# services/hermes/networkpolicy.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: hermes-ollama-ingress
  namespace: hermes
spec:
  podSelector:
    matchLabels:
      app: hermes-ollama
  policyTypes:
    - Ingress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: hermes-model-gate
      ports:
        - protocol: TCP
          port: 11434
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: maintenance
          podSelector:
            matchLabels:
              app: ariadne
      ports:
        - protocol: TCP
          port: 11434
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: hermes-triage-ingress
  namespace: hermes
spec:
  podSelector:
    matchLabels:
      app: hermes
  policyTypes: [Ingress]
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: oauth2-proxy-hermes-triage
      ports:
        - {protocol: TCP, port: 8787}
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: maintenance
          podSelector:
            matchLabels:
              app: ariadne
      ports:
        - {protocol: TCP, port: 8642}
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: hermes-agent-isolation
  namespace: hermes
spec:
  podSelector:
    matchLabels:
      app: hermes-agent
  policyTypes: [Ingress, Egress]
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: oauth2-proxy-hermes-agent
      ports:
        - {protocol: TCP, port: 7681}
  egress:
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
          podSelector:
            matchLabels:
              k8s-app: kube-dns
      ports:
        - {protocol: UDP, port: 53}
        - {protocol: TCP, port: 53}
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: vault
          podSelector:
            matchLabels:
              app: vault
      ports:
        - {protocol: TCP, port: 8200}
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: ai
          podSelector:
            matchLabels:
              app: ollama
      ports:
        - {protocol: TCP, port: 11434}
    - to:
        - podSelector:
            matchLabels:
              app: hermes-model-gate
      ports:
        - {protocol: TCP, port: 8080}
    - to:
        - ipBlock:
            cidr: 10.43.0.1/32
      ports:
        - {protocol: TCP, port: 443}
    - to:
        - ipBlock:
            cidr: 192.168.22.11/32
        - ipBlock:
            cidr: 192.168.22.12/32
        - ipBlock:
            cidr: 192.168.22.13/32
      ports:
        - {protocol: TCP, port: 6443}
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: traefik
          podSelector:
            matchLabels:
              app: traefik
      ports:
        - {protocol: TCP, port: 443}
    - to:
        - ipBlock:
            cidr: 0.0.0.0/0
            except:
              - 10.0.0.0/8
              - 100.64.0.0/10
              - 127.0.0.0/8
              - 169.254.0.0/16
              - 172.16.0.0/12
              - 192.168.0.0/16
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: hermes-chat-sandbox-deny
  namespace: hermes
spec:
  podSelector:
    matchLabels:
      app: hermes-chat-sandbox
  policyTypes: [Ingress, Egress]
  ingress: []
  egress: []
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: hermes-chat-sandbox-tenant-0
  namespace: hermes
spec:
  podSelector:
    matchLabels:
      app: hermes-chat-sandbox
      apps.kubernetes.io/pod-index: "0"
  policyTypes: [Ingress]
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: hermes-chat-tenant
              apps.kubernetes.io/pod-index: "0"
      ports:
        - {protocol: TCP, port: 9080}
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: hermes-chat-sandbox-tenant-1
  namespace: hermes
spec:
  podSelector:
    matchLabels:
      app: hermes-chat-sandbox
      apps.kubernetes.io/pod-index: "1"
  policyTypes: [Ingress]
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: hermes-chat-tenant
              apps.kubernetes.io/pod-index: "1"
      ports:
        - {protocol: TCP, port: 9080}
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: hermes-chat-sandbox-tenant-2
  namespace: hermes
spec:
  podSelector:
    matchLabels:
      app: hermes-chat-sandbox
      apps.kubernetes.io/pod-index: "2"
  policyTypes: [Ingress]
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: hermes-chat-tenant
              apps.kubernetes.io/pod-index: "2"
      ports:
        - {protocol: TCP, port: 9080}
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: hermes-chat-sandbox-tenant-3
  namespace: hermes
spec:
  podSelector:
