apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: poimen-frontend-egress
  namespace: poimen
  annotations:
    argocd.argoproj.io/sync-wave: "0"
spec:
  podSelector:
    matchLabels:
      app: poimen-frontend
  policyTypes:
    - Ingress
    - Egress

  ingress:
    # Allow from ingress-nginx controller → frontend on port 3000
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: ingress-nginx
      ports:
        - protocol: TCP
          port: 3000

  egress:
    # DNS — required for all in-cluster service resolution
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
      ports:
        - protocol: UDP
          port: 53
        - protocol: TCP
          port: 53

    # api-gw (api namespace) — all server-side LLM + workflow + memory calls
    # api-gw NetworkPolicy already allows ingress from poimen namespace.
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: api
      ports:
        - protocol: TCP
          port: 8080

    # Memory service (co-located in poimen namespace) — GraphQL session queries
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: poimen
          podSelector:
            matchLabels:
              app.kubernetes.io/name: poimen-memory
      ports:
        - protocol: TCP
          port: 8080

    # Gotify (notifications namespace) — /api/notify/messages server-side poll
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: notifications
      ports:
        - protocol: TCP
          port: 80

    # Authentik (iam namespace) — OIDC token fetch + JWKS verification
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: iam
      ports:
        - protocol: TCP
          port: 9000
        - protocol: TCP
          port: 9443