Networking

Connect services through private networks and publish only intentional entry points.

Private by default#

Every environment has an isolated private network. Services discover peers through environment-scoped names such as catalog.services.internal. Public access is configured through an API gateway route, not by publishing every instance port.

Boundary	Behavior
Within an environment	Controlled by service network policies
Between environments	Denied unless a peering policy allows it
Public ingress	Explicit gateway routes only
Outbound access	Controlled by environment egress policy

Allow a specific dependency#

apiVersion: universe/v1
kind: NetworkPolicy
metadata:
  name: checkout-to-catalog
spec:
  source:
    service: checkout
  destination:
    service: catalog
    port: 8080
  action: allow

Trace connectivity#

Use du network trace checkout catalog:8080 to inspect name resolution, applicable policies, and endpoint readiness. The trace reports the policy decision without changing any rule.