import { FirewallRule } from '../../../providers/interfaces/firewall-provider.interface';
/**
 * Firewall rules — public surface only.
 *
 * Intra-cluster and inter-cluster traffic (Prometheus scrape, Loki ingest,
 * kubelet, K3s API, DB/Redis NodePorts, ClusterIP services) flows over the
 * environment VNet/Subnet and never touches the public interface.
 *
 * Observability + workload cluster public ports:
 *   22     SSH (management, sourceCidrs)
 *   80     Traefik HTTP (api/app/auth via nip.io ingress)
 *   443    Traefik HTTPS
 */
export declare const OBSERVABILITY_FIREWALL_RULES: (sourceCidrs: string[]) => FirewallRule[];
export declare const WORKLOAD_FIREWALL_RULES: (sourceCidrs: string[]) => FirewallRule[];
export declare const OBSERVABILITY_PORTS: {
    readonly SSH: {
        readonly port: 22;
        readonly protocol: "tcp";
        readonly description: "SSH management";
    };
    readonly HTTP_INGRESS: {
        readonly port: 80;
        readonly protocol: "tcp";
        readonly description: "HTTP Ingress (Traefik)";
    };
    readonly HTTPS_INGRESS: {
        readonly port: 443;
        readonly protocol: "tcp";
        readonly description: "HTTPS Ingress (Traefik)";
    };
};
export declare const WORKLOAD_PORTS: {
    readonly SSH: {
        readonly port: 22;
        readonly protocol: "tcp";
        readonly description: "SSH management";
    };
    readonly HTTP_INGRESS: {
        readonly port: 80;
        readonly protocol: "tcp";
        readonly description: "HTTP Ingress (Traefik)";
    };
    readonly HTTPS_INGRESS: {
        readonly port: 443;
        readonly protocol: "tcp";
        readonly description: "HTTPS Ingress (Traefik)";
    };
};
export declare function validateFirewallRules(rules: FirewallRule[]): {
    valid: boolean;
    errors: string[];
};
export declare function getFirewallRulesForClusterType(clusterType: 'observability' | 'workload', sourceCidrs: string[]): FirewallRule[];
