apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: odoo-network-policy
  namespace: {{ taskserv.namespace }}
  labels:
    app.kubernetes.io/name: {{ taskserv.name }}
    app.kubernetes.io/instance: {{ taskserv.tenant }}
    app.kubernetes.io/managed-by: provisioning
spec:
  endpointSelector:
    matchLabels:
      app.kubernetes.io/name: odoo
  ingress:
    - fromEntities:
        - ingress
      toPorts:
        - ports:
            - port: "8069"
              protocol: TCP
    - fromEndpoints:
        - matchLabels:
            io.kubernetes.pod.namespace: kube-system
      toPorts:
        - ports:
            - port: "8069"
              protocol: TCP
    - fromEndpoints:
        - matchLabels:
            io.kubernetes.pod.namespace: "{{ taskserv.namespace }}"
  egress:
    - toEndpoints:
        - matchLabels:
            io.kubernetes.pod.namespace: kube-system
            k8s-app: kube-dns
      toPorts:
        - ports:
            - port: "53"
              protocol: UDP
            - port: "53"
              protocol: TCP
    - toEndpoints:
        - matchLabels:
            io.kubernetes.pod.namespace: core-data
            app.kubernetes.io/name: postgresql
      toPorts:
        - ports:
            - port: "5432"
              protocol: TCP
    - toEntities:
        - world
      toPorts:
        - ports:
            - port: "443"
              protocol: TCP
            - port: "80"
              protocol: TCP
{% if taskserv.mail_egress is defined %}
    - toEndpoints:
        - matchLabels:
            io.kubernetes.pod.namespace: {{ taskserv.mail_egress.namespace }}
            app.kubernetes.io/name: {{ taskserv.mail_egress.pod_name }}
      toPorts:
        - ports:
{% for p in taskserv.mail_egress.ports %}
            - port: "{{ p }}"
              protocol: TCP
{% endfor %}
{% endif %}