# Requires the academy-demo namespace from workload.yaml.
# RBAC grants Deployment access to an EXAMPLE group. Map to your IdP group.
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: application-developer
  namespace: academy-demo
rules:
  - apiGroups: [apps]
    resources: [deployments]
    verbs: [get, list, watch, create, update, patch]
  - apiGroups: ['']
    resources: [pods, services]
    verbs: [get, list, watch]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: application-developers
  namespace: academy-demo
subjects:
  - kind: Group
    name: example-academy-developers
    apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: application-developer
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: v1
kind: ResourceQuota
metadata:
  name: team-budget
  namespace: academy-demo
spec:
  hard:
    requests.cpu: '2'
    requests.memory: 2Gi
    limits.cpu: '4'
    limits.memory: 4Gi
    pods: '12'
---
# Denies inbound traffic except namespace-local traffic to the demo web port.
# Requires an enforcing CNI. Egress remains unconstrained in this example.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: web-namespace-only
  namespace: academy-demo
spec:
  podSelector:
    matchLabels:
      app: web
  policyTypes: [Ingress]
  ingress:
    - from:
        - podSelector: {}
      ports:
        - protocol: TCP
          port: 8080