{{- if .Values.NetworkPolicy.Enabled }}
---
kind: NetworkPolicy
apiVersion: {{ template "cockroachdb.networkPolicy.apiVersion" . }}
metadata:
  name: "{{ printf "%s-%s" .Release.Name .Values.Name | trunc 56 }}"
  labels:
    heritage: {{ .Release.Service | quote }}
    release: {{ .Release.Name | quote }}
    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
    component: "{{ .Release.Name }}-{{ .Values.Component }}"
spec:
  podSelector:
    matchLabels:
      component: "{{.Release.Name}}-{{.Values.Component}}"
  ingress:
  - ports:
    - port: {{ .Values.ExternalGrpcPort}}
    {{- if not .Values.NetworkPolicy.AllowExternal }}
    from:
    # Allow clients to connect.
    - podSelector:
        matchLabels:
          {{.Release.Name}}-{{.Values.Component}}-client: "true"
    # Allow other cockroachdb's to connect to form cluster.
    - podSelector:
        matchLabels:
          component: "{{.Release.Name}}-{{.Values.Component}}"
    {{- end }}
  {{- if ne .Values.InternalGrpcPort .Values.ExternalGrpcPort }}
  - ports:
    - port: {{ .Values.InternalGrpcPort}}
    from:
    # Allow other cockroachdb's to connect to form cluster.
    - podSelector:
        matchLabels:
          component: "{{.Release.Name}}-{{.Values.Component}}"
  {{- end }}
  # Allow connections to admin UI.
  - ports:
    - port: {{.Values.ExternalHttpPort}}
  # Allow connections from Prometheus.
  - ports:
    - port: {{.Values.ExternalHttpPort}}
{{- end }}
