# EN: Kubernetes NetworkPolicy — default-deny + explicit allow rules (DEVOPS-W-05)
# VI: Kubernetes NetworkPolicy — tu choi mac dinh + cho phep tuong minh (DEVOPS-W-05)
#
# Strategy:
#   1. Default-deny all ingress and egress in staging namespace
#   2. Allow DNS resolution (kube-dns)
#   3. Allow inter-service communication via explicit rules
#   4. Allow ingress from Traefik (API gateway)
#   5. Allow Prometheus scraping metrics from all services
#   6. Allow Redis access only from application services
#   7. Allow RabbitMQ access from services that use messaging
#   8. Allow MinIO access from storage service

# =============================================================================
# Default Deny — block all ingress + egress by default
# =============================================================================
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
  namespace: staging
  labels:
    environment: staging
    platform: goodgo
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress

---
# =============================================================================
# Allow DNS (kube-dns) — required for all pods to resolve service names
# =============================================================================
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-dns-egress
  namespace: staging
  labels:
    environment: staging
    platform: goodgo
spec:
  podSelector: {}
  policyTypes:
  - Egress
  egress:
  - ports:
    - port: 53
      protocol: UDP
    - port: 53
      protocol: TCP

---
# =============================================================================
# Allow Traefik ingress → microservices (port 8080)
# =============================================================================
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-traefik-ingress
  namespace: staging
  labels:
    environment: staging
    platform: goodgo
spec:
  podSelector:
    matchExpressions:
    - key: app
      operator: In
      values:
      - iam-service
      - merchant-service
      - order-service
      - fnb-engine
      - inventory-service
      - wallet-service
      - catalog-service
      - storage-service
      - booking-service
      - chat-service
      - social-service
      - promotion-service
      - membership-service
      - mining-service
      - mission-service
      - ads-manager-service
      - ads-serving-service
      - ads-billing-service
      - ads-tracking-service
      - ads-analytics-service
      - mkt-facebook-service
      - mkt-whatsapp-service
      - mkt-x-service
      - mkt-zalo-service
      - pos-web
  policyTypes:
  - Ingress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: kube-system
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: traefik
    ports:
    - port: 8080
      protocol: TCP

---
# =============================================================================
# Allow microservices to egress to each other (port 8080)
# =============================================================================
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-inter-service-egress
  namespace: staging
  labels:
    environment: staging
    platform: goodgo
spec:
  podSelector:
    matchExpressions:
    - key: app
      operator: In
      values:
      - iam-service
      - merchant-service
      - order-service
      - fnb-engine
      - inventory-service
      - wallet-service
      - catalog-service
      - storage-service
      - booking-service
      - chat-service
      - social-service
      - promotion-service
      - membership-service
      - mining-service
      - mission-service
      - ads-manager-service
      - ads-serving-service
      - ads-billing-service
      - ads-tracking-service
      - ads-analytics-service
      - mkt-facebook-service
      - mkt-whatsapp-service
      - mkt-x-service
      - mkt-zalo-service
  policyTypes:
  - Egress
  egress:
  - to:
    - podSelector:
        matchExpressions:
        - key: app
          operator: In
          values:
          - iam-service
          - merchant-service
          - order-service
          - fnb-engine
          - inventory-service
          - wallet-service
          - catalog-service
          - storage-service
          - booking-service
          - chat-service
          - social-service
          - promotion-service
          - membership-service
          - mining-service
          - mission-service
          - ads-manager-service
          - ads-serving-service
          - ads-billing-service
          - ads-tracking-service
          - ads-analytics-service
          - mkt-facebook-service
          - mkt-whatsapp-service
          - mkt-x-service
          - mkt-zalo-service
    ports:
    - port: 8080
      protocol: TCP

---
# =============================================================================
# Allow Redis access — only from app services (port 6379)
# =============================================================================
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-redis-ingress
  namespace: staging
  labels:
    environment: staging
    platform: goodgo
spec:
  podSelector:
    matchExpressions:
    - key: app
      operator: In
      values:
      - redis
      - redis-master
      - redis-replica
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector:
        matchExpressions:
        - key: app
          operator: In
          values:
          - iam-service
          - merchant-service
          - order-service
          - fnb-engine
          - inventory-service
          - wallet-service
          - catalog-service
          - storage-service
          - booking-service
          - chat-service
          - social-service
          - promotion-service
          - membership-service
          - mining-service
          - mission-service
          - ads-manager-service
          - ads-serving-service
          - ads-tracking-service
          - ads-analytics-service
    ports:
    - port: 6379
      protocol: TCP

---
# Allow Redis master → replica replication egress
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-redis-replication
  namespace: staging
  labels:
    environment: staging
    platform: goodgo
spec:
  podSelector:
    matchExpressions:
    - key: app
      operator: In
      values:
      - redis-master
      - redis-replica
      - redis-sentinel
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - podSelector:
        matchExpressions:
        - key: app
          operator: In
          values:
          - redis-master
          - redis-replica
          - redis-sentinel
    ports:
    - port: 6379
      protocol: TCP
    - port: 26379
      protocol: TCP
  egress:
  - to:
    - podSelector:
        matchExpressions:
        - key: app
          operator: In
          values:
          - redis-master
          - redis-replica
          - redis-sentinel
    ports:
    - port: 6379
      protocol: TCP
    - port: 26379
      protocol: TCP

