{{- /*
NetworkPolicy for minecraft-router (Gitea #5).

The router is the one chart here whose whole job is to forward traffic to OTHER
releases, so its egress rule is the interesting one and it is DERIVED from the
routing table rather than guessed: server.backendPort, plus the per-mapping
"port" override for every entry of mappings that has one. Add a backend on a
non-standard port and the policy follows it, because both come from the same
value.

What it does NOT express is the destination. The mappings name hosts
(internalUrl), and a NetworkPolicy matches CIDRs and selectors and never
hostnames - so the rule permits those PORTS to any address, not those services.
A backend in another namespace is reachable through this rule; so is anything
else listening on 25565.

Inbound splits in two: the proxy port is a NodePort and faces the internet, the
API port is the probe path.

WHAT THIS OBJECT IS: a ceiling on reachability, not an authentication layer.
Only the ports declared below are reachable at all - whatever else the process
binds, now or after the next app update, is blocked without anyone having to
notice it exists.

WHAT IT IS NOT:
  - EGRESS IS COARSE. A NetworkPolicy matches CIDRs and selectors and NEVER
    hostnames, so "only to the database host" cannot be expressed at all. This
    cluster's CNI is Canal (Flannel plus Calico for policy) and has no FQDN
    rule; Calico's GlobalNetworkSet could express one but would bind this chart
    to Calico, the same argument that kept implementation-specific objects out
    of the Gateway-API sweep (#114). Each egress rule therefore permits its
    PORT to any destination.
  - NOT A BOUNDARY WHERE THE CNI DOES NOT ENFORCE ONE. An unenforced policy is
    accepted by the API server and filters nothing, so everything reads as
    configured while nothing is filtered.
  - THE REASONING IS IN TEMPLATE COMMENTS, not in "#" comments: those are part
    of the rendered object, travel into the cluster and appear in every release
    diff. ci/run-networkpolicy-test.sh fails on a rendered "#".

THE PORT NUMBERS BELOW ARE POD PORTS, NEVER NODEPORTS. A NetworkPolicy is
evaluated at the pod's network interface, after kube-proxy has already
translated a NodePort to the targetPort, so a NodePort number here would match
nothing while looking strict - and, being the only rule for that port, would
block every inbound connection instead. ci/run-networkpolicy-test.sh asserts
every port here against the containerPorts of the pod spec this policy
selects.
*/ -}}
{{- if .Values.networkPolicy.enabled }}
{{- $backendPorts := list (int .Values.server.backendPort) }}
{{- range .Values.mappings }}
{{- if .port }}{{- $backendPorts = append $backendPorts (int .port) }}{{- end }}
{{- end }}
{{- $np := .Values.networkPolicy }}
{{- $ns := .Release.Namespace }}
{{- $probeSources := $np.probeSources | default list }}
{{- $allowedNs := $np.allowedNamespaces | default list }}
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: {{ .Release.Name }}-{{ .Chart.Name }}-networkpolicy
  labels:
    app: {{ .Release.Name }}-{{ .Chart.Name }}-networkpolicy
spec:
  {{- /*
  Selects the Deployment's pods. ci/run-networkpolicy-test.sh fails if
  this matches no pod spec of the same render - which is the mistake that
  would otherwise leave a policy in the namespace filtering nothing, and
  its usual cause is a label renamed in the workload template.
  */}}
  podSelector:
    matchLabels:
      app: {{ .Release.Name }}-{{ .Chart.Name }}-deployment
  policyTypes:
    - Ingress
    {{- /*
    Egress is listed because the router's outbound traffic is exactly known for
    once - DNS, and the backend ports from its own routing table. That makes this
    one of the few egress caps in the sweep that is derived rather than guessed.
    */}}
    - Egress
  ingress:
    {{- /*
    THE PROXY PORT, and deliberately open with no "from" at all: it is published
    as a NodePort (server.outwardPort) and the senders are Minecraft clients on the
    internet. After NodePort masquerading the source address is a cluster node
    anyway, so a source selector here could only ever be a list of node IPs - which
    would be a restriction in appearance and a maintenance trap in fact.

    NOTE THE NUMBER: this is the POD port (server.port), not server.outwardPort.
    The NodePort is translated by kube-proxy before the packet reaches the pod, so
    writing 30565 here would match nothing while looking strict - and being the
    only rule for this port, it would block every player instead.
    ci/run-networkpolicy-test.sh asserts exactly this.
    */}}
    - ports:
        - protocol: TCP
          port: {{ .Values.server.port | int64 }}
    {{- /*
    THE API PORT - the router's own HTTP interface, and the port all three probes
    address. So it is the probe path and stays open inside the cluster by default.

    No ingress-controller entry: this chart renders no Ingress, and nothing should
    route to the router's API from outside.
    */}}
    - ports:
        - protocol: TCP
          port: {{ .Values.server.apiPort | int64 }}
      {{- if $probeSources }}
      {{- /*
      RESTRICTED, because the operator supplied probeSources. The kubelet's probes
      come from the IP of the WORKER NODE running the pod, so that address has to be
      in the list or the pod never becomes Ready - and a pod that is never Ready
      reads as a broken application rather than as a policy.
      */}}
      from:
        - namespaceSelector:
            matchLabels:
              {{- /*
              Set by Kubernetes itself on every namespace (>= 1.21), so this needs no
              labelling work on a namespace this chart does not own.
              */}}
              kubernetes.io/metadata.name: {{ $ns }}
        {{- range $allowedNs }}
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: {{ . | quote }}
        {{- end }}
        {{- range $probeSources }}
        - ipBlock:
            cidr: {{ . | quote }}
        {{- end }}
      {{- else }}
      {{- /*
      NO "from" SELECTOR, WHICH MEANS OPEN - deliberately, and only inside the
      cluster, because this port carries no NodePort. The alternative was to guess
      the worker node CIDRs, and a wrong guess blocks every kubelet probe: the pod
      stays un-Ready, the rollout times out, and the cause looks like the
      application. An empty "from: []" would be worse than either - it allows
      everything too, but while reading as a restriction. Narrow it with
      networkPolicy.probeSources.
      */}}
      {{- end }}
  egress:
    {{- /*
    DNS, unconditionally. There is no value to switch this off, and that is
    deliberate: a knob whose only other setting breaks every name lookup in
    the pod is a trap and not a feature.
    */}}
    - ports:
        - protocol: UDP
          port: 53
        - protocol: TCP
          port: 53
    {{- /*
    THE BACKENDS, by port, derived from the routing table: server.backendPort plus
    the "port" override of every mapping that sets one. So a backend on a
    non-standard port is covered automatically, and there is no second list to keep
    in step with mappings.

    Ports and not destinations: the mappings name hosts (internalUrl) and this
    object cannot match a hostname, so this rule permits those ports to ANY
    address. That is wider than the routing table and is the honest description of
    what the object can do.
    */}}
    - ports:
        {{- range $backendPorts | uniq }}
        - protocol: TCP
          port: {{ . }}
        {{- end }}
    {{- with $np.egress }}
    {{- with .extraPorts }}
    {{- /*
    Ports only, to any destination - see the header. This is the operator's
    escape hatch from the egress cap, and the only alternative to switching
    the whole policy off.
    */}}
    - ports:
        {{- range . }}
        - protocol: TCP
          port: {{ int . }}
        {{- end }}
    {{- end }}
    {{- end }}
{{- end }}