# Exercise 2: Zero-trust namespace with NetworkPolicies (medium)
#
# Prereqs: a cluster with a policy-enforcing CNI, e.g.
#   kind create cluster --config kind-no-cni.yaml  (disableDefaultCNI: true) + install Calico or Cilium
#
# Namespace `shop` runs three tiers: frontend (app=frontend), api (app=api),
# postgres (app=postgres). The ingress controller lives in namespace ingress-nginx.
#
#   TODO 1: default-deny for ingress AND egress for all Pods in `shop`
#   TODO 2: allow DNS egress (UDP+TCP 53) to kube-dns for all Pods in `shop`
#   TODO 3: frontend: ingress only from the ingress-nginx namespace on 8080;
#           egress only to api on 8080
#   TODO 4: api: ingress only from frontend on 8080; egress to postgres on 5432 and to
#           the external payment provider CIDR 203.0.113.0/24 on 443
#   TODO 5: postgres: ingress only from api on 5432 (and from Pods labelled
#           role=db-admin in namespace `ops`); no egress besides DNS
#
# Test with: kubectl run -n shop t --rm -it --image=busybox:1.36 --labels=app=frontend -- sh
#            (wget -T2 api:8080, nc -zv -w2 postgres 5432, nslookup api)
#
# CHECKLIST:
# [ ] From an unlabelled Pod in shop: nothing reachable except DNS.
# [ ] frontend → api works; frontend → postgres times out.
# [ ] api → postgres works; postgres → api times out.
# [ ] A Pod in `ops` with role=db-admin can reach postgres; without the label it can't.
# [ ] Explain in a comment why namespaceSelector + podSelector in ONE `from` entry differs
#     from two separate entries.
apiVersion: v1
kind: Namespace
metadata:
  name: shop
---
# TODO 1: default-deny
# ---
# TODO 2: allow-dns
# ---
# TODO 3: frontend
# ---
# TODO 4: api
# ---
# TODO 5: postgres