# Base egress for ALL Argo workflow pods: DNS, K8s API, MinIO (logging), Mattermost (notifications).
# Applies to every pod with app.kubernetes.io/part-of: foxhunt.
# Component-specific policies below add extra rules (GitLab SSH, external HTTPS, etc.).
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: argo-base-egress
  namespace: foxhunt
  labels:
    app.kubernetes.io/part-of: foxhunt
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/part-of: foxhunt
  policyTypes:
    - Egress
  egress:
    # DNS
    - ports:
        - port: 53
          protocol: UDP
        - port: 53
          protocol: TCP
    # Kubernetes API — Argo executor reports task results
    - ports:
        - port: 443
          protocol: TCP
        - port: 6443
          protocol: TCP
      to:
        - ipBlock:
            cidr: 10.32.0.0/16
        - ipBlock:
            cidr: 172.16.0.4/32
    # MinIO — log archival (Argo wait sidecar)
    - ports:
        - port: 9000
          protocol: TCP
      to:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: minio
    # Mattermost — exit handler webhook notifications
    - ports:
        - port: 8065
          protocol: TCP
      to:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: mattermost
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: argo-training-workflow
  namespace: foxhunt
  labels:
    app.kubernetes.io/part-of: foxhunt
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/component: training-workflow
  policyTypes:
    - Egress
  egress:
    # DNS — required for hostname resolution (minio, gitlab, etc.)
    - ports:
        - port: 53
          protocol: UDP
        - port: 53
          protocol: TCP
    # Kubernetes API — Argo executor reports task results
    - ports:
        - port: 443
          protocol: TCP
        - port: 6443
          protocol: TCP
      to:
        - ipBlock:
            cidr: 10.32.0.0/16
        - ipBlock:
            cidr: 172.16.0.4/32
    # HTTPS (external registries, etc.)
    - ports:
        - port: 443
          protocol: TCP
    # GitLab SSH — git clone
    - ports:
        - port: 2222
          protocol: TCP
      to:
        - ipBlock:
            cidr: 100.90.76.85/32
        - podSelector:
            matchLabels:
              app: gitlab-shell
    # GitLab API — binary fetch from packages
    - ports:
        - port: 8181
          protocol: TCP
      to:
        - podSelector:
            matchLabels:
              app: webservice
    # MinIO — log archival + result upload
    - ports:
        - port: 9000
          protocol: TCP
      to:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: minio
    # Pushgateway — Prometheus metrics
    - ports:
        - port: 9091
          protocol: TCP
      to:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: pushgateway
    # Tempo — OTLP traces
    - ports:
        - port: 4317
          protocol: TCP
      to:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: tempo
    # Mattermost — exit handler webhook notifications
    - ports:
        - port: 8065
          protocol: TCP
      to:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: mattermost
    # Container registry — image pulls
    - ports:
        - port: 5000
          protocol: TCP
      to:
        - podSelector:
            matchLabels:
              app: registry
---
# Compile workflow pods: need GitLab SSH, MinIO, k8s API, external HTTPS (cargo deps)
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: argo-compile-workflow
  namespace: foxhunt
  labels:
    app.kubernetes.io/part-of: foxhunt
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/component: compile
  policyTypes:
    - Egress
  egress:
    # DNS — resolve external hostnames (crates.io, github.com)
    - ports:
        - port: 53
          protocol: UDP
        - port: 53
          protocol: TCP
    # Kubernetes API — Argo executor
    - ports:
        - port: 443
          protocol: TCP
        - port: 6443
          protocol: TCP
      to:
        - ipBlock:
            cidr: 10.32.0.0/16
        - ipBlock:
            cidr: 172.16.0.4/32
    # External HTTPS — cargo fetches crates.io, github.com (candle git dep)
    - ports:
        - port: 443
          protocol: TCP
    # GitLab SSH — git clone (Tailscale IP + cluster service)
    - ports:
        - port: 2222
          protocol: TCP
      to:
        - ipBlock:
            cidr: 100.90.76.85/32
        - podSelector:
            matchLabels:
              app: gitlab-shell
    # MinIO — binary upload
    - ports:
        - port: 9000
          protocol: TCP
      to:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: minio
    # Mattermost — exit handler webhook notifications
    - ports:
        - port: 8065
          protocol: TCP
      to:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: mattermost
---
# Compile-and-deploy workflow pods: need GitLab HTTP (tagging/releases), MinIO,
# k8s API (deploy rollouts + Argo executor), DNS, GitLab SSH, external HTTPS.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: argo-compile-and-deploy-workflow
  namespace: foxhunt
  labels:
    app.kubernetes.io/part-of: foxhunt
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/component: compile-and-deploy
  policyTypes:
    - Egress
  egress:
    # DNS
    - ports:
        - port: 53
          protocol: UDP
        - port: 53
          protocol: TCP
    # Kubernetes API — Argo executor + kubectl rollout
    - ports:
        - port: 443
          protocol: TCP
        - port: 6443
          protocol: TCP
      to:
        - ipBlock:
            cidr: 10.32.0.0/16
        - ipBlock:
            cidr: 172.16.0.4/32
    # External HTTPS — cargo fetches, kubectl download
    - ports:
        - port: 443
          protocol: TCP
    # GitLab SSH — git clone
    - ports:
        - port: 2222
          protocol: TCP
      to:
        - ipBlock:
            cidr: 100.90.76.85/32
        - podSelector:
            matchLabels:
              app: gitlab-shell
    # GitLab webservice — CalVer tagging, releases, package uploads
    - ports:
