For a 3-tier app in one namespace, db Pods should accept TCP 5432 o…

Question

For a 3-tier app in one namespace, db Pods should accept TCP 5432 only from Pods labeled tier=api, not from tier=web. Which NetworkPolicy approach fits?

Accepted Answer

Select db Pods and allow ingress from podSelector tier=api on the required port; do not allow tier=web. — Picture the database as a vault that only the API desk can open—not the public web lobby. Put the NetworkPolicy on the db Pods and allow ingress from tier=api on 5432. Leave web out of that allow list and they stay outside.

Answer

Select db Pods and allow ingress from the entire namespace with an empty namespaceSelector only.

Answer

Select web Pods and set egress deny to db so db ingress rules become unnecessary.

Answer

Use a Service of type ExternalName so NetworkPolicy peer selectors are bypassed for SQL.

For a 3-tier app in one namespace, db Pods should accept TCP 5432 only from Pods labeled `tier=api`, not from `tier=web`. Which NetworkPolicy approach fits?

Short Explanation

Full Explanation