-view"
  namespace = "system"
}

output "network_policy_view_id" {
  value = data.xcsh_network_policy_view.example.id
}

Argument Reference

-> Syntax Rule: This provider uses OneOf groups for mutually exclusive options. Fields documented as “Optional Block” use block syntax field_name { ... }. Empty OneOf object attributes use field_name = {}; conditional selection uses condition ? {} : null. Boolean attributes (such as add_hsts and http_redirect) use = true or = false.

🔶 High Risk Operations — Some operations on this resource have high danger level. Destructive operations may require confirmation.

Metadata Argument Reference

• name - Required String
Name of the NetworkPolicyView

• namespace - Optional String
Namespace where the NetworkPolicyView exists

Attributes Reference

In addition to all arguments above, the following attributes are exported:

• annotations - Optional Map
Annotations applied to this resource

• description - Optional String
Description of the NetworkPolicyView

• egress_rules - Optional List
Ordered list of rules applied to connections from policy endpoints

• endpoint - Optional String
Shape of the endpoint choices for a view

• id - Optional String
Unique identifier for the resource

• ingress_rules - Optional List
Ordered list of rules applied to connections to policy endpoints

• labels - Optional Map
Labels applied to this resource

• action - Optional String Defaults to DENY
Possible values are DENY, ALLOW
[Enum: DENY|ALLOW] Network policy rule action configures the action to be taken on rule match Apply deny action on rule match Apply allow action on rule match

• adv_action - Optional String
Network Policy Rule Advanced Action provides additional OPTIONS along with RuleAction and PBRRuleAction

• all_tcp_traffic - Optional Object
Configuration parameter for all TCP traffic

• all_traffic - Optional Object
Configuration parameter for all traffic

• all_udp_traffic - Optional Object
Configuration parameter for all UDP traffic

• any - Optional Object
Enable this option

• applications - Optional String
Configuration parameter for applications

• inside_endpoints - Optional Object
Enable this option

• ip_prefix_set - Optional String
List of references to ip_prefix_set objects

• label_matcher - Optional String
Label matcher specifies a list of label keys whose values need to match for source/client and destination/server. Note that the actual label values are not specified and do not matter. This allows an ability to scope grouping by the label key name

• label_selector - Optional String
Type can be used to establish a ‘selector reference’ from one object(called selector) to a set of other objects(called selectees) based on the value of expressions. A label selector is a label query over a set of resources. An empty label selector matches all objects

• metadata - Optional String
MessageMetaType is metadata (common attributes) of a message that only certain messages have. This information is propagated to the metadata of a child object that gets created from the containing message during view processing. The information in this type can be specified by user during create

• outside_endpoints - Optional Object
Enable this option

• prefix_list - Optional String
List of IPv4 prefixes that represent an endpoint

• protocol_port_range - Optional String
Protocol and Port. Protocol and Port ranges

• action - Optional String Defaults to NOLOG
Possible values are NOLOG, LOG
[Enum: NOLOG|LOG] Choice to choose logging or no logging This works together with option selected via NetworkPolicyRuleAction or any other action specified x-

• applications - Optional List Defaults to APPLICATION_HTTP
Possible values are APPLICATION_HTTP, APPLICATION_HTTPS, APPLICATION_SNMP, APPLICATION_DNS
[Enum: APPLICATION_HTTP|APPLICATION_HTTPS|APPLICATION_SNMP|APPLICATION_DNS] Application Protocols. Application protocols like HTTP, SNMP

• ref - Optional List
List of references to ip_prefix_set objects

• kind - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then kind will hold the referred object’s kind (e.g. ‘route’)

• name - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then name will hold the referred object’s(e.g. Route’s) name

• namespace - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then namespace will hold the referred object’s(e.g. Route’s) namespace

• tenant - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then tenant will hold the referred object’s(e.g. Route’s) tenant

• uid - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then uid will hold the referred object’s(e.g. Route’s) uid

