apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: minecraft
  namespace: minecraft
spec:
  endpointSelector:
    matchLabels:
      app.kubernetes.io/name: minecraft
      app.kubernetes.io/instance: skies
  ingress:
    - fromEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: grafana
            app.kubernetes.io/name: grafana
            app.kubernetes.io/instance: grafana
      toPorts:
        - ports:
            - port: "25575"
              protocol: TCP
    - fromEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: victoriametrics
            app.kubernetes.io/name: vmagent
            app.kubernetes.io/instance: main
      toPorts:
        - ports:
            - port: "19565"
              protocol: TCP
    - fromEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: short
            app.kubernetes.io/name: tunnel
            app.kubernetes.io/instance: short
      toPorts:
        - ports: [{port: "25565", protocol: TCP}]
    - fromEntities: [host]
      toPorts:
        - ports:
            - port: "25565"
              protocol: TCP
    - fromCIDR:
        - 10.115.187.218/24
        - 10.63.81.107/24
        - 10.162.8.60/24
        - 10.82.151.234/24
      toPorts:
        - ports:
            - port: "25565"
              protocol: TCP
  egress:
    - toFQDNs:
        - matchName: s3.quorate.internal
      toPorts:
        - ports: [{port: "443", protocol: TCP}]
    - toEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: versitygw
            app.kubernetes.io/name: versitygw
            app.kubernetes.io/instance: versitygw
      toPorts:
        - ports: [{port: "7070", protocol: TCP}]
    - toEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: kube-system
            k8s:k8s-app: kube-dns
      toPorts:
        - ports:
            - port: "53"
              protocol: UDP
            - port: "53"
              protocol: TCP
          rules:
            dns:
              - matchName: sessionserver.mojang.com
              - matchName: api.minecraftservices.com
              - matchName: s3.quorate.internal
    - toFQDNs:
        - matchName: sessionserver.mojang.com
        - matchName: api.minecraftservices.com
      toPorts:
        - ports:
            - port: "443"
              protocol: TCP

---
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: minecraft-artifacts
  namespace: versitygw
spec:
  endpointSelector:
    matchLabels:
      app.kubernetes.io/name: versitygw
      app.kubernetes.io/instance: versitygw
  ingress:
    - fromEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: minecraft
            app.kubernetes.io/name: minecraft
            app.kubernetes.io/instance: skies
      toPorts:
        - ports: [{port: "7070", protocol: TCP}]