# Egress for the coding agent: DNS, Bedrock and GitHub, nothing else.
#
# An EKS Auto Mode ApplicationNetworkPolicy is a NetworkPolicy that also accepts
# hostnames (domainNames) in an egress rule. For the pods it selects, all ingress
# and all egress are denied except DNS to CoreDNS, the Pod Identity credential
# address, and HTTPS to the three names below.
#
# DNS (port 53) is allowed to any address, not pinned to one CoreDNS Service IP. On EKS
# Auto Mode CoreDNS runs locally on each instance rather than behind a single ClusterIP,
# so a rule pinned to one looked-up address would not reliably reach the resolver a pod
# actually uses; allowing the port to any destination keeps name resolution working
# without that lookup. The rule still opens only port 53.
# If you run in a Region other than us-west-2, change the Bedrock hostname to match.
#
# The Pod Identity rule is what lets the agent get its Bedrock credentials. A Nitro
# sandbox passes credential requests to 169.254.170.23 on to the Pod Identity Agent on
# the node, and this policy applies to them: without the rule they time out, from a
# sandboxed pod as from an ordinary one.
apiVersion: networking.k8s.aws/v1alpha1
kind: ApplicationNetworkPolicy
metadata:
  name: coding-agent-egress
spec:
  podSelector:
    matchLabels:
      app: coding-agent
  policyTypes:
    - Ingress
    - Egress
  egress:
    - to:
        - ipBlock: { cidr: 0.0.0.0/0 }
      ports:
        - { protocol: UDP, port: 53 }
        - { protocol: TCP, port: 53 }
    - to:
        - ipBlock: { cidr: 169.254.170.23/32 }   # EKS Pod Identity credentials
      ports:
        - { protocol: TCP, port: 80 }
    - to:
        - domainNames:
            - bedrock-runtime.us-west-2.amazonaws.com   # the model
            - github.com                                # git clone and push
            - api.github.com                            # read the issue, open the PR
      ports:
        - { protocol: TCP, port: 443 }