apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: sensitive-runs-policy
  namespace: default
spec:
  podSelector:
    matchLabels:
      sensitive: "true"
  policyTypes:
    - Ingress
    - Egress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              cloud-pipeline/cp-edge: "true"
    - from:
        - podSelector:
            matchLabels:
              sensitive: "true"
  egress:
    - to:
        - podSelector:
            matchLabels:
              sensitive: "true"
    - to:
        - namespaceSelector:
            matchLabels:
              name: "kube-system"
      ports:
        - protocol: UDP
          port: 53
    - to:
        - podSelector:
            matchLabels:
              cloud-pipeline/cp-api-srv: "true"
    - to:
        - podSelector:
            matchLabels:
              cloud-pipeline/cp-edge: "true"
    - to:
        - podSelector:
            matchLabels:
              cloud-pipeline/cp-sensitive-proxy: "true"



