Hardening MetalLB and Ingress-NGINX: Pinned Versions and NetworkPolicies

Overview

This article hardens MetalLB and ingress-nginx by pinning Helm chart versions and adding NetworkPolicies. Both are infrastructure components that need privileged access, but we can still limit their network blast radius.


Tip:	Having trouble? See v1.6.0 for what your setup should look like after completing this article.

Before You Begin

Prerequisites

Tailscale Hardening completed

What We're Hardening

Component	Before	After
MetalLB Helm	`0.15.x` (floating)	Pinned version
ingress-nginx Helm	`4.x` (floating)	Pinned version
NetworkPolicy	None	Egress limited per component

Why These Controls

Helm Pinning: Floating versions can introduce breaking changes or vulnerabilities without notice. Pinning ensures reproducible deployments.

NetworkPolicy: MetalLB speakers need to announce IPs via ARP on the local network. Ingress-nginx needs to reach backend services. Both are privileged but can still be network-constrained to limit lateral movement if compromised.

Harden MetalLB

MetalLB speakers need to send ARP announcements on the local network and communicate with the controller.

Check: MetalLB Chart Version

helm list -n metallb-system

Note the chart version (e.g., 0.15.3) - this is what you'll pin.

HelmRelease: Pin MetalLB Chart

k8s/core/metallb/helmrelease.yaml:

# ... existing header ...
spec:
    interval: 1h
    chart:
        spec:
            chart: metallb
            version: "0.15.3" # CHANGE from "0.15.x"
            sourceRef:
                kind: HelmRepository
                name: metallb
                namespace: flux-system
    # ... existing install, upgrade, values ...

Replace 0.15.3 with your current version from the helm list output.

NetworkPolicy: Restrict Speaker Egress

k8s/core/metallb/networkpolicy.yaml:

---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
    name: metallb
    namespace: metallb-system
spec:
    podSelector: {}
    policyTypes:
        - Egress
    egress:
        # DNS resolution
        - to:
              - namespaceSelector:
                    matchLabels:
                        kubernetes.io/metadata.name: kube-system
          ports:
              - protocol: UDP
                port: 53
        # Kubernetes API (controller needs this)
        - to:
              - ipBlock:
                    cidr: 192.168.10.30/32
              - ipBlock:
                    cidr: 192.168.10.31/32
              - ipBlock:
                    cidr: 192.168.10.32/32
          ports:
              - protocol: TCP
                port: 6443
        # Lab VLAN (L2 ARP announcements)
        - to:
              - ipBlock:
                    cidr: 192.168.10.0/24

Kustomization: Add MetalLB Policy

k8s/core/metallb/kustomization.yaml:

# ... existing header ...
resources:
    - namespace.yaml
    - helmrepository.yaml
    - helmrelease.yaml
    - config.flux.yaml
    - networkpolicy.yaml # ADD

Harden Ingress-NGINX

Ingress-nginx needs to reach backend services in app namespaces and the Kubernetes API for ingress discovery.

Check: Ingress Chart Version

helm list -n ingress-nginx

Note the chart version (e.g., 4.14.3) - this is what you'll pin.

HelmRelease: Pin Ingress Chart

k8s/core/ingress-nginx/helmrelease.yaml:

# ... existing header ...
spec:
    interval: 1h
    chart:
        spec:
            chart: ingress-nginx
            version: "4.14.3" # CHANGE from "4.x"
            sourceRef:
                kind: HelmRepository
                name: ingress-nginx
                namespace: flux-system
    # ... existing install, upgrade, values ...

Replace 4.14.3 with your current version from the helm list output.

NetworkPolicy: Allow Backend Access

k8s/core/ingress-nginx/networkpolicy.yaml:

---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
    name: ingress-nginx
    namespace: ingress-nginx
spec:
    podSelector: {}
    policyTypes:
        - Egress
    egress:
        # DNS resolution
        - to:
              - namespaceSelector:
                    matchLabels:
                        kubernetes.io/metadata.name: kube-system
          ports:
              - protocol: UDP
                port: 53
        # Kubernetes API (ingress discovery)
        - to:
              - ipBlock:
                    cidr: 192.168.10.30/32
              - ipBlock:
                    cidr: 192.168.10.31/32
              - ipBlock:
                    cidr: 192.168.10.32/32
          ports:
              - protocol: TCP
                port: 6443
        # Backend services (pod network)
        - to:
              - ipBlock:
                    cidr: 10.244.0.0/16

Kustomization: Add Ingress Policy

k8s/core/ingress-nginx/kustomization.yaml:

# ... existing header ...
resources:
    - namespace.yaml
    - helmrepository.yaml
    - helmrelease.yaml
    - networkpolicy.yaml # ADD

Deploy Changes

Git: Commit MetalLB and Ingress

git add k8s/core/metallb/ k8s/core/ingress-nginx/
git commit -m "feat(infra): harden MetalLB and ingress-nginx with pinned versions and NetworkPolicies"
git push

Flux: Sync MetalLB and Ingress

flux reconcile source git flux-system
flux reconcile kustomization sync

Verify: Pinned Helm Versions

kubectl get helmrelease -n metallb-system metallb -o jsonpath='{.spec.chart.spec.version}'
kubectl get helmrelease -n ingress-nginx ingress-nginx -o jsonpath='{.spec.chart.spec.version}'

Expected: Your pinned versions. HelmChart reconciliation can take a minute - if you still see floating versions, wait and check again.

Verify: NetworkPolicies Applied

kubectl get networkpolicy -n metallb-system
kubectl get networkpolicy -n ingress-nginx

Expected: metallb and ingress-nginx policies listed.

Verify: Services Still Work

kubectl get svc -A | grep LoadBalancer

Expected: Services still have external IPs assigned.

Next Steps

With MetalLB and ingress-nginx hardened, continue with Longhorn hardening.

See: Longhorn Hardening