# NetworkPolicy (task 46). Default-deny for the app pods.
#
# Selecting the pods below with BOTH policy types makes this a default-deny
# for them in any CNI that enforces NetworkPolicy (Calico, Cilium, ...): only
# the flows listed here are admitted, everything else is dropped. A CNI that
# ignores NetworkPolicy does not apply this control; verify the cluster CNI.
#
# Egress:
# - DNS only, to the `kube-system` namespace on port 53 (UDP + TCP). Adjust if
#   CoreDNS runs elsewhere; NodeLocal DNSCache also lives in `kube-system`, so
#   it is covered.
# - Postgres (5432) and Redis (6379) scoped to the namespace that hosts them.
#   The reference ConfigMap DSNs point at `*.d-oauth.svc.cluster.local`, so the
#   default selects the `d-oauth` namespace. There is deliberately NO
#   `ipBlock: 0.0.0.0/0` peer: that would leave both ports as an exfiltration
#   channel to any internet host. Point the selector at the data namespace if
#   it differs, and AND in a `podSelector` for their labels to admit only the
#   database and cache pods rather than the whole namespace.
# - A managed database outside the cluster cannot be named by a selector. Give
#   its private endpoint a specific `ipBlock` CIDR (never `0.0.0.0/0`) or, on a
#   CNI with FQDN policy (Cilium `toFQDNs`), the DNS name. Every `ipBlock` peer
#   must exclude `169.254.0.0/16` so the cloud metadata endpoint
#   (`169.254.169.254`) can never be reached.
# - Everything else, including the Kubernetes API and arbitrary HTTPS
#   exfiltration, is denied. The app never calls the API and runs with
#   `automountServiceAccountToken: false`.
#
# Ingress: only the public TLS port (8080) and the plaintext health port
# (8081) are reachable. NetworkPolicy cannot name a Service (the Service is
# virtual, and traffic arrives from the L4 gateway or the kubelet), so the
# source is unrestricted but the ports are not. The Service keeps publishing
# 8080 only; 8081 must never be internet-facing.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: d-oauth-server
  namespace: d-oauth
  labels:
    app.kubernetes.io/name: d-oauth-server
    app.kubernetes.io/part-of: d-oauth
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: d-oauth-server
  policyTypes:
    - Ingress
    - Egress
  ingress:
    - ports:
        - port: 8080
          protocol: TCP
        - port: 8081
          protocol: TCP
  egress:
    # DNS (kube-dns / CoreDNS in kube-system).
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
      ports:
        - port: 53
          protocol: UDP
        - port: 53
          protocol: TCP
    # Postgres + Redis, scoped to their namespace (the reference deployment
    # runs the data services alongside the app in `d-oauth`). No internet-wide
    # `ipBlock`: these ports are not an exfiltration channel.
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: d-oauth
      ports:
        - port: 5432
          protocol: TCP
        - port: 6379
          protocol: TCP