apiVersion: v1
kind: Namespace
metadata:
  name: cks-lab
---
apiVersion: v1
kind: Pod
metadata:
  name: db
  namespace: cks-lab
  labels:
    app: db
spec:
  containers:
    - name: http
      image: hashicorp/http-echo:1.0
      args: ["-text=database", "-listen=:8080"]
      ports:
        - containerPort: 8080
---
apiVersion: v1
kind: Service
metadata:
  name: db
  namespace: cks-lab
spec:
  selector:
    app: db
  ports:
    - port: 8080
      targetPort: 8080
---
apiVersion: v1
kind: Pod
metadata:
  name: api
  namespace: cks-lab
  labels:
    app: api
spec:
  containers:
    - name: tools
      image: busybox:1.37
      command: ["sh", "-c", "sleep 3600"]
---
apiVersion: v1
kind: Pod
metadata:
  name: intruder
  namespace: cks-lab
  labels:
    app: intruder
spec:
  containers:
    - name: tools
      image: busybox:1.37
      command: ["sh", "-c", "sleep 3600"]
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: db-only-from-api
  namespace: cks-lab
spec:
  podSelector:
    matchLabels:
      app: db
  policyTypes:
    - Ingress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: api
      ports:
        - protocol: TCP
          port: 8080