apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata: {name: tunnel, namespace: short}
spec:
  endpointSelector:
    matchLabels: {app.kubernetes.io/name: tunnel, app.kubernetes.io/instance: short}
  ingress:
    - fromCIDRSet: [{cidrGroupRef: short}]
      toPorts:
        - ports: [{port: "500", protocol: UDP}, {port: "4500", protocol: UDP}]
    - fromEntities: [host]
      toPorts:
        - ports: [{port: "9090", protocol: TCP}]
  egress:
    - toCIDRSet: [{cidrGroupRef: short}]
      toPorts:
        - ports: [{port: "500", protocol: UDP}, {port: "4500", protocol: UDP}]
    - toEntities: [kube-apiserver]
      toPorts:
        - ports: [{port: "6443", protocol: TCP}]
    - toEntities: [ingress]
      toPorts:
        - ports: [{port: "80", protocol: TCP}, {port: "443", protocol: TCP}]
    - toEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: short
            app.kubernetes.io/name: short-canary
            app.kubernetes.io/instance: short
      toPorts:
        - ports: [{port: "8080", protocol: TCP}]
    - toEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: minecraft
            app.kubernetes.io/name: minecraft
            app.kubernetes.io/instance: skies
      toPorts:
        - ports: [{port: "25565", protocol: TCP}]
---
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata: {name: short-tunnel-host}
spec:
  nodeSelector: {}
  egress:
    - toEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: short
            app.kubernetes.io/name: tunnel
            app.kubernetes.io/instance: short
      toPorts:
        - ports: [{port: "9090", protocol: TCP}]
  ingress:
    - fromEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: short
            app.kubernetes.io/name: tunnel
            app.kubernetes.io/instance: short
      toPorts:
        - ports: [{port: "32768", endPort: 60999, protocol: TCP}]