If it only exists in someone’s console, it does not exist

infra/network.tf

terraform {
  required_version = "~> 1.10"

  # State in an account you control, with locking.
  backend "s3" {
    bucket       = "acme-tfstate"
    key          = "prod/network.tfstate"
    region       = "eu-north-1"
    use_lockfile = true
    encrypt      = true
  }
}

module "vpc" {
  source = "./modules/vpc"

  cidr               = "10.20.0.0/16"
  availability_zones = ["eu-north-1a", "eu-north-1b"]
  single_nat_gateway = false   # one per AZ; a NAT outage is not an outage

  tags = {
    environment = "prod"
    managed_by  = "opentofu"
    owner       = "platform"
  }
}

.github/workflows/release.yml

name: release
on:
  push:
    tags: ['v*']

permissions:
  contents: read
  id-token: write      # keyless signing, no long-lived secret
  packages: write

jobs:
  build:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v5
      - uses: docker/setup-buildx-action@v3

      - name: Build and push
        id: push
        uses: docker/build-push-action@v6
        with:
          push: true
          tags: ${{ env.IMAGE }}:${{ github.ref_name }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          provenance: true
          sbom: true

      - name: Sign the image
        run: cosign sign --yes ${IMAGE}@${DIGEST}
        env:
          DIGEST: ${{ steps.push.outputs.digest }}

apps/api/netpol.yaml

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: api-default-deny
spec:
  podSelector: { matchLabels: { app: api } }
  policyTypes: [Ingress, Egress]

  # Only the gateway may reach it.
  ingress:
    - from:
        - podSelector: { matchLabels: { app: gateway } }
      ports: [{ port: 8080 }]

  # Only postgres and the cluster's DNS out. Everything else is denied.
  egress:
    - to: [{ podSelector: { matchLabels: { app: postgres } } }]
      ports: [{ port: 5432 }]
    - to:
        - namespaceSelector: { matchLabels: { kubernetes.io/metadata.name: kube-system } }
          podSelector: { matchLabels: { k8s-app: kube-dns } }
      ports:
        - { port: 53, protocol: UDP }
        - { port: 53, protocol: TCP }   # large answers fall back to TCP