custom-network-policy-postgresql-cluster.yml

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: {{ .Release.Name }}-postgresql
  namespace: {{ $.Release.Namespace }}
  labels:
    {{- include "common.resource-labels" . | indent 4 }}
spec:
  podSelector:
    matchExpressions:
      - key: cnpg.io/cluster
        operator: In
        values: 
          - {{ $.Release.Name }}
  policyTypes:
    - Ingress
  ingress:
    # Accept traffic from pomerium
    - ports:
        - protocol: TCP
          port: 5432
      from:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: pomerium
              app.kubernetes.io/instance: {{ .Release.Name }}