Network Policies Overview

Network Policies in the MATIH platform implement a zero-trust network model where all pod-to-pod communication is denied by default and explicitly allowed only for known service dependencies. Policies are defined per service in Helm chart templates and enforce ingress, egress, and tenant isolation boundaries.

Network Policy Strategy

The MATIH platform follows a deny-all-then-allow approach:

1. Default deny: A namespace-level policy denies all ingress and egress traffic
2. Service-specific allow: Each service defines its own NetworkPolicy allowing only required communication paths
3. Namespace isolation: Cross-namespace traffic is restricted to documented service dependencies
4. Tenant isolation: Tenant namespaces cannot communicate with each other

Policy Architecture

Default Deny (namespace-level)
    |
    +--> Service-specific policies (per Helm chart)
    |        |
    |        +--> Ingress rules (who can talk to me)
    |        +--> Egress rules (who can I talk to)
    |
    +--> Namespace-level cross-namespace rules
    |
    +--> Tenant isolation policies

Namespace Communication Matrix

Standard Policy Template

Each MATIH Helm chart includes a NetworkPolicy template that follows this pattern:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: service-name
spec:
  podSelector:
    matchLabels:
      app: service-name
  policyTypes:
    - Ingress
    - Egress
  ingress:
    # Allow from ingress controller
    # Allow from same namespace
    # Allow Prometheus scraping
  egress:
    # Allow DNS
    # Allow specific dependencies

Policy Enforcement

Monitoring

NetworkPolicy effectiveness can be monitored through:

Detailed Sections