• keys - Optional List
The list of label key names that have to match

• expressions - Optional List
Expressions contains the Kubernetes style label expression for selections

• description_spec - Optional String
Description. Human readable description

• name - Optional String
Name of the message. The value of name has to follow DNS-1035 format

• prefixes - Optional List
List of IPv4 prefixes that represent an endpoint

• port_ranges - Optional List
List of port ranges. Each range is a single port or a pair of start and end ports e.g. 8080-8192

• protocol - Optional String
Possible values are ALL, TCP, UDP, ICMP
[Enum: ALL|TCP|UDP|ICMP] Protocol in IP packet to be used as match criteria Values are TCP, UDP, and ICMP

Endpoint

An endpoint block supports the following:

• any - Optional Object
Enable this option

• inside_endpoints - Optional Object
Enable this option

• outside_endpoints - Optional Object
Enable this option

• prefix_list - Optional String
List of IPv4 prefixes that represent an endpoint

Endpoint Any

An any block (within endpoint) supports the following:

Endpoint Inside Endpoints

An inside_endpoints block (within endpoint) supports the following:

Endpoint Label Selector

A label_selector block (within endpoint) supports the following:

• expressions - Optional List
Expressions contains the Kubernetes style label expression for selections

Endpoint Outside Endpoints

An outside_endpoints block (within endpoint) supports the following:

Endpoint Prefix List

A prefix_list block (within endpoint) supports the following:

• prefixes - Optional List
List of IPv4 prefixes that represent an endpoint

Ingress Rules

An ingress_rules block supports the following:

• adv_action - Optional String
Network Policy Rule Advanced Action provides additional OPTIONS along with RuleAction and PBRRuleAction

• all_tcp_traffic - Optional Object
Configuration parameter for all TCP traffic

• all_traffic - Optional Object
Configuration parameter for all traffic

• all_udp_traffic - Optional Object
Configuration parameter for all UDP traffic

• any - Optional Object
Enable this option

• applications - Optional String
Configuration parameter for applications

• inside_endpoints - Optional Object
Enable this option

• ip_prefix_set - Optional String
List of references to ip_prefix_set objects

• outside_endpoints - Optional Object
Enable this option

• prefix_list - Optional String
List of IPv4 prefixes that represent an endpoint

• protocol_port_range - Optional String
Protocol and Port. Protocol and Port ranges

Ingress Rules Adv Action

An adv_action block (within ingress_rules) supports the following:

Ingress Rules All TCP Traffic

An all_tcp_traffic block (within ingress_rules) supports the following:

Ingress Rules All Traffic

An all_traffic block (within ingress_rules) supports the following:

Ingress Rules All UDP Traffic

An all_udp_traffic block (within ingress_rules) supports the following:

Ingress Rules Any

An any block (within ingress_rules) supports the following:

Ingress Rules Applications

An applications block (within ingress_rules) supports the following:

Ingress Rules Inside Endpoints

An inside_endpoints block (within ingress_rules) supports the following:

Ingress Rules IP Prefix Set

An ip_prefix_set block (within ingress_rules) supports the following:

• ref - Optional List
List of references to ip_prefix_set objects

Ingress Rules IP Prefix Set Ref

A ref block (within ingress_rules.ip_prefix_set) supports the following:

• kind - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then kind will hold the referred object’s kind (e.g. ‘route’)

• name - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then name will hold the referred object’s(e.g. Route’s) name

• namespace - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then namespace will hold the referred object’s(e.g. Route’s) namespace

• tenant - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then tenant will hold the referred object’s(e.g. Route’s) tenant

• uid - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then uid will hold the referred object’s(e.g. Route’s) uid

Ingress Rules Label Matcher

A label_matcher block (within ingress_rules) supports the following:

• keys - Optional List
The list of label key names that have to match

Ingress Rules Label Selector

A label_selector block (within ingress_rules) supports the following:

