---
apiVersion: "k8s.cni.cncf.io/v1"
kind: NetworkAttachmentDefinition
metadata:
  namespace: default
  name: macvlan1-simple
spec: 
  config: '{
            "cniVersion": "0.3.1",
            "name": "macvlan1-simple",
            "plugins": [
                {
                    "type": "macvlan",
                    "mode": "bridge",
                    "ipam":{
                      "type":"host-local",
                      "subnet":"2.2.6.0/24",
                      "rangeStart":"2.2.6.8",
                      "rangeEnd":"2.2.6.67"
                    }
                }]
        }'
---
# namespace for MultiNetworkPolicy 
apiVersion: v1
kind: Namespace
metadata:
    name: test-simple-v4-ingress
    labels:
      pod-security.kubernetes.io/audit: privileged
      pod-security.kubernetes.io/enforce: privileged
      pod-security.kubernetes.io/warn: privileged
      security.openshift.io/scc.podSecurityLabelSync: "false"

---
# Pods
apiVersion: v1
kind: Pod
metadata:
  name: pod-server
  namespace: test-simple-v4-ingress
  annotations:
    k8s.v1.cni.cncf.io/networks: default/macvlan1-simple
  labels:
    app: test-simple-v4-ingress
    name: pod-server
spec:
  containers:
  - name: macvlan-worker1
    image: ghcr.io/k8snetworkplumbingwg/multi-networkpolicy-iptables:e2e-test
    command: ["nc", "-klp", "5555"]
    securityContext:
      privileged: true
---
apiVersion: v1
kind: Pod
metadata:
  name: pod-client-a
  namespace: test-simple-v4-ingress
  annotations:
    k8s.v1.cni.cncf.io/networks: default/macvlan1-simple
  labels:
    app: test-simple-v4-ingress
    name: pod-client-a
spec:
  containers:
  - name: macvlan-worker1
    image: ghcr.io/k8snetworkplumbingwg/multi-networkpolicy-iptables:e2e-test
    command: ["nc", "-klp", "5555"]
    securityContext:
      privileged: true
---
apiVersion: v1
kind: Pod
metadata:
  name: pod-client-b
  namespace: test-simple-v4-ingress
  annotations:
    k8s.v1.cni.cncf.io/networks: default/macvlan1-simple
  labels:
    app: test-simple-v4-ingress
    name: pod-client-b
spec:
  containers:
  - name: macvlan-worker1
    image: ghcr.io/k8snetworkplumbingwg/multi-networkpolicy-iptables:e2e-test
    command: ["nc", "-klp", "5555"]
    securityContext:
      privileged: true
---
# MultiNetworkPolicies
# this policy accepts ingress trafic from pod-client-a to pod-server
apiVersion: k8s.cni.cncf.io/v1beta1
kind: MultiNetworkPolicy
metadata:
  name: test-multinetwork-policy-simple-1
  namespace: test-simple-v4-ingress
  annotations:
    k8s.v1.cni.cncf.io/policy-for: default/macvlan1-simple
spec:
  podSelector:
    matchLabels:
      name: pod-server
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          name: pod-client-a
