Network isolation

Every ChallengeInstance is fenced off from the rest of the cluster. When the instance controller creates the workload it also creates a NetworkFence — you never have to apply one yourself — and the NetworkFence controller translates it into a Kubernetes NetworkPolicy selecting that instance's pods.

Default posture

For an instance whose template exposes port 8080:

• Ingress: only the exposed ports are reachable. Everything else is denied.
• Egress: denied entirely (allowEgress: false), including traffic toward the kimo-system namespace — a compromised challenge container can't call out or attack the operator.

flowchart LR
    P[Players] -->|":8080 only"| C[Challenge pod]
    C -.->|"blocked"| X[Other pods / internet / kimo-system]

Customizing the fence

The auto-created fence covers the common case. For extra rules — say CIDR-scoped ingress or opening egress for a challenge that needs to fetch something — you can apply an additional NetworkFence targeting the same instance:

apiVersion: kimo.kimo.io/v1alpha1
kind: NetworkFence
metadata:
  name: demo-web-team-alpha-extra
spec:
  instanceRef: demo-web-team-alpha   # matched via the kimo.io/instance pod label
  allowRules:
    - cidr: 10.0.0.0/8
      port: 8080
  denyRules:
    - to: kimo-system
  allowEgress: false

Field	Meaning
instanceRef	Name of the ChallengeInstance whose pods this fence selects.
allowRules[].port	Ingress port to open (TCP).
allowRules[].cidr	Restricts who may connect to the allowed ports.
denyRules[].to	Documents an egress-deny target; with allowEgress: false all egress is already blocked.
allowEgress	true adds an allow-all egress rule. Default false.

CNI requirement

NetworkPolicies are enforced by the cluster's CNI. On CNIs without NetworkPolicy support (e.g. kind's default kindnet), the policies are created but not enforced — use Calico or Cilium in production.