# NetworkPolicy for verification-service.
#
# Cluster-wide NetworkPolicy enforcement is active on BasicStack (see
# cluster memory on NetworkPolicy activation). Pods in agent-trust
# without an explicit allow-list are isolated; this file is the
# explicit allow-list for verification-service per DEV-615.
#
# Ingress callers (per Phase-1 architecture V1.1 §7):
#   - approval-service       — supplies the approval predicate when a
#                              fast chain pre-check is needed.
#   - testagent-transform    — the transformation agent that submits
#                              a chain to vet before shipping to the sink.
#   - dummy-sink             — the Phase-1 sink that calls back into
#                              verify/chain before persisting a payload.
#
# Egress reachable targets:
#   - transparency-log       — pulls DSSE envelopes + inclusion proofs
#                              (agent-trust/transparency-log, port 80).
#   - trust-pg               — Postgres backing the replay-store
#                              `verification_decisions` table (store=postgres).
#   - Pocket-ID JWKS         — out-of-cluster `auth.basicstack.de` JWKS
#                              fetch for OIDC validators (HTTPS/443).
#   - DNS                    — kube-dns in kube-system for service name
#                              resolution.
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: verification-service
  namespace: agent-trust
  labels:
    app.kubernetes.io/name: verification-service
    app.kubernetes.io/part-of: proofedmesh
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: verification-service
  policyTypes:
    - Ingress
    - Egress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: approval-service
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: testagent-transform
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: dummy-sink
      ports:
        - port: 8084
          protocol: TCP
  egress:
    # transparency-log (in-cluster, agent-trust namespace, port 80).
    - to:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: transparency-log
      ports:
        - port: 8080
          protocol: TCP
    # trust-api Postgres (replay-store backend). Reached via the
    # `trust-pg` Service in the same namespace.
    - to:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: trust-pg
      ports:
        - port: 5432
          protocol: TCP
    # Pocket-ID JWKS discovery is served from the public ingress
    # (`auth.basicstack.de`). Egress is cluster-external HTTPS; no
    # cluster selector will match, so this is an unrestricted
    # TCP/443 egress rule.
    - ports:
        - port: 443
          protocol: TCP
    # DNS egress to kube-dns (cluster hostname resolution + out-of-
    # cluster CNAME lookups for Pocket-ID JWKS).
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
          podSelector:
            matchLabels:
              k8s-app: kube-dns
      ports:
        - port: 53
          protocol: UDP
        - port: 53
          protocol: TCP