apiVersion: networking.k8s.io/v1
kind: NetworkPolicy   # https://kubernetes.io/docs/concepts/services-networking/network-policies/
metadata:
  name: restriction-service
  namespace: default
spec:
  podSelector:
    matchLabels:
      app: unserveur
  policyTypes:
  - Ingress   # par défaut
#  - Egress
  ingress:
  - from:
#    - ipBlock:
#        cidr: 172.17.0.0/16
#        except:
#        - 172.17.1.0/24
#    - namespaceSelector:   # While NetworkPolicy cannot target a namespace by its name with some object field,
#        matchLabels:       #   you can use the standardized label to target a specific namespace
#          project: myproject
    - podSelector:
        matchLabels:
          app: leclient
      namespaceSelector:   # NOTER absence - devant namespaceSelector, ce qui implique qu'il est combiné avec podSelector 
        matchLabels:
          espace: clients
    ports:
    - protocol: TCP
      port: 80
#  egress:
#  - to:
#    - ipBlock:
#        cidr: 10.0.0.0/24
#    ports:
#    - protocol: TCP
#      port: 5978
