 ## Second policy - enables access to pods in kube-system with tier frontend can be accessed only by pods from namespace vendor-system

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: enable-from-ipblock-to-isolated-by-tier
  namespace: kube-system
spec:
  podSelector: 
    matchLabels:
      tier: frontend
  policyTypes:
  - Ingress
  ingress:
    - from:
      - ipBlock:
          cidr: 0.0.0.0/0     # All destinations
          except:
          - 10.0.0.0/9
          - 10.128.0.0/9
          - 172.21.0.0/16     # Kube Service CIDR Range
          - 172.30.0.0/16     # Kube Cluster CIDR Range
      ports:
        - port: 53
          protocol: TCP
