Observe first, deny second

Everyone writes network policy from the architecture diagram, and the diagram is always wrong. The only allowlist that survives contact with production is one written from the flows you actually watched - applied out-of-band, proven enforcing, and only then handed to GitOps.

• security
• networking
• cilium
• hubble
• kubernetes
• gitops