{{- if .Values.networkPolicies.enabled }}
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-ingress
  namespace: {{ .Release.Namespace }}
spec:
  podSelector: {}
  policyTypes:
    - Ingress
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-query-api-ingress
  namespace: {{ .Release.Namespace }}
spec:
  podSelector:
    matchLabels:
      app: query-api
  policyTypes:
    - Ingress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
        - podSelector:
            matchLabels:
              app: dashboard
      ports:
        - protocol: TCP
          port: 8000
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-symbol-registry-ingress
  namespace: {{ .Release.Namespace }}
spec:
  podSelector:
    matchLabels:
      app: symbol-registry
  policyTypes:
    - Ingress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
        - podSelector:
            matchLabels:
              app: dashboard
      ports:
        - protocol: TCP
          port: 8000
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-risk-engine-ingress
  namespace: {{ .Release.Namespace }}
spec:
  podSelector:
    matchLabels:
      app: risk
  policyTypes:
    - Ingress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: broker-adapter
        - podSelector:
            matchLabels:
              app: query-api
        - podSelector:
            matchLabels:
              app: dashboard
      ports:
        - protocol: TCP
          port: 8000
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-trading-engine-ingress
  namespace: {{ .Release.Namespace }}
spec:
  podSelector:
    matchLabels:
      app: trading-engine
  policyTypes:
    - Ingress
    - Egress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: query-api
        - podSelector:
            matchLabels:
              app: dashboard
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
      ports:
        - protocol: TCP
          port: 8000
  egress:
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: postgresql-service
      ports:
        - protocol: TCP
          port: 5432
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: redis-service
      ports:
        - protocol: TCP
          port: 6379
    - to: []
      ports:
        - protocol: TCP
          port: 443
        - protocol: TCP
          port: 587
    - to:
        - namespaceSelector: {}
      ports:
        - protocol: UDP
          port: 53
        - protocol: TCP
          port: 53
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-superset-ingress
  namespace: {{ .Release.Namespace }}
spec:
  podSelector:
    matchLabels:
      app: superset
  policyTypes:
    - Ingress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
      ports:
        - protocol: TCP
          port: 8088
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-trino-ingress
  namespace: {{ .Release.Namespace }}
spec:
  podSelector:
    matchLabels:
      app: trino
  policyTypes:
    - Ingress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: superset
        - podSelector:
            matchLabels:
              app: query-api
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
      ports:
        - protocol: TCP
          port: 8080
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-hive-metastore-ingress
  namespace: {{ .Release.Namespace }}
spec:
  podSelector:
    matchLabels:
      app: hive-metastore
  policyTypes:
    - Ingress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: trino
        - podSelector:
            matchLabels:
              app: lake-publisher
      ports:
        - protocol: TCP
          port: 9083
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-dashboard-ingress
  namespace: {{ .Release.Namespace }}
spec:
  podSelector:
    matchLabels:
      app: dashboard
  policyTypes:
    - Ingress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
      ports:
        - protocol: TCP
          port: 8080
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-broker-adapter-ingress
  namespace: {{ .Release.Namespace }}
spec:
  podSelector:
    matchLabels:
      app: broker-adapter
  policyTypes:
    - Ingress
  ingress: []
{{- end }}
