# SPDX-License-Identifier: AGPL-3.0-or-later

{{- $clusterEnabled := dig "enabled" false .Values.cluster -}}
{{- $distPort := int (dig "erlangDistribution" "port" 8081 .Values.cluster) }}
{{- $epmdPort := int (dig "erlangDistribution" "epmdPort" 4369 .Values.cluster) }}
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: gateway
  namespace: {{.Values.global.namespace}}
  labels: {{- include "fluxer.labels" . | nindent 4}}
spec:
  podSelector:
    matchLabels:
      {{- if dig "enabled" false .Values.roles }}
      app.kubernetes.io/instance: {{ .Release.Name }}
      app.kubernetes.io/part-of: fluxer
      {{- else }}
      {{- include "fluxer.selectorLabels" (dict "name" "gateway" "context" .) | nindent 6 }}
      {{- end }}
  policyTypes:
    - Ingress
    - Egress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: ingress-nginx
      ports:
        - port: {{.Values.gateway.port}}
          protocol: TCP
    - from:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: api
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: api-canary
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: worker-realtime
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: worker-lifecycle
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: worker-batch
      ports:
        - port: {{.Values.gateway.port}}
          protocol: TCP
    - from:
        - podSelector:
            matchLabels:
              {{- if dig "enabled" false .Values.roles }}
              app.kubernetes.io/instance: {{ .Release.Name }}
              app.kubernetes.io/part-of: fluxer
              {{- else }}
              {{- include "fluxer.selectorLabels" (dict "name" "gateway" "context" .) | nindent 14 }}
              {{- end }}
      ports:
        - port: {{.Values.gateway.port}}
          protocol: TCP
        {{- if $clusterEnabled }}
        - port: {{ $epmdPort }}
          protocol: TCP
        - port: {{ $distPort }}
          protocol: TCP
        {{- end }}
  egress:
    - {}