# Коллектору нужны только DNS, Kafka и Vault (агент-инжектор). Входящие — только health-check kubelet'а.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: audit-collector
spec:
  podSelector: {}
  policyTypes: [Ingress, Egress]
  ingress:
    - ports:
        - {port: 13133, protocol: TCP}   # health_check (liveness/readiness)
  egress:
    - to:
        - namespaceSelector:
            matchLabels: {kubernetes.io/metadata.name: kube-system}
          podSelector:
            matchLabels: {k8s-app: kube-dns}
        - ipBlock: {cidr: 169.254.25.10/32}   # nodelocaldns kubespray; TODO(verify): enable_nodelocaldns в контуре
      ports:
        - {port: 53, protocol: UDP}
        - {port: 53, protocol: TCP}
    - to:
        - namespaceSelector:
            matchLabels: {kubernetes.io/metadata.name: kafka}
      ports:
        # client-листенер SASL_SSL: bootstrap kafka-kafka-contour и advertised-адреса подов controller-headless
        - {port: 9092, protocol: TCP}
    - to:
        - namespaceSelector:
            matchLabels: {kubernetes.io/metadata.name: vault}
      ports:
        - {port: 8200, protocol: TCP}         # vault-vault-contour.vault.svc:8200 (AGENT_INJECT_VAULT_ADDR)