# CONTRACT ONLY. Do not apply from this repository.
# Default deny in namespace whitehat; live E2 adds a named egress rule per
# registered target. This example names audit-core only as the currently
# applicable live E2 target.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny
  namespace: whitehat
spec:
  podSelector: {}
  policyTypes: ["Ingress", "Egress"]
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-audit-core-e2
  namespace: whitehat
spec:
  podSelector:
    matchLabels:
      whitehat.security/target: audit-core
  policyTypes: ["Egress"]
  egress:
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: audit-core
      ports:
        - protocol: TCP
          port: 8080
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
      ports:
        - protocol: UDP
          port: 53
        - protocol: TCP
          port: 53