{{- /*
NetworkPolicy — locks the VPA pods (recommender / updater /
admission-controller) down to the minimum egress / ingress required.

Egress targets:
  - Cluster DNS (kube-system) — service discovery for metrics-server
    + kube-apiserver.
  - Kubernetes API (port 443/6443) — VPA controllers watch Pod, VPA,
    and pod-evictionsubresource resources.
  - metrics-server (kube-system, default port 4443) — Recommender
    primary metrics source.
  - Prometheus / Mimir (when configured) — Recommender extra-args
    `--prometheus-address` may point at a Mimir / kube-prometheus-stack
    endpoint once the observability tier is reconciled.

Ingress is locked to:
  - kube-apiserver -> admission-controller webhook (port 8000) for the
    MutatingWebhookConfiguration the chart registers.
  - Prometheus scraping when serviceMonitor toggles are on.

DEFAULT FALSE per Catalyst overlay convention — operator turns this on
via per-Sovereign overlay once the metrics endpoints are known. Per
docs/INVIOLABLE-PRINCIPLES.md #4 every selector / port is operator-
tunable through `vpaOverlay.networkPolicy.*`.
*/}}
{{- if .Values.vpaOverlay.networkPolicy.enabled }}
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: bp-vpa
  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "bp-vpa.labels" . | nindent 4 }}
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: vertical-pod-autoscaler
  policyTypes:
    - Ingress
    - Egress
  ingress:
    # kube-apiserver -> admission-controller webhook. Allowed from any
    # namespace because the apiserver source IP is not stable.
    - from:
        - ipBlock:
            cidr: 0.0.0.0/0
      ports:
        - protocol: TCP
          port: {{ .Values.vpaOverlay.networkPolicy.admissionWebhookPort | default 8000 }}
    # Prometheus scraping when ServiceMonitor toggles are flipped on.
    - from:
        - namespaceSelector: {}
          podSelector:
            matchLabels:
              app.kubernetes.io/name: prometheus
      ports:
        - protocol: TCP
          port: {{ .Values.vpaOverlay.networkPolicy.metricsPort | default 8942 }}
  egress:
    # Cluster DNS.
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
      ports:
        - protocol: UDP
          port: 53
        - protocol: TCP
          port: 53
    # kube-apiserver — VPA watches Pod, VPA, eviction resources.
    - to:
        - ipBlock:
            cidr: 0.0.0.0/0
      ports:
        - protocol: TCP
          port: 443
        - protocol: TCP
          port: 6443
    # metrics-server.
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
          podSelector:
            matchLabels:
              k8s-app: metrics-server
      ports:
        - protocol: TCP
          port: {{ .Values.vpaOverlay.networkPolicy.metricsServerPort | default 4443 }}
{{- end }}
