diff --git a/backend/deployment.yaml b/backend/deployment.yaml
new file mode 100644
index 0000000..23874fb
--- /dev/null
+++ b/backend/deployment.yaml
@@ -0,0 +1,77 @@
+# kubernetes/backend/backend.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: backend
+  namespace: todo-app
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: backend
+  template:
+    metadata:
+      labels:
+        app: backend
+        tier: api             # ← label for NetworkPolicy
+    spec:
+      containers:
+        - name: backend
+          image: silvarno/todo-backend:latest
+          ports:
+            - containerPort: 5000
+          env:
+            - name: PORT
+              value: "5000"
+            - name: NODE_ENV
+              value: "production"
+            - name: MONGO_URI
+              valueFrom:
+                secretKeyRef:
+                  name: todo-secrets
+                  key: MONGO_URI
+            - name: JWT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: todo-secrets
+                  key: JWT_SECRET
+          # Security context
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 1000
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+          # Health checks
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: 5000
+            initialDelaySeconds: 15
+            periodSeconds: 20
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: 5000
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          # Resource limits
+          resources:
+            requests:
+              memory: "128Mi"
+              cpu: "100m"
+            limits:
+              memory: "256Mi"
+              cpu: "500m"
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: backend-service
+  namespace: todo-app
+spec:
+  selector:
+    app: backend
+  ports:
+    - port: 5000
+      targetPort: 5000
+  type: ClusterIP    # ← internal only
diff --git a/frontend/deployment.yaml b/frontend/deployment.yaml
new file mode 100644
index 0000000..4879c53
--- /dev/null
+++ b/frontend/deployment.yaml
@@ -0,0 +1,46 @@
+# kubernetes/frontend/deployment.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: frontend
+  namespace: todo-app
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: frontend
+  template:
+    metadata:
+      labels:
+        app: frontend
+        tier: web
+    spec:
+      containers:
+        - name: frontend
+          image: silvarno/todo-frontend:latest
+          ports:
+            - containerPort: 80
+          securityContext:
+            runAsNonRoot: false  # nginx needs root to bind port 80
+            allowPrivilegeEscalation: false
+          resources:
+            requests:
+              memory: "64Mi"
+              cpu: "50m"
+            limits:
+              memory: "128Mi"
+              cpu: "200m"
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: frontend-service
+  namespace: todo-app
+spec:
+  selector:
+    app: frontend
+  type: NodePort
+  ports:
+    - port: 80
+      targetPort: 80
+      nodePort: 31081
diff --git a/gateway/gateway.yaml b/gateway/gateway.yaml
new file mode 100644
index 0000000..84ea0de
--- /dev/null
+++ b/gateway/gateway.yaml
@@ -0,0 +1,22 @@
+# kubernetes/gateway/gateway.yaml
+apiVersion: gateway.networking.k8s.io/v1
+kind: GatewayClass
+metadata:
+  name: nginx
+spec:
+  controllerName: gateway.nginx.org/nginx-gateway-controller
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: todo-gateway
+  namespace: todo-app
+spec:
+  gatewayClassName: nginx
+  listeners:
+    - name: http
+      port: 80
+      protocol: HTTP
+      allowedRoutes:
