saved working code

apps/order-service/base/deployment.yaml

@@ -3,6 +3,10 @@ kind: Deployment
 metadata:
   name: order-service
 
+  annotations:
+
+    instrumentation.opentelemetry.io/inject-java: "true"
+
 spec:
   replicas: 2
 
@@ -22,6 +26,8 @@ spec:
     metadata:
       labels:
         app: order-service
+        networkpolicy.enabled: "true"
+        pdb.enabled: "true"
 
     spec:
       terminationGracePeriodSeconds: 30
@@ -97,6 +103,14 @@ spec:
             - containerPort: 8083
 
           env:
+            - name: OTEL_SERVICE_NAME
+              value: order-service
+
+            - name: OTEL_RESOURCE_ATTRIBUTES
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+
             - name: DB_HOST
               valueFrom:
                 secretKeyRef:

apps/order-service/base/kustomization.yaml

@@ -4,4 +4,5 @@ kind: Kustomization
 resources:
   - deployment.yaml
   - service.yaml
-  - poddisruption.yaml
+  - poddisruption.yaml
+  - networkpolicies/

apps/order-service/base/networkpolicies/allow-dns.yaml

@@ -0,0 +1,31 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+
+metadata:
+  name: allow-dns
+
+spec:
+  podSelector:
+    matchLabels:
+      app: order-service
+
+  policyTypes:
+    - Egress
+
+  egress:
+    - to:
+
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+
+      ports:
+        - protocol: UDP
+          port: 53
+
+        - protocol: TCP
+          port: 53

apps/order-service/base/networkpolicies/allow-ingress.yaml

@@ -0,0 +1,24 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+
+metadata:
+  name: allow-ingress
+
+spec:
+  podSelector:
+    matchLabels:
+      app: order-service
+
+  policyTypes:
+    - Ingress
+
+  ingress:
+    - from:
+
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: ingress-system
+
+      ports:
+        - protocol: TCP
+          port: 8083

apps/order-service/base/networkpolicies/allow-postgres.yaml

@@ -0,0 +1,23 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+
+metadata:
+  name: allow-postgres
+
+spec:
+  podSelector:
+    matchLabels:
+      app: order-service
+
+  policyTypes:
+    - Egress
+
+  egress:
+    - to:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: postgresql
+
+      ports:
+        - protocol: TCP
+          port: 5432

apps/order-service/base/networkpolicies/allow-prometheus.yaml

@@ -0,0 +1,28 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+
+metadata:
+  name: allow-prometheus
+
+spec:
+  podSelector:
+    matchLabels:
+      app: order-service
+
+  policyTypes:
+    - Ingress
+
+  ingress:
+    - from:
+
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: monitoring
+
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: prometheus
+
+      ports:
+        - protocol: TCP
+          port: 8083

apps/order-service/base/networkpolicies/allow-redis.yaml

@@ -0,0 +1,23 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+
+metadata:
+  name: allow-redis
+
+spec:
+  podSelector:
+    matchLabels:
+      app: order-service
+
+  policyTypes:
+    - Egress
+
+  egress:
+    - to:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: redis
+
+      ports:
+        - protocol: TCP
+          port: 6379

apps/order-service/base/networkpolicies/default-deny.yaml

@@ -0,0 +1,12 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+
+metadata:
+  name: default-deny
+
+spec:
+  podSelector: {}
+
+  policyTypes:
+    - Ingress
+    - Egress

apps/order-service/base/networkpolicies/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - default-deny.yaml
+  - allow-ingress.yaml
+  - allow-dns.yaml
+  - allow-prometheus.yaml

apps/order-service/overlays/dev/kustomization.yaml

@@ -10,7 +10,7 @@ namespace: dev
 images:
   - name: 579871530627.dkr.ecr.us-east-1.amazonaws.com/ja-mics-ap/order-service
     newName: 579871530627.dkr.ecr.us-east-1.amazonaws.com/ja-mics-ap/order-service
-    newTag: 345d54e836039442ab120287b7961cd092761182
+    newTag: 75c566e3063d58803f614facda8a3a6e0df6e812
 
 replicas:
 - count: 1

apps/payment-service/base/deployment.yaml

@@ -3,6 +3,10 @@ kind: Deployment
 metadata:
   name: payment-service
 
+  annotations:
+
+    instrumentation.opentelemetry.io/inject-java: "true"
+
 spec:
   replicas: 2
 
@@ -22,6 +26,8 @@ spec:
     metadata:
       labels:
         app: payment-service
+        networkpolicy.enabled: "true"
+        pdb.enabled: "true"
 
     spec:
       terminationGracePeriodSeconds: 30
@@ -97,6 +103,14 @@ spec:
             - containerPort: 8084
 
           env:
+            - name: OTEL_SERVICE_NAME
+              value: payment-service
+
+            - name: OTEL_RESOURCE_ATTRIBUTES
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+
             - name: DB_HOST
               valueFrom:
                 secretKeyRef:

apps/payment-service/base/kustomization.yaml

@@ -4,4 +4,5 @@ kind: Kustomization
 resources:
   - deployment.yaml
   - service.yaml
-  - poddisruption.yaml
+  - poddisruption.yaml
+  - networkpolicies/

apps/payment-service/base/networkpolicies/allow-dns.yaml

@@ -0,0 +1,31 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+
+metadata:
+  name: allow-dns
+
+spec:
+  podSelector:
+    matchLabels:
+      app: order-service
+
+  policyTypes:
+    - Egress
+
+  egress:
+    - to:
+
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+
+      ports:
+        - protocol: UDP
+          port: 53
+
+        - protocol: TCP
+          port: 53

apps/payment-service/base/networkpolicies/allow-ingress.yaml

@@ -0,0 +1,24 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+
+metadata:
+  name: allow-ingress
+
+spec:
+  podSelector:
+    matchLabels:
+      app: order-service
+
+  policyTypes:
+    - Ingress
+
+  ingress:
+    - from:
+
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: ingress-system
+
+      ports:
+        - protocol: TCP
+          port: 8084

apps/payment-service/base/networkpolicies/allow-postgres.yaml

@@ -0,0 +1,23 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+
+metadata:
+  name: allow-postgres
+
+spec:
+  podSelector:
+    matchLabels:
+      app: order-service
+
+  policyTypes:
+    - Egress
+
+  egress:
+    - to:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: postgresql
+
+      ports:
+        - protocol: TCP
+          port: 5432

apps/payment-service/base/networkpolicies/allow-prometheus.yaml

@@ -0,0 +1,28 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+
+metadata:
+  name: allow-prometheus
+
+spec:
+  podSelector:
+    matchLabels:
+      app: order-service
+
+  policyTypes:
+    - Ingress
+
+  ingress:
+    - from:
+
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: monitoring
+
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: prometheus
+
+      ports:
+        - protocol: TCP
+          port: 8084

apps/payment-service/base/networkpolicies/allow-redis.yaml

@@ -0,0 +1,23 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+
+metadata:
+  name: allow-redis
+
+spec:
+  podSelector:
+    matchLabels:
+      app: order-service
+
+  policyTypes:
+    - Egress
+
+  egress:
+    - to:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: redis
+
+      ports:
+        - protocol: TCP
+          port: 6379