# The egress NetworkPolicy for the DNS probe pods. The sandboxed probe has a
# network, so the sample restricts its egress, as the security rules require, and
# shows the whole policy on the page.
#
# It selects every probe pod (app: dns-probe) and governs their egress:
#
#   - allow egress to DNS on UDP and TCP 53 (any IP), which the DNS probe needs;
#   - allow egress to the conntrack sink on TCP 9000, which the connection-limit
#     probe needs (it connects to the sink by raw IP, so it uses no DNS);
#   - deny everything else, which is the default for the selected pods once
#     policyTypes lists Egress;
#   - deny all ingress (policyTypes lists Ingress with no ingress rule).
#
# The same policy applies to probe-standard (an ordinary pod) and the sandboxed
# probes (runtimeClassName: isolated-sandbox). The policy scopes which destinations
# the probe can reach; it does not change the DNS query-rate limit being measured,
# which sits on the sandbox network path and not in the policy. Keeping egress to
# the in-cluster resolver means the sample needs no internet egress.
#
# This is networking.k8s.io/v1, the standard Kubernetes NetworkPolicy. DNS (port 53) is
# allowed to any IP address. While CoreDNS typically runs on a fixed cluster address,
# allowing any destination eliminates the need for address lookup and substitution.
# This simplifies the setup and avoids issues with missing or malformed cluster DNS
# addresses (#104).
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: dns-probe-egress
  namespace: sandbox-limits
spec:
  podSelector:
    matchLabels:
      app: dns-probe
  policyTypes:
    - Ingress
    - Egress
  # No ingress rule, so all ingress to the probe pods is denied.
  egress:
    # Allow: DNS on port 53 to any IP, so the probe's DNS queries reach the cluster resolver.
    - to:
        - ipBlock: { cidr: 0.0.0.0/0 }
      ports:
        - { protocol: UDP, port: 53 }
        - { protocol: TCP, port: 53 }
    # Allow: the conntrack sink, by its pod label, on TCP 9000. The
    # connection-limit probe opens held-open TCP flows to it by raw IP.
    - to:
        - podSelector:
            matchLabels:
              app: conntrack-sink
      ports:
        - { protocol: TCP, port: 9000 }