+        namespaces:
+          from: Same    # only routes from todo-app namespace
diff --git a/gateway/httproute.yaml b/gateway/httproute.yaml
new file mode 100644
index 0000000..a0e91fb
--- /dev/null
+++ b/gateway/httproute.yaml
@@ -0,0 +1,27 @@
+# kubernetes/gateway/httproute.yaml
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: todo-routes
+  namespace: todo-app
+spec:
+  parentRefs:
+    - name: todo-gateway
+  rules:
+    # API traffic → backend
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /api
+      backendRefs:
+        - name: backend-service
+          port: 5000
+
+    # All other traffic → frontend
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      backendRefs:
+        - name: frontend-service
+          port: 30081
diff --git a/ingress/ingress.yaml b/ingress/ingress.yaml
new file mode 100644
index 0000000..e656c91
--- /dev/null
+++ b/ingress/ingress.yaml
@@ -0,0 +1,27 @@
+# kubernetes/ingress/ingress.yaml
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: todo-ingress
+  namespace: todo-app
+  annotations:
+    nginx.ingress.kubernetes.io/rewrite-target: /
+spec:
+  ingressClassName: nginx
+  rules:
+    - http:
+        paths:
+          - path: /api
+            pathType: Prefix
+            backend:
+              service:
+                name: backend-service
+                port:
+                  number: 5000
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: frontend-service
+                port:
+                  number: 30081
diff --git a/mongodb/data/WiredTiger b/mongodb/data/WiredTiger
new file mode 100644
index 0000000..420d79a
--- /dev/null
+++ b/mongodb/data/WiredTiger
@@ -0,0 +1,2 @@
+WiredTiger
+WiredTiger 12.0.0: (November 15, 2024)
diff --git a/mongodb/data/WiredTiger.lock b/mongodb/data/WiredTiger.lock
new file mode 100644
index 0000000..3d84206
--- /dev/null
+++ b/mongodb/data/WiredTiger.lock
@@ -0,0 +1 @@
+WiredTiger lock file
diff --git a/mongodb/data/WiredTiger.turtle b/mongodb/data/WiredTiger.turtle
new file mode 100644
index 0000000..4be3b27
--- /dev/null
+++ b/mongodb/data/WiredTiger.turtle
@@ -0,0 +1,6 @@
+WiredTiger version string
+WiredTiger 12.0.0: (November 15, 2024)
+WiredTiger version
+major=12,minor=0,patch=0
+file:WiredTiger.wt
+access_pattern_hint=none,allocation_size=4KB,app_metadata=,assert=(commit_timestamp=none,durable_timestamp=none,read_timestamp=none,write_timestamp=off),block_allocation=best,block_compressor=,cache_resident=false,checksum=on,collator=,columns=,dictionary=0,encryption=(keyid=,name=),format=btree,huffman_key=,huffman_value=,id=0,ignore_in_memory_cache_size=false,internal_item_max=0,internal_key_max=0,internal_key_truncate=true,internal_page_max=4KB,key_format=S,key_gap=10,leaf_item_max=0,leaf_key_max=0,leaf_page_max=32KB,leaf_value_max=0,log=(enabled=true),memory_page_image_max=0,memory_page_max=5MB,os_cache_dirty_max=0,os_cache_max=0,prefix_compression=false,prefix_compression_min=4,readonly=false,split_deepen_min_child=0,split_deepen_per_child=0,split_pct=90,tiered_object=false,tiered_storage=(auth_token=,bucket=,bucket_prefix=,cache_directory=,local_retention=300,name=,object_target_size=0),value_format=S,verbose=[],version=(major=1,minor=1),write_timestamp_usage=none,checkpoint=(WiredTigerCheckpoint.6962=(addr="019081e46d2258f99181e48f5326a39581e4a8cad1a2808080e3014fc0e25fc0",order=6962,time=1777795082,size=36864,newest_start_durable_ts=0,oldest_start_ts=0,newest_txn=7123,newest_stop_durable_ts=0,newest_stop_ts=-1,newest_stop_txn=-11,prepare=0,write_gen=20886,run_write_gen=1)),checkpoint_backup_info=,checkpoint_lsn=(1,6911616)
