Network Policy Default Deny

Most clusters allow all pod-to-pod. Migrate to default-deny.

Idea

Default-deny network policy. Each app explicitly allows traffic.

Lateral movement bounded.

Migrate

Audit current traffic. Add policies. Switch default.

Months-long; pace it.

Benefit

Compromise blast radius bounded.

Compliance stories cleaner.