    matchLabels:
      app: hermes-chat-sandbox
      apps.kubernetes.io/pod-index: "3"
  policyTypes: [Ingress]
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: hermes-chat-tenant
              apps.kubernetes.io/pod-index: "3"
      ports:
        - {protocol: TCP, port: 9080}
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: hermes-chat-tenant-isolation
  namespace: hermes
spec:
  podSelector:
    matchLabels:
      app: hermes-chat-tenant
  policyTypes: [Ingress, Egress]
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: hermes-chat-router
      ports:
        - {protocol: TCP, port: 8787}
        - {protocol: TCP, port: 8642}
  egress:
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
          podSelector:
            matchLabels:
              k8s-app: kube-dns
      ports:
        - {protocol: UDP, port: 53}
        - {protocol: TCP, port: 53}
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: vault
          podSelector:
            matchLabels:
              app: vault
      ports:
        - {protocol: TCP, port: 8200}
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: ai
          podSelector:
            matchLabels:
              app: ollama
      ports:
        - {protocol: TCP, port: 11434}
    - to:
        - podSelector:
            matchLabels:
              app: hermes-model-gate
      ports:
        - {protocol: TCP, port: 8080}
    - to:
        - podSelector:
            matchLabels:
              app: hermes-chat-sandbox
      ports:
        - {protocol: TCP, port: 9080}
    - to:
        - ipBlock:
            cidr: 0.0.0.0/0
            except:
              - 10.0.0.0/8
              - 100.64.0.0/10
              - 127.0.0.0/8
              - 169.254.0.0/16
              - 172.16.0.0/12
              - 192.168.0.0/16
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: hermes-chat-router-isolation
  namespace: hermes
spec:
  podSelector:
    matchLabels:
      app: hermes-chat-router
  policyTypes: [Ingress, Egress]
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: oauth2-proxy-hermes-chat
      ports:
        - {protocol: TCP, port: 8080}
  egress:
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
          podSelector:
            matchLabels:
              k8s-app: kube-dns
      ports:
        - {protocol: UDP, port: 53}
        - {protocol: TCP, port: 53}
    - to:
        - podSelector:
            matchLabels:
              app: hermes-chat-tenant
      ports:
        - {protocol: TCP, port: 8787}
        - {protocol: TCP, port: 8642}
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: vault
          podSelector:
            matchLabels:
              app: vault
      ports:
        - {protocol: TCP, port: 8200}
    - to:
        - ipBlock:
            cidr: 0.0.0.0/0
            except:
              - 10.0.0.0/8
              - 100.64.0.0/10
              - 127.0.0.0/8
              - 169.254.0.0/16
              - 172.16.0.0/12
              - 192.168.0.0/16
      ports:
        - {protocol: TCP, port: 443}
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: hermes-oauth2-proxies
  namespace: hermes
spec:
  podSelector:
    matchExpressions:
      - key: app
        operator: In
        values:
          - oauth2-proxy-hermes-agent
          - oauth2-proxy-hermes-chat
          - oauth2-proxy-hermes-triage
  policyTypes: [Ingress, Egress]
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: traefik
          podSelector:
            matchLabels:
              app: traefik
      ports:
        - {protocol: TCP, port: 4180}
  egress:
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
          podSelector:
            matchLabels:
              k8s-app: kube-dns
      ports:
        - {protocol: UDP, port: 53}
        - {protocol: TCP, port: 53}
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: vault
          podSelector:
            matchLabels:
              app: vault
      ports:
        - {protocol: TCP, port: 8200}
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: traefik
          podSelector:
            matchLabels:
              app: traefik
      ports:
        - {protocol: TCP, port: 443}
    - to:
        - podSelector:
            matchExpressions:
              - key: app
                operator: In
                values: [hermes, hermes-agent, hermes-chat-router]
      ports:
        - {protocol: TCP, port: 7681}
        - {protocol: TCP, port: 8787}
        - {protocol: TCP, port: 8080}