# AWOOOI 正式環境零信任網路策略
# 負責人: CIO
# 版本: v1.7
# 日期: 2026-05-03
# 變更:
#   - v1.7: ADR-110 — 新增 GCP-A/GCP-B Ollama egress（GCP 三層容災）
#   - v1.6: 新增 K3s node 120/121 SSH egress，供 SSH MCP 主機診斷/修復
#   - v1.5: 新增 keepalived VIP 192.168.0.125/32 ArgoCD NodePort 30443 egress（修復 heartbeat probe）
#   - v1.4: 新增 ArgoCD MCP egress（argocd namespace port 80/443）
#   - v1.3: 新增 192.168.0.111 Ollama 主機 (M1 Pro)，移除 188 的 Ollama port
#   - v1.2: 修復 DNS 規則使用 namespaceSelector (ADR-011 Appendix B)
#   - v1.1: 新增 Langfuse LLMOps (192.168.0.110:3100) - Phase 15.1
#
# 原則: Default Deny All - 預設拒絕所有流量，僅白名單允許

# 1. 預設拒絕所有流量
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
  namespace: awoooi-prod
spec:
  podSelector: {}
  policyTypes:
    - Ingress
    - Egress

---
# 2. 允許 Nginx Gateway 與 K3s NodePort 的 Ingress 流量
# 注意: externalTrafficPolicy: Cluster 會導致 NodePort 流量源 IP 被 SNAT 為節點 IP
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-nginx-ingress
  namespace: awoooi-prod
spec:
  podSelector: {}
  policyTypes:
    - Ingress
  ingress:
    # 允許來自 Nginx Gateway (188) 的直接流量
    - from:
        - ipBlock:
            cidr: 192.168.0.188/32
      ports:
        - protocol: TCP
          port: 3000
        - protocol: TCP
          port: 8000
    # 允許 K3s NodePort 流量 (SNAT 後源 IP 變為節點 IP)
    # 2026-04-05 Claude Code: 加入 110 — Alertmanager 需要從 110 送 webhook 到 API
    - from:
        - ipBlock:
            cidr: 192.168.0.120/32  # K3s Master (mon)
        - ipBlock:
            cidr: 192.168.0.121/32  # K3s Worker (mon1)
        - ipBlock:
            cidr: 192.168.0.110/32  # DevOps 主機 (Alertmanager 來源)
      ports:
        - protocol: TCP
          port: 3000
        - protocol: TCP
          port: 8000
    # 允許 K3s 內部 Pod 網段 (健康檢查 + 叢集內部通訊)
    - from:
        - ipBlock:
            cidr: 10.42.0.0/16  # K3s Pod CIDR
      ports:
        - protocol: TCP
          port: 3000
        - protocol: TCP
          port: 8000

---
# 3. 允許訪問必要的外部服務 (Egress)
# 2026-03-23 修正: 使用 system: awoooi 匹配所有 Pods (API + Worker + Web)
# 教訓: app: awoooi-api 會排除 Worker (app: awoooi-worker)
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-required-egress
  namespace: awoooi-prod
spec:
  podSelector:
    matchLabels:
      system: awoooi
  policyTypes:
    - Egress
  egress:
    # 允許訪問 192.168.0.188 主機服務 (AI+Web 中心)
    - to:
        - ipBlock:
            cidr: 192.168.0.188/32
      ports:
        # SSH — repair-bot-188.sh 自動修復 (momo-app/tsenyang/signoz/minio/openclaw)
        # (2026-04-09 Claude Sonnet 4.6 Asia/Taipei, docker-188 修復路徑)
        - protocol: TCP
          port: 22
        # PostgreSQL (Host 直裝)
        - protocol: TCP
          port: 5432
        # Redis Stack (Docker)
        - protocol: TCP
          port: 6380
        # OpenClaw (clawbot Docker) - 2026-04-01 ogt: 修正為 8088 (clawbot-v5 使用 8088)
        - protocol: TCP
          port: 8088
        # SigNoz UI (Docker)
        - protocol: TCP
          port: 3301
        # ========== OTEL 神經連線 (P0 核心) ==========
        # SigNoz OTEL Collector gRPC (Host 24317 -> Container 4317)
        - protocol: TCP
          port: 24317
        # SigNoz OTEL Collector HTTP (Host 24318 -> Container 4318)
        - protocol: TCP
          port: 24318
        # ClickHouse HTTP API (直接查詢)
        - protocol: TCP
          port: 8123

