apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: web-frontend
  labels:
    app.kubernetes.io/name: a0005
    app.kubernetes.io/component: web-frontend
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: a0005
      app.kubernetes.io/component: web-frontend
  policyTypes:
    - Ingress
    - Egress
  ingress:
    - from:
        # From Ingress Controller
        - namespaceSelector:
            matchLabels:
              app.kubernetes.io/name: ingress-nginx
              app.kubernetes.io/instance: ingress-nginx
          podSelector:
            matchLabels:
              app.kubernetes.io/component: controller
              app.kubernetes.io/instance: ingress-nginx
      ports:
        - port: web
          protocol: TCP
  egress:
    - ports:
        # For our service mesh proxy to talk to its xDS controller
        - port: 15128
          protocol: TCP
    - to:
        # To a0005-o/microservice-a
        - namespaceSelector:
            matchLabels:
              app.kubernetes.io/name: a0005
              pci-scope: out-of-scope
          podSelector: 
            matchLabels:
              app.kubernetes.io/name: a0005
              app.kubernetes.io/component: microservice-a
      ports:
        - port: web
          protocol: TCP
