# RAPPS-WP-0014: admitted empty demo workspace; no credentials or database data.
apiVersion: v1
kind: Namespace
metadata:
  name: vergabe-demo-company
  labels:
    railiance.io/workload-class: application
    railiance.io/postgres-client: apps-pg
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny
  namespace: vergabe-demo-company
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: vergabe-runtime
  namespace: vergabe-demo-company
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: vergabe-teilnahme
      app.kubernetes.io/instance: vergabe-teilnahme
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: kube-system
    ports:
    - protocol: TCP
      port: 8000
  egress:
  - to:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: databases
      podSelector:
        matchLabels:
          cnpg.io/cluster: apps-pg
    ports:
    - protocol: TCP
      port: 5432
  - to:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: kube-system
    ports:
    - protocol: UDP
      port: 53
    - protocol: TCP
      port: 53
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-acme-http01
  namespace: vergabe-demo-company
spec:
  podSelector:
    matchLabels:
      acme.cert-manager.io/http01-solver: 'true'
  policyTypes:
  - Ingress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: kube-system
    ports:
    - protocol: TCP
      port: 8089
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: vergabe-demo-tls
  namespace: vergabe-demo-company
spec:
  secretName: vergabe-demo-tls
  dnsNames:
  - vergabe-teilnahme.coulomb.social
  issuerRef:
    kind: ClusterIssuer
    name: letsencrypt-prod