Hardening a Kubernetes Homelab: VLAN Segmentation, NetworkPolicies, and Defense-in-Depth Security

Overview

This series documents hardening my Kubernetes homelab after completing the V2 setup. If your cluster works but lacks network isolation, container hardening, or proper access controls, this guide shows how to add production-grade security without rebuilding from scratch.

Before You Begin

Prerequisites

Before starting, you should have:

• V2 Series completed: Working Talos cluster with Flux GitOps
• UniFi networking gear: UDM Pro or similar with VLAN support
• Basic security concepts: Understanding of network isolation, firewall rules, least privilege

What We're Building

A hardened homelab with defense-in-depth security:

• VLAN Segmentation: Isolate infrastructure, lab, IoT, and user devices at layer 2
• NetworkPolicies: Block lateral movement from compromised pods to home network
• Container Hardening: Non-root containers, dropped capabilities, resource limits
• Tailscale ACLs: Tag-based access control for remote access

What V3 Adds

Why This Approach

The Core Problem: V2 works, but a compromised game server pod can reach everything - the UDM, NAS, personal devices. No container escape required, just network access.

Defense-in-Depth: V3 adds multiple independent security layers. Even if one fails, others limit the blast radius:

1. VLANs isolate at layer 2 (network boundary)
2. NetworkPolicies isolate at layer 3 (pod boundary)
3. Container hardening limits escape vectors
4. Tailscale ACLs limit remote access scope

Incremental Migration: Each phase is independently testable. VLAN creation doesn't break existing services. NetworkPolicies can be deployed per-namespace. You can pause between phases without leaving the cluster in a broken state.

What's Not In Scope

This series focuses on hardening existing infrastructure. These are deferred to V4:

• Longhorn backups: UNAS Pro lacks NFSv4 support required by Longhorn (see backup storage plan)
• NAS storage setup: UNAS Pro configuration and bulk media storage
• Public exposure: Self-hosted tunnels (frp) for web services
• New applications: Matrix, Nextcloud, or other self-hosted services
• Vulnerability scanning: Nessus/OpenVAS for active scanning
• Maintenance processes: Security audits, CVE review, firewall review, firmware updates

Target Architecture

flowchart TD
    subgraph Internet
        A[Attacker]
    end

    subgraph Lab["Lab VLAN 192.168.10.0/24"]
        G[Game Server Pod]
        P[Plex Pod]
    end

    subgraph Network["Network VLAN 192.168.1.0/24"]
        UDM[UDM Pro]
    end

    subgraph Drive["Drive VLAN 192.168.5.0/24"]
        NAS[NAS]
    end

    subgraph Users["Unrestricted-Trusted VLAN 192.168.30.0/24"]
        PERSONAL[Personal Devices]
    end

    A -->|playit.gg tunnel| G
    G x--x|"VLAN firewall"| UDM
    G x--x|"VLAN firewall"| PERSONAL
    G x--x|"VLAN firewall"| NAS
    G -.->|"NetworkPolicy"| P

    style G fill:#6bcb77,color:#fff
    style UDM fill:#6bcb77,color:#fff
    style NAS fill:#6bcb77,color:#fff
    style PERSONAL fill:#6bcb77,color:#fff

Key principle: No single compromise grants access to the Network VLAN. Infrastructure is air-gapped from all attack surfaces.

Follow the Series

Follow these articles in order to harden your homelab:

Network Prep (UDM configuration)

1. VLAN Architecture - Create VLANs, SSIDs, and switch port profiles
2. Firewall Rules - Inter-VLAN traffic control

Migration (GitOps changes)

3. Talos Migration - Update node IPs and gateway for Lab VLAN
4. Tailscale Migration - Update routes for remote access
5. MetalLB Migration - Update IP pool for Lab VLAN
6. Plex LAN Configuration - Static IP, ADVERTISE_IP, cross-VLAN direct play

Infrastructure Hardening (per-service, complete hardening)

7. Tailscale Hardening - Helm pin, ACLs, NetworkPolicy
8. MetalLB & Ingress Hardening - Helm pins, NetworkPolicies
9. Longhorn Hardening - Helm pin, encryption, NetworkPolicy

Application Hardening (per-service, complete hardening)

10. Minecraft Hardening - Encrypted storage, NetworkPolicy, Helm pin
11. Factorio Hardening - Encrypted storage, NetworkPolicy, Helm pin
12. Plex Hardening - Encrypted storage, NetworkPolicy, read-only media, Helm pin

Trusted Boot & Disk Encryption (SecureBoot + TPM encryption)

13. SecureBoot & Encryption Prep - Verify TPM, generate SecureBoot ISO, update cluster config with TPM encryption
14. Secure Node Re-image - Rolling re-image with UEFI SecureBoot and TPM-sealed LUKS2 encryption

Appendix

• Content Filtering - CyberSecure for Restricted VLANs
• Longhorn Upgrade - Upgrade Longhorn from 1.7.x to 1.9.x for volume encryption on Talos 1.9+
• Plex Performance - 4K playback, GPU transcoding, resource tuning

Talos Security Checklist

The Talos Security Checklist¹ covers nine areas for production clusters. This series addresses six of them:

Getting Help

If you get stuck:

1. Consult official docs (UniFi, Talos, Kubernetes NetworkPolicy)
2. Leave a comment on the article - I'll try to help
3. Ask in community forums (r/homelab, r/kubernetes, r/Ubiquiti)

What's Next?

Ready to begin? Start with VLAN architecture - the foundation for all other hardening.

See: VLAN Architecture

Resources