Restricting egress to known IP addresses for Dynamic Engine

Last updated: 9/16/2026

Replace the default internet-egress policy with a custom policy that allows only known external IP addresses and access to the Kubernetes API server.

About this task

Apply this procedure when you need tighter outbound control than the default network policy set provides.

Procedure

Check the default policies:

# For dynamic engine chart
helm show values oci://ghcr.io/talend/helm/dynamic-engine --version $DYNAMIC_ENGINE_VERSION \
--jsonpath '{.configuration.networkPolicies.policies}' | jq -r

# For dynamic engine environment chart
helm show values oci://ghcr.io/talend/helm/dynamic-engine-environment --version $DYNAMIC_ENGINE_VERSION \
--jsonpath '{.configuration.networkPolicies.policies}' | jq -r

Collect the endpoint addresses that the policy must allow.

Query the public IP addresses for the required Qlik endpoints and the Kubernetes API server before you build the custom policy.

Attention: The IP addresses are subject to changes on the AWS side and can thus require regular maintenance of your egress network policies.

# Find the public IP addresses
dig api.<region>.cloud.talend.com +short
dig msg.<region>.cloud.talend.com +short

# Find the virtual IP address of the Kubernetes API server
kubectl get service kubernetes -n default -o jsonpath='{.spec.clusterIP}'

# Find the real IP addresses of the Kubernetes API server
kubectl get endpointslices.discovery.k8s.io -n default kubernetes

Disable the default internet-egress policy (default-allow-egress-to-internet) and enable the policy to narrow the access to specific known (static) IP addresses.

cat <<EOF > custom-network-policies-values.yaml
configuration:
  networkPolicies:
    enabled: true # Enable network policies
    policies:
      default-allow-egress-to-internet:
        enabled: false # Disable default policy allowing all egress traffic to the internet
      restrict-allow-egress-to-known-ip-addresses:
        enabled: true
        spec:
          podSelector: {}
          egress:
            - to:
                - ipBlock:
                    cidr: xx.xxx.xxx.xxx/xx
                - ipBlock:
                    cidr: yy.yyy.yyy.yyy/yy
               # Skipped more lines for brevity
              ports:
                - port: 443
                  protocol: TCP
            - to:
                - ipBlock:
                    cidr: xx.xx.x.x/xx
              ports:
                - port: 443
                  protocol: TCP
            - to:
                - ipBlock:
                    cidr: xxx.xxx.xx.x/xx
              ports:
                - port: 8443
                  protocol: TCP
          policyTypes:
            - Egress
EOF

Replace the IP placeholders (x and y) with actual addresses.

Add the Docker registry exception to the environment-level policy.

The image registry API is used in service di-job-deployer and data-service-route-deployer in addition to kubelet. As a result, add the environment-specific policy so the Dynamic Engine environment can still pull images from the Docker registry service.
- For external Docker registry, add its IP address to restrict-allow-egress-to-known-ip-addresses policy above.
- For internal Docker registry, create the following values file:
```
# For inernal embedded Docker registry
cat <<EOF > custom-environment-network-policies-values.yaml
configuration:
  networkPolicies:
    policies:
      allow-egress-to-docker-registry:
        enabled: true
        spec:
          podSelector: {}
          egress:
            - to:
                - namespaceSelector:
                    matchLabels:
                      kubernetes.io/metadata.name: qlik-dynamic-engine # namespace of the embedded image registry
                  podSelector:
                    matchLabels:
                      app: docker-registry
              ports:
                - port: 5000
                  protocol: TCP
          policyTypes:
            - Egress
            EOF
```
  Information noteImportant: Dynamic Engine is shipped with an internal Docker registry for quick-start and development deployments only. A Dynamic Engine environment, which has its own namespace and network policies, needs access to this Docker registry.
  For a production environment, set up an external Docker registry for your Talend Management Console tasks. For more information, see Configuring a custom Docker registry for Talend Management Console tasks.

Install or upgrade the charts with the custom policy files.

helm upgrade --install dynamic-engine-$DYNAMIC_ENGINE_ID \
  -f $DYNAMIC_ENGINE_ID-values.yaml \
  -f custom-network-policies-values.yaml \
  oci://ghcr.io/talend/helm/dynamic-engine \
  --version $DYNAMIC_ENGINE_VERSION

helm upgrade --install dynamic-engine-environment-$DYNAMIC_ENGINE_ENVIRONMENT_ID \
  -f $DYNAMIC_ENGINE_ENVIRONMENT_ID-values.yaml \
  -f custom-network-policies-values.yaml \
  -f custom-environment-network-policies-values.yaml \
  oci://ghcr.io/talend/helm/dynamic-engine-environment \
  --version $DYNAMIC_ENGINE_VERSION

Verify the restrictive policy set.
Confirm that the default internet-egress policy is disabled and the custom policy is present in the engine and environment namespaces.
```
kubectl get networkpolicies -A -l "app.qlik.com/owned-by=qlik"
```
The default-allow-egress-to-internet policy should be gone, and the custom egress policies should appear instead. For example:
In the engine namespace:
- default-deny-all
- default-allow-dns
- default-allow-ingress-docker-registry
- restrict-allow-egress-to-known-ip-addresses (New)
In the environment namespace:
- default-deny-all
- default-allow-dns
- default-allow-egress-to-same-namespace
- restrict-allow-egress-to-known-ip-addresses (New)
- allow-egress-to-docker-registry (New)
The output should no longer include default-allow-egress-to-internet for either chart if the custom values file was applied correctly.

Did this page help you?

If you find any issues with this page or its content – a typo, a missing step, or a technical error – please let us know!

Leave your feedback here