abyss-wna3ta already has default-deny. Nothing can reach anything. Open three doors.
The database, for the API only:
sh
kubectl apply -n abyss-wna3ta -f - <<EOF
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: db-from-api
spec:
podSelector:
matchLabels:
app: market-db
ingress:
- from:
- podSelector:
matchLabels:
app: market-api
ports:
- port: 5432
EOFThe web tier, for everyone:
sh
kubectl apply -n abyss-wna3ta -f - <<EOF
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: web-open
spec:
podSelector:
matchLabels:
app: market-web
ingress:
- {}
EOFThe API, for the prober Pod in ops-wna3ta only. Write this one yourself: a policy named api-from-prober selecting app=market-api, with one from item that combines a namespaceSelector on kubernetes.io/metadata.name: ops-wna3ta with a podSelector on app: prober, port 8080.
sh
kubectl exec prober -n ops-wna3ta -- wget -qO- -T 1 market-api.abyss-wna3ta:8080/healthz
kubectl exec outsider -n ops-wna3ta -- wget -qO- -T 1 market-api.abyss-wna3ta:8080/healthz