Calico Network Policy - test

# Policy to allow ingress-nginx to access glance app specifically
apiVersion: projectcalico.org/v3
kind: NetworkPolicy
metadata:
  name: allow-ingress-to-glance
  namespace: ma3x-glance
spec:
  selector: app == "glance"
  types:
    - Ingress
  ingress:
    # Allow traffic from ingress-nginx namespace
    - action: Allow
      protocol: TCP
      source:
        namespaceSelector: name == "ingress-nginx"
      destination:
        ports:
          - 8080

---
# Allow glance app to make external requests (if needed)
apiVersion: projectcalico.org/v3
kind: NetworkPolicy
metadata:
  name: glance-egress
  namespace: ma3x-glance
spec:
  selector: app == "glance"
  types:
    - Egress
  egress:
    # DNS resolution
    - action: Allow
      protocol: UDP
      destination:
        namespaceSelector: name == "kube-system"
        selector: k8s-app == "kube-dns"
        ports:
          - 53
    # External HTTP/HTTPS if your app needs it
    - action: Allow
      protocol: TCP
      destination:
        notNets:
          - "10.0.0.0/8"
          - "172.16.0.0/12"
          - "192.168.0.0/16"
        ports:
          - 80
          - 443