{{- if and (or $.Values.datadog.networkPolicy.create $.Values.agents.networkPolicy.create) (eq $.Values.datadog.networkPolicy.flavor "kubernetes") -}}
apiVersion: "networking.k8s.io/v1"
kind: NetworkPolicy
metadata:
  name: {{ template "datadog.fullname" . }}
  namespace: {{ .Release.Namespace }}
  labels:
{{ include "datadog.labels" . | indent 4 }}
spec:
  podSelector:
    matchLabels:
      app: {{ template "datadog.fullname" . }}
  policyTypes:
    - Ingress
    - Egress
  ingress:
{{- if $.Values.datadog.dogstatsd.port }}
    - # Ingress for dogstatsd
      ports:
        - port: {{ $.Values.datadog.dogstatsd.port }}
          protocol: UDP
{{- end }}
{{- if eq  (include "trace-agent-use-tcp-port" .) "true" }}
    - # Ingress for APM trace
      ports:
        - port: {{ $.Values.datadog.apm.port }}
          protocol: TCP
{{- end }}
  egress:
    - # Egress to
      # * Datadog intake
      # * Kube API server
      ports:
        - port: 443
# The agents are susceptible to connect to any pod
# that would be annotated with auto-discovery annotations.
#
# When a user wants to add a check on one of its pod, he needs to
# * annotate its pod
# * add an ingress policy from the agent on its own pod
# In order to not ask end-users to inject NetworkPolicy on the agent in
# the agent namespace, the agent must be allowed to probe any pod.
    - {} # Egress to anything for checks
{{- end }}
