# Postgres: 5432 nur fuer Pods mit db-client: "true" (api, worker, Jobs,
# pg_dump) im selben Namespace. Raus nichts ausser DNS (allow-dns).
# Der Selektor muss zu den Pod-Labels in base/postgres/statefulset.yaml
# passen; der Test manifest-policy.test.mjs prueft das.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: apicore-postgres
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: apicore-postgres
  policyTypes: [Ingress, Egress]
  ingress:
    - from:
        - podSelector:
            matchLabels:
              db-client: "true"
      ports:
        - {protocol: TCP, port: 5432}