{{- /*
NetworkPolicy for samba (Gitea #5).

Samba publishes both of its ports as NodePorts and the clients are machines on
the LAN, so both inbound rules are deliberately open: after NodePort
masquerading the source address is a cluster node anyway, and a source selector
could only ever be a list of node IPs - a restriction in appearance and a
maintenance trap in fact. 445 is additionally the port the probes address.

THE NUMBERS HERE ARE 445 AND 139, NOT samba.smbNodePort AND
samba.netbiosNodePort. That distinction is this chart's easiest mistake, which
is why it is spelled out: a NetworkPolicy is evaluated at the pod's interface
after kube-proxy has translated the NodePort, so writing 30445 would match
nothing while looking strict - and, being the only rule for the port, would
block every SMB client instead.

Egress is DNS only, which is as tight as a file server gets. Note what that
does NOT cover and why it does not matter: the NetBIOS name-service broadcasts
on 137 and 138/UDP are not published by this chart's Service at all, and
Windows clients here reach the share by address rather than by browse list.

WHAT THIS OBJECT IS: a ceiling on reachability, not an authentication layer.
Only the ports declared below are reachable at all - whatever else the process
binds, now or after the next app update, is blocked without anyone having to
notice it exists.

WHAT IT IS NOT:
  - EGRESS IS COARSE. A NetworkPolicy matches CIDRs and selectors and NEVER
    hostnames, so "only to the database host" cannot be expressed at all. This
    cluster's CNI is Canal (Flannel plus Calico for policy) and has no FQDN
    rule; Calico's GlobalNetworkSet could express one but would bind this chart
    to Calico, the same argument that kept implementation-specific objects out
    of the Gateway-API sweep (#114). Each egress rule therefore permits its
    PORT to any destination.
  - NOT A BOUNDARY WHERE THE CNI DOES NOT ENFORCE ONE. An unenforced policy is
    accepted by the API server and filters nothing, so everything reads as
    configured while nothing is filtered.
  - THE REASONING IS IN TEMPLATE COMMENTS, not in "#" comments: those are part
    of the rendered object, travel into the cluster and appear in every release
    diff. ci/run-networkpolicy-test.sh fails on a rendered "#".

THE PORT NUMBERS BELOW ARE POD PORTS, NEVER NODEPORTS. A NetworkPolicy is
evaluated at the pod's network interface, after kube-proxy has already
translated a NodePort to the targetPort, so a NodePort number here would match
nothing while looking strict - and, being the only rule for that port, would
block every inbound connection instead. ci/run-networkpolicy-test.sh asserts
every port here against the containerPorts of the pod spec this policy
selects.
*/ -}}
{{- if .Values.networkPolicy.enabled }}
{{- $np := .Values.networkPolicy }}
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: {{ .Release.Name }}-{{ .Chart.Name }}-networkpolicy
  labels:
    app: {{ .Release.Name }}-{{ .Chart.Name }}-networkpolicy
spec:
  {{- /*
  Selects the StatefulSet's pods. ci/run-networkpolicy-test.sh fails if
  this matches no pod spec of the same render - which is the mistake that
  would otherwise leave a policy in the namespace filtering nothing, and
  its usual cause is a label renamed in the workload template.
  */}}
  podSelector:
    matchLabels:
      app: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
  policyTypes:
    - Ingress
    {{- /*
    Egress is listed because the restriction is nearly total and therefore worth
    having: a standalone file server needs name resolution and nothing else. A
    domain-joined one would need Kerberos and LDAP, which is what extraPorts is
    for.
    */}}
    - Egress
  ingress:
    {{- /*
    SMB (445) and NetBIOS session service (139), both POD ports, both published as
    NodePorts (samba.smbNodePort and samba.netbiosNodePort) and both deliberately
    open: the clients are machines on the LAN, and after masquerading the source is
    a cluster node. 445 is also the port all three probes open a TCP socket
    against, so it is the probe path as well - justified twice over.

    Writing the NodePort numbers here instead would match nothing and block every
    client. See the header.
    */}}
    - ports:
        - protocol: TCP
          port: 445
        - protocol: TCP
          port: 139
  egress:
    {{- /*
    DNS, unconditionally. There is no value to switch this off, and that is
    deliberate: a knob whose only other setting breaks every name lookup in
    the pod is a trap and not a feature.
    */}}
    - ports:
        - protocol: UDP
          port: 53
        - protocol: TCP
          port: 53
    {{- with $np.egress }}
    {{- with .extraPorts }}
    {{- /*
    Ports only, to any destination - see the header. This is the operator's
    escape hatch from the egress cap, and the only alternative to switching
    the whole policy off.
    */}}
    - ports:
        {{- range . }}
        - protocol: TCP
          port: {{ int . }}
        {{- end }}
    {{- end }}
    {{- end }}
{{- end }}