diff --git a/mongodb/data/WiredTiger.wt b/mongodb/data/WiredTiger.wt
new file mode 100644
index 0000000..8807576
Binary files /dev/null and b/mongodb/data/WiredTiger.wt differ
diff --git a/mongodb/data/WiredTigerHS.wt b/mongodb/data/WiredTigerHS.wt
new file mode 100644
index 0000000..3f019cb
Binary files /dev/null and b/mongodb/data/WiredTigerHS.wt differ
diff --git a/mongodb/data/_mdb_catalog.wt b/mongodb/data/_mdb_catalog.wt
new file mode 100644
index 0000000..ca32120
Binary files /dev/null and b/mongodb/data/_mdb_catalog.wt differ
diff --git a/mongodb/data/_tmp/spilldb/WiredTiger b/mongodb/data/_tmp/spilldb/WiredTiger
new file mode 100644
index 0000000..420d79a
--- /dev/null
+++ b/mongodb/data/_tmp/spilldb/WiredTiger
@@ -0,0 +1,2 @@
+WiredTiger
+WiredTiger 12.0.0: (November 15, 2024)
diff --git a/mongodb/data/_tmp/spilldb/WiredTiger.lock b/mongodb/data/_tmp/spilldb/WiredTiger.lock
new file mode 100644
index 0000000..3d84206
--- /dev/null
+++ b/mongodb/data/_tmp/spilldb/WiredTiger.lock
@@ -0,0 +1 @@
+WiredTiger lock file
diff --git a/mongodb/data/_tmp/spilldb/WiredTiger.turtle b/mongodb/data/_tmp/spilldb/WiredTiger.turtle
new file mode 100644
index 0000000..cd5e77a
--- /dev/null
+++ b/mongodb/data/_tmp/spilldb/WiredTiger.turtle
@@ -0,0 +1,6 @@
+WiredTiger version string
+WiredTiger 12.0.0: (November 15, 2024)
+WiredTiger version
+major=12,minor=0,patch=0
+file:WiredTiger.wt
+access_pattern_hint=none,allocation_size=4KB,app_metadata=,assert=(commit_timestamp=none,durable_timestamp=none,read_timestamp=none,write_timestamp=off),block_allocation=best,block_compressor=,cache_resident=false,checksum=on,collator=,columns=,dictionary=0,encryption=(keyid=,name=),format=btree,huffman_key=,huffman_value=,id=0,ignore_in_memory_cache_size=false,internal_item_max=0,internal_key_max=0,internal_key_truncate=true,internal_page_max=4KB,key_format=S,key_gap=10,leaf_item_max=0,leaf_key_max=0,leaf_page_max=32KB,leaf_value_max=0,log=(enabled=true),memory_page_image_max=0,memory_page_max=5MB,os_cache_dirty_max=0,os_cache_max=0,prefix_compression=false,prefix_compression_min=4,readonly=false,split_deepen_min_child=0,split_deepen_per_child=0,split_pct=90,tiered_object=false,tiered_storage=(auth_token=,bucket=,bucket_prefix=,cache_directory=,local_retention=300,name=,object_target_size=0),value_format=S,verbose=[],version=(major=1,minor=1),write_timestamp_usage=none,checkpoint=(WiredTigerCheckpoint.2=(addr="018181e407ed97398281e41546bd168381e44d7dd725808080e22fc0cfc0",order=2,time=1777371693,size=8192,newest_start_durable_ts=0,oldest_start_ts=0,newest_txn=1,newest_stop_durable_ts=0,newest_stop_ts=-1,newest_stop_txn=-11,prepare=0,write_gen=3,run_write_gen=1)),checkpoint_backup_info=,checkpoint_lsn=(4294967295,2147483647)
diff --git a/mongodb/data/_tmp/spilldb/WiredTiger.wt b/mongodb/data/_tmp/spilldb/WiredTiger.wt
new file mode 100644
index 0000000..0860c7b
Binary files /dev/null and b/mongodb/data/_tmp/spilldb/WiredTiger.wt differ
diff --git a/mongodb/data/_tmp/spilldb/WiredTigerHS.wt b/mongodb/data/_tmp/spilldb/WiredTigerHS.wt
new file mode 100644
index 0000000..3f019cb
Binary files /dev/null and b/mongodb/data/_tmp/spilldb/WiredTigerHS.wt differ
diff --git a/mongodb/data/collection-8d46f3be-43b7-4796-bef4-2dfe6e0cc31b.wt b/mongodb/data/collection-8d46f3be-43b7-4796-bef4-2dfe6e0cc31b.wt
new file mode 100644
index 0000000..6940f66
Binary files /dev/null and b/mongodb/data/collection-8d46f3be-43b7-4796-bef4-2dfe6e0cc31b.wt differ
diff --git a/mongodb/data/collection-932ea143-ae51-4efa-b6f1-fefcc6626451.wt b/mongodb/data/collection-932ea143-ae51-4efa-b6f1-fefcc6626451.wt