        - port: 8181
          protocol: TCP
      to:
        - podSelector:
            matchLabels:
              app: webservice
    # MinIO — binary upload + log archival
    - ports:
        - port: 9000
          protocol: TCP
      to:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: minio
    # Mattermost — exit handler webhook notifications
    - ports:
        - port: 8065
          protocol: TCP
      to:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: mattermost
---
# Compile-and-train workflow pods: compile step needs GitLab SSH + external HTTPS + DNS,
# training steps need GitLab HTTP (package fetch/upload), MinIO, Tempo, k8s API.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: argo-train-workflow
  namespace: foxhunt
  labels:
    app.kubernetes.io/part-of: foxhunt
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/component: train
  policyTypes:
    - Egress
  egress:
    # DNS
    - ports:
        - port: 53
          protocol: UDP
        - port: 53
          protocol: TCP
    # Kubernetes API — Argo executor
    - ports:
        - port: 443
          protocol: TCP
        - port: 6443
          protocol: TCP
      to:
        - ipBlock:
            cidr: 10.32.0.0/16
        - ipBlock:
            cidr: 172.16.0.4/32
    # External HTTPS — cargo fetches crates.io, github.com (candle git dep)
    - ports:
        - port: 443
          protocol: TCP
    # GitLab SSH — git clone
    - ports:
        - port: 2222
          protocol: TCP
      to:
        - ipBlock:
            cidr: 100.90.76.85/32
        - podSelector:
            matchLabels:
              app: gitlab-shell
    # GitLab webservice — package upload/download
    - ports:
        - port: 8181
          protocol: TCP
      to:
        - podSelector:
            matchLabels:
              app: webservice
    # MinIO — binary upload
    - ports:
        - port: 9000
          protocol: TCP
      to:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: minio
    # Tempo — OTLP traces
    - ports:
        - port: 4317
          protocol: TCP
      to:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: tempo
    # Mattermost — exit handler webhook notifications
    - ports:
        - port: 8065
          protocol: TCP
      to:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: mattermost
---
# CI pipeline pods (detect-changes + compile-service inline templates)
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: argo-ci-pipeline
  namespace: foxhunt
  labels:
    app.kubernetes.io/part-of: foxhunt
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/component: ci-pipeline
  policyTypes:
    - Egress
  egress:
    # DNS — resolve external hostnames
    - ports:
        - port: 53
          protocol: UDP
        - port: 53
          protocol: TCP
    # Kubernetes API — Argo executor
    - ports:
        - port: 443
          protocol: TCP
        - port: 6443
          protocol: TCP
      to:
        - ipBlock:
            cidr: 10.32.0.0/16
        - ipBlock:
            cidr: 172.16.0.4/32
    # External HTTP/HTTPS — Kaniko base image pulls, apt-get, cargo fetches
    - ports:
        - port: 80
          protocol: TCP
        - port: 443
          protocol: TCP
    # GitLab SSH — git clone (compile-service uses ssh://git@git.fxhnt.ai)
    - ports:
        - port: 2222
          protocol: TCP
      to:
        - ipBlock:
            cidr: 100.90.76.85/32
        - podSelector:
            matchLabels:
              app: gitlab-shell
    # MinIO — binary upload from compile-service
    - ports:
        - port: 9000
          protocol: TCP
      to:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: minio
    # GitLab registry — Kaniko image push
    - ports:
        - port: 5000
          protocol: TCP
      to:
        - podSelector:
            matchLabels:
              app: registry
    # GitLab webservice — JWT auth for registry tokens
    - ports:
        - port: 8181
          protocol: TCP
      to:
        - podSelector:
            matchLabels:
              app: webservice
    # Mattermost — exit handler webhook notifications
    - ports:
        - port: 8065
          protocol: TCP
      to:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: mattermost
---
# ── sanitizer-test + nsys-test + smoke-test workflows: same egress as ci-pipeline ──
# (git fetch over SSH, MinIO log archive + nsys-rep upload, registry image pull,
# external HTTPS for mc download)
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: argo-sanitizer-nsys-workflow
  namespace: foxhunt
spec:
  podSelector:
    matchExpressions:
      - key: app.kubernetes.io/component
        operator: In
        values:
          - sanitizer-test
          - nsys-test
          - smoke-test
  policyTypes:
    - Egress
  egress:
    # DNS
    - ports:
        - port: 53
          protocol: UDP
        - port: 53
          protocol: TCP
    # Kubernetes API
    - ports:
        - port: 443
          protocol: TCP
        - port: 6443
          protocol: TCP
      to:
        - ipBlock:
            cidr: 10.32.0.0/16
        - ipBlock:
            cidr: 172.16.0.4/32
    # External HTTPS — mc binary download from dl.min.io
    - ports:
        - port: 80
          protocol: TCP
        - port: 443
          protocol: TCP
    # GitLab SSH — git fetch
    - ports:
        - port: 2222
          protocol: TCP
      to:
        - ipBlock:
            cidr: 100.90.76.85/32
        - podSelector:
            matchLabels:
              app: gitlab-shell
    # MinIO — log archive + nsys profile upload
    - ports:
        - port: 9000
          protocol: TCP
      to:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: minio
    # GitLab registry — ci-builder image pull
    - ports:
        - port: 5000
          protocol: TCP
      to:
        - podSelector:
            matchLabels:
              app: registry
    # GitLab webservice — JWT auth for registry tokens
    - ports:
        - port: 8181
          protocol: TCP
      to:
        - podSelector:
            matchLabels:
              app: webservice
