{{- /*
NetworkPolicy for homeassistant (Gitea #5).

INGRESS ONLY, AND THE MISSING EGRESS SECTION IS THE DECISION IN THIS FILE.

Home Assistant's outbound traffic is the union of every integration an operator
enables, and that set is unknowable to a chart: mDNS and SSDP discovery on
5353/UDP and 1900/UDP, MQTT on 1883 or 8883, a Zigbee or Z-Wave bridge on
whatever port its firmware chose, ESPHome on 6053, printers, speakers, TVs,
inverters, cloud APIs on 443, an NTP client on 123/UDP. A port cap here would
not protect anything meaningful - the devices are on the same LAN as the node -
and it would break integrations ONE AT A TIME, months apart, each failure
looking like a flaky device rather than like this object. There is no version
of this list that stays correct.

So the rule from valkey applies, in the other direction: policyTypes names only
what there is something to restrict, because an egress rule that has to be
widened until it permits everything makes the object look stricter than it is
while costing real outages to get there. If a deployment wants an egress cap,
it belongs in a release-level policy written against that installation's actual
integrations - not in a chart that cannot see them.

What the Ingress half still buys is real and worth having on its own: only 8123
is reachable, so anything else this image or an add-on binds is not.

WHAT THIS OBJECT IS: a ceiling on reachability, not an authentication layer.
Only the ports declared below are reachable at all - whatever else the process
binds, now or after the next app update, is blocked without anyone having to
notice it exists.

WHAT IT IS NOT:
  - EGRESS IS COARSE. A NetworkPolicy matches CIDRs and selectors and NEVER
    hostnames, so "only to the database host" cannot be expressed at all. This
    cluster's CNI is Canal (Flannel plus Calico for policy) and has no FQDN
    rule; Calico's GlobalNetworkSet could express one but would bind this chart
    to Calico, the same argument that kept implementation-specific objects out
    of the Gateway-API sweep (#114). Each egress rule therefore permits its
    PORT to any destination.
  - NOT A BOUNDARY WHERE THE CNI DOES NOT ENFORCE ONE. An unenforced policy is
    accepted by the API server and filters nothing, so everything reads as
    configured while nothing is filtered.
  - THE REASONING IS IN TEMPLATE COMMENTS, not in "#" comments: those are part
    of the rendered object, travel into the cluster and appear in every release
    diff. ci/run-networkpolicy-test.sh fails on a rendered "#".

THE PORT NUMBERS BELOW ARE POD PORTS, NEVER NODEPORTS. A NetworkPolicy is
evaluated at the pod's network interface, after kube-proxy has already
translated a NodePort to the targetPort, so a NodePort number here would match
nothing while looking strict - and, being the only rule for that port, would
block every inbound connection instead. ci/run-networkpolicy-test.sh asserts
every port here against the containerPorts of the pod spec this policy
selects.
*/ -}}
{{- if .Values.networkPolicy.enabled }}
{{- $np := .Values.networkPolicy }}
{{- $ns := .Release.Namespace }}
{{- $probeSources := $np.probeSources | default list }}
{{- $allowedNs := $np.allowedNamespaces | default list }}
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: {{ .Release.Name }}-{{ .Chart.Name }}-networkpolicy
  labels:
    app: {{ .Release.Name }}-{{ .Chart.Name }}-networkpolicy
spec:
  {{- /*
  Selects this chart's workload. Note the label: the bare release-and-chart name,
  QUOTED, with no -sfs suffix - unlike most charts here. Copying a selector from
  a neighbouring chart would match nothing and leave this policy filtering
  nothing, which is what ci/run-networkpolicy-test.sh holds it against.
  */}}
  podSelector:
    matchLabels:
      app: "{{ .Release.Name }}-{{ .Chart.Name }}"
  policyTypes:
    - Ingress
  ingress:
    {{- /*
    8123 - the only port this pod declares, the one the Service forwards 80 to, and
    the port all three probes address. The probe path.

    No ingress-controller entry: this chart keeps its flexible upstream ingress
    style and renders no Ingress of its own (a documented exception in README),
    so the sources to name are namespaces, through allowedNamespaces.
    */}}
    - ports:
        - protocol: TCP
          port: 8123
      {{- if $probeSources }}
      {{- /*
      RESTRICTED, because the operator supplied probeSources. The kubelet's probes
      come from the IP of the WORKER NODE running the pod, so that address has to be
      in the list or the pod never becomes Ready - and a pod that is never Ready
      reads as a broken application rather than as a policy.
      */}}
      from:
        - namespaceSelector:
            matchLabels:
              {{- /*
              Set by Kubernetes itself on every namespace (>= 1.21), so this needs no
              labelling work on a namespace this chart does not own.
              */}}
              kubernetes.io/metadata.name: {{ $ns }}
        {{- range $allowedNs }}
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: {{ . | quote }}
        {{- end }}
        {{- range $probeSources }}
        - ipBlock:
            cidr: {{ . | quote }}
        {{- end }}
      {{- else }}
      {{- /*
      NO "from" SELECTOR, WHICH MEANS OPEN - deliberately, and only inside the
      cluster, because this port carries no NodePort. The alternative was to guess
      the worker node CIDRs, and a wrong guess blocks every kubelet probe: the pod
      stays un-Ready, the rollout times out, and the cause looks like the
      application. An empty "from: []" would be worse than either - it allows
      everything too, but while reading as a restriction. Narrow it with
      networkPolicy.probeSources.
      */}}
      {{- end }}
{{- end }}