apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata: {name: orders-database, namespace: data}
spec:
  podSelector: {matchLabels: {cnpg.io/cluster: orders-db}}
  policyTypes: [Ingress, Egress]
  ingress:
    - from:
        - namespaceSelector: {matchLabels: {kubernetes.io/metadata.name: orders}}
        - namespaceSelector: {matchLabels: {kubernetes.io/metadata.name: keycloak}}
        - namespaceSelector: {matchLabels: {kubernetes.io/metadata.name: operations}}
        - podSelector: {matchExpressions: [{key: cnpg.io/cluster, operator: Exists}]}
      ports: [{port: 5432, protocol: TCP}]
    - from: [{namespaceSelector: {matchLabels: {kubernetes.io/metadata.name: cnpg-system}}}]
      ports: [{port: 8000, protocol: TCP}]
    - from: [{namespaceSelector: {matchLabels: {kubernetes.io/metadata.name: monitoring}}}]
      ports: [{port: 9187, protocol: TCP}]
  egress:
    - to: [{podSelector: {matchExpressions: [{key: cnpg.io/cluster, operator: Exists}]}}]
      ports: [{port: 5432, protocol: TCP}]
    - to:
        - namespaceSelector: {matchLabels: {kubernetes.io/metadata.name: kube-system}}
          podSelector: {matchLabels: {k8s-app: kube-dns}}
      ports: [{port: 53, protocol: UDP}, {port: 53, protocol: TCP}]
    - to:
        - ipBlock: {cidr: REPLACE_API_SERVER_CIDR}
        - ipBlock: {cidr: REPLACE_S3_ENDPOINT_CIDR}
        - ipBlock: {cidr: REPLACE_REGIONAL_STS_ENDPOINT_CIDR}
      ports: [{port: 443, protocol: TCP}]
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata: {name: orders-restore-isolated, namespace: data}
spec:
  podSelector: {matchLabels: {cnpg.io/cluster: orders-restore}}
  policyTypes: [Ingress, Egress]
  ingress:
    - from:
        - namespaceSelector: {matchLabels: {kubernetes.io/metadata.name: operations}}
        - podSelector: {matchLabels: {cnpg.io/cluster: orders-restore}}
      ports: [{port: 5432, protocol: TCP}]
    - from: [{namespaceSelector: {matchLabels: {kubernetes.io/metadata.name: cnpg-system}}}]
      ports: [{port: 8000, protocol: TCP}]
    - from: [{namespaceSelector: {matchLabels: {kubernetes.io/metadata.name: monitoring}}}]
      ports: [{port: 9187, protocol: TCP}]
  egress:
    - to: [{podSelector: {matchLabels: {cnpg.io/cluster: orders-restore}}}]
      ports: [{port: 5432, protocol: TCP}]
    - to:
        - namespaceSelector: {matchLabels: {kubernetes.io/metadata.name: kube-system}}
          podSelector: {matchLabels: {k8s-app: kube-dns}}
      ports: [{port: 53, protocol: UDP}, {port: 53, protocol: TCP}]
    - to:
        - ipBlock: {cidr: REPLACE_API_SERVER_CIDR}
        - ipBlock: {cidr: REPLACE_S3_ENDPOINT_CIDR}
        - ipBlock: {cidr: REPLACE_REGIONAL_STS_ENDPOINT_CIDR}
      ports: [{port: 443, protocol: TCP}]