{{- if .Values.isolated }}
---
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: allow-internal-communication
  namespace: {{ include "tenant.name" . }}
spec:
  endpointSelector: {}
  ingress:
  - fromEndpoints:
    - {}
  egress:
  - toEndpoints:
    - {}
---
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: allow-external-communication
  namespace: {{ include "tenant.name" . }}
spec:
  endpointSelector: {}
  ingress:
  - fromEntities:
      - world
      - cluster
  egress:
  - toEntities:
      - world
---
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
  name: {{ include "tenant.name" . }}-egress
spec:
  endpointSelector:
    matchLabels:
      "k8s:io.kubernetes.pod.namespace": "{{ include "tenant.name" . }}"
  egress:
  - toEndpoints:
    - matchLabels:
        "k8s:io.cilium.k8s.namespace.labels.tenant.cozystack.io/{{ include "tenant.name" . }}": ""
  {{- if ne (include "tenant.name" .) "tenant-root" }}
  - toEndpoints:
    {{- if hasPrefix "tenant-" .Release.Namespace }}
    {{- $parts := splitList "-" .Release.Namespace }}
    {{- range $i, $v := $parts }}
    {{- if ne $i 0 }}
    - matchLabels:
        "k8s:io.kubernetes.pod.namespace": {{ join "-" (slice $parts 0 (add $i 1)) }}
    {{- end }}
    {{- end }}
    {{- end }}
  {{- end }}
---
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
  name: {{ include "tenant.name" . }}-ingress
spec:
  endpointSelector:
    matchLabels:
      "k8s:io.kubernetes.pod.namespace": "{{ include "tenant.name" . }}"
  ingress:
  - fromEntities:
    - kube-apiserver
  - fromEndpoints:
      - matchLabels:
          "k8s:io.cilium.k8s.namespace.labels.cozystack.io/system": "true"
  - fromEndpoints:
      - matchLabels:
          "k8s:io.kubernetes.pod.namespace": kube-system
  {{- if ne (include "tenant.name" .) "tenant-root" }}
  - fromEndpoints:
    {{- if hasPrefix "tenant-" .Release.Namespace }}
    {{- $parts := splitList "-" .Release.Namespace }}
    {{- range $i, $v := $parts }}
    {{- if ne $i 0 }}
    - matchLabels:
        "k8s:io.kubernetes.pod.namespace": {{ join "-" (slice $parts 0 (add $i 1)) }}
    {{- end }}
    {{- end }}
    {{- end }}
  {{- end }}
---
{{- if .Values.ingress }}
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
  name: {{ include "tenant.name" . }}-ingress-ingress
spec:
  endpointSelector:
    matchLabels:
      "k8s:io.kubernetes.pod.namespace": "{{ include "tenant.name" . }}"
      cozystack.io/service: ingress
  ingress:
  - fromEndpoints:
    - {}
{{- end }}
---
{{- if .Values.etcd }}
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
  name: {{ include "tenant.name" . }}-ingress-etcd
spec:
  endpointSelector:
    matchLabels:
      "k8s:io.kubernetes.pod.namespace": "{{ include "tenant.name" . }}"
      cozystack.io/service: etcd
  ingress:
  - fromEndpoints:
    - matchLabels:
        "k8s:io.cilium.k8s.namespace.labels.namespace.cozystack.io/etcd": "{{ include "tenant.name" . }}"
        policy.cozystack.io/allow-to-etcd: "true"
{{- end }}
---
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: allow-to-apiserver
  namespace: {{ include "tenant.name" . }}
spec:
  endpointSelector:
    matchLabels:
      policy.cozystack.io/allow-to-apiserver: "true"
  egress:
  - toEntities:
    - kube-apiserver
  - toPorts:
    - ports:
      - port: "6443"
        protocol: TCP
---
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: allow-to-dns
  namespace: {{ include "tenant.name" . }}
spec:
  endpointSelector: {}
  egress:
  - toEndpoints:
    - matchLabels:
        "k8s:io.kubernetes.pod.namespace": kube-system
        k8s-app: kube-dns
---
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: allow-to-dashboard
  namespace: {{ include "tenant.name" . }}
spec:
  endpointSelector: {}
  egress:
  - toEndpoints:
      - matchLabels:
          "k8s:io.kubernetes.pod.namespace": cozy-dashboard
---
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: allow-to-keycloak
  namespace: {{ include "tenant.name" . }}
spec:
  endpointSelector: {}
  egress:
  - toEndpoints:
      - matchLabels:
          "k8s:io.kubernetes.pod.namespace": cozy-keycloak
---
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: allow-to-cdi-upload-proxy
  namespace: {{ include "tenant.name" . }}
spec:
  endpointSelector: {}
  egress:
  - toEndpoints:
      - matchLabels:
          "k8s:io.kubernetes.pod.namespace": cozy-kubevirt-cdi
---
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: allow-to-ingress
  namespace: {{ include "tenant.name" . }}
spec:
  endpointSelector: {}
  egress:
  - toEndpoints:
    - matchLabels:
        cozystack.io/service: ingress
{{- end }}
