apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: traefik-preserve-ingress-and-allow-prometheus-metrics
  namespace: kube-system
  labels:
    app.kubernetes.io/name: traefik
    app.kubernetes.io/part-of: platform
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: traefik
      app.kubernetes.io/instance: traefik-kube-system
  policyTypes:
    - Ingress
  ingress:
    # Preserve the pre-policy HTTP, HTTPS, and health reachability. The new
    # policy isolates the selected Pod, so omitting these ports would break the
    # existing NodePort and controller health paths.
    - ports:
        - protocol: TCP
          port: 8000
        - protocol: TCP
          port: 8443
        - protocol: TCP
          port: 8080
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: observability
          podSelector:
            matchLabels:
              app.kubernetes.io/name: prometheus
              app.kubernetes.io/instance: observability-core-kube-pr-prometheus
      ports:
        - protocol: TCP
          port: 9100
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: observability-allow-prometheus-platform-targets
  namespace: observability
  labels:
    app.kubernetes.io/name: prometheus
    app.kubernetes.io/part-of: platform-observability
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: prometheus
      app.kubernetes.io/instance: observability-core-kube-pr-prometheus
  policyTypes:
    - Egress
  egress:
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: gitea
          podSelector:
            matchLabels:
              app.kubernetes.io/name: gitea
              app.kubernetes.io/instance: gitea
      ports:
        - protocol: TCP
          port: 3000
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: keycloak
          podSelector:
            matchLabels:
              app: keycloak
              app.kubernetes.io/instance: keycloak
              app.kubernetes.io/managed-by: keycloak-operator
      ports:
        - protocol: TCP
          port: 9000
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: platform-data
          podSelector:
            matchLabels:
              cnpg.io/cluster: platform-postgres
      ports:
        - protocol: TCP
          port: 9187
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: object-storage
          podSelector:
            matchLabels:
              aistor.min.io/objectStore: minio-aistor
      ports:
        - protocol: TCP
          port: 9000
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
          podSelector:
            matchLabels:
              app.kubernetes.io/name: traefik
              app.kubernetes.io/instance: traefik-kube-system
      ports:
        - protocol: TCP
          port: 9100