> ## Documentation Index
> Fetch the complete documentation index at: https://docs.qodo.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Network and security considerations

## Network requirements

**Outbound connectivity required:**

* `artifacts-self-hosted.qodo.ai` - Helm chart and image registry
* `artif-reg-self-hosted.codium.ai` - Container images
* AI model provider endpoints (api.openai.com, api.anthropic.com, etc.)
* Git provider APIs (github.com, gitlab.com, or your self-hosted instances)

**Inbound connectivity required:**

* Git provider webhooks must reach your ingress endpoints
* Developer IDEs must reach Qodo API endpoints
* (For Context Engine) Context retriever MCP endpoint

**Firewall considerations:**

* Allow outbound HTTPS (443) to all external dependencies
* Allow inbound HTTPS (443) for webhooks and API access
* Ensure K8s cluster can reach external PostgreSQL if not in-cluster

## Security best practices

**Secrets management:**

* Use Kubernetes secrets for all sensitive data
* Never commit `.secrets.toml` files to version control
* Consider External Secrets Operator for centralized secret management
* Rotate API keys and credentials regularly

**Network policies:**

* Restrict pod-to-pod communication
* Limit egress to only required endpoints
* Implement namespace isolation

**Access control:**

* Use RBAC for Kubernetes access
* Implement principle of least privilege
* Use service accounts with minimal permissions

**TLS/SSL:**

* Always use TLS for external endpoints
* Use cert-manager for certificate management
* Configure proper certificate validation

**Image security:**

* Images come from trusted Replicated registry
* Regular updates through Helm for security patches
* Scan images for vulnerabilities if required by policy