{{- if .Values.networkPolicy.enabled }}
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: {{ include "aptly.fullname" . }}
  labels:
    {{- include "aptly.labels" . | nindent 4 }}
spec:
  podSelector:
    matchLabels:
      {{- include "aptly.selectorLabels" . | nindent 6 }}
  policyTypes:
    - Ingress
    - Egress
  ingress:
    {{- if .Values.networkPolicy.allowedNamespaces }}
    # Restricted to these namespaces (plus this one). NOTE: this applies to
    # the whole nginx endpoint — read and write share one port, so this
    # cannot itself express "reads are public, writes are cluster-only" any
    # more precisely than security.write.allowCIDRs can (see the warning
    # rendered into nginx.conf for that). Use it to fence the Service off
    # from unrelated namespaces, not as a read/write split.
    - from:
        - podSelector: {}
    {{- range .Values.networkPolicy.allowedNamespaces }}
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: {{ . }}
    {{- end }}
    {{- else }}
    - {}
    {{- end }}
    {{- with .Values.networkPolicy.extraIngress }}
    {{- toYaml . | nindent 4 }}
    {{- end }}
  egress:
    {{- if .Values.networkPolicy.egress.allowAll }}
    - {}
    {{- else }}
    - to:
        - namespaceSelector: {}
      ports:
        - protocol: UDP
          port: 53
        - protocol: TCP
          port: 53
    {{- with .Values.networkPolicy.egress.extra }}
    {{- toYaml . | nindent 4 }}
    {{- end }}
    {{- end }}
{{- end }}