{{- if .Values.networkPolicy.enabled }}
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: {{ include "redis-cluster.fullname" . }}
  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "redis-cluster.labels" . | nindent 4 }}
spec:
  podSelector:
    matchLabels:
      {{- include "redis-cluster.selectorLabels" . | nindent 6 }}
  policyTypes:
    - Ingress
  ingress:
    # Intra-release traffic: client protocol is also used for replication and
    # key migration; the cluster bus carries gossip and failover elections.
    - from:
        - podSelector:
            matchLabels:
              {{- include "redis-cluster.selectorLabels" . | nindent 14 }}
      ports:
        - port: {{ .Values.redis.port }}
        - port: {{ .Values.cluster.busPort }}
    # Client traffic.
    {{- if .Values.networkPolicy.allowExternal }}
    - ports:
        - port: {{ .Values.redis.port }}
    {{- else if .Values.networkPolicy.extraIngress }}
    - from:
        {{- toYaml .Values.networkPolicy.extraIngress | nindent 8 }}
      ports:
        - port: {{ .Values.redis.port }}
    {{- end }}
    {{- if .Values.metrics.enabled }}
    # Metrics scraping.
    {{- if .Values.networkPolicy.metricsFromNamespaces }}
    - from:
        {{- range .Values.networkPolicy.metricsFromNamespaces }}
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: {{ . }}
        {{- end }}
      ports:
        - port: {{ .Values.metrics.port }}
    {{- else }}
    - ports:
        - port: {{ .Values.metrics.port }}
    {{- end }}
    {{- end }}
{{- end }}