basic_nsp_workspace.yaml

apiVersion: template.openshift.io/v1
kind: Template
parameters:
- name: NAMESPACE
- name: NAME
objects:
- apiVersion: security.devops.gov.bc.ca/v1alpha1
  kind: NetworkSecurityPolicy
  metadata:
    name: egress-internet
  spec:
    description: "allow ${NAMESPACE} namespace to talk to the internet."
    source:
      - - $namespace=${NAMESPACE}
    destination:
      - - ext:network=any
- apiVersion: security.devops.gov.bc.ca/v1alpha1
  kind: NetworkSecurityPolicy
  metadata:
    name: intra-namespace-comms
  spec:
    description: "allow ${NAMESPACE} namespace to talk to itself"
    source:
      - - $namespace=${NAMESPACE}
    destination:
      - - $namespace=${NAMESPACE}
- apiVersion: security.devops.gov.bc.ca/v1alpha1
  kind: NetworkSecurityPolicy
  metadata:
    name: int-cluster-k8s-api-comms
  spec:
    description: "allow ${NAMESPACE} pods to talk to the k8s api"
    destination:
    - - int:network=internal-cluster-api-endpoint
    - - $namespace=${NAMESPACE}
    source:
    - - $namespace=${NAMESPACE}
    - - int:network=internal-cluster-api-endpoint
- apiVersion: security.devops.gov.bc.ca/v1alpha1
  kind: NetworkSecurityPolicy
  metadata:
    name: tools-namespace-comms
  spec:
    description: "allow ${NAMESPACE} namespace to get images from the tools workspace"
    source:
      - - $namespace=${NAME}-tools
    destination:
      - - $namespace=${NAMESPACE}