Add application egress NetworkPolicies

README.md

@@ -283,6 +283,12 @@ readiness, pod restart storms, unavailable deployments, node/PVC storage
 pressure, Traefik 5xx spikes, website availability, and Gitea/Pi-hole scrape
 coverage. Keep this set small so alerts remain actionable.
 
+Application egress is controlled with Kubernetes NetworkPolicies where the lab
+owns the workload. The website namespace defaults to denied egress and allows
+only DNS, Redis, and the Debian Ollama endpoint. The security lab namespace is
+isolated from the cluster and LAN while allowing DNS plus outbound HTTP/HTTPS
+for controlled practice targets.
+
 Focused doctor commands run narrower read-only checks and print the most likely
 next step:
 

README.md.tmpl

@@ -283,6 +283,12 @@ readiness, pod restart storms, unavailable deployments, node/PVC storage
 pressure, Traefik 5xx spikes, website availability, and Gitea/Pi-hole scrape
 coverage. Keep this set small so alerts remain actionable.
 
+Application egress is controlled with Kubernetes NetworkPolicies where the lab
+owns the workload. The website namespace defaults to denied egress and allows
+only DNS, Redis, and the Debian Ollama endpoint. The security lab namespace is
+isolated from the cluster and LAN while allowing DNS plus outbound HTTP/HTTPS
+for controlled practice targets.
+
 Focused doctor commands run narrower read-only checks and print the most likely
 next step:
 

apps/security-lab/network-policy.yaml

@@ -1,5 +1,48 @@
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
+metadata:
+  name: security-lab-default-deny-egress
+  namespace: security-lab
+spec:
+  podSelector: {}
+  policyTypes:
+    - Egress
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: security-lab-allow-web-egress
+  namespace: security-lab
+spec:
+  podSelector:
+    matchLabels:
+      homelab.dev/security-lab-app: "true"
+  policyTypes:
+    - Egress
+  egress:
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+      ports:
+        - protocol: UDP
+          port: 53
+        - protocol: TCP
+          port: 53
+    - to:
+        - ipBlock:
+            cidr: 0.0.0.0/0
+            except:
+              - 10.96.0.0/12
+              - 192.168.100.0/24
+      ports:
+        - protocol: TCP
+          port: 80
+        - protocol: TCP
+          port: 443
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
 metadata:
   name: security-lab-default-deny-ingress
   namespace: security-lab

apps/website/kustomization.yaml

@@ -2,4 +2,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - namespace.yaml
+  - network-policy.yaml
   - web-app.yaml

apps/website/network-policy.yaml

@@ -0,0 +1,56 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: website-default-deny-egress
+  namespace: website-production
+spec:
+  podSelector: {}
+  policyTypes:
+    - Egress
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: website-allow-required-egress
+  namespace: website-production
+spec:
+  podSelector:
+    matchLabels:
+      app: php-website
+  policyTypes:
+    - Egress
+  egress:
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+      ports:
+        - protocol: UDP
+          port: 53
+        - protocol: TCP
+          port: 53
+    - to:
+        - podSelector:
+            matchLabels:
+              app: website-redis
+      ports:
+        - protocol: TCP
+          port: 6379
+    - to:
+        - ipBlock:
+            cidr: 192.168.100.73/32
+      ports:
+        - protocol: TCP
+          port: 11434
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: website-redis-deny-egress
+  namespace: website-production
+spec:
+  podSelector:
+    matchLabels:
+      app: website-redis
+  policyTypes:
+    - Egress

docs/jeannie.1.md

@@ -57,6 +57,11 @@ Prometheus alerts
 They cover node readiness, restart storms, unavailable deployments, storage
 pressure, Traefik 5xx, and core service visibility.
 
+NetworkPolicies
+: Owned application namespaces include egress policies. The website can reach
+DNS, Redis, and the Debian Ollama endpoint; the security lab can reach DNS and
+external web targets while remaining isolated from cluster and LAN ranges.
+
 `validate`
 : Run non-mutating repository checks used by the GitOps promotion flow:
 inventory, generated docs, Bash syntax, shellcheck, YAML parsing, OpenTofu