apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-egress
  namespace: arc-ci
spec:
  podSelector: {}
  policyTypes: ["Egress"]
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-dns
  namespace: arc-ci
spec:
  # The scale-set listener and ephemeral runners both resolve named endpoints.
  podSelector: {}
  policyTypes: ["Egress"]
  egress:
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
          podSelector:
            matchLabels:
              k8s-app: kube-dns
      ports:
        - {protocol: UDP, port: 53}
        - {protocol: TCP, port: 53}
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-platform-registry-gateway
  namespace: arc-ci
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: arc-runner
  policyTypes: ["Egress"]
  egress:
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: platform-registry
          podSelector:
            matchLabels:
              app.kubernetes.io/name: platform-registry-gateway
      ports:
        - {protocol: TCP, port: 4873}
---
apiVersion: v1
kind: Service
metadata:
  name: platform-registry-gateway
  namespace: arc-ci
spec:
  type: ExternalName
  externalName: platform-registry-gateway.platform-registry.svc.cluster.local
  ports:
    - name: npm-registry
      port: 4873
      targetPort: 4873
---
# Kubernetes NetworkPolicy has no FQDN selector. This single external-HTTPS rule
# permits github.com and registry.npmjs.org but cannot distinguish them from other
# HTTPS destinations. Enforce those two names with the installed CNI's FQDN policy
# before treating egress as fail-closed; do not add GitHub/package credentials.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-github-and-npmjs-https
  namespace: arc-ci
  annotations:
    overdeck.dev/intended-fqdns: github.com,api.github.com,registry.npmjs.org
spec:
  # The listener reaches GitHub; runner pods reach GitHub and npmjs. The
  # namespace contains only this scale set.
  podSelector: {}
  policyTypes: ["Egress"]
  egress:
    - to:
        - ipBlock:
            cidr: 0.0.0.0/0
            except:
              - 10.0.0.0/8
              - 172.16.0.0/12
              - 192.168.0.0/16
      ports:
        - {protocol: TCP, port: 443}
---
# The ARC listener watches its scale-set resources through the cluster API. The
# service IP is the installed k3s kubernetes.default endpoint; runner pods have
# no service-account token and therefore cannot authenticate even if selected.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-kubernetes-api
  namespace: arc-ci
spec:
  podSelector: {}
  policyTypes: ["Egress"]
  egress:
    - to:
        - ipBlock:
            cidr: 10.43.0.1/32
      ports:
        - {protocol: TCP, port: 443}
