# NetworkPolicy — restrict traffic to only what EDDI needs
#
# Allows:
#   - Ingress: HTTP (7070) from any pod in the eddi namespace
#   - Egress: MongoDB (27017), PostgreSQL (5432), NATS (4222),
#             Keycloak (8080), DNS, and external HTTPS (LLM APIs)
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: eddi-network-policy
  labels:
    app.kubernetes.io/name: eddi
    app.kubernetes.io/part-of: eddi
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: eddi
      app.kubernetes.io/component: server
  policyTypes:
    - Ingress
    - Egress
  ingress:
    # Allow traffic from within the namespace (Ingress controller, Manager, etc.)
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: eddi
      ports:
        - protocol: TCP
          port: 7070
    # Allow traffic from Ingress controllers (typically in a different namespace)
    - from:
        - namespaceSelector: {}
          podSelector:
            matchLabels:
              app.kubernetes.io/name: ingress-nginx
      ports:
        - protocol: TCP
          port: 7070
  egress:
    # DNS
    - to:
        - namespaceSelector: {}
      ports:
        - protocol: UDP
          port: 53
        - protocol: TCP
          port: 53
    # MongoDB
    - to:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: mongodb
      ports:
        - protocol: TCP
          port: 27017
    # PostgreSQL
    - to:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: postgres
      ports:
        - protocol: TCP
          port: 5432
    # NATS
    - to:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: nats
      ports:
        - protocol: TCP
          port: 4222
    # Keycloak
    - to:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: keycloak
      ports:
        - protocol: TCP
          port: 8080
    # External HTTPS — LLM API providers (OpenAI, Anthropic, etc.)
    - to:
        - ipBlock:
            cidr: 0.0.0.0/0
            except:
              - 10.0.0.0/8
              - 172.16.0.0/12
              - 192.168.0.0/16
      ports:
        - protocol: TCP
          port: 443
