// Module included in the following assemblies:
//
// * security/cert_manager_operator/cert-manager-nw-policy.adoc

:_mod-docs-content-type: REFERENCE
[id="cert-manager-nw-policy-params_{context}"]
= Network policy configuration parameters

[role="_abstract"]
You can enable and configure network policies for the cert-manager Operator components by updating the `CertManager` custom resource (CR). The CR includes the following parameters for enabling default network policies and defining custom egress rules.

[cols="1,1,3", options="header"]
|===
| Field
| Type
| Description

|`spec.defaultNetworkPolicy`
|`boolean`
a|Specifies whether to enable the default network policy for the cert-manager Operator components.
[IMPORTANT]
====
Once you enable default network policies, you cannot disable them. This restriction prevents accidental security degradation. Before enabling this setting, ensure that you plan the network policy requirements.
====

|`spec.networkPolicies`
|`object`
|Defines a list of custom network policy configuration. To apply the configuration, you must set `spec.defaultNetworkPolicy` to `true`.

|`spec.networkPolicies.componentName`
|`string`
|Specifies the component that this network policy targets. The only valid value is `CoreController`.

|`spec.networkPolicies.egress`
|`object`
|Defines the egress rules for the specified component. Set to `{}` to allow connections to all external providers.

|`spec.networkPolicies.egress.ports`
|`object`
|Defines a list of network ports and protocols for the specified providers.

|`spec.networkPolicies.name`
|`string`
|Specifies a unique name for the custom network policy, which is used to generate the `NetworkPolicy` resource name.
|===