new file mode 100644
index 0000000..42ac9c4
Binary files /dev/null and b/mongodb/data/collection-932ea143-ae51-4efa-b6f1-fefcc6626451.wt differ
diff --git a/mongodb/data/collection-a70d77e6-e249-4d50-bb34-0eac316ba3c1.wt b/mongodb/data/collection-a70d77e6-e249-4d50-bb34-0eac316ba3c1.wt
new file mode 100644
index 0000000..0163cf2
Binary files /dev/null and b/mongodb/data/collection-a70d77e6-e249-4d50-bb34-0eac316ba3c1.wt differ
diff --git a/mongodb/data/collection-b04d43ef-a3dc-4e8e-96dc-aef9cdc0a1d0.wt b/mongodb/data/collection-b04d43ef-a3dc-4e8e-96dc-aef9cdc0a1d0.wt
new file mode 100644
index 0000000..6d993b2
Binary files /dev/null and b/mongodb/data/collection-b04d43ef-a3dc-4e8e-96dc-aef9cdc0a1d0.wt differ
diff --git a/mongodb/data/collection-d40d260d-c378-4fbc-9072-0b5a9d5d44cc.wt b/mongodb/data/collection-d40d260d-c378-4fbc-9072-0b5a9d5d44cc.wt
new file mode 100644
index 0000000..6a70960
Binary files /dev/null and b/mongodb/data/collection-d40d260d-c378-4fbc-9072-0b5a9d5d44cc.wt differ
diff --git a/mongodb/data/diagnostic.data/metrics.2026-04-28T10-21-33Z-00000 b/mongodb/data/diagnostic.data/metrics.2026-04-28T10-21-33Z-00000
new file mode 100644
index 0000000..5d0b055
Binary files /dev/null and b/mongodb/data/diagnostic.data/metrics.2026-04-28T10-21-33Z-00000 differ
diff --git a/mongodb/data/diagnostic.data/metrics.2026-04-29T04-37-57Z-00000 b/mongodb/data/diagnostic.data/metrics.2026-04-29T04-37-57Z-00000
new file mode 100644
index 0000000..7b0e177
Binary files /dev/null and b/mongodb/data/diagnostic.data/metrics.2026-04-29T04-37-57Z-00000 differ
diff --git a/mongodb/data/diagnostic.data/metrics.2026-04-29T22-57-57Z-00000 b/mongodb/data/diagnostic.data/metrics.2026-04-29T22-57-57Z-00000
new file mode 100644
index 0000000..6722298
Binary files /dev/null and b/mongodb/data/diagnostic.data/metrics.2026-04-29T22-57-57Z-00000 differ
diff --git a/mongodb/data/diagnostic.data/metrics.2026-04-30T17-17-57Z-00000 b/mongodb/data/diagnostic.data/metrics.2026-04-30T17-17-57Z-00000
new file mode 100644
index 0000000..6393b40
Binary files /dev/null and b/mongodb/data/diagnostic.data/metrics.2026-04-30T17-17-57Z-00000 differ
diff --git a/mongodb/data/diagnostic.data/metrics.2026-05-01T11-42-57Z-00000 b/mongodb/data/diagnostic.data/metrics.2026-05-01T11-42-57Z-00000
new file mode 100644
index 0000000..8a50f91
Binary files /dev/null and b/mongodb/data/diagnostic.data/metrics.2026-05-01T11-42-57Z-00000 differ
diff --git a/mongodb/data/diagnostic.data/metrics.2026-05-02T06-07-57Z-00000 b/mongodb/data/diagnostic.data/metrics.2026-05-02T06-07-57Z-00000
new file mode 100644
index 0000000..72aa201
Binary files /dev/null and b/mongodb/data/diagnostic.data/metrics.2026-05-02T06-07-57Z-00000 differ
diff --git a/mongodb/data/diagnostic.data/metrics.2026-05-03T00-27-58Z-00000 b/mongodb/data/diagnostic.data/metrics.2026-05-03T00-27-58Z-00000
new file mode 100644
index 0000000..31c0ea3
Binary files /dev/null and b/mongodb/data/diagnostic.data/metrics.2026-05-03T00-27-58Z-00000 differ
diff --git a/mongodb/data/diagnostic.data/metrics.interim b/mongodb/data/diagnostic.data/metrics.interim
new file mode 100644
index 0000000..1c20751
Binary files /dev/null and b/mongodb/data/diagnostic.data/metrics.interim differ
diff --git a/mongodb/data/index-3c3f9649-7578-4c4c-9805-ba875897872b.wt b/mongodb/data/index-3c3f9649-7578-4c4c-9805-ba875897872b.wt
new file mode 100644
index 0000000..1231959
Binary files /dev/null and b/mongodb/data/index-3c3f9649-7578-4c4c-9805-ba875897872b.wt differ
diff --git a/mongodb/data/index-427de11e-e4bb-4946-b972-fc95068b82f7.wt b/mongodb/data/index-427de11e-e4bb-4946-b972-fc95068b82f7.wt
