# Vérification que le CNI applique bien les NetworkPolicy avant de faire
# confiance à deploy/chart-gestion/network-policy pour l'isolation des démos.
#
#   kubectl apply -f deploy/cni/network-policy-test.yml
#   kubectl wait -n netpol-test --for=condition=ready pod -l app=target --timeout=60s
#
#   # Doit réussir (client autorisé) :
#   kubectl exec -n netpol-test allowed-client -- wget -qO- --timeout=2 target
#
#   # Doit échouer / timeout (client non autorisé — c'est le résultat attendu) :
#   kubectl exec -n netpol-test blocked-client -- wget -qO- --timeout=2 target
#
# Si "blocked-client" arrive quand même à joindre "target", le CNI n'applique
# PAS les NetworkPolicy : deploy/chart-gestion/network-policy ne protège rien.
#
# Nettoyage : kubectl delete namespace netpol-test

apiVersion: v1
kind: Namespace
metadata:
  name: netpol-test

---
apiVersion: v1
kind: Pod
metadata:
  name: target
  namespace: netpol-test
  labels:
    app: target
spec:
  containers:
    - name: nginx
      image: nginx:1.27-alpine
      ports:
        - containerPort: 80

---
apiVersion: v1
kind: Service
metadata:
  name: target
  namespace: netpol-test
spec:
  selector:
    app: target
  ports:
    - port: 80
      targetPort: 80

---
apiVersion: v1
kind: Pod
metadata:
  name: allowed-client
  namespace: netpol-test
  labels:
    role: allowed
spec:
  containers:
    - name: busybox
      image: busybox:1.37
      command: ["sh", "-c", "sleep 3600"]

---
apiVersion: v1
kind: Pod
metadata:
  name: blocked-client
  namespace: netpol-test
  labels:
    role: blocked
spec:
  containers:
    - name: busybox
      image: busybox:1.37
      command: ["sh", "-c", "sleep 3600"]

---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-only-labeled
  namespace: netpol-test
spec:
  podSelector:
    matchLabels:
      app: target
  policyTypes:
    - Ingress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              role: allowed