# Default-deny plus the narrowest exceptions (EMAIL-WP-0004-T03).
#
# Reachability is part of the threat model: only user-engine may call the
# receiver, and egress is limited to DNS + the IONOS SMTP STARTTLS port.
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: email-connect-default-deny
  namespace: email-connect
  labels:
    app.kubernetes.io/name: email-connect
    app.kubernetes.io/part-of: email-connect
spec:
  podSelector: {}
  policyTypes: [Ingress, Egress]
  # No rules: everything not permitted below is denied.
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: email-connect-user-engine-ingress
  namespace: email-connect
  labels:
    app.kubernetes.io/name: email-connect
    app.kubernetes.io/part-of: email-connect
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: email-connect
  policyTypes: [Ingress]
  ingress:
    # user-engine is the only approved sender. Adding a second caller is a
    # deliberate change here and a matching credential binding.
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: user-engine
          podSelector:
            matchLabels:
              app.kubernetes.io/name: user-engine
      ports:
        - {protocol: TCP, port: 8080}
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: email-connect-egress
  namespace: email-connect
  labels:
    app.kubernetes.io/name: email-connect
    app.kubernetes.io/part-of: email-connect
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: email-connect
  policyTypes: [Egress]
  egress:
    # Cluster DNS
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
      ports:
        - {protocol: UDP, port: 53}
        - {protocol: TCP, port: 53}
    # IONOS SMTP STARTTLS only. No general internet egress.
    # smtp.ionos.de resolves outside the cluster; CIDR is intentionally broad
    # but port-locked to 587. Tighten to provider CIDRs if inventory is fixed.
    - to:
        - ipBlock:
            cidr: 0.0.0.0/0
            except:
              - 10.0.0.0/8
              - 172.16.0.0/12
              - 192.168.0.0/16
      ports:
        - {protocol: TCP, port: 587}