# A standard Kubernetes NetworkPolicy -- the kind platform teams already use, with no
# sandbox-specific fields. It selects BOTH clients (app: netpol-client) and governs
# their egress:
#
#   - allow egress to the web-allowed server on TCP 8080
#   - allow egress to CoreDNS on UDP and TCP 53, so name lookups keep working
#   - deny everything else, which is the default for the selected pods once policyTypes
#     lists Egress
#
# Egress to web-blocked matches no allow rule, so it is refused. The same policy applies
# to client-standard (an ordinary pod) and client-sandboxed (runtimeClassName:
# isolated-sandbox): the ordinary client is the control that shows the result means what
# the page says it means.
#
# This is networking.k8s.io/v1, not the Auto Mode ApplicationNetworkPolicy. It selects
# by pod and never by hostname; the optional variant in app-egress-policy.yaml shows the
# hostname form.
#
# DNS (port 53) is allowed to any IP address. While CoreDNS typically runs on a fixed
# cluster address, allowing any destination eliminates the need for address lookup and
# substitution. This simplifies the setup and avoids issues with missing or malformed
# cluster DNS addresses (#104).
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: netpol-client-egress
spec:
  podSelector:
    matchLabels:
      app: netpol-client
  policyTypes:
    - Egress
  egress:
    # Allow: the web-allowed server, by its pod label, on its port.
    - to:
        - podSelector:
            matchLabels:
              app: web-allowed
      ports:
        - { protocol: TCP, port: 8080 }
    # Allow: DNS on port 53 to any IP, so the clients can resolve names.
    - to:
        - ipBlock: { cidr: 0.0.0.0/0 }
      ports:
        - { protocol: UDP, port: 53 }
        - { protocol: TCP, port: 53 }