Completed upto lesson 35

lab/lesson-34-answer.yaml

@@ -0,0 +1,106 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: orders-api
+  namespace: orders-prod
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: orders-api
+  template:
+    metadata:
+      labels:
+        app: orders-api
+        tier: backend
+    spec:
+      automountServiceAccountToken: false
+      serviceAccountName: orders-api
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 10001
+        runAsGroup: 10001
+        fsGroup: 10001
+        seccompProfile:
+          type: RuntimeDefault
+      volumes:
+      - name: orders
+        emptyDir: {}
+      - name: srv
+        emptyDir: {}
+      containers:
+      - name: api
+        image: busybox:1.37
+        volumeMounts:
+        - name: orders
+          mountPath: /var/log/orders
+        - name: srv
+          mountPath: /srv
+        securityContext:
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: true
+          capabilities:
+            drop: ["ALL"]
+        command: ["sh", "-c", "mkdir -p /srv; echo ready > /srv/index.html; httpd -f -p 8080 -h /srv"]
+        ports:
+        - name: http
+          containerPort: 8080
+      - name: audit-writer
+        image: busybox:1.37
+        command: ["sh", "-c", "while true; do date >> /var/log/orders/audit.log; sleep 20; done"]
+        securityContext:
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: true
+          capabilities:
+            drop: ["ALL"]
+        volumeMounts:
+        - name: orders
+          mountPath: /var/log/orders
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: orders-api-boundary
+  namespace: orders-prod
+spec:
+  podSelector:
+    matchLabels:
+      app: orders-api
+  policyTypes:
+  - Ingress
+  - Egress
+  ingress:
+  - from:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: edge
+      podSelector:
+        matchLabels:
+          app: edge-gateway
+    ports:
+    - protocol: TCP
+      port: 8080
+  egress:
+  - to:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: data
+      podSelector:
+        matchLabels:
+          app: orders-db
+    ports:
+    - protocol: TCP
+      port: 5432
+  - to:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: kube-system
+      podSelector:
+        matchLabels:
+          k8s-app: kube-dns
+    ports:
+    - protocol: TCP
+      port: 53
+    - protocol: UDP
+      port: 53