{{- if .Values.metacontroller.enabled }}
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: {{ include "rise.fullname" . }}-webhook
  labels:
    {{- include "rise.labels" . | nindent 4 }}
spec:
  podSelector:
    matchLabels:
      {{- include "rise.selectorLabels" . | nindent 6 }}
      app.kubernetes.io/component: server
  policyTypes:
  - Ingress
  ingress:
  # Allow traffic to the main HTTP port (e.g. from the Ingress controller)
  - ports:
    - port: {{ .Values.service.targetPort }}
      protocol: TCP
    {{- with .Values.networkPolicy.httpIngressFrom }}
    from:
      {{- toYaml . | nindent 4 }}
    {{- end }}
  # Allow metacontroller to reach the webhook port
  - ports:
    - port: {{ .Values.metacontroller.webhookPort | default 3001 }}
      protocol: TCP
    from:
    - podSelector:
        matchLabels:
          app.kubernetes.io/name: metacontroller-operator
      {{- if not .Values.metacontroller.install }}
      namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: {{ .Values.metacontroller.namespace | default "metacontroller" }}
      {{- end }}
{{- end }}
