docs: Kubernetes hardening #7846
Open
ppawlowski wants to merge 6 commits into
Open
Conversation
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #7846 +/- ##
==========================================
+ Coverage 75.10% 75.21% +0.11%
==========================================
Files 430 432 +2
Lines 22844 22973 +129
Branches 6054 6090 +36
==========================================
+ Hits 17157 17280 +123
- Misses 5687 5693 +6
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
added 2 commits
July 20, 2026 20:08
ppawlowski
marked this pull request as ready for review
July 20, 2026 18:13
allthedoll
requested changes
Jul 24, 2026
allthedoll
left a comment
allthedoll
left a comment
Contributor
There was a problem hiding this comment.
I made some suggestions based on my limited knowledge. LMK if you agree to add them, and then we might also consider updating the yml with the UDP/TCP port information.
| Network Policies let you enforce the principle of least privilege at the network layer: a pod should only be able to talk to the workloads it genuinely needs. Restricting traffic contains lateral movement, so a breach in one component cannot trivially spread to others. | ||
|
|
||
| {% warning %} | ||
| **Do not treat the policies below as a copy-and-paste solution.** They are illustrative examples, tied to the assumptions of the environment they were written for - namespace names, the ingress controller, the CNI, service ports, which components are deployed, and where operators live. Applied blindly they will either break platform traffic or leave gaps you believe are closed. Network Policies are one of the easiest things in Kubernetes to get subtly wrong: a rule that *looks* correct can silently drop traffic (wrong port direction, Service vs pod port, a missing return path) or silently allow it (an unenforced CNI, an overly broad selector). Implement them deliberately, with a working understanding of how traffic actually flows in your cluster - pod-to-pod, cross-namespace, ingress, egress, and DNS. Roll out one policy at a time, start in a non-production environment, verify each addition against real traffic (and check the affected pods' logs and Service endpoints), and confirm your CNI actually enforces policies before relying on them for security. |
Contributor
There was a problem hiding this comment.
✨ do not treat the policies as a copy-and-paste solution ✨
Contributor
Author
There was a problem hiding this comment.
Just to cover ourselves
Co-authored-by: Jamie Strusz <5758031+allthedoll@users.noreply.github.com>
Co-authored-by: Jamie Strusz <5758031+allthedoll@users.noreply.github.com>
allthedoll
approved these changes
Jul 24, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This pull request introduces the
Hardeningpage in the FlowFuse documentation with theKubernetesplatform hardening guides.Related Issue(s)
Closes https://github.com/FlowFuse/engineering/issues/113
Checklist
flowforge.yml?FlowFuse/helmto update ConfigMap TemplateFlowFuse/CloudProjectto update values for Staging/ProductionLabels
area:migrationlabel