Perimeter security
Keep Graph Studio private by default. When users outside a trusted internal network need access, publish Graph Studio through an organization-approved ingress or API gateway and place a Web Application Firewall (WAF) in front of that entry point.
Recommended boundary
The public-facing path should be:
User → WAF → Ingress controller or API gateway → Graph Studio Service (ClusterIP) → Graph Studio Pods
The WAF is part of the customer-managed network boundary. Graph Studio does not install, configure, or operate a WAF.
- Keep the Graph Studio Kubernetes Service internal (
ClusterIP) unless a release-specific design requires another service type. - Do not publish a Pod, NodePort, or load balancer directly when an approved ingress or gateway path is available.
- Route externally reachable DNS names only to the WAF or its protected ingress/gateway endpoint.
- Permit traffic from the ingress/gateway to Graph Studio only as required by the approved deployment design.
WAF recommendation
Deploy an organization-approved WAF in front of every Graph Studio endpoint that is reachable outside a trusted internal network boundary. Configure it according to the organization's security policy, including:
- HTTPS enforcement and the approved TLS inspection or termination model.
- Restricted host names, request methods, and source networks.
- Request filtering and rate limiting appropriate to the organization's WAF standard.
- Security-event logging and the ownership of alerts, blocked-request review, and rule changes.
Treat the WAF as a complementary control. It does not replace Graph Studio authentication, Kubernetes authorization, TLS certificate management, or network segmentation.
Exposure decisions
Record these decisions before exposing Graph Studio:
| Decision | Required outcome |
|---|---|
| External endpoint | The approved Graph Studio DNS name and owning team are known. |
| Entry path | All external requests traverse the approved WAF and ingress/gateway. |
| TLS | Certificates, trusted CA chain, termination point, and renewal owner are defined. |
| Source access | Allowed networks and any VPN or private-access requirement are approved. |
| WAF policy | The applicable policy, logging destination, alert owner, and change process are defined. |
Use the prerequisites and production planning pages for the existing Kubernetes ingress, TLS, and allowed-CIDR inputs.
Scope boundary
This page does not provide vendor-specific WAF rules, Kubernetes NetworkPolicy manifests, ingress-controller configuration, or component port lists. Those details depend on the customer network architecture and require release-validated deployment evidence.