Network

Egress

Destination	Port	When	Avoidable
PostgreSQL	5432	Always	No
Object storage	443	Report artifacts	No
Your OIDC issuer	443	At sign-in	Yes, use IAP
Container registry	443	Image pull only	Yes, mirror the image
api.openai.com	443	Narrative rendering and chat	Yes, unset OPENAI_API_KEY
Google Speech-to-Text	443	Audio uploads	Yes, off by default
kube-dns	53	Always	No

There is no connection to the vendor at runtime. License validation is a local signature check unless you set LICENSE_VALIDATION_URL.

Ingress

Source	Destination	Port
Ingress controller or load balancer	App pods	8080

The Service listens on 80 and targets 8080.

A default-deny policy

Working, assuming PostgreSQL sits in 10.20.16.0/24. Add an OpenAI egress rule only if you set the API key.

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: presponsieve
  namespace: presponsieve
spec:
  podSelector: {}
  policyTypes: [Ingress, Egress]

  ingress:
    - from:
        - namespaceSelector:
            matchLabels: {kubernetes.io/metadata.name: ingress-nginx}
      ports:
        - {protocol: TCP, port: 8080}

  egress:
    - to:
        - namespaceSelector:
            matchLabels: {kubernetes.io/metadata.name: kube-system}
      ports:
        - {protocol: UDP, port: 53}
    - to:
        - ipBlock: {cidr: 10.20.16.0/24}
      ports:
        - {protocol: TCP, port: 5432}
    # Object storage, and your OIDC issuer if used. Narrow this to real
    # addresses once you know them; a private endpoint is better still.
    - to:
        - ipBlock: {cidr: 0.0.0.0/0}
      ports:
        - {protocol: TCP, port: 443}

Applying this with OPENAI_API_KEY unset and watching an analysis complete is the most direct way to demonstrate the egress claim to a reviewer.

Note the failure mode if you get storage wrong: uploads hang rather than failing cleanly, which is a confusing symptom.

Internal versus internet-facing

Behavioral profiles of your employees or candidates have no business being reachable from the public internet. Where the cloud offers an internal load balancer, use it and have users arrive over VPN or a private interconnect.

"We put SSO in front of it" is a weaker answer to a reviewer than "it is not routable from outside our network."

IAP requires no direct path

With header-trust authentication, any network path that reaches a pod directly is a path that can forge identity. See IAP. This is a network control, not an application setting.

Request size and timeouts

Transcripts and audio go past the nginx 1MB body default, and an analysis can hold a connection for minutes.

nginx.ingress.kubernetes.io/proxy-body-size: "100m"
nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
nginx.ingress.kubernetes.io/proxy-send-timeout: "600"

On GKE, a BackendConfig with timeoutSec: 600. The GCLB default of 30 seconds is shorter than a long analysis, and past it the load balancer returns an HTML 502 the app never sees.

On an ALB, idle_timeout.timeout_seconds=600.