# Allow Option A backup Jobs to reach kube-api, DNS, and HTTPS offsite (Nextcloud).
# databases/ has default-deny; CNPG cluster pods already have kube-api egress by label.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-egress-cnpg-option-a-backup
  namespace: databases
  labels:
    app.kubernetes.io/part-of: railiance-apps
    railiance.apps/backup-lane: option-a
spec:
  podSelector:
    matchLabels:
      railiance.apps/backup-lane: option-a
  policyTypes:
    - Egress
  egress:
    # kube-api (in-cluster service + node port forms)
    - ports:
        - port: 443
          protocol: TCP
        - port: 6443
          protocol: TCP
    # DNS
    - ports:
        - port: 53
          protocol: UDP
        - port: 53
          protocol: TCP
    # Nextcloud WebDAV HTTPS (and general HTTPS for future mirrors)
    - ports:
        - port: 443
          protocol: TCP
      to:
        - namespaceSelector: {}
          # allow all namespaces + external via empty podSelector not possible;
          # for external CIDR use 0.0.0.0/0
        - ipBlock:
            cidr: 0.0.0.0/0
---
# Some CNI stacks need separate CIDR-only rules for kube-api ClusterIP
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-egress-cnpg-option-a-backup-kubeapi-cidr
  namespace: databases
  labels:
    app.kubernetes.io/part-of: railiance-apps
    railiance.apps/backup-lane: option-a
spec:
  podSelector:
    matchLabels:
      railiance.apps/backup-lane: option-a
  policyTypes:
    - Egress
  egress:
    - to:
        - ipBlock:
            cidr: 10.43.0.0/16
      ports:
        - port: 443
          protocol: TCP
        - port: 6443
          protocol: TCP
    - to:
        - ipBlock:
            cidr: 10.42.0.0/16
      ports:
        - port: 443
          protocol: TCP
        - port: 6443
          protocol: TCP