# Default deny: no traffic in or out of the namespace unless explicitly allowed below.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
  namespace: rbcs
spec:
  podSelector: {}
  policyTypes: [Ingress, Egress]
---
# Allow all pods to resolve services via cluster DNS.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-dns-egress
  namespace: rbcs
spec:
  podSelector: {}
  policyTypes: [Egress]
  egress:
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
          podSelector:
            matchLabels:
              k8s-app: kube-dns
      ports:
        - protocol: UDP
          port: 53
        - protocol: TCP
          port: 53
---
# memcached: only the two cache servers may reach it; it needs no egress.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: memcached-allow
  namespace: rbcs
spec:
  podSelector:
    matchLabels:
      app: memcached
  policyTypes: [Ingress, Egress]
  ingress:
    - from:
        - podSelector:
            matchExpressions:
              - key: app
                operator: In
                values: [rbcs, rbcs-kaya]
      ports:
        - protocol: TCP
          port: 11211
  egress: []
---
# rbcs (java): reachable by benchmark client pods only; egress to memcached only.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: rbcs-allow
  namespace: rbcs
spec:
  podSelector:
    matchLabels:
      app: rbcs
  policyTypes: [Ingress, Egress]
  ingress:
    - from:
        - podSelector:
            matchLabels:
              role: benchmark
      ports:
        - protocol: TCP
          port: 8080
  egress:
    - to:
        - podSelector:
            matchLabels:
              app: memcached
      ports:
        - protocol: TCP
          port: 11211
---
# rbcs-kaya (kaya-rbcs): reachable by benchmark client pods only; egress to memcached only.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: rbcs-kaya-allow
  namespace: rbcs
spec:
  podSelector:
    matchLabels:
      app: rbcs-kaya
  policyTypes: [Ingress, Egress]
  ingress:
    - from:
        - podSelector:
            matchLabels:
              role: benchmark
      ports:
        - protocol: TCP
          port: 8080
  egress:
    - to:
        - podSelector:
            matchLabels:
              app: memcached
      ports:
        - protocol: TCP
          port: 11211
---
# Benchmark client pods: no ingress; egress only to the two cache servers.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: benchmark-allow
  namespace: rbcs
spec:
  podSelector:
    matchLabels:
      role: benchmark
  policyTypes: [Ingress, Egress]
  ingress: []
  egress:
    - to:
        - podSelector:
            matchExpressions:
              - key: app
                operator: In
                values: [rbcs, rbcs-kaya]
      ports:
        - protocol: TCP
          port: 8080