# Solution: Security Configuration from Module 7
# This demonstrates security best practices for operators
#
# Note: Kubebuilder generates network policies automatically in config/network-policy/
# This file shows the generated policies and secure deployment configuration.

---
# Secure Deployment Configuration
# These settings are already in config/manager/manager.yaml (kubebuilder defaults)
apiVersion: apps/v1
kind: Deployment
metadata:
  name: controller-manager
  namespace: postgres-operator-system
  labels:
    app.kubernetes.io/name: postgres-operator
    control-plane: controller-manager
spec:
  replicas: 1
  selector:
    matchLabels:
      control-plane: controller-manager
  template:
    metadata:
      labels:
        control-plane: controller-manager
    spec:
      serviceAccountName: controller-manager
      # Pod-level security context (kubebuilder defaults)
      securityContext:
        runAsNonRoot: true
        seccompProfile:
          type: RuntimeDefault
      containers:
      - name: manager
        image: postgres-operator:latest
        args:
        - --leader-elect=false
        - --health-probe-bind-address=:8081
        - --metrics-bind-address=:8443
        - --metrics-secure=true
        ports:
        - containerPort: 8443
          name: metrics
          protocol: TCP
        - containerPort: 8081
          name: health
          protocol: TCP
        - containerPort: 9443
          name: webhook-server
          protocol: TCP
        # Container-level security context (kubebuilder defaults)
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
        # Health probes
        livenessProbe:
          httpGet:
            path: /healthz
            port: 8081
          initialDelaySeconds: 15
          periodSeconds: 20
        readinessProbe:
          httpGet:
            path: /readyz
            port: 8081
          initialDelaySeconds: 5
          periodSeconds: 10
        # Resource limits (kubebuilder defaults)
        resources:
          limits:
            cpu: 500m
            memory: 128Mi
          requests:
            cpu: 10m
            memory: 64Mi
      terminationGracePeriodSeconds: 10

---
# Network Policy: Allow Metrics Traffic
# Generated by kubebuilder in config/network-policy/allow-metrics-traffic.yaml
# Enable by uncommenting ../network-policy in config/default/kustomization.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  labels:
    app.kubernetes.io/name: postgres-operator
    app.kubernetes.io/managed-by: kustomize
  name: allow-metrics-traffic
  namespace: postgres-operator-system
spec:
  podSelector:
    matchLabels:
      control-plane: controller-manager
      app.kubernetes.io/name: postgres-operator
  policyTypes:
    - Ingress
  ingress:
    # Only allows ingress from namespaces labeled: metrics: enabled
    - from:
      - namespaceSelector:
          matchLabels:
            metrics: enabled
      ports:
        - port: 8443
          protocol: TCP

---
# Network Policy: Allow Webhook Traffic
# Generated by kubebuilder in config/network-policy/allow-webhook-traffic.yaml
# Enable by uncommenting ../network-policy in config/default/kustomization.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  labels:
    app.kubernetes.io/name: postgres-operator
    app.kubernetes.io/managed-by: kustomize
  name: allow-webhook-traffic
  namespace: postgres-operator-system
spec:
  podSelector:
    matchLabels:
      control-plane: controller-manager
      app.kubernetes.io/name: postgres-operator
  policyTypes:
    - Ingress
  ingress:
    # Only allows ingress from namespaces labeled: webhook: enabled
    - from:
      - namespaceSelector:
          matchLabels:
            webhook: enabled
      ports:
        - port: 443
          protocol: TCP

---
# RBAC: Grant Prometheus access to metrics endpoint
# Place in config/rbac/metrics_reader_prometheus_binding.yaml
# Add to config/rbac/kustomization.yaml resources list
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  labels:
    app.kubernetes.io/name: postgres-operator
    app.kubernetes.io/managed-by: kustomize
  name: metrics-reader-prometheus
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: metrics-reader
subjects:
- kind: ServiceAccount
  name: prometheus-kube-prometheus-prometheus
  namespace: monitoring

---
# To enable network policies, edit config/default/kustomization.yaml:
#
# resources:
# - ../crd
# - ../rbac
# - ../manager
# - ../network-policy  # <-- Uncomment this line
#
# Then label namespaces that need access:
#
# kubectl label namespace monitoring metrics=enabled
# kubectl label namespace default webhook=enabled
