---
title: "Enable and enforce application layer policies"
description: "Configure access controls based on Layer-7 attributes by enforcing Calico Cloud application-layer policy in connected clusters."
product: "Calico Cloud"
version: "v23.0.1"
section: "Network policy"
canonical_url: "https://docs.tigera.io/calico-cloud/network-policy/application-layer-policies/alp"
---

# Enable and enforce application layer policies

> **WARNING:** Application layer policy based on Envoy is deprecated and will be removed in an upcoming release. For similar functionality, try [Istio Ambient Mode](https://docs.tigera.io/calico-cloud/compliance/istio/about-istio-ambient.md) with [Istio authorization policies](https://istio.io/latest/docs/ambient/getting-started/enforce-auth-policies/).

Application layer policies let you configure access controls based on L7 attributes.

## Before you begin

### Limitations

- Application layer policy is not compatible with a service mesh such as Istio.
- Application layer policy can restrict only *ingress* traffic. It can not restrict egress traffic.
- Support for L7 attributes is limited to HTTP method and URL exact/prefix path.
- Supported protocols are limited to TCP-based protocols (for example, HTTP, HTTPS, or gRPC).
- Application layer policies apply to the entire cluster. They can not be namespaced.
- Logs for application layer polices are not included with other L7 logs in Service Graph.
- Application layer policy is supported only on Kubernetes 1.29 and later.

> **INFO:** When you enable application layer policy for a deployment, all of that deployment's pods will restart Active connections may be disrupted.

### Enable application layer policy (ALP)

Create an (or edit an existing ApplicationLayer) resource with the `sidecarInjection` field to `Enabled`:

```bash
kubectl apply -f - <<EOF
apiVersion: operator.tigera.io/v1
kind: ApplicationLayer
metadata:
  name: tigera-secure
spec:
  sidecarInjection: Enabled
EOF
```

Wait for the Tigera APIServer deployment and Log collection daemonset to progress to ready.

```bash
kubectl rollout status -n calico-system deployment/calico-apiserver --timeout=120s
kubectl rollout status -n calico-system ds/l7-log-collector --timeout=120s
```

Patch your deployments by running the following command:

```bash
kubectl patch deployment <deployment-name> -n <deployment-namespace> -p '{"spec":{"template":{"metadata":{"labels":{"applicationlayer.projectcalico.org/sidecar":"true"},"annotations":{"applicationlayer.projectcalico.org/policy":"Enabled"}}}}}'
```

### Enforce application layer policies for ingress traffic

You can restrict ingress traffic using HTTP match criteria using Global network policy. For a list of all HTTP match parameters, see [Global network policy](https://docs.tigera.io/calico-cloud/reference/resources/globalnetworkpolicy.md).

In the following example, the trading app is allowed ingress traffic only for HTTP GET requests that match the exact path /projects/calico, or that begins with the prefix, /users.

```yaml
apiVersion: projectcalico.org/v3
kind: GlobalNetworkPolicy
metadata:
  name: customer
spec:
  selector: app == 'tradingapp'
  ingress:
   - action: Allow
     http:
       methods: ["GET"]
       paths:
         - exact: "/projects/calico"
         - prefix: "/users"
  egress:
    - action: Allow
```

### Disable application layer policies

To disable the policies, do one of the following steps:

- Recreate your application pods without the sidecar label and annotations.
- Remove the `applicationLayerPolicy` field entirely.
- Remove the `sidecarInjection` field entirely, if sidecar mode was being used only for ALP.
- Delete the ApplicationLayer\` custom resource if only ALP was enabled on it.