Skip to content

Networking

Networking is part of the platform, configured with Kubernetes objects rather than a parallel proprietary console. Firewalling, load balancing, VPN termination, multi-cluster connectivity and VM networks are all resources in the cluster API.

Network configuration therefore lives in Git next to the application it belongs to, is applied by the same pipeline, and is portable to any conformant cluster.

The default-deny pattern

Start closed, then declare what you need. Most other pages in these docs assume this shape:

default-deny-egress.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-egress
spec:
  podSelector: {}
  policyTypes: ["Egress"]

Egress policy has no \"same namespace is free\" rule

A default-deny-egress policy with podSelector: {} blocks traffic between your own pods too — including DNS — not just traffic leaving the namespace. Add a self-referencing rule so members of the namespace can talk to each other, the same way you would with a security group.

allow-intra-namespace-egress.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-intra-namespace-egress
spec:
  podSelector: {}
  policyTypes: ["Egress"]
  egress:
    - to:
        - podSelector: {}

What this section will cover

  • NetworkPolicy patterns and micro-segmentation
  • Load balancing and external addresses
  • Ingress, Gateway API, DNS and TLS
  • Private subnets and user-defined networks for VMs
  • VPN and site-to-site connectivity
  • Multi-cluster networking

Scaffold status

This is a placeholder. Configuration reference is written here once confirmed against the platform.