sample.yaml

apiVersion: template.openshift.io/v1
kind: Template
labels:
  template: some-cool-app
metadata:
  name: some-cool-app
objects:
  - kind: NetworkPolicy
    apiVersion: networking.k8s.io/v1
    metadata:
      name: deny-by-default
      labels:
        app: some-cool-app
    spec:
      # This project's default posture is "security first". All 
      # traffic is denied by default.
      podSelector: {}
      ingress: []
  - apiVersion: networking.k8s.io/v1
    kind: NetworkPolicy
    metadata:
      name: allow-from-openshift-ingress
      labels:
        app: some-cool-app
    spec:
      # Any pod with an external route & service combination is
      # allowed to accept traffic; if we don't want external access
      # we do not assign a route.
      ingress:
        - from:
            - namespaceSelector:
                matchLabels:
                  network.openshift.io/policy-group: ingress
      podSelector: {}
      policyTypes:
        - Ingress
  - kind: NetworkPolicy
    apiVersion: networking.k8s.io/v1
    metadata:
      name: allow-api-to-patroni
      labels:
        app: some-cool-app
    spec:
      # Allow the API pod to communicate to any pod in the Patroni
      # cluster on the given port.
      podSelector:
        matchLabels:
          cluster-name: patroni
      ingress:
        - from:
            - podSelector:
                matchLabels:
                  component: api
          ports:
            - protocol: TCP
              port: 5432
  - kind: NetworkPolicy
    apiVersion: networking.k8s.io/v1
    metadata:
      name: allow-api-to-minio
      labels:
        app: some-cool-app
    spec:
      # Allow the API pod to talk to any pod to communicate with
      # any minio pod on the given port.
      podSelector:
        matchLabels:
          component: minio
      ingress:
        - from:
            - podSelector:
                matchLabels:
                  component: api
          ports:
            - protocol: TCP
              port: 9000