Network Policies

Berserk includes optional Kubernetes NetworkPolicies that restrict both ingress and egress traffic for each service. When enabled, only known communication paths are allowed -- blocking unauthorized pod-to-pod traffic and outbound connections.

Enabling

Network policies are disabled by default. Enable them in your values file:

global:
  networkPolicy:
    enabled: true

Service Communication Map

The following table shows the allowed traffic when network policies are enabled:

All services are always allowed DNS egress (port 53 UDP/TCP).

External Egress

Services that need to reach external endpoints (S3, PostgreSQL) use a configurable CIDR allowlist. By default, HTTPS (443) and PostgreSQL (5432) are open to all IPs. Tighten these for production:

global:
  networkPolicy:
    enabled: true
    externalEgress:
      # S3 VPC endpoint
      - cidr: 10.0.0.0/16
        ports:
          - port: 443
            protocol: TCP
      # RDS PostgreSQL
      - cidr: 10.1.0.0/24
        ports:
          - port: 5432
            protocol: TCP

OTLP Telemetry

When global.observability.otlpEnabled is true, all services automatically get egress to the OTLP endpoint. Two cases are handled:

Default endpoint (ingest:4317): Egress to the ingest pod is added automatically via pod selector. The ingest service also gets an ingress rule allowing all namespace pods to send telemetry on port 4317.

External collector: If global.observability.otlpEndpoint points outside the namespace, configure global.networkPolicy.otlpEgress with the appropriate CIDR rules:

global:
  observability:
    otlpEnabled: true
    otlpEndpoint: "otel-collector.monitoring:4317"
  networkPolicy:
    enabled: true
    otlpEgress:
      - cidr: 10.2.0.0/16
        ports:
          - port: 4317
            protocol: TCP

Custom Rules

Add custom ingress or egress rules for all services via the global values, or per-service via the sub-chart values.

Global (applied to all services):

global:
  networkPolicy:
    additionalIngress:
      - from:
          - namespaceSelector:
              matchLabels:
                name: monitoring
        ports:
          - port: 9090
            protocol: TCP

Per-service (e.g., allow a specific namespace to reach query):

query:
  networkPolicy:
    additionalIngress:
      - from:
          - namespaceSelector:
              matchLabels:
                name: data-team
        ports:
          - port: 9510
            protocol: TCP

Per-Service Configuration

Each service supports these networkPolicy values: