---
# LIVE — reconciled by the non-gating `apps-vms` Flux Kustomization (see namespace.yaml header).
#
# Additive ALLOWs on top of the 10-default-deny baseline. Cilium enforces the UNION of the k8s
# NetworkPolicy (default-deny) and these CiliumNetworkPolicies (same pattern as pihole). The VM's
# datapath is the virt-launcher pod, so endpointSelector kubevirt.io/vm=unifi targets the VM.
#
# NOTE on selector pinning: fromEntities/toEntities (world/cluster/host) are entity-based and need
# no namespace pin. The endpointSelector is already namespace-scoped by each CNP's own namespace.
# (The "must carry io.kubernetes.pod.namespace" caution applies to fromEndpoints/toEndpoints PEER
# selectors, which we deliberately avoid here.)
# --------------------------------------------------------------------------------------------
# 1) INGRESS to the controller: LAN devices + admin browsers reach the L4 ports. LAN hosts are
#    entity `world` to Cilium (off-cluster); `host`/`cluster` cover node-local health probes and
#    any in-cluster caller.
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: unifi-allow-l4-ingress
  namespace: unifi
  labels:
    app.kubernetes.io/name: unifi
spec:
  endpointSelector:
    matchLabels:
      kubevirt.io/vm: unifi
  ingress:
    - fromEntities:
        - world
        - cluster
        - host
      toPorts:
        - ports:
            - { port: "8080", protocol: TCP }    # inform / adoption
            - { port: "11443", protocol: TCP }   # UOS UI
            - { port: "8443", protocol: TCP }    # legacy UI
            - { port: "8880", protocol: TCP }    # guest portal http
            - { port: "8843", protocol: TCP }    # guest portal https
            - { port: "6789", protocol: TCP }    # throughput
            - { port: "3478", protocol: UDP }    # STUN
            - { port: "10001", protocol: UDP }   # discovery
---
# 2) EGRESS from the controller: internet (apt, the UOS installer download, UniFi updates + remote
#    access/STUN to Ubiquiti) + DNS. `world` = default WAN egress (egress-class: internet).
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: unifi-allow-egress
  namespace: unifi
  labels:
    app.kubernetes.io/name: unifi
spec:
  endpointSelector:
    matchLabels:
      kubevirt.io/vm: unifi
  egress:
    - toEntities:
        - world
    - toEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: kube-system
            k8s-app: kube-dns
      toPorts:
        - ports:
            - { port: "53", protocol: UDP }
            - { port: "53", protocol: TCP }
---
# 3) EGRESS for the CDI IMPORTER pod (one-shot, during the DataVolume http import). It runs in this
#    default-deny namespace, so without this it cannot reach cloud-images.ubuntu.com and the import
#    hangs. Selects the importer by its CDI label; allows DNS + world. (This is the app-namespace
#    analogue of the CDI-import allow the vm-data-survival runbook notes.)
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: unifi-allow-cdi-import-egress
  namespace: unifi
  labels:
    app.kubernetes.io/name: unifi
spec:
  endpointSelector:
    matchExpressions:
      - { key: cdi.kubevirt.io, operator: Exists }
  egress:
    - toEntities:
        - world
    - toEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: kube-system
            k8s-app: kube-dns
      toPorts:
        - ports:
            - { port: "53", protocol: UDP }
            - { port: "53", protocol: TCP }