NMC Network Policies

Calico network policies for NVIDIA Mission Control (NMC), delivered as a Helm chart.

Purpose

This chart manages Calico network policies to control network traffic within NMC Kubernetes clusters. It applies a default-deny posture and selectively permits only the traffic required by NMC services on both the admin (k8s-admin) and user (k8s-user) clusters.

Features

• Default-deny — blocks all traffic not explicitly allowed.
• Cluster-type aware — deploys policies tailored to the services running on each cluster type (admin vs. user).
• Least-privilege network access — permits only the egress and ingress traffic necessary for NMC services to operate.

Prerequisites

• Kubernetes
• Calico CNI installed
• Helm 3

Usage

Set clusterType.admin=true or clusterType.user=true depending on which cluster you are installing to. Exactly one must be set. You must also provide the BCM head node CIDR.

# k8s-admin cluster
helm install nmc-network-policies <repo>/nmc-network-policies \
  --set clusterType.admin=true \
  --set bcmHeadNodeCidr="<your-cidr>"

# k8s-user cluster
helm install nmc-network-policies <repo>/nmc-network-policies \
  --set clusterType.user=true \
  --set bcmHeadNodeCidr="<your-cidr>"

Documentation

For full installation and configuration details, see the Kubernetes Security Hardening section of the NVIDIA Mission Control Software Installation Guide.

License

NVIDIA Proprietary