kind: Ingress
spec:
  tls: [{ hosts: [shop.example.com], secretName: shop-cert }]
  rules:
  - host: shop.example.com
    http: { paths: [{ path: /, backend: web:80 }, { path: /api, backend: api:80 }] }
  - host: admin.example.com
    http: { paths: [{ path: /, backend: admin:80 }] }
---
kind: NetworkPolicy        # allow api → db (plus a default-deny policy)
spec: { podSelector: { matchLabels: { app: db } }, policyTypes: [Ingress],
        ingress: [{ from: [{ podSelector: { matchLabels: { app: api } } }] }] }
Ringed dot: an outside HTTPS request, until the Ingress terminates TLSPod lamp: traffic let inRed: web → db, dropped when the allow-list does not include itAn Ingress is a set of HTTP routing rules, by host name and path, to Services; an Ingress controller, here ingress-nginx, is the proxy that reads them, terminates TLS with a certificate from a Secret, and forwards requests into the cluster. NetworkPolicy works the other way, inside the cluster: by default every pod accepts traffic from every other pod. Once a policy selects a pod, only the traffic some policy allows gets in, so the usual pattern is a default-deny policy plus narrow allow rules, such as letting only api talk to db.
Next: ConfigMaps & Secrets →