pal-e-docs

Architecture: Network Policy

arch-network-policy Doc

architecture
Project

Overview

Kubernetes NetworkPolicy resources that enforce namespace-level ingress/egress allow lists across the pal-e cluster. All policies are defined in terraform/network-policies.tf and applied via tofu.

Key Resources

  • netpol_keycloak — controls ingress to the keycloak namespace
  • netpol_postgres — controls ingress to the postgres namespace
  • netpol_harbor — controls ingress to the harbor namespace
  • netpol_minio — controls ingress to the minio namespace

Conventions

  • Every namespace that needs to reach another must be explicitly listed in the target's ingress allow list.
  • Manual kubectl patch additions are infrastructure drift — they must be codified in network-policies.tf before the next tofu apply.
  • New service onboarding must include NP updates as part of the service onboarding SOP.