{{- /*
NetworkPolicy — locks the SeaweedFS pods (master/volume/filer/s3) down to
the minimum egress / ingress required for Catalyst's unified S3 surface.

Per docs/PLATFORM-TECH-STACK.md §3.5, every Catalyst consumer (Loki,
Mimir, Tempo, Velero, Harbor, CNPG WAL, OpenSearch snapshots, per-App
buckets) talks to `seaweedfs-s3.seaweedfs.svc.cluster.local:8333`. The
S3 endpoint MUST therefore be reachable cross-namespace from any
namespace where a Catalyst consumer runs. Internal cluster traffic
between SeaweedFS pods (master <-> volume <-> filer <-> s3) is allowed
intra-namespace.

DEFAULT FALSE per Catalyst overlay convention — operator turns this on
via per-Sovereign overlay once consumer namespaces are known. Per
docs/INVIOLABLE-PRINCIPLES.md #4 every selector / port is operator-
tunable through `seaweedfsOverlay.networkPolicy.*`.
*/}}
{{- if .Values.seaweedfsOverlay.networkPolicy.enabled }}
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: bp-seaweedfs
  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "bp-seaweedfs.labels" . | nindent 4 }}
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: seaweedfs
  policyTypes:
    - Ingress
    - Egress
  ingress:
    # Intra-namespace traffic between SeaweedFS components.
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: {{ .Release.Namespace }}
    # Cross-namespace S3 API access — every Catalyst consumer hits 8333.
    - from:
        - namespaceSelector: {}
      ports:
        - protocol: TCP
          port: {{ .Values.seaweedfs.s3.port | default 8333 }}
    # Prometheus scraping — only when ServiceMonitor is opted in.
    {{- if .Values.seaweedfsOverlay.serviceMonitor.enabled }}
    - from:
        - namespaceSelector: {}
          podSelector:
            matchLabels:
              app.kubernetes.io/name: prometheus
      ports:
        - protocol: TCP
          port: {{ .Values.seaweedfs.s3.metricsPort | default 9327 }}
    {{- end }}
  egress:
    # Cluster DNS — SeaweedFS resolves cold-tier endpoints + filer peers.
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
      ports:
        - protocol: UDP
          port: 53
        - protocol: TCP
          port: 53
    # Intra-namespace traffic between SeaweedFS components.
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: {{ .Release.Namespace }}
    # Cold-tier offload to cloud archive (Cloudflare R2 / AWS S3 Glacier
    # / Hetzner S3). Operator restricts to specific cidrs in
    # per-Sovereign overlay if the cold backend is a private endpoint.
    {{- if or .Values.seaweedfsOverlay.coldTier.cloudflareR2.enabled .Values.seaweedfsOverlay.coldTier.awsS3Glacier.enabled .Values.seaweedfsOverlay.coldTier.hetznerS3.enabled }}
    - to:
        - ipBlock:
            cidr: 0.0.0.0/0
            except:
              - 10.0.0.0/8
              - 172.16.0.0/12
              - 192.168.0.0/16
      ports:
        - protocol: TCP
          port: 443
    {{- end }}
{{- end }}
