# Serves: R-NET-01 (baseline must actually deny both directions)
# Spec: docs/03 "Deny all ingress and deny all egress by default".
#
# Catches a MALFORMED baseline: a NetworkPolicy claiming to be the default-deny
# baseline (label homelab.keithjackson.dev/baseline=default-deny) that does not
# actually cover BOTH Ingress and Egress is rejected. This is the "test the
# behavior, not the existence" guard for R-NET-01 at the manifest layer -- an
# object existing is not proof it denies (docs/14 principle 1).
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: validate-default-deny-shape
  annotations:
    policies.kyverno.io/title: Validate default-deny baseline shape
    policies.kyverno.io/category: Network Isolation
    policies.kyverno.io/severity: high
    homelab.keithjackson.dev/requirements: R-NET-01
    policies.kyverno.io/description: >-
      A NetworkPolicy labelled as the default-deny baseline must set policyTypes
      to include both Ingress and Egress. Rejects a baseline that silently leaves
      a direction open.
spec:
  validationFailureAction: Enforce
  background: true
  rules:
    - name: baseline-must-deny-both-directions
      match:
        any:
          - resources:
              kinds:
                - NetworkPolicy
              selector:
                matchLabels:
                  homelab.keithjackson.dev/baseline: default-deny
      validate:
        message: >-
          A default-deny baseline NetworkPolicy must set spec.policyTypes to include
          BOTH Ingress and Egress (R-NET-01, docs/03).
        pattern:
          spec:
            policyTypes:
              - Ingress
              - Egress