apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: argo-gpu-test-workflow
  namespace: foxhunt
  labels:
    app.kubernetes.io/part-of: foxhunt
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/component: gpu-test
  policyTypes:
    - Egress
  egress:
    # DNS
    - ports:
        - port: 53
          protocol: UDP
        - port: 53
          protocol: TCP
    # Kubernetes API + internal services (service CIDR)
    - ports:
        - port: 443
          protocol: TCP
        - port: 6443
          protocol: TCP
      to:
        - ipBlock:
            cidr: 10.32.0.0/16
        - ipBlock:
            cidr: 172.16.0.4/32
    # HTTPS egress (crates.io, etc.)
    - ports:
        - port: 443
          protocol: TCP
    # Git SSH (GitLab)
    - ports:
        - port: 2222
          protocol: TCP
      to:
        - ipBlock:
            cidr: 100.90.76.85/32
        - podSelector:
            matchLabels:
              app: gitlab-shell
    # GitLab webservice (git-http)
    - ports:
        - port: 8181
          protocol: TCP
      to:
        - podSelector:
            matchLabels:
              app: webservice
    # MinIO (artifact/log storage)
    - ports:
        - port: 9000
          protocol: TCP
      to:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: minio
    # Pushgateway (Prometheus metrics)
    - ports:
        - port: 9091
          protocol: TCP
      to:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: pushgateway
    # OTLP (Tempo)
    - ports:
        - port: 4317
          protocol: TCP
      to:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: tempo
    # Mattermost (notifications)
    - ports:
        - port: 8065
          protocol: TCP
      to:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: mattermost
    # GitLab container registry
    - ports:
        - port: 5000
          protocol: TCP
      to:
        - podSelector:
            matchLabels:
              app: registry