tenant-network-isolation

When to trigger

• Deploying multiple mutually-untrusted applications from ONE shared workload chart onto ONE shared cluster (the "template a chart per app, one namespace each" pattern).
• Adding a new tenant to a shared multi-tenant chart, or reviewing tenant isolation.
• Debugging cross-tenant reachability, or turning cluster NetworkPolicy enforcement on.

The fragment — a per-namespace default-deny pair (bake it in the chart, every tenant inherits)

A Kubernetes cluster is a flat L3 network absent an ENFORCED NetworkPolicy. Isolation on a shared chart is a CHART concern (baked once) plus a VERIFICATION concern (proven, not assumed). The chart fragment renders a default-deny NetworkPolicy PAIR (ingress + egress, podSelector: {}) per tenant namespace, parameterized by podCidr, serviceCidr, dnsNamespace/dnsServiceIP, dataTier: [{cidr, ports}], servingPort/ingressSource:

• Egress-side denial is THE control — ingress-only does not stop initiation. An ingress-only default-deny still lets tenant A INITIATE connections to B. The enforcing rule is the egress default-deny whose allow-list is: DNS, same-namespace, the declared data tier, and the internet EXCEPT the cluster CIDRs.
• Put BOTH podCidr AND serviceCidr in the egress ipBlock.except. Denying only the pod CIDR is insufficient: a pod can still reach a peer tenant via the peer's Service ClusterIP, because whether the CNI evaluates the rule pre- or post-DNAT is version-dependent — the ClusterIP DNAT bypass is closed only when the Service CIDR is excepted too.
• Allow DNS REDUNDANTLY — a namespace selector for the DNS namespace AND an explicit ipBlock to the DNS Service IP on port 53 — so resolution works under EITHER DNAT behavior.
• Declare the data tier explicitly — dataTier: [{cidr, ports}] egress allowances for the app's DB/cache endpoints (a managed store inside the workload CIDR still needs this allow).
• Same-namespace traffic is always permitted (intra-app ingress + egress).
• The chart's load-balancer default is INTERNAL. An internet-facing L7 load balancer is a public-IP path that routes AROUND the pod-CIDR egress deny — expose publicly only as an explicit, reviewed exception.
• Safe defaults: a tenant that declares nothing still gets a correct isolating policy — the fragment's defaults deny cross-tenant both ways and allow only DNS + same-namespace + internet- minus-cluster-CIDRs.