# any pod in the formbuilder-services-{{ .Values.environmentName }} namespace
# should be able to access any pod in the formbuilder-platform-{{ .Values.environmentName }} namespace
# that has a label "app=fb-submitter-api-{{ .Values.environmentName }}"
# on port 3000
# NOTE: NetworkPolicy only affects pods, Services are effectively transparent
# to them - so it doesn't matter that pod x is accessing pod y port p via
# service z port p2, you have to set up the policy between
# pod x and pod y port p
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-services-to-access-submitter
  namespace: formbuilder-platform-{{ .Values.environmentName }}
spec:
  podSelector:
    matchLabels:
      app: fb-submitter-api-{{ .Values.environmentName }}
  policyTypes:
  - Ingress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          name: formbuilder-services-{{ .Values.environmentName }}
    ports:
    - protocol: TCP
      port: 3000
  - from:
    - podSelector:
        matchLabels:
          app: fb-user-datastore-api-{{ .Values.environmentName }}
