apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: ollama-ingress-restriction
  namespace: nxtgauge-ai
  labels:
    app: ollama
spec:
  podSelector:
    matchLabels:
      app: ollama
  policyTypes:
    - Ingress
  ingress:
    # Allow traffic from users service (port 11434)
    - from:
        - namespaceSelector:
            matchLabels:
              name: default
          podSelector:
            matchLabels:
              app: users
      ports:
        - protocol: TCP
          port: 11434
    # Allow traffic from payments service
    - from:
        - namespaceSelector:
            matchLabels:
              name: default
          podSelector:
            matchLabels:
              app: payments
      ports:
        - protocol: TCP
          port: 11434
    # Allow traffic from nxtgauge-ai-assistant service
    - from:
        - namespaceSelector:
            matchLabels:
              name: nxtgauge-ai
          podSelector:
            matchLabels:
              app: nxtgauge-ai-assistant
      ports:
        - protocol: TCP
          port: 11434
    # Allow traffic from within the same namespace (for health checks, etc.)
    - from:
        - podSelector: {}
      ports:
        - protocol: TCP
          port: 11434