# The sandboxes' network: nothing in, the two OpenAI hosts out.
#
# An EKS Auto Mode ApplicationNetworkPolicy is a NetworkPolicy that also accepts
# hostnames (domainNames) in an egress rule. For the sandbox pods it allows:
#   - NO ingress at all. The launcher delivers the session and the key through
#     the SandboxClaim env (the control plane), not over the pod network, so no
#     pod ever needs to connect to a sandbox. The kubelet's readiness probe is
#     node-local and not pod-to-pod traffic, so a deny-all ingress does not
#     block it.
#   - egress to DNS (port 53) for name lookups;
#   - egress to api.openai.com (the executor registers the environment there);
#   - egress to codex-cloud-environments.chatgpt.com (commands and results).
# These are the two hosts OpenAI lists for a self-hosted environment's network
# access. Every other address is refused, so a command the model runs cannot
# reach other pods, AWS APIs or the rest of the internet. (Kubernetes always
# allows a pod to reach its own node, which is not a path to the internet.)
#
# DNS (port 53) is allowed to any IP address. While CoreDNS typically runs on a fixed
# cluster address, allowing any destination eliminates the need for address lookup and
# substitution.
apiVersion: networking.k8s.aws/v1alpha1
kind: ApplicationNetworkPolicy
metadata:
  name: openai-sandbox-executor-egress
spec:
  podSelector:
    matchLabels:
      app: openai-sandbox-executor
  policyTypes:
    - Ingress
    - Egress
  ingress: []        # deny all ingress; the sandbox has no network intake
  egress:
    - to:
        - ipBlock: { cidr: 0.0.0.0/0 }
      ports:
        - { protocol: UDP, port: 53 }
        - { protocol: TCP, port: 53 }
    - to:
        - domainNames:
            - api.openai.com
            - codex-cloud-environments.chatgpt.com
      ports:
        - { protocol: TCP, port: 443 }