new file mode 100644
index 0000000..242b846
Binary files /dev/null and b/mongodb/data/index-427de11e-e4bb-4946-b972-fc95068b82f7.wt differ
diff --git a/mongodb/data/index-4912291d-393b-42ba-b80b-20ddbddc9abd.wt b/mongodb/data/index-4912291d-393b-42ba-b80b-20ddbddc9abd.wt
new file mode 100644
index 0000000..e7ee0f5
Binary files /dev/null and b/mongodb/data/index-4912291d-393b-42ba-b80b-20ddbddc9abd.wt differ
diff --git a/mongodb/data/index-5fca679f-4bb3-4945-9851-68705fb37c0b.wt b/mongodb/data/index-5fca679f-4bb3-4945-9851-68705fb37c0b.wt
new file mode 100644
index 0000000..7352f36
Binary files /dev/null and b/mongodb/data/index-5fca679f-4bb3-4945-9851-68705fb37c0b.wt differ
diff --git a/mongodb/data/index-657a482d-636b-4332-9c8f-01f87f019b43.wt b/mongodb/data/index-657a482d-636b-4332-9c8f-01f87f019b43.wt
new file mode 100644
index 0000000..1adeed0
Binary files /dev/null and b/mongodb/data/index-657a482d-636b-4332-9c8f-01f87f019b43.wt differ
diff --git a/mongodb/data/index-80bea044-13ab-4362-b0e0-09db61e0e51c.wt b/mongodb/data/index-80bea044-13ab-4362-b0e0-09db61e0e51c.wt
new file mode 100644
index 0000000..b2ed450
Binary files /dev/null and b/mongodb/data/index-80bea044-13ab-4362-b0e0-09db61e0e51c.wt differ
diff --git a/mongodb/data/index-85c5e8ce-ef5e-4457-8a2b-514888905fc5.wt b/mongodb/data/index-85c5e8ce-ef5e-4457-8a2b-514888905fc5.wt
new file mode 100644
index 0000000..d447f5a
Binary files /dev/null and b/mongodb/data/index-85c5e8ce-ef5e-4457-8a2b-514888905fc5.wt differ
diff --git a/mongodb/data/journal/WiredTigerLog.0000000001 b/mongodb/data/journal/WiredTigerLog.0000000001
new file mode 100644
index 0000000..f244efb
Binary files /dev/null and b/mongodb/data/journal/WiredTigerLog.0000000001 differ
diff --git a/mongodb/data/journal/WiredTigerPreplog.0000000001 b/mongodb/data/journal/WiredTigerPreplog.0000000001
new file mode 100644
index 0000000..aa52a21
Binary files /dev/null and b/mongodb/data/journal/WiredTigerPreplog.0000000001 differ
diff --git a/mongodb/data/mongod.lock b/mongodb/data/mongod.lock
new file mode 100644
index 0000000..d00491f
--- /dev/null
+++ b/mongodb/data/mongod.lock
@@ -0,0 +1 @@
+1
diff --git a/mongodb/data/sizeStorer.wt b/mongodb/data/sizeStorer.wt
new file mode 100644
index 0000000..a07a559
Binary files /dev/null and b/mongodb/data/sizeStorer.wt differ
diff --git a/mongodb/data/storage.bson b/mongodb/data/storage.bson
new file mode 100644
index 0000000..276b694
Binary files /dev/null and b/mongodb/data/storage.bson differ
diff --git a/mongodb/development.yaml b/mongodb/development.yaml
new file mode 100644
index 0000000..f42979e
--- /dev/null
+++ b/mongodb/development.yaml
@@ -0,0 +1,85 @@
+# kubernetes/mongodb/mongodb.yaml
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: mongo-pv
+spec:
+  capacity:
+    storage: 2Gi
+  volumeMode: Filesystem
+  accessModes:
+  - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: local-storage
+  local:
+    path: /root/todoApp/kubernetes/mongodb/data
+
+  nodeAffinity:
+    required:
+      nodeSelectorTerms:
+      - matchExpressions:
+        - key: kubernetes.io/hostname
+          operator: In
+          values:
+          - master-controller
+
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: mongo
+  namespace: todo-app
+spec:
+  serviceName: mongo-service   # ✅ REQUIRED
+  replicas: 1
+  selector:
+    matchLabels:
+      app: mongo
+
+  volumeClaimTemplates:
+  - metadata:
+      name: mongo-pvc
+    spec:
+      accessModes: [ "ReadWriteOnce" ]
+      storageClassName: local-storage
+      resources:
+        requests:
