# The editor's network: nothing in from the pod network, DNS and three names out.
#
# An EKS Auto Mode ApplicationNetworkPolicy is a NetworkPolicy that also accepts
# hostnames (domainNames) in an egress rule. For the editor's pod it allows:
#   - no ingress at all, because no pod on the cluster needs to reach the editor.
#     kubectl port-forward still works: the stream arrives from the pod's own
#     node, and Kubernetes always allows traffic between a pod and its node, so
#     an ingress rule can neither deny that nor is needed to permit it. The
#     consequence is that anything sending from the node's own address, such as
#     a hostNetwork pod on that node, can still reach the editor's port;
#   - egress to DNS on port 53 for name lookups, and HTTPS to the extension
#     registry and the git host a developer actually uses from the workbench.
# Every other address is refused, so code the developer runs in the editor cannot
# reach other pods, AWS APIs or the rest of the internet. (Kubernetes always
# allows a pod to reach its own node, which is not a path to the internet.)
#
# DNS (port 53) is allowed to any IP address. While CoreDNS typically runs on a
# fixed cluster address, allowing any destination eliminates the need for address
# lookup and substitution. This simplifies the setup and avoids issues with
# missing or malformed cluster DNS addresses (#104).
# __NAMESPACE__ is filled in at apply time by scripts/setup.sh, from NAMESPACE.
apiVersion: networking.k8s.aws/v1alpha1
kind: ApplicationNetworkPolicy
metadata:
  name: ide-egress
  namespace: __NAMESPACE__
spec:
  podSelector:
    matchLabels:
      app: ide
  policyTypes:
    - Ingress
    - Egress
  # No ingress rules under policyTypes: Ingress means every connection to the
  # editor from the pod network is refused, including from other pods on the
  # cluster. kubectl port-forward still works.
  egress:
    - to:
        - ipBlock: { cidr: 0.0.0.0/0 }
      ports:
        - { protocol: UDP, port: 53 }
        - { protocol: TCP, port: 53 }
    - to:
        - domainNames:
            # The extension registry code-server searches needs two names: the
            # gallery answers the search on open-vsx.org and then redirects the
            # download of the extension itself to its asset host. With only the
            # first name, a search succeeds and every install times out.
            - open-vsx.org
            - openvsx.eclipsecontent.org
            # git clone, fetch and push over HTTPS from the editor's terminal.
            - github.com
      ports:
        - { protocol: TCP, port: 443 }