---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: orders-api
  namespace: orders-prod
spec:
  replicas: 2
  selector:
    matchLabels:
      app: orders-api
  template:
    metadata:
      labels:
        app: orders-api
        tier: backend
    spec:
      automountServiceAccountToken: false
      serviceAccountName: orders-api
      securityContext:
        runAsNonRoot: true
        runAsUser: 10001
        runAsGroup: 10001
        fsGroup: 10001
        seccompProfile:
          type: RuntimeDefault
      volumes:
      - name: orders
        emptyDir: {}
      - name: srv
        emptyDir: {}
      containers:
      - name: api
        image: busybox:1.37
        volumeMounts:
        - name: orders
          mountPath: /var/log/orders
        - name: srv
          mountPath: /srv
        securityContext:
          allowPrivilegeEscalation: false
          readOnlyRootFilesystem: true
          capabilities:
            drop: ["ALL"]
        command: ["sh", "-c", "mkdir -p /srv; echo ready > /srv/index.html; httpd -f -p 8080 -h /srv"]
        ports:
        - name: http
          containerPort: 8080
      - name: audit-writer
        image: busybox:1.37
        command: ["sh", "-c", "while true; do date >> /var/log/orders/audit.log; sleep 20; done"]
        securityContext:
          allowPrivilegeEscalation: false
          readOnlyRootFilesystem: true
          capabilities:
            drop: ["ALL"]
        volumeMounts:
        - name: orders
          mountPath: /var/log/orders
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: orders-api-boundary
  namespace: orders-prod
spec:
  podSelector:
    matchLabels:
      app: orders-api
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: edge
      podSelector:
        matchLabels:
          app: edge-gateway
    ports:
    - protocol: TCP
      port: 8080
  egress:
  - to:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: data
      podSelector:
        matchLabels:
          app: orders-db
    ports:
    - protocol: TCP
      port: 5432
  - to:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: kube-system
      podSelector:
        matchLabels:
          k8s-app: kube-dns
    ports:
    - protocol: TCP
      port: 53
    - protocol: UDP
      port: 53