TLS & network policy

A step of the Cloud application tree on Gradus, in the Security area: Secrets, auth, TLS, input.

Enforce TLS everywhere, let the origin answer only to the edge in front of it and restrict network access between services to only what each one needs.

Usually comes after: Secrets management.

Leads to: Security headers, Rate limiting & WAF.

Prompt for your AI assistant

Ensure all external traffic is served over TLS 1.2 or later and that the edge verifies the origin's certificate rather than accepting any. Add an HSTS header, and before turning on includeSubDomains or preload write down in docs/ what each would mean for every other subdomain of this domain. Make the origin accept traffic only from the edge or load balancer in front of it, through the platform's ingress setting or a secret header the edge adds, and check that calling the origin directly fails. Define network policy rules that restrict traffic between services to the paths they need.

This is https://gradus.kazet.blog/tree/cloud-application/step/tls-and-network-policy as plain HTML. In a browser the page also lets you mark the step forged and copy a message for your AI assistant.