# kubernetes/networkpolicy/networkpolicy.yaml

# Rule 1 — Default deny ALL ingress + egress in namespace
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
  namespace: todo-app
spec:
  podSelector: {}    # applies to ALL pods
  policyTypes:
    - Ingress
    - Egress
---
# Rule 2 — Frontend can receive from Gateway only
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-gateway-to-frontend
  namespace: todo-app
spec:
  podSelector:
    matchLabels:
      tier: web
  policyTypes:
    - Ingress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: nginx-gateway
---
# Rule 3 — Backend can receive from Gateway only
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-gateway-to-backend
  namespace: todo-app
spec:
  podSelector:
    matchLabels:
      tier: api
  policyTypes:
    - Ingress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: nginx-gateway
---
# Rule 4 — MongoDB accepts connections from backend ONLY
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-backend-to-mongo
  namespace: todo-app
spec:
  podSelector:
    matchLabels:
      tier: database
  policyTypes:
    - Ingress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              tier: api    # only backend pods
      ports:
        - port: 27017
---
# Rule 5 — Backend can talk to MongoDB + DNS only
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: backend-egress
  namespace: todo-app
spec:
  podSelector:
    matchLabels:
      tier: api
  policyTypes:
    - Egress
  egress:
    # Allow MongoDB
    - to:
        - podSelector:
            matchLabels:
              tier: database
      ports:
        - port: 27017
    # Allow DNS resolution
    - to:
        - namespaceSelector: {}
      ports:
        - port: 53
          protocol: UDP
        - port: 53
          protocol: TCP