# The broker has no Service and shares the server pod, so its socket is
# already unreachable over the network. These policies enforce the rest of
# the §15 topology: the database secret-holders are the only egress-capable
# pods, and the frontend can reach only the server.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: teamclaw-frontend-egress
  labels: {{- include "teamclaw.labels" . | nindent 4 }}
spec:
  podSelector:
    matchLabels: {{- include "teamclaw.frontendSelector" . | nindent 6 }}
  policyTypes: [Egress]
  egress:
    # DNS, then only the server.
    - to: []
      ports:
        - { protocol: UDP, port: 53 }
        - { protocol: TCP, port: 53 }
    - to:
        - podSelector:
            matchLabels: {{- include "teamclaw.serverSelector" . | nindent 14 }}
      ports:
        - { protocol: TCP, port: 8080 }
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: teamclaw-server-ingress
  labels: {{- include "teamclaw.labels" . | nindent 4 }}
spec:
  podSelector:
    matchLabels: {{- include "teamclaw.serverSelector" . | nindent 6 }}
  policyTypes: [Ingress]
  ingress:
    - from:
        - podSelector:
            matchLabels: {{- include "teamclaw.frontendSelector" . | nindent 14 }}
        # Ingress controller namespaces vary; admit via namespace selector.
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: ingress-nginx
      ports:
        - { protocol: TCP, port: 8080 }