    # 允許訪問 Ollama 主機群（GCP-A / GCP-B / Local HDD）
    # 2026-04-08 ogt: 切換 Ollama 到 M1 Pro，速度從 0.45→40+ tok/s
    # 2026-05-03 ogt: ADR-110 GCP 三層容災，主力移至 GCP SSD（9x 載速 + 2x 推理）
    - to:
        - ipBlock:
            cidr: 34.143.170.20/32   # GCP-A Ollama Primary (SSD)
        - ipBlock:
            cidr: 34.21.145.224/32   # GCP-B Ollama Secondary (SSD)
        - ipBlock:
            cidr: 192.168.0.111/32   # Local HDD Fallback (M1 Pro)
      ports:
        # Ollama LLM API
        - protocol: TCP
          port: 11434

    # 允許訪問 192.168.0.110 DevOps 金庫 (Harbor + Sentry + Langfuse + SSH Repair + Monitoring)
    # 2026-03-24 新增: Sentry Self-Hosted
    # 2026-03-26 新增: Langfuse LLMOps (Phase 15.1)
    # 2026-04-09 新增: SSH port 22 — repair-bot-110.sh 自動修復 (Bug #11 修正)
    # 2026-04-09 新增: Grafana(3002) + Prometheus(9090) + Gitea(3001) — monitoring probe
    - to:
        - ipBlock:
            cidr: 192.168.0.110/32
      ports:
        # Sentry Self-Hosted HTTP API
        - protocol: TCP
          port: 9000
        # Harbor Registry (CD pipeline 使用)
        - protocol: TCP
          port: 5000
        # Langfuse LLMOps (Phase 15.1)
        - protocol: TCP
          port: 3100
        # SSH — repair-bot-110.sh 自動修復執行路徑
        # ADR-062: SSH_COMMAND Playbook 需要 K8s Pod → 110:22 的 egress
        - protocol: TCP
          port: 22
        # Grafana — monitoring probe + 監控工具卡片
        - protocol: TCP
          port: 3002
        # Prometheus — monitoring probe + 監控工具卡片
        - protocol: TCP
          port: 9090
        # Gitea — CI/CD 主倉 probe + monitoring
        - protocol: TCP
          port: 3001
        # 2026-05-25 Codex: ADR-110 production Ollama proxy pool.
        # 11435=GCP-A, 11436=GCP-B, 11437=Local 111 fallback.
        - protocol: TCP
          port: 11435
        - protocol: TCP
          port: 11436
        - protocol: TCP
          port: 11437

    # 允許訪問 192.168.0.112 安全掃描服務
    - to:
        - ipBlock:
            cidr: 192.168.0.112/32
      ports:
        # Kali Scanner API
        - protocol: TCP
          port: 8080

    # 允許訪問 K8s API + K3s master SSH (Executor 執行 kubectl/host diagnosis)
    # 2026-03-23 修復: Y 按鈕執行超時
    # 重要: ClusterIP (10.43.0.1:443) 會路由到實際端點 (192.168.0.120:6443)
    #       必須同時允許兩者，否則流量會被 192.168.0.0/16 排除規則阻擋
    - to:
        - ipBlock:
            cidr: 10.43.0.1/32  # K3s API Server ClusterIP
      ports:
        - protocol: TCP
          port: 443
    - to:
        - ipBlock:
            cidr: 192.168.0.120/32  # K3s Master 實際 API Server 端點 + ArgoCD NodePort + SSH MCP
      ports:
        # SSH MCP — K3s master host diagnosis/repair path
        - protocol: TCP
          port: 22
        - protocol: TCP
          port: 6443
        # ArgoCD MCP NodePort (2026-04-11): ClusterIP DNAT 跨 namespace 不穩定，改用 NodePort
        - protocol: TCP
          port: 30443

