ds-netpolicy.yaml

# Allow DS Operator to talk ldap to only the pods it manages
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: ds-operator-ldap
  labels:
    tier: data
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/managed-by: ds-operator
  policyTypes:
  - Ingress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          control-plane: ds-operator
      podSelector:
        matchExpressions:
        - key: control-plane
          operator: In
          values:
          - ds-operator
    ports:
    - protocol: TCP
      port: 1636

# Allow DS to replicate between themselves, you could further limit
# CTS and idrepo replication port isolation
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: ds-replication
  labels:
    tier: data
spec:
  podSelector:
    matchExpressions:
    - key: app.kubernetes.io/name
      operator: In
      values:
      - ds
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector:
        matchExpressions:
        - key: app.kubernetes.io/name
          operator: In
          values:
          - ds
    ports:
    - protocol: TCP
      port: 8989

# Allow Apps to talk LDAP to idrepo
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: ds-idrepo-app-ldap
  labels:
    tier: data
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/instance: ds-idrepo
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector:
        matchExpressions:
        - key: app
          operator: In
          values:
          - am
          - idm
          - amster
    ports:
    - protocol: TCP
      port: 1389
    - protocol: TCP
      port: 1636
    - protocol: TCP
      port: 8080
# Allow AM and Amster to talk LDAP to cts
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: ds-cts-app-ldap
  labels:
    tier: data
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/instance: ds-cts
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector:
        matchExpressions:
        - key: app
          operator: In
          values:
          - am
          - amster
    ports:
    - protocol: TCP
      port: 1389
    - protocol: TCP
      port: 1636
    - protocol: TCP
      port: 8080