# NetworkPolicy: only the Gitea action runners may reach the buildkit daemon.
# Closes the reviewer's High: buildkit listens on plaintext tcp:1234 with no
# auth — without this policy ANY cluster pod could submit arbitrary build
# requests (lateral-movement / resource-abuse surface). Restricting ingress to
# the gitea-runner namespace (where the runners live) removes that exposure.
# Homelab note: full TLS+auth on the buildkit socket is deferred (documented) —
# the runner and daemon are on the private cluster network; the policy closes the
# pod-to-pod surface that TLS alone wouldn't.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: buildkit-allow-runner-only
  namespace: gitea-runner
spec:
  podSelector:
    matchLabels:
      app: buildkit
  policyTypes: ["Ingress"]
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: gitea-runner
      ports:
        - protocol: TCP
          port: 1234