chore: update

deploy/cni/network-policy-test.yml

@@ -0,0 +1,95 @@
+# Vérification que le CNI applique bien les NetworkPolicy avant de faire
+# confiance à deploy/chart-gestion/network-policy pour l'isolation des démos.
+#
+#   kubectl apply -f deploy/cni/network-policy-test.yml
+#   kubectl wait -n netpol-test --for=condition=ready pod -l app=target --timeout=60s
+#
+#   # Doit réussir (client autorisé) :
+#   kubectl exec -n netpol-test allowed-client -- wget -qO- --timeout=2 target
+#
+#   # Doit échouer / timeout (client non autorisé — c'est le résultat attendu) :
+#   kubectl exec -n netpol-test blocked-client -- wget -qO- --timeout=2 target
+#
+# Si "blocked-client" arrive quand même à joindre "target", le CNI n'applique
+# PAS les NetworkPolicy : deploy/chart-gestion/network-policy ne protège rien.
+#
+# Nettoyage : kubectl delete namespace netpol-test
+
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: netpol-test
+
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: target
+  namespace: netpol-test
+  labels:
+    app: target
+spec:
+  containers:
+    - name: nginx
+      image: nginx:1.27-alpine
+      ports:
+        - containerPort: 80
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: target
+  namespace: netpol-test
+spec:
+  selector:
+    app: target
+  ports:
+    - port: 80
+      targetPort: 80
+
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: allowed-client
+  namespace: netpol-test
+  labels:
+    role: allowed
+spec:
+  containers:
+    - name: busybox
+      image: busybox:1.37
+      command: ["sh", "-c", "sleep 3600"]
+
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: blocked-client
+  namespace: netpol-test
+  labels:
+    role: blocked
+spec:
+  containers:
+    - name: busybox
+      image: busybox:1.37
+      command: ["sh", "-c", "sleep 3600"]
+
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-only-labeled
+  namespace: netpol-test
+spec:
+  podSelector:
+    matchLabels:
+      app: target
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              role: allowed