# NetworkPolicy template for MCP provider pods.
#
# Usage:
#   This template is auto-generated by Hangar based on the provider's
#   capability declaration. Manual use:
#
#     kubectl apply -f security/networkpolicy/mcp-provider-deny-all.yaml
#
# This is the default deny-all template. The Hangar operator generates
# provider-specific policies with egress rules from capabilities.network.egress.
#
# See: PRODUCT_ARCHITECTURE.md Phase 1 - Network Policy Enforcement (P0)

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: mcp-provider-deny-all
  namespace: mcp-hangar
  labels:
    app.kubernetes.io/managed-by: mcp-hangar-operator
    mcp.hangar/policy-type: default-deny
  annotations:
    mcp.hangar/description: >
      Default deny-all egress policy for MCP providers without explicit
      capability declarations. Generated by mcp-hangar-operator.
      Override by adding capabilities.network.egress to provider config.
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/part-of: mcp-hangar
      mcp.hangar/component: provider
  policyTypes:
    - Ingress
    - Egress
  ingress:
    # Allow traffic from the Hangar control plane only
    - from:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: mcp-hangar
      ports:
        - protocol: TCP
          port: 8080
  egress:
    # Allow DNS resolution (required for any network communication)
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
      ports:
        - protocol: UDP
          port: 53
        - protocol: TCP
          port: 53
    # No other egress allowed by default.
    # Hangar operator adds provider-specific rules from capabilities.network.egress.
---
# Template for a provider WITH declared egress rules.
# The operator generates this per-provider from the capability declaration.
#
# apiVersion: networking.k8s.io/v1
# kind: NetworkPolicy
# metadata:
#   name: mcp-provider-{{ provider_id }}
#   namespace: mcp-hangar
#   labels:
#     app.kubernetes.io/managed-by: mcp-hangar-operator
#     mcp.hangar/provider-id: "{{ provider_id }}"
# spec:
#   podSelector:
#     matchLabels:
#       mcp.hangar/provider-id: "{{ provider_id }}"
#   policyTypes:
#     - Egress
#   egress:
#     - to: []
#       ports: []
#     # Generated from capabilities.network.egress entries:
#     # - to:
#     #     - ipBlock:
#     #         cidr: {{ resolved_ip }}/32
#     #   ports:
#     #     - protocol: TCP
#     #       port: {{ port }}