Networkpolicy

1# =============================================================================
2# Kubernetes NetworkPolicy Template — AKS Deploy Skill
3# =============================================================================
4# Restricts ingress to the application pod so only the ingress controller
5# (or gateway) namespace can reach it. Denies all other inbound traffic.
6#
7# REPLACE: <app-name>             — your application name (e.g., order-api)
8# REPLACE: <namespace>            — target namespace (e.g., production)
9# REPLACE: <ingress-namespace>    — namespace of the ingress controller
10#                                   AKS Web App Routing: app-routing-system
11#                                   Istio Gateway:       aks-istio-ingress
12# =============================================================================
13apiVersion: networking.k8s.io/v1
14kind: NetworkPolicy
15metadata:
16  name: <app-name>-allow-ingress
17  namespace: <namespace>
18  labels:
19    app: <app-name>
20spec:
21  podSelector:
22    matchLabels:
23      app: <app-name>
24  policyTypes:
25    - Ingress
26    # Uncomment to also restrict egress (recommended for production):
27    # - Egress
28  ingress:
29    - from:
30        - namespaceSelector:
31            matchLabels:
32              kubernetes.io/metadata.name: <ingress-namespace>
33  # Uncomment and customize to restrict egress (e.g., allow only DNS + database):
34  # egress:
35  #   - ports:
36  #       - port: 53
37  #         protocol: UDP
38  #       - port: 53
39  #         protocol: TCP
40  #   - to:
41  #       - namespaceSelector:
42  #           matchLabels:
43  #             kubernetes.io/metadata.name: <database-namespace>