apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: api
  namespace: foxhunt
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: api
  policyTypes:
    - Ingress
    - Egress
  ingress:
    # Tailscale ingress proxy
    - from:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: tailscale-gitlab-proxy
      ports:
        - protocol: TCP
          port: 50051
  egress:
    # Postgres
    - to:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: postgres
      ports:
        - protocol: TCP
          port: 5432
    # Redis
    - to:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: redis
      ports:
        - protocol: TCP
          port: 6379
    # Downstream gRPC services
    - to:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: trading-service
      ports:
        - protocol: TCP
          port: 50051
    - to:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: backtesting-service
      ports:
        - protocol: TCP
          port: 50053
    - to:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: ml-training-service
      ports:
        - protocol: TCP
          port: 50053
    - to:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: trading-agent-service
      ports:
        - protocol: TCP
          port: 50055
    - to:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: broker-gateway
      ports:
        - protocol: TCP
          port: 50056
    - to:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: data-acquisition-service
      ports:
        - protocol: TCP
          port: 50057
    # Prometheus (metric scraping from monitoring handler)
    - to:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: prometheus
      ports:
        - protocol: TCP
          port: 9090
    # Minio (initContainer binary fetch)
    - to:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: minio
      ports:
        - protocol: TCP
          port: 9000
    # Kubernetes API (pod listing for Pods cockpit)
    - to:
        - ipBlock:
            cidr: 10.32.0.0/12
      ports:
        - protocol: TCP
          port: 443
    - to:
        - ipBlock:
            cidr: 172.16.0.0/16
      ports:
        - protocol: TCP
          port: 6443