apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata: {name: default-deny, namespace: proxy-pool}
spec:
  podSelector: {}
  policyTypes: [Ingress, Egress]
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata: {name: gateway-traffic, namespace: proxy-pool}
spec:
  podSelector: {matchLabels: {app.kubernetes.io/name: proxy-gateway}}
  policyTypes: [Ingress, Egress]
  ingress:
    - ports: [{port: 8080, protocol: TCP}]
    - from:
        - namespaceSelector: {matchLabels: {kubernetes.io/metadata.name: monitoring}}
      ports: [{port: 9090, protocol: TCP}]
  egress:
    - to:
        - namespaceSelector: {matchLabels: {kubernetes.io/metadata.name: kube-system}}
      ports: [{port: 53, protocol: UDP}, {port: 53, protocol: TCP}]
    - to:
        - podSelector: {matchLabels: {app.kubernetes.io/name: proxy-controller}}
      ports: [{port: 8443, protocol: TCP}]
    # Gateway 需要连接任意公网目标；应用层 DestinationPolicy 仍拒绝私网、回环和元数据地址。
    - to:
        - ipBlock:
            cidr: 0.0.0.0/0
            except: [10.0.0.0/8, 100.64.0.0/10, 127.0.0.0/8, 169.254.0.0/16, 172.16.0.0/12, 192.168.0.0/16]
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata: {name: control-plane-traffic, namespace: proxy-pool}
spec:
  podSelector:
    matchLabels: {app.kubernetes.io/name: proxy-controller}
  policyTypes: [Ingress, Egress]
  ingress:
    - from:
        - namespaceSelector: {matchLabels: {kubernetes.io/metadata.name: proxy-pool}}
    - from:
        - namespaceSelector: {matchLabels: {kubernetes.io/metadata.name: monitoring}}
      ports: [{port: 9090, protocol: TCP}]
  egress:
    - to:
        - namespaceSelector: {matchLabels: {kubernetes.io/metadata.name: kube-system}}
      ports: [{port: 53, protocol: UDP}, {port: 53, protocol: TCP}]
    # Provider、健康目标及外部托管 PostgreSQL/Redis 的精确网段应在环境 Overlay 收紧。
    - to: [{ipBlock: {cidr: 0.0.0.0/0}}]