# Egress NetworkPolicies for the fxhnt cockpit, mirroring the per-service pattern (see `api`).
#
# The `app.kubernetes.io/part-of: foxhunt` label on the pods (a) satisfies the `postgres` ingress allow and
# (b) subjects them to `argo-base-egress` (DNS + 443-to-cluster only). These policies ADD the egress each
# workload actually needs on top of that baseline. NetworkPolicies are additive (union of allows).
---
# Dashboard: reads the cockpit DB only. DNS already granted by argo-base-egress via the part-of label.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: fxhnt-dashboard
  namespace: foxhunt
  labels: { app.kubernetes.io/part-of: foxhunt }
spec:
  podSelector:
    matchLabels: { app.kubernetes.io/name: fxhnt-dashboard }
  policyTypes: [Egress]
  egress:
    - to:                                       # cockpit -> postgres (identity match; Cilium needs podSelector, not ipBlock)
        - podSelector: { matchLabels: { app.kubernetes.io/name: postgres } }
      ports:
        - { port: 5432, protocol: TCP }
    - to:                                       # git-sync initContainer -> gitea-sshd (svc :22 -> rootless pod :2222)
        - podSelector: { matchLabels: { app.kubernetes.io/name: gitea } }
      ports:
        - { port: 2222, protocol: TCP }
        - { port: 22, protocol: TCP }
    - ports:                                    # DNS
        - { port: 53, protocol: UDP }
        - { port: 53, protocol: TCP }
    - to: [{ ipBlock: { cidr: 172.16.0.11/32 } }]   # kube-apiserver REAL endpoint (kube-proxy DNATs kubernetes.default.svc 10.32.0.1:443 -> this before NP eval). The tailscale sidecar reads/writes its ts-state Secret via the apiserver — WITHOUT this it crashloops "context deadline exceeded" on a fresh start (e.g. after the deploy scale-0->1), causing a bad gateway. Mirrors the dagster NP fix (06d12fd).
      ports: [{ port: 6443, protocol: TCP }]
    - to:                                       # tailscale sidecar -> coordination/DERP (public internet). except now includes 172.16.0.0/16 so the apiserver rule above is the only cluster-internal path.
        - ipBlock: { cidr: 0.0.0.0/0, except: [10.32.0.0/16, 100.64.0.0/15, 172.16.0.0/16] }
      ports:
        - { port: 443, protocol: TCP }
        - { port: 3478, protocol: UDP }
        - { port: 41641, protocol: UDP }
---
# Factory CronJob: reads/writes the cockpit DB only — no public internet needed.
# DNS already granted by argo-base-egress via the part-of label.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: fxhnt-factory
  namespace: foxhunt
  labels: { app.kubernetes.io/part-of: foxhunt }
spec:
  podSelector:
    matchLabels: { app.kubernetes.io/name: fxhnt-factory }
  policyTypes: [Egress]
  egress:
    - to:                                       # factory -> postgres (identity match)
        - podSelector: { matchLabels: { app.kubernetes.io/name: postgres } }
      ports:
        - { port: 5432, protocol: TCP }
    - ports:                                    # DNS
        - { port: 53, protocol: UDP }
        - { port: 53, protocol: TCP }
