Objective
Harden inter-pod traffic with Kubernetes NetworkPolicies.

Scope

• Namespace cloudtolocalllm default deny ingress policy
• Allow web -> api (HTTP), web -> streaming (HTTP/WS)
• Allow api -> postgresql only (TCP 5432) and deny other egress
• Optional: limit ingress to api/streaming from Ingress NEGs only

Acceptance Criteria

• Policies applied; connectivity matrix matches design
• API can reach Postgres; web cannot reach Postgres directly
• No unintended service breakage; document policies

Dependencies

• Phase 1: Complete GKE Cloud Deployment (Epic) #96, Validate API ↔ PostgreSQL connectivity and migrations #99

Effort: S (0.5–1 day)
Priority: P2