# Network policies for maintenance CronJobs (postgres-backup, pvc-autoscaler)
# These jobs need egress to internal services but no internet access.
# Apply: kubectl apply -f maintenance-jobs.yaml
---
# Postgres backup job: egress to postgres (5432) + minio (9000)
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: postgres-backup
  namespace: foxhunt
spec:
  podSelector:
    matchLabels:
      app: postgres-backup
  policyTypes:
    - Egress
  egress:
    # DNS
    - ports:
        - protocol: UDP
          port: 53
        - protocol: TCP
          port: 53
    # Postgres
    - to:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: postgres
      ports:
        - protocol: TCP
          port: 5432
    # MinIO (backup upload)
    - to:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: minio
      ports:
        - protocol: TCP
          port: 9000
---
# PVC autoscaler job: egress to K8s API + kubelet stats
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: pvc-autoscaler
  namespace: foxhunt
spec:
  podSelector:
    matchLabels:
      app: pvc-autoscaler
  policyTypes:
    - Egress
  egress:
    # DNS
    - ports:
        - protocol: UDP
          port: 53
        - protocol: TCP
          port: 53
    # Kubernetes API server (HTTPS)
    - ports:
        - protocol: TCP
          port: 443
    # Kubelet stats API (port 10250)
    - ports:
        - protocol: TCP
          port: 10250
