---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: ${PROJECT_NAME}
spec:
  podSelector:
    matchExpressions:
    - key: "app"
      operator: "Exists"
  policyTypes:
  - Ingress
  - Egress
  # IP 段访问白名单, 入向
  ingress:
  # 允许所有入向流量
  - {}
  - from:
    # IP 地址段白名单
    - ipBlock:
        cidr: 172.30.0.0/16
        # 过滤某些地址段
        # except:
        # - 172.30.1.0/24
    - ipBlock:
        cidr: 172.31.0.0/16
    - ipBlock:
        cidr: 10.177.92.0/24
    - namespaceSelector:
        matchLabels:
          project: ${PROJECT_NAME}
    - podSelector:
        matchLabels:
          app: nginx
    # 指定允许访问的端口
    ports:
    - protocol: TCP
      port: 80
  # 允许所有出向流量
  egress:
  - {}