---
# =============================================================================
# Allow microservices to reach Redis (egress)
# =============================================================================
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-app-to-redis-egress
  namespace: staging
  labels:
    environment: staging
    platform: goodgo
spec:
  podSelector:
    matchExpressions:
    - key: app
      operator: In
      values:
      - iam-service
      - merchant-service
      - order-service
      - fnb-engine
      - inventory-service
      - wallet-service
      - catalog-service
      - storage-service
      - booking-service
      - chat-service
      - social-service
      - promotion-service
      - membership-service
      - mining-service
      - mission-service
      - ads-manager-service
      - ads-serving-service
      - ads-tracking-service
      - ads-analytics-service
  policyTypes:
  - Egress
  egress:
  - to:
    - podSelector:
        matchExpressions:
        - key: app
          operator: In
          values:
          - redis
          - redis-master
          - redis-replica
          - redis-sentinel
    ports:
    - port: 6379
      protocol: TCP
    - port: 26379
      protocol: TCP

---
# =============================================================================
# Allow RabbitMQ ingress — from messaging services (port 5672)
# =============================================================================
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-rabbitmq-ingress
  namespace: staging
  labels:
    environment: staging
    platform: goodgo
spec:
  podSelector:
    matchLabels:
      app: rabbitmq
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector:
        matchExpressions:
        - key: app
          operator: In
          values:
          - ads-serving-service
          - ads-tracking-service
          - mkt-facebook-service
          - mkt-whatsapp-service
          - mkt-x-service
          - mkt-zalo-service
          - chat-service
          - order-service
    ports:
    - port: 5672
      protocol: TCP

---
# =============================================================================
# Allow microservices to reach RabbitMQ (egress)
# =============================================================================
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-app-to-rabbitmq-egress
  namespace: staging
  labels:
    environment: staging
    platform: goodgo
spec:
  podSelector:
    matchExpressions:
    - key: app
      operator: In
      values:
      - ads-serving-service
      - ads-tracking-service
      - mkt-facebook-service
      - mkt-whatsapp-service
      - mkt-x-service
      - mkt-zalo-service
      - chat-service
      - order-service
  policyTypes:
  - Egress
  egress:
  - to:
    - podSelector:
        matchLabels:
          app: rabbitmq
    ports:
    - port: 5672
      protocol: TCP

---
# =============================================================================
# Allow MinIO ingress — from storage service (port 9000)
# =============================================================================
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-minio-ingress
  namespace: staging
  labels:
    environment: staging
    platform: goodgo
spec:
  podSelector:
    matchLabels:
      app: minio
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: storage-service
    ports:
    - port: 9000
      protocol: TCP

---
# =============================================================================
# Allow storage-service to reach MinIO (egress)
# =============================================================================
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-app-to-minio-egress
  namespace: staging
  labels:
    environment: staging
    platform: goodgo
spec:
  podSelector:
    matchLabels:
      app: storage-service
  policyTypes:
  - Egress
  egress:
  - to:
    - podSelector:
        matchLabels:
          app: minio
    ports:
    - port: 9000
      protocol: TCP

---
# =============================================================================
# Allow Prometheus scrape — port 8080 metrics from all app pods
# =============================================================================
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-prometheus-scrape
  namespace: staging
  labels:
    environment: staging
    platform: goodgo
spec:
  podSelector:
    matchExpressions:
    - key: app
      operator: In
      values:
      - iam-service
      - merchant-service
      - order-service
      - fnb-engine
      - inventory-service
      - wallet-service
      - catalog-service
      - storage-service
      - booking-service
      - chat-service
      - social-service
      - promotion-service
      - membership-service
      - mining-service
      - mission-service
      - ads-manager-service
      - ads-serving-service
      - ads-billing-service
      - ads-tracking-service
      - ads-analytics-service
      - mkt-facebook-service
      - mkt-whatsapp-service
      - mkt-x-service
      - mkt-zalo-service
      - pos-web
  policyTypes:
  - Ingress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: monitoring
    ports:
    - port: 8080
      protocol: TCP

---
# =============================================================================
# Allow microservices to reach external services (PostgreSQL, SMTP, etc.)
# =============================================================================
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-external-egress
  namespace: staging
  labels:
    environment: staging
    platform: goodgo
spec:
  podSelector:
    matchExpressions:
    - key: app
      operator: In
      values:
      - iam-service
      - merchant-service
      - order-service
      - fnb-engine
      - inventory-service
      - wallet-service
      - catalog-service
      - storage-service
      - booking-service
      - chat-service
      - social-service
      - promotion-service
      - membership-service
      - mining-service
      - mission-service
      - ads-manager-service
      - ads-serving-service
      - ads-billing-service
      - ads-tracking-service
      - ads-analytics-service
      - mkt-facebook-service
      - mkt-whatsapp-service
      - mkt-x-service
      - mkt-zalo-service
  policyTypes:
  - Egress
  egress:
  - ports:
    - port: 443
      protocol: TCP
    - port: 5432
      protocol: TCP
    - port: 30992
      protocol: TCP
    - port: 5671
      protocol: TCP
    - port: 5672
      protocol: TCP
