updates

README.md

@@ -56,6 +56,7 @@ sys     0m2.015s
 |------|------|
 | [helm_release.console_access](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
 | [kubernetes_namespace.operators](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/namespace) | resource |
+| [kubernetes_network_policy.operators_default](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/network_policy) | resource |
 | [kubernetes_storage_class.ebs_encrypted](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/storage_class) | resource |
 | [kubernetes_storage_class.efs_sc](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/storage_class) | resource |
 | [kubernetes_storage_class.gp3_encrypted](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/storage_class) | resource |

main.tf

@@ -25,10 +25,6 @@ resource "kubernetes_storage_class" "gp3_encrypted" {
   reclaim_policy         = "Delete"
   volume_binding_mode    = "WaitForFirstConsumer" # Changed from Immediate for better scheduling
   allow_volume_expansion = "true"
-
-  # lifecycle {
-  #    prevent_destroy = true  # Protect storage class from accidental deletion
-  # }
 }
 
 resource "kubernetes_storage_class" "ebs_encrypted" {
@@ -90,5 +86,42 @@ resource "kubernetes_storage_class" "efs_sc" {
 resource "kubernetes_namespace" "operators" {
   metadata {
     name = var.operators_ns
+    labels = {
+      "app.kubernetes.io/managed-by" = "terraform"
+      "app.kubernetes.io/part-of"    = var.cluster_name
+    }
+  }
+}
+
+resource "kubernetes_network_policy" "operators_default" {
+  metadata {
+    name      = "default-deny"
+    namespace = kubernetes_namespace.operators.metadata[0].name
+  }
+
+  spec {
+    pod_selector {}
+    policy_types = ["Ingress", "Egress"]
+
+    ingress {
+      from {
+        namespace_selector {
+          match_labels = {
+            "kubernetes.io/metadata.name" = "kube-system"
+          }
+        }
+      }
+    }
+
+    egress {
+      to {
+        ip_block {
+          cidr = "0.0.0.0/0"
+          except = [
+            "169.254.169.254/32" # Instance metadata
+          ]
+        }
+      }
+    }
   }
 }