# Allow Prometheus to scrape metrics ports on all foxhunt + CI pods.
# Also allow all foxhunt + CI pods to push traces to Tempo.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-monitoring-scrape
  namespace: foxhunt
  labels:
    app.kubernetes.io/part-of: foxhunt
spec:
  podSelector:
    matchExpressions:
      - key: app.kubernetes.io/part-of
        operator: In
        values: ["foxhunt", "foxhunt-ci"]
  policyTypes:
    - Ingress
    - Egress
  ingress:
    - from:
        # External monitoring namespace (if any)
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: monitoring
        # GitLab Prometheus in foxhunt namespace
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: prometheus
      ports:
        - protocol: TCP
          port: 8080
        - protocol: TCP
          port: 9003
        - protocol: TCP
          port: 9091
        - protocol: TCP
          port: 9092
        - protocol: TCP
          port: 9093
        - protocol: TCP
          port: 9094
        - protocol: TCP
          port: 9095
        - protocol: TCP
          port: 9096
        - protocol: TCP
          port: 9097
        - protocol: TCP
          port: 9098
  egress:
    # Tempo OTLP gRPC
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: foxhunt
          podSelector:
            matchLabels:
              app.kubernetes.io/name: tempo
      ports:
        - protocol: TCP
          port: 4317
    # Kubernetes API (for kube-state-metrics list/watch)
    - to:
        - ipBlock:
            cidr: 10.32.0.0/16
      ports:
        - protocol: TCP
          port: 443
        - protocol: TCP
          port: 6443
    - to:
        - ipBlock:
            cidr: 172.16.0.0/16
      ports:
        - protocol: TCP
          port: 6443
