apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata: {name: gateway-short}
spec:
  endpointSelector:
    matchLabels: {"reserved:ingress": ""}
  ingress:
    - fromEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: short
            app.kubernetes.io/name: tunnel
            app.kubernetes.io/instance: short
      toPorts:
        - ports: [{port: "80", protocol: TCP}, {port: "443", protocol: TCP}]