---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: node1-deny-traffic-except-platform
  namespace: test
spec:
  podSelector:
    matchLabels:
      app: node1
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - ipBlock:
        cidr: 10.233.0.0/17
    - namespaceSelector:
        matchLabels:
          namespace: testpods
  egress:
  - to:
    - ipBlock:
        cidr: 10.233.0.0/17
    - namespaceSelector:
        matchLabels:
          namespace: testpods

---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: node2-deny-traffic-except-platform
  namespace: test
spec:
  podSelector:
    matchLabels:
      app: node2
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - ipBlock:
        cidr: 10.233.0.0/17
    - namespaceSelector:
        matchLabels:
          namespace: testpods
  egress:
  - to:
    - ipBlock:
        cidr: 10.233.0.0/17
    - namespaceSelector:
        matchLabels:
          namespace: testpods

---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: node3-deny-traffic-except-platform
  namespace: test
spec:
  podSelector:
    matchLabels:
      app: node3
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - ipBlock:
        cidr: 10.233.0.0/17
    - namespaceSelector:
        matchLabels:
          namespace: testpods
  egress:
  - to:
    - ipBlock:
        cidr: 10.233.0.0/17
    - namespaceSelector:
        matchLabels:
          namespace: testpods

---
kind: PersistentVolume
apiVersion: v1
metadata:
  name: pv-node1
  namespace: test
  labels:
    type: local
spec:
  storageClassName: hostssd
  capacity:
    storage: 10Gi
  accessModes:
    - ReadWriteOnce
  hostPath:
    path: "/mnt/node1"

---
kind: PersistentVolumeClaim
apiVersion: v1
metadata:
  name: pv-node1-claim
  namespace: test
spec:
  storageClassName: hostssd
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 10Gi



---
kind: PersistentVolume
apiVersion: v1
metadata:
  name: pv-node2
  namespace: test
  labels:
    type: local
spec:
  storageClassName: hostssd
  capacity:
    storage: 10Gi
  accessModes:
    - ReadWriteOnce
  hostPath:
    path: "/mnt/node2"

---
kind: PersistentVolumeClaim
apiVersion: v1
metadata:
  name: pv-node2-claim
  namespace: test
spec:
  storageClassName: hostssd
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 10Gi



---
kind: PersistentVolume
apiVersion: v1
metadata:
  name: pv-node3
  namespace: test
  labels:
    type: local
spec:
  storageClassName: hostssd
  capacity:
    storage: 10Gi
  accessModes:
    - ReadWriteOnce
  hostPath:
    path: "/mnt/node3"

---
kind: PersistentVolumeClaim
apiVersion: v1
metadata:
  name: pv-node3-claim
  namespace: test
spec:
  storageClassName: hostssd
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 10Gi



---
apiVersion: v1
kind: Service
metadata:
  name: node1
  namespace: test
  labels:
    app: node1
spec:
  ports:
  - name: node1-api
    port: 56833
    targetPort: node1-api
  selector:
    app: node1


---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: node1
  labels:
    app: node1
  namespace: test
spec:
  replicas: 1
  revisionHistoryLimit: 2
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
  selector:
    matchLabels:
      app: node1
  template:
    metadata:
      labels:
        app: node1
    spec:
      containers:
      - name: node1
        image: _IMAGE_NAME_:_VERSION_
        command: ["dotnet"]
        args: ["DeStream.DeStreamD.dll","-addnode=node2","-addnode=node3","IpRangeFiltering=false"]
        ports:
        - name: node1-api
          containerPort: 56833
        volumeMounts:
        - name: pv-node1
          mountPath: "/root/.destreamnode"
      nodeName: node1
      imagePullSecrets:
      - name: registrypullsecret
      volumes:
      - name: pv-node1
        persistentVolumeClaim:
          claimName: pv-node1-claim


---
apiVersion: v1
kind: Service
metadata:
  name: node2
  namespace: test
  labels:
    app: node2
spec:
  ports:
  - name: node2-api
    port: 56833
    targetPort: node2-api
  selector:
    app: node2

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: node2
  labels:
    app: node2
  namespace: test
spec:
  replicas: 1
  revisionHistoryLimit: 2
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
  selector:
    matchLabels:
      app: node2
  template:
    metadata:
      labels:
        app: node2
    spec:
      containers:
      - name: node2
        image: _IMAGE_NAME_:_VERSION_
        command: ["dotnet"]
        args: ["DeStream.DeStreamD.dll","-addnode=node1","-addnode=node3","IpRangeFiltering=false"]
        ports:
        - name: node2-api
          containerPort: 56833
        volumeMounts:
        - name: pv-node2
          mountPath: "/root/.destreamnode"
      nodeName: node2
      imagePullSecrets:
      - name: registrypullsecret
      volumes:
      - name: pv-node2
        persistentVolumeClaim:
          claimName: pv-node2-claim


---
apiVersion: v1
kind: Service
metadata:
  name: node3
  namespace: test
  labels:
    app: node3
spec:
  ports:
  - name: node3-api
    port: 56833
    targetPort: node3-api
  selector:
    app: node3

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: node3
  labels:
    app: node3
  namespace: test
spec:
  replicas: 1
  revisionHistoryLimit: 2
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
  selector:
    matchLabels:
      app: node3
  template:
    metadata:
      labels:
        app: node3
    spec:
      containers:
      - name: node3
        image: _IMAGE_NAME_:_VERSION_
        command: ["dotnet"]
        args: ["DeStream.DeStreamD.dll","-addnode=node1","-addnode=node2","IpRangeFiltering=false"]
        ports:
        - name: node3-api
          containerPort: 56833
        volumeMounts:
        - name: pv-node3
          mountPath: "/root/.destreamnode"
      nodeName: node3
      imagePullSecrets:
      - name: registrypullsecret
      volumes:
      - name: pv-node3
        persistentVolumeClaim:
          claimName: pv-node3-claim
