Egress network policies for platform applications

[j-zimnowoda]

Is your feature request related to a problem? Please describe.

Most of the platform application does not need to initiate connection with endpoints outside the cluster. A simple allow egress in cluster rule could significantly improve network security, making traffic unable to leave the cluster.

The cluster LoadBalancerIP shall be whitelisted, so application still can leverage platform public urls. Moreover it should be possible to define public IP addresses per platform app.

Describe the solution you'd like A clear and concise description of what you want to happen.

Each platform application/namespace shall have corresponding network policy rule that allows egress only inside the cluster.

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-egress-in-cluster
spec:
  podSelector: {}
  policyTypes:
  - Egress
  egress:
  - to:
    - namespaceSelector: {}

Describe alternatives you've considered A clear and concise description of any alternative solutions or features you've considered.

Additional context Add any other context or screenshots about the feature request here.

[Morriz]

Can we please stick to scrum instead of using templates for the public @j-zimnowoda ?