app-netpolicy.yaml

# API access to AM/IDM
# This can potentially further limited but is usecase dependent
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: backend-http-access
  labels:
    tier: middle
spec:
  podSelector:
    matchExpressions:
    - key: tier
      operator: In
      values:
      - middle
  policyTypes:
  - Ingress
  ingress:
  - from: []
    ports:
      # AM uses 8081
      - protocol: TCP
        port: 8081
      # IDM uses 8080
      - protocol: TCP
        port: 8080

# UI apps
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: front-end-http-access
  labels:
    tier: ui
spec:
  podSelector:
    matchExpressions:
    - key: tier
      operator: In
      values:
      - ui
  policyTypes:
  - Ingress
  ingress:
  - from: []
    ports:
      - protocol: TCP
        port: 8080