---
title: "Enable and enforce application layer policies"
description: "Configure access controls based on Layer-7 attributes by enforcing Calico Enterprise application-layer policy in the cluster."
product: "Calico Enterprise"
version: "3.23 (latest)"
section: "Network policy"
canonical_url: "https://docs.tigera.io/calico-enterprise/latest/network-policy/application-layer-policies/alp"
---

# Enable and enforce application layer policies

> **WARNING:** Application layer policy based on Envoy is deprecated and will be removed in an upcoming release. For similar functionality, try [Istio Ambient Mode](https://docs.tigera.io/calico-enterprise/latest/compliance/istio/about-istio-ambient.md) with [Istio authorization policies](https://istio.io/latest/docs/ambient/getting-started/enforce-auth-policies/).

Application layer policies let you configure access controls based on L7 attributes.

## Before you begin

### Limitations

- Application layer policy is not compatible with a service mesh such as Istio.
- Application layer policy can restrict only *ingress* traffic. It can not restrict egress traffic.
- Support for L7 attributes is limited to HTTP method and URL exact/prefix path.
- Supported protocols are limited to TCP-based protocols (for example, HTTP, HTTPS, or gRPC).
- Application layer policies apply to the entire cluster. They can not be namespaced.
- Logs for application layer polices are not included with other L7 logs in Service Graph. To view logs for application layer policies, you must [view them in Kibana](https://docs.tigera.io/calico-enterprise/latest/observability/elastic/l7/configure.md#kibana).
- Application layer policy is supported only on Kubernetes 1.29 and later.

> **INFO:** When you enable application layer policy for a deployment, all of that deployment's pods will restart Active connections may be disrupted.

### Enable application layer policy (ALP)

Create an (or edit an existing ApplicationLayer) resource with the `sidecarInjection` field to `Enabled`:

```bash
kubectl apply -f - <<EOF
apiVersion: operator.tigera.io/v1
kind: ApplicationLayer
metadata:
  name: tigera-secure
spec:
  sidecarInjection: Enabled
EOF
```

Wait for the Tigera APIServer deployment and Log collection daemonset to progress to ready.

```bash
kubectl rollout status -n calico-system deployment/calico-apiserver --timeout=120s
kubectl rollout status -n calico-system ds/l7-log-collector --timeout=120s
```

Patch your deployments by running the following command:

```bash
kubectl patch deployment <deployment-name> -n <deployment-namespace> -p '{"spec":{"template":{"metadata":{"labels":{"applicationlayer.projectcalico.org/sidecar":"true"},"annotations":{"applicationlayer.projectcalico.org/policy":"Enabled"}}}}}'
```

### Enforce application layer policies for ingress traffic

You can restrict ingress traffic using HTTP match criteria using Global network policy. For a list of all HTTP match parameters, see [Global network policy](https://docs.tigera.io/calico-enterprise/latest/reference/resources/globalnetworkpolicy.md).

In the following example, the trading app is allowed ingress traffic only for HTTP GET requests that match the exact path `/projects/calico`, or that begin with the prefix `/users`. Additionally, the HTTP request must contain the `Content-Type` HTTP header with a value of either `text/plain` or `application/json`, as well as the `User-Agent` HTTP header with a value that has the prefix `curl`. Any HTTP request from the trading app that does not fulfill the outlined criteria is rejected.

```yaml
apiVersion: projectcalico.org/v3
kind: GlobalNetworkPolicy
metadata:
  name: customer
spec:
  selector: app == 'tradingapp'
  ingress:
   - action: Allow
     http:
       methods: ["GET"]
       paths:
         - exact: "/projects/calico"
         - prefix: "/users"
       headers:
         - header: "content-type"
           operator: "In"
           values: ["text/plain", "application/json"]
         - header: "user-agent"
           operator: "HasPrefix"
           values: ["curl"]
  egress:
    - action: Allow
```

### Disable application layer policies

To disable the policies, do one of the following steps:

- Recreate your application pods without the sidecar label and annotations.
- Remove the `applicationLayerPolicy` field entirely.
- Remove the `sidecarInjection` field entirely, if sidecar mode was being used only for ALP.
- Delete the ApplicationLayer\` custom resource if only ALP was enabled on it.