+          storage: 2Gi
+  template:
+    metadata:
+      labels:
+        app: mongo
+        tier: database        # ← label for NetworkPolicy
+    spec:
+      tolerations:
+      - key: "node-role.kubernetes.io/control-plane"
+        operator: "Exists"
+        effect: "NoSchedule"
+      containers:
+        - name: mongo
+          image: mongo
+          ports:
+            - containerPort: 27017
+          volumeMounts:
+            - name: mongo-pvc
+              mountPath: /data/db
+          # Security — run as non-root
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 999
+            allowPrivilegeEscalation: false
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: mongo-service
+  namespace: todo-app
+spec:
+  clusterIP: None
+  selector:
+    app: mongo
+  ports:
+    - port: 27017
+      targetPort: 27017
+  # ClusterIP — internal only, never exposed outside
+  type: ClusterIP
diff --git a/mongodb/pvc.yaml b/mongodb/pvc.yaml
new file mode 100644
index 0000000..3a90dcf
--- /dev/null
+++ b/mongodb/pvc.yaml
@@ -0,0 +1,12 @@
+# kubernetes/mongodb/pvc.yaml
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: mongo-pvc
+  namespace: todo-app
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 2Gi
diff --git a/networkpolicy/networkpolicy.yaml b/networkpolicy/networkpolicy.yaml
new file mode 100644
index 0000000..a5ffa97
--- /dev/null
+++ b/networkpolicy/networkpolicy.yaml
@@ -0,0 +1,98 @@
+# kubernetes/networkpolicy/networkpolicy.yaml
+
+# Rule 1 — Default deny ALL ingress + egress in namespace
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: default-deny-all
+  namespace: todo-app
+spec:
+  podSelector: {}    # applies to ALL pods
+  policyTypes:
+    - Ingress
+    - Egress
+---
+# Rule 2 — Frontend can receive from Gateway only
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-gateway-to-frontend
+  namespace: todo-app
+spec:
+  podSelector:
+    matchLabels:
+      tier: web
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: nginx-gateway
+---
+# Rule 3 — Backend can receive from Gateway only
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-gateway-to-backend
+  namespace: todo-app
+spec:
+  podSelector:
+    matchLabels:
+      tier: api
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: nginx-gateway
+---
+# Rule 4 — MongoDB accepts connections from backend ONLY
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-backend-to-mongo
+  namespace: todo-app
+spec:
+  podSelector:
+    matchLabels:
+      tier: database
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              tier: api    # only backend pods
+      ports:
+        - port: 27017
+---
+# Rule 5 — Backend can talk to MongoDB + DNS only
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: backend-egress
+  namespace: todo-app
+spec:
+  podSelector:
+    matchLabels:
+      tier: api
+  policyTypes:
+    - Egress
+  egress:
+    # Allow MongoDB
+    - to:
+        - podSelector:
+            matchLabels:
+              tier: database
+      ports:
+        - port: 27017
+    # Allow DNS resolution
+    - to:
+        - namespaceSelector: {}
+      ports:
+        - port: 53
+          protocol: UDP
+        - port: 53
+          protocol: TCP
diff --git a/secret.yaml b/secret.yaml
new file mode 100644
index 0000000..5cf48f6
--- /dev/null
+++ b/secret.yaml
@@ -0,0 +1,10 @@
+# kubernetes/secrets.yaml
+apiVersion: v1
+kind: Secret
+metadata:
+  name: todo-secrets
+  namespace: todo-app
+type: Opaque
+data:
+  JWT_SECRET: MTIzUmFTaElrXjBOeSY4KG1FYVBwX1MzYw==
+  MONGO_URI: bW9uZ29kYjovL21vbmdvLXNlcnZpY2U6MjcwMTcvdG9kb2FwcA==