{{- if .Values.networkPolicy.enabled }}
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: {{ .Release.Name }}-{{ .Chart.Name }}-networkpolicy
spec:
  podSelector:
    matchLabels:
      app: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
  # Ingress only. Egress is deliberately unrestricted: this instance opens no
  # outbound connection of its own (no replication, no cluster bus), so an
  # egress rule here would constrain nothing while making the object look
  # stricter than it is.
  policyTypes:
    - Ingress
  ingress:
    # One rule with a list of sources. Note the shape: an empty "from" would
    # allow EVERYTHING, so the namespaces are always spelled out - the release's
    # own namespace first, then whatever networkPolicy.allowedNamespaces adds.
    - from:
        - namespaceSelector:
            matchLabels:
              # Set by Kubernetes itself on every namespace (>= 1.21), so this
              # needs no labelling work on the target namespaces.
              kubernetes.io/metadata.name: {{ .Release.Namespace }}
        {{- range .Values.networkPolicy.allowedNamespaces }}
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: {{ . | quote }}
        {{- end }}
      ports:
        - protocol: TCP
          port: 6379
{{- end }}