with kubernetes config files

networkpolicy/networkpolicy.yaml

@@ -0,0 +1,98 @@
+# kubernetes/networkpolicy/networkpolicy.yaml
+
+# Rule 1 — Default deny ALL ingress + egress in namespace
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: default-deny-all
+  namespace: todo-app
+spec:
+  podSelector: {}    # applies to ALL pods
+  policyTypes:
+    - Ingress
+    - Egress
+---
+# Rule 2 — Frontend can receive from Gateway only
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-gateway-to-frontend
+  namespace: todo-app
+spec:
+  podSelector:
+    matchLabels:
+      tier: web
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: nginx-gateway
+---
+# Rule 3 — Backend can receive from Gateway only
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-gateway-to-backend
+  namespace: todo-app
+spec:
+  podSelector:
+    matchLabels:
+      tier: api
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: nginx-gateway
+---
+# Rule 4 — MongoDB accepts connections from backend ONLY
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-backend-to-mongo
+  namespace: todo-app
+spec:
+  podSelector:
+    matchLabels:
+      tier: database
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              tier: api    # only backend pods
+      ports:
+        - port: 27017
+---
+# Rule 5 — Backend can talk to MongoDB + DNS only
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: backend-egress
+  namespace: todo-app
+spec:
+  podSelector:
+    matchLabels:
+      tier: api
+  policyTypes:
+    - Egress
+  egress:
+    # Allow MongoDB
+    - to:
+        - podSelector:
+            matchLabels:
+              tier: database
+      ports:
+        - port: 27017
+    # Allow DNS resolution
+    - to:
+        - namespaceSelector: {}
+      ports:
+        - port: 53
+          protocol: UDP
+        - port: 53
+          protocol: TCP