• expressions - Optional List
Expressions contains the Kubernetes style label expression for selections

Ingress Rules Metadata

A metadata block (within ingress_rules) supports the following:

• description_spec - Optional String
Description. Human readable description

• name - Optional String
Name of the message. The value of name has to follow DNS-1035 format

Ingress Rules Outside Endpoints

An outside_endpoints block (within ingress_rules) supports the following:

Ingress Rules Prefix List

A prefix_list block (within ingress_rules) supports the following:

• prefixes - Optional List
List of IPv4 prefixes that represent an endpoint

Ingress Rules Protocol Port Range

A protocol_port_range block (within ingress_rules) supports the following:

• port_ranges - Optional List
List of port ranges. Each range is a single port or a pair of start and end ports e.g. 8080-8192

• protocol - Optional String
Possible values are ALL, TCP, UDP, ICMP
[Enum: ALL|TCP|UDP|ICMP] Protocol in IP packet to be used as match criteria Values are TCP, UDP, and ICMP

Common Types

The following type definitions are used throughout this resource. See the full definition here rather than repeated inline.

Object Reference {#common-object-reference}

Object references establish a direct reference from one configuration object to another in F5 Distributed Cloud. References use the format tenant/namespace/name.

Field	Type	Description
`name`	String	Name of the referenced object
`namespace`	String	Namespace containing the referenced object
`tenant`	String	Tenant of the referenced object (system-managed)

Transformers {#common-transformers}

Transformers apply transformations to input values before matching. Multiple transformers can be applied in order.

Value	Description
`LOWER_CASE`	Convert to lowercase
`UPPER_CASE`	Convert to uppercase
`BASE64_DECODE`	Decodebase64 content
`NORMALIZE_PATH`	Normalize URL path
`REMOVE_WHITESPACE`	Remove whitespace characters
`URL_DECODE`	Decode URL-encoded characters
`TRIM_LEFT`	Trim leading whitespace
`TRIM_RIGHT`	Trim trailing whitespace
`TRIM`	Trim both leading and trailing whitespace

HTTP Methods {#common-http-methods}

HTTP methods used for request matching.

Value	Description
`ANY`	Match any HTTP method
`GET`	HTTP GET request
`HEAD`	HTTP HEAD request
`POST`	HTTP POST request
`PUT`	HTTP PUT request
`DELETE`	HTTP DELETE request
`CONNECT`	HTTP CONNECT request
`OPTIONS`	HTTP OPTIONS request
`TRACE`	HTTP TRACE request
`PATCH`	HTTP PATCH request
`COPY`	HTTP COPY request (WebDAV)

TLS Fingerprints {#common-tls-fingerprints}

TLS fingerprint categories for malicious client detection.

Value	Description
`TLS_FINGERPRINT_NONE`	No fingerprint matching
`ANY_MALICIOUS_FINGERPRINT`	Match any known malicious fingerprint
`ADWARE`	Adware-associated fingerprints
`DRIDEX`	Dridex malware fingerprints
`GOOTKIT`	Gootkit malware fingerprints
`RANSOMWARE`	Ransomware-associated fingerprints
`TRICKBOT`	Trickbot malware fingerprints

IP Threat Categories {#common-ip-threat-categories}

IP address threat categories for security filtering.

Value	Description
`SPAM_SOURCES`	Known spam sources
`WINDOWS_EXPLOITS`	Windows exploit sources
`WEB_ATTACKS`	Web attack sources
`BOTNETS`	Known botnet IPs
`SCANNERS`	Network scanner IPs
`REPUTATION`	Poor reputation IPs
`PHISHING`	Phishing-related IPs
`PROXY`	Anonymous proxy IPs
`MOBILE_THREATS`	Mobile threat sources
`TOR_PROXY`	Tor exit nodes
`DENIAL_OF_SERVICE`	DoS attack sources
`NETWORK`	Known bad network ranges