abyss-o5mtsz runs the whole market, wide open: anything can reach the database, and nothing is published to the outside. Close it, then open the right doors.

kubectl get pods,svc -n abyss-o5mtsz -o wide
kubectl get netpol,ingress -n abyss-o5mtsz

Inside: default deny, then allow

1. A policy default-deny that isolates every Pod in the namespace for ingress and egress.
2. market-db accepts connections only from market-api, on 5432.
3. market-api accepts connections only from market-web and from the ingress controller, on 8080. The controller runs in kube-system; a namespaceSelector on that namespace is the usual way to allow it.
4. market-web accepts connections from anywhere on 80.
5. Everything selected needs DNS back: an egress policy allow-dns for all Pods, UDP 53 to kube-system, plus whatever egress each tier needs: web to api on 8080, api to db on 5432.

Test as you go from the client Pod and from the Pods themselves:

kubectl exec client -n abyss-o5mtsz -- nc -zv -w 1 market-db 5432
kubectl exec deploy/market-web -n abyss-o5mtsz -- wget -qO- -T 1 market-api:8080/healthz

Outside: one hostname

6. An Ingress market on class traefik for host market.example: /monsters (Prefix) to market-api:8080, everything else to market-web:80.

curl -s -H "Host: market.example" http://10.0.0.10/
curl -s -H "Host: market.example" http://10.0.0.10/monsters

The last call only works once the API's ingress policy lets the controller in. The final objective asks which status the controller returns when a rule matches but the Service has no endpoints.