# Egress for the EFS pods: DNS and NFS to the mount targets, nothing else.
#
# An EKS Auto Mode ApplicationNetworkPolicy is a NetworkPolicy enforced on the node,
# outside the guest, so a command inside the sandbox cannot change it. For the pods it
# selects (app: efs-shared), all ingress and all egress are denied except DNS on UDP and
# TCP 53 and NFS (TCP 2049) to the EFS mount-target addresses.
#
# DNS is allowed to any address (0.0.0.0/0 on port 53), not pinned to the CoreDNS
# Service IP. On EKS Auto Mode CoreDNS runs as a per-node systemd service rather than a
# pod behind a ClusterIP, so the resolver a pod actually reaches is node-local; allowing
# port 53 to any address keeps name resolution working wherever Auto Mode places it. The
# rule is still narrow: it opens only the DNS ports, and everything else stays denied.
#
# test.sh renders this file before applying it:
#   <MOUNT_TARGET_BLOCK>  one `- ipBlock: { cidr: <ip>/32 }` line per EFS mount-target IP,
#                         one per cluster Availability Zone:
#                         aws efs describe-mount-targets --file-system-id <fs> \
#                           --query 'MountTargets[].IpAddress'
#
# The mount targets are addressed by IP (ipBlock), not domainNames: the EFS DNS name
# resolves to these mount-target IPs, and pinning them keeps the rule to exactly the
# interfaces NFS must reach. The TLS connection is terminated inside each guest; the node
# coordinates the CSI operation but is not on the file-data path.
apiVersion: networking.k8s.aws/v1alpha1
kind: ApplicationNetworkPolicy
metadata:
  name: efs-shared-egress
spec:
  podSelector:
    matchLabels:
      app: efs-shared
  policyTypes:
    - Ingress
    - Egress
  egress:
    - to:
        - ipBlock: { cidr: 0.0.0.0/0 }
      ports:
        - { protocol: UDP, port: 53 }
        - { protocol: TCP, port: 53 }
    - to:
        <MOUNT_TARGET_BLOCK>
      ports:
        - { protocol: TCP, port: 2049 }