Add NetworkPolicies to restrict inter-pod communication #33

New issue

Open

opened 2026-07-25 19:37:17 +00:00 by lab · 0 comments

lab commented

2026-07-25 19:37:17 +00:00

Owner

No NetworkPolicy resources exist. Any pod can talk to any other pod across all namespaces.

Policies to create

Allow Caddy → all services (ingress controller needs to reach everything)
Allow CrowdSec LAPI → only from Caddy (bouncer traffic)
Allow databases → only from their consumers (MySQL, PostgreSQL)
Deny all ingress by default in each namespace, then allow specific sources

Steps

Create a default deny-all policy per namespace
Add allow policies for each service pair
Test that Caddy can still reach all backends
Apply via GitOps

No NetworkPolicy resources exist. Any pod can talk to any other pod across all namespaces. ## Policies to create 1. **Allow Caddy → all services** (ingress controller needs to reach everything) 2. **Allow CrowdSec LAPI → only from Caddy** (bouncer traffic) 3. **Allow databases → only from their consumers** (MySQL, PostgreSQL) 4. **Deny all ingress by default** in each namespace, then allow specific sources ## Steps 1. Create a default deny-all policy per namespace 2. Add allow policies for each service pair 3. Test that Caddy can still reach all backends 4. Apply via GitOps