Installation Manual - 79 Hub NetworkPolicy remediation preflight

Preflight proposal for the first hub-dc-v7 NetworkPolicy remediation set.

This chapter records the hub-dc-v7 NetworkPolicy remediation preflight.

The gate did not apply NetworkPolicies. It converted the namespace classification from the previous gate into a first apply proposal.

Governance

Access Path

All live checks used the established path:

local workspace -> dl385-2 -> gf-ocp-bootstrap-01 -> hub-dc-v7 kubeconfig

No Secret values, kubeconfigs, tokens, pull secrets, PAT values, MinIO keys, or full Secret manifests were printed.

Live Health

Read-only validation at 2026-05-19T11:31:00Z:

All-object ComplianceCheckResult counts:

First Apply Candidates

The first candidate namespaces had no application controller workloads, no pods, no routes, no existing NetworkPolicies, and no service endpoints.

The default namespace has the Kubernetes API service and endpoints, but NetworkPolicy selects pods, and there are no pods in default.

Deferred Operator Namespaces

These namespaces have running controllers or metrics-service considerations and should not be included in the first apply set:

Design explicit policies for these later with monitoring ingress allows.

Proposed GitOps Path

Recommended path for the apply gate:

clusters/hub-dc-v7/platform/networkpolicy/

Recommended parent reference:

resources:
  - platform/networkpolicy

Proposed Policy Shape

Use the existing hub platform-bootstrap pattern: ingress-only default deny.

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-ingress
  namespace: <candidate-namespace>
  labels:
    app.kubernetes.io/name: hub-networkpolicy-baseline
    app.kubernetes.io/part-of: hub-dc-v7-platform
spec:
  podSelector: {}
  policyTypes:
    - Ingress

Do not add egress default-deny in the first apply set. The goal is a low-blast-radius namespace baseline, not a full traffic lockdown.

Apply-Gate Plan

The next gate should:

1. Revalidate hub health.
2. Reconfirm the five candidate namespaces still have no pods and no services except default/kubernetes.
3. Add the GitOps manifests under clusters/hub-dc-v7/platform/networkpolicy/.
4. Render kubectl kustomize clusters/hub-dc-v7.
5. Push platform GitOps and refresh hub-dc-v7-bootstrap.
6. Wait for Argo CD Synced/Healthy.
7. Confirm the five policies exist.
8. Confirm hub health remains steady.
9. Trigger a controlled ocp4-cis rescan only after health is steady.

Next Gate

Recommended next gate:

OP-GF-COMPLIANCE-9: apply hub low-risk NetworkPolicy set