---
id: w7/m1/t004
title: "Platform-side lockdown: deny apps+build namespaces at bex-system · bex-registry · OpenBao · monitoring"
worker: worker7
status: done
estimate: 45m
depends_on: [w7/m1/t001]
---

## Objective

Platform namespaces refuse traffic originating from tenant workloads: ingress NetworkPolicies on bex-system (operator + bex-api incl. the `:8091` internal tenant API), bex-registry (zot `:5000`), the OpenBao namespace, and the monitoring/Prometheus namespace deny the apps and build namespaces — with the one legitimate exception (build Jobs push images to zot) kept working.

## Context

- Defense-in-depth pairing with t003: even if a tenant-side policy regresses, the platform side still refuses.
- bex-api's internal API is bearer-gated (`BEX_CP_TOKEN`) and OpenBao is auth-scoped (`tenants/*`), but both are network-reachable from tenant pods today — this closes the network layer.
- Build Jobs run in `BEX_BUILD_NAMESPACE` (docs/ADR004-deployment.md) and must still push to `zot.bex-registry.svc:5000`.
- Platform manifests live in `deploy/gitops/`; `scripts/gitops-validate.sh` must keep rendering the whole tree.

## Steps

1. Add per-namespace ingress policies in `deploy/gitops/` (base + overlays as the tree is structured) denying the apps/build namespaces, defaulting the rest of each namespace's traffic unchanged.
2. Add the build-ns→zot allow (namespaceSelector + port 5000).
3. Validate with `scripts/gitops-validate.sh`; deploy to the mock cluster and smoke a build-from-git deploy (`scripts/deploy-sample.sh` with `hello-go`).

## Files

- `deploy/gitops/` (new NetworkPolicy manifests per platform namespace)
- `docs/ADR022-tenant-isolation.md` (platform-side table)

## Acceptance criteria

- [ ] From a pod in the apps namespace: bex-api `:8091`, OpenBao `:8200`, Prometheus, and zot are unreachable
- [ ] A build-from-git deploy still completes (build Job pushes to zot, node pulls the image)
- [ ] `scripts/gitops-validate.sh` PASS

## Out of scope

- Tenant-side policies (t003); node-level firewalls (out of w7 entirely — DO_NOT_DO)