    # keepalived VIP — ArgoCD NodePort 存取點
    # 2026-04-14 Claude Sonnet 4.6: VIP=192.168.0.125 當前在 mon(120)，ARGOCD_URL 指向 VIP
    # 修復: heartbeat _probe_argocd_sync() 連 VIP:30443 被 NetworkPolicy 擋（All connection attempts failed）
    - to:
        - ipBlock:
            cidr: 192.168.0.125/32  # keepalived VIP
      ports:
        - protocol: TCP
          port: 30443

    # 允許訪問 ArgoCD MCP（MCP Phase 3，2026-04-11）
    # ArgoCD Server Pod 在 argocd namespace (10.42.0.252)，但 DNS 解析到 ClusterIP (10.43.16.201)
    # 必須同時允許 namespace+pod selector（Pod IP）和 ClusterIP
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: argocd
          podSelector:
            matchLabels:
              app.kubernetes.io/name: argocd-server
        - ipBlock:
            cidr: 10.43.16.201/32  # argocd-server ClusterIP
      ports:
        - protocol: TCP
          port: 8080

    # 允許訪問 192.168.0.121 K3s Worker (mon1)
    # 2026-04-09 新增: NodePort 32334(API)/32335(Web) 在 121 上，host probe 需要
    # 2026-04-14 新增: 30443 — ArgoCD server pod 在 121，kube-proxy DNAT 從此節點
    - to:
        - ipBlock:
            cidr: 192.168.0.121/32
      ports:
        # SSH MCP — K3s worker host diagnosis/repair path
        - protocol: TCP
          port: 22
        - protocol: TCP
          port: 6443
        - protocol: TCP
          port: 30443
        - protocol: TCP
          port: 32334
        - protocol: TCP
          port: 32335

    # 允許 DNS 解析
    # 2026-03-26 修復: 使用 namespaceSelector 明確指定 kube-system
    # ADR-011 Appendix B: CoreDNS 只有 k8s-app=kube-dns 標籤，不要加其他標籤要求
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
          podSelector:
            matchLabels:
              k8s-app: kube-dns
      ports:
        - protocol: UDP
          port: 53
        - protocol: TCP
          port: 53

    # 允許訪問外部 AI API (雲端備援: Gemini / Claude)
    # ⚠️ 2026-03-29 首席架構師審查:
    #   - K8s NetworkPolicy 不支援 FQDN (域名)，僅支援 CIDR
    #   - Google/Anthropic API IP 範圍動態變化
    #   - 若限定 CIDR，API 變更時會中斷 AI 功能
    #   - 建議: 維持 0.0.0.0/0:443，透過 Egress Gateway 強化 (未來)
    - to:
        - ipBlock:
            cidr: 0.0.0.0/0
            except:
              # 排除內網
              - 10.0.0.0/8
              - 172.16.0.0/12
              - 192.168.0.0/16
      ports:
        - protocol: TCP
          port: 443

---
# 4. 明確禁止訪問 Legacy Namespace
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-legacy-access
  namespace: awoooi-prod
spec:
  podSelector: {}
  policyTypes:
    - Egress
  egress:
    # 這條規則會被上面的 allow 規則覆蓋
    # 但明確表示禁止訪問 Legacy
    - to:
        - namespaceSelector:
            matchLabels:
              name: wooo-aiops
      # 沒有 ports = 全部拒絕 (但此規則實際上不會生效因為 default-deny)
