How can I prevent Harvester workloads from being accidentally exposed to the public internet?

In a Harvester deployment, administrators need to guarantee that newly created virtual machines and container workloads remain reachable only within the trusted internal network. The default installation does not automatically block external exposure mechanisms such as LoadBalancer services, NodePorts, or ingress controllers, which could lead to unintended public access if a service is misconfigured.

Given the need to maintain internal connectivity for management and storage while enforcing a strict deny‑by‑default posture for external traffic, what mechanisms or configurations should be reviewed to ensure that any service definition is implicitly internal‑only unless explicitly allowed? How can continuous validation be set up to detect accidental public exposure before it becomes a risk?