apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: pihole-config-data-netwrokpolicy
  labels:
    project: pihole

spec:
  podSelector:
    matchLabels:
      pod-project: pihole
  egress:
    # Allow all egress
    # - {}

    # Allow egress only to public networks
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
          podSelector:
            matchLabels:
              k8s-app: kube-dns
      ports:
        - protocol: UDP
          port: 53
        - protocol: TCP
          port: 53    

    - to:
      - ipBlock:
          cidr: 0.0.0.0/0
          except:
            - 10.0.0.0/8
            - 172.16.0.0/12
            - 192.168.0.0/16

  ingress:
  # - from:
    # - namespaceSelector:
    #     matchLabels:
    #       ns-name: <namespace>
    #   podSelector:
    #     matchLabels:
    #       podDomain: <podLabels>
    # ports:
    # - protocol: TCP
    #   port: 80
    # - protocol: TCP
    #   port: 443

  # - from:
  #   - namespaceSelector:
  #       matchLabels:
  #         ns-name: <nebulaNS>
  #     podSelector:
  #       matchLabels:
  #         pod-project: nebula-sync
  #   ports:
  #   - protocol: TCP
  #     port: 443
  #   - protocol: TCP
  #     port: 80

  - from:
      - ipBlock: 
          cidr: 192.168.0.0/16 
    ports:
    - protocol: UDP
      port: 53
    - protocol: TCP
      port: 53
      
  - from: 
      - ipBlock: 
          cidr: 10.0.0.0/8
    ports:
    - protocol: UDP
      port: 53
    - protocol: TCP
      port: 53
      
  - from:
      - ipBlock: 
          cidr: 172.16.0.0/12
    ports:
    - protocol: UDP
      port: 53
    - protocol: TCP
