the default that has to be deny

Per-port rules look like security and behave like a promise to remember every port. Workloads get new ports when they are rescheduled, and the rule list does not grow with them, so the estate accumulates silent holes that nobody wrote down.

The fix is a default-deny on the ingress path with a short allowlist of internal sources: a service that moves is still covered, a service that appears is not accidentally public, and the only deliberate exception is the one protocol that must face the world. One audit found that everything had been closed port by port, and that the interesting failure was not a missing rule but the shape of the approach.

The same shape appeared twice more. An access control list was flipped from allow to deny in a rolling pass, with two narrow credentials minted before the flip so the change could not lock itself out. A public dashboard surface turned out to be readable anonymously, so the anonymous path was closed and the two intended public views scoped by token — rehearsed on a throwaway instance before the live one was touched.

The cost is that somebody has to write down what should be reachable. That list is now the security posture rather than a side effect of what happened to be running.

What this proves is that exposure became a decision with an owner instead of an accumulation with a story attached.