{{- if .Values.networkPolicy.enabled }}
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: {{ include "claude-code.fullname" . }}-manager
  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "claude-code.labels" . | nindent 4 }}
spec:
  podSelector:
    matchLabels:
      {{- include "claude-code.selectorLabels" . | nindent 6 }}
      app.kubernetes.io/component: control-plane
  policyTypes:
    - Ingress
    - Egress
  ingress:
    # ブラウザ / Ingress コントローラーからの受付ポート
    - ports:
        - protocol: TCP
          port: {{ .Values.gateway.port }}
  egress:
    # DNS
    - to:
        - namespaceSelector:
            matchLabels:
              {{- toYaml .Values.networkPolicy.dnsNamespaceSelector | nindent 14 }}
      ports:
        - protocol: UDP
          port: 53
        - protocol: TCP
          port: 53
    # kube-apiserver（セッション Pod/Service の CRUD）
    - ports:
        - protocol: TCP
          port: 443
        - protocol: TCP
          port: 6443
    # セッション Pod の ttyd へのリバースプロキシ
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: {{ include "claude-code.sessionsNamespace" . }}
          podSelector:
            matchLabels:
              app.kubernetes.io/name: claude-code
              app.kubernetes.io/component: session
      ports:
        - protocol: TCP
          port: {{ .Values.session.ttydPort }}
{{- end }}