# NetworkPolicy for dummy-sink.
#
# Cluster-wide NetworkPolicy enforcement is active on BasicStack (see
# cluster memory on NetworkPolicy activation). Pods in agent-trust
# without an explicit allow-list are isolated; this file is the
# explicit allow-list for dummy-sink per DEV-615.
#
# Ingress callers (per Phase-1 architecture V1.1 §7):
#   - testagent-transform    — the sole producer of handover deliveries.
#
# Egress reachable targets (Phase-1 §7 Senken-Vertrag):
#   - verification-service   — chain verification + replay guard.
#   - signing-service        — handover-attestation signing.
#   - transparency-log       — logging the signed handover envelope.
#   - DNS                    — kube-dns for service name resolution.
#
# dummy-sink intentionally does NOT egress Pocket-ID directly; it uses
# the Pocket-ID OIDC endpoint via HTTPS/443 as the client_credentials
# source for its Bearer token to signing-service. That cluster-external
# target is included below.
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: dummy-sink
  namespace: agent-trust
  labels:
    app.kubernetes.io/name: dummy-sink
    app.kubernetes.io/part-of: proofedmesh
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: dummy-sink
  policyTypes:
    - Ingress
    - Egress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: testagent-transform
      ports:
        - port: 8083
          protocol: TCP
  egress:
    # verification-service (same namespace).
    - to:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: verification-service
      ports:
        - port: 8084
          protocol: TCP
    # signing-service (same namespace).
    - to:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: signing-service
      ports:
        - port: 8081
          protocol: TCP
    # transparency-log (same namespace, port 80 → container 8080).
    - to:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: transparency-log
      ports:
        - port: 8080
          protocol: TCP
    # Pocket-ID OIDC token exchange + JWKS — cluster-external HTTPS/443.
    - ports:
        - port: 443
          protocol: TCP
    # DNS egress to kube-dns.
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
          podSelector:
            matchLabels:
              k8s-app: kube-dns
      ports:
        - port: 53
          protocol: UDP
        - port: 53
          protocol: TCP