apiVersion: v1
kind: ConfigMap
metadata:
  name: membership-config
  namespace: {{ www_namespace }}
data:
{% for key, value in www_membership_environment | dictsort %}
  {{ key }}: {{ value | string | to_json }}
{% endfor %}
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: membership-tiers
  namespace: {{ www_namespace }}
data:
  tiers.json: {{ www_membership_tiers | to_json | to_json }}
---
# Only Apache may assert the trusted proxy headers to the membership service.
# Requires a CNI which actually enforces NetworkPolicy.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: membership-web
  namespace: {{ www_namespace }}
spec:
  podSelector:
    matchLabels:
      app: membership
  policyTypes: [Ingress]
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: httpd
      ports:
        - protocol: TCP
          port: 8000
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: membership-worker
  namespace: {{ www_namespace }}
spec:
  podSelector:
    matchLabels:
      app: membership-worker
  policyTypes: [Ingress]
  ingress: []
{% if www_membership_postgres_managed %}
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: membership-db
  namespace: {{ www_namespace }}
spec:
  podSelector:
    matchLabels:
      app: membership-db
  policyTypes: [Ingress]
  ingress:
    - from:
        - podSelector:
            matchLabels:
              www-membership-client: "true"
      ports:
        - protocol: TCP
          port: 5432
{% endif %}