feat: add default-deny network policies and security hardening#1497

Draft

devantler wants to merge 14 commits intomainfrom

devantler/fix-prod-e2e-testing

Commits on May 5, 2026

feat: add default-deny network policies and security hardening

devantler
and
Copilot
committed
ci: enable kubescape scan in system test

devantler
and
Copilot
committed
feat: scale prod workers from cx23 to cx33

devantler
and
Copilot
committed
feat: enable full VPA CPU+memory management and lower resource defaults

devantler
and
Copilot
committed
fix: correct CiliumNetworkPolicy webhook ports, add DNS egress, fix auth-proxy runAsUser

devantler
and
Copilot
committed
fix: grant Kyverno RBAC for CiliumNetworkPolicy generation

devantler
and
Copilot
committed
fix: suspend FleetDM HelmRelease (MySQL PVC format failure)

devantler
and
Copilot
committed
fix: add intra-namespace ingress to KEDA network policy

devantler
and
Copilot
committed
fix: add CNPG operator egress to managed DB pods and fix namespace label

devantler
and
Copilot
committed