# EN: Kubernetes NetworkPolicy — default-deny + explicit allow rules (DEVOPS-W-05)
# VI: Kubernetes NetworkPolicy — tu choi mac dinh + cho phep tuong minh (DEVOPS-W-05)
#
# Strategy:
#   1. Default-deny all ingress and egress in staging namespace
#   2. Allow DNS resolution (kube-dns)
#   3. Allow inter-service communication via explicit rules
#   4. Allow ingress from Traefik (API gateway)
#   5. Allow Prometheus scraping metrics from all services
#   6. Allow Redis access only from application services

# =============================================================================
# Default Deny — block all ingress + egress by default
# =============================================================================
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
  namespace: staging
  labels:
    environment: staging
    platform: goodgo
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress

---
# =============================================================================
# Allow DNS (kube-dns) — required for all pods to resolve service names
# =============================================================================
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-dns-egress
  namespace: staging
  labels:
    environment: staging
    platform: goodgo
spec:
  podSelector: {}
  policyTypes:
  - Egress
  egress:
  - ports:
    - port: 53
      protocol: UDP
    - port: 53
      protocol: TCP

---
# =============================================================================
# Allow Traefik ingress → microservices (port 8080)
# EN: Traefik runs in kube-system namespace (or traefik namespace).
# VI: Traefik chay trong namespace kube-system (hoac traefik namespace).
# =============================================================================
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-traefik-ingress
  namespace: staging
  labels:
    environment: staging
    platform: goodgo
spec:
  podSelector:
    matchExpressions:
    - key: app
      operator: In
      values:
      - iam-service
      - merchant-service
      - order-service
      - fnb-engine
      - inventory-service
      - wallet-service
      - catalog-service
      - storage-service
      - booking-service
      - pos-web
  policyTypes:
  - Ingress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: kube-system
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: traefik
    ports:
    - port: 8080
      protocol: TCP

---
# =============================================================================
# Allow microservices to egress to each other (port 8080)
# EN: Services communicate internally via REST (HTTP/8080).
# VI: Cac service giao tiep noi bo qua REST (HTTP/8080).
# =============================================================================
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-inter-service-egress
  namespace: staging
  labels:
    environment: staging
    platform: goodgo
spec:
  podSelector:
    matchExpressions:
    - key: app
      operator: In
      values:
      - iam-service
      - merchant-service
      - order-service
      - fnb-engine
      - inventory-service
      - wallet-service
      - catalog-service
      - storage-service
      - booking-service
  policyTypes:
  - Egress
  egress:
  - to:
    - podSelector:
        matchExpressions:
        - key: app
          operator: In
          values:
          - iam-service
          - merchant-service
          - order-service
          - fnb-engine
          - inventory-service
          - wallet-service
          - catalog-service
          - storage-service
          - booking-service
    ports:
    - port: 8080
      protocol: TCP

---
# =============================================================================
# Allow Redis access — only from app services (port 6379)
# EN: Redis is accessed only by application pods (not pos-web frontend).
# VI: Redis chi duoc truy cap boi cac pod ung dung (khong phai pos-web frontend).
# =============================================================================
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-redis-ingress
  namespace: staging
  labels:
    environment: staging
    platform: goodgo
spec:
  podSelector:
    matchExpressions:
    - key: app
      operator: In
      values:
      - redis-master
      - redis-replica
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector:
        matchExpressions:
        - key: app
          operator: In
          values:
          - iam-service
          - merchant-service
          - order-service
          - fnb-engine
          - inventory-service
          - wallet-service
          - catalog-service
          - storage-service
          - booking-service
    ports:
    - port: 6379
      protocol: TCP

---
# Allow Redis master → replica replication egress
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-redis-replication
  namespace: staging
  labels:
    environment: staging
    platform: goodgo
spec:
  podSelector:
    matchExpressions:
    - key: app
      operator: In
      values:
      - redis-master
      - redis-replica
      - redis-sentinel
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - podSelector:
        matchExpressions:
        - key: app
          operator: In
          values:
          - redis-master
          - redis-replica
          - redis-sentinel
    ports:
    - port: 6379
      protocol: TCP
    - port: 26379
      protocol: TCP
  egress:
  - to:
    - podSelector:
        matchExpressions:
        - key: app
          operator: In
          values:
          - redis-master
          - redis-replica
          - redis-sentinel
    ports:
    - port: 6379
      protocol: TCP
    - port: 26379
      protocol: TCP

---
# =============================================================================
# Allow microservices to reach Redis (egress)
# =============================================================================
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-app-to-redis-egress
  namespace: staging
  labels:
    environment: staging
    platform: goodgo
spec:
  podSelector:
    matchExpressions:
    - key: app
      operator: In
      values:
      - iam-service
      - merchant-service
      - order-service
      - fnb-engine
      - inventory-service
      - wallet-service
      - catalog-service
      - storage-service
      - booking-service
  policyTypes:
  - Egress
  egress:
  - to:
    - podSelector:
        matchExpressions:
        - key: app
          operator: In
          values:
          - redis-master
          - redis-replica
          - redis-sentinel
    ports:
    - port: 6379
      protocol: TCP
    - port: 26379
      protocol: TCP

---
# =============================================================================
# Allow Prometheus scrape — port 8080 metrics from all app pods
# EN: Prometheus runs in monitoring namespace and scrapes /metrics.
# VI: Prometheus chay trong namespace monitoring va thu thap /metrics.
# =============================================================================
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-prometheus-scrape
  namespace: staging
  labels:
    environment: staging
    platform: goodgo
spec:
  podSelector:
    matchExpressions:
    - key: app
      operator: In
      values:
      - iam-service
      - merchant-service
      - order-service
      - fnb-engine
      - inventory-service
      - wallet-service
      - catalog-service
      - storage-service
      - booking-service
      - pos-web
  policyTypes:
  - Ingress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: monitoring
    ports:
    - port: 8080
      protocol: TCP

---
# =============================================================================
# Allow microservices to reach external services (Neon PostgreSQL, etc.)
# EN: Egress to external HTTPS/PostgreSQL (Neon cloud DB, SMTP, etc.)
# VI: Egress ra ngoai HTTPS/PostgreSQL (Neon cloud DB, SMTP, v.v.)
# =============================================================================
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-external-egress
  namespace: staging
  labels:
    environment: staging
    platform: goodgo
spec:
  podSelector:
    matchExpressions:
    - key: app
      operator: In
      values:
      - iam-service
      - merchant-service
      - order-service
      - fnb-engine
      - inventory-service
      - wallet-service
      - catalog-service
      - storage-service
      - booking-service
  policyTypes:
  - Egress
  egress:
  - ports:
    - port: 443
      protocol: TCP
    - port: 5432
      protocol: TCP
    - port: 5671
      protocol: TCP
    - port: 5672
      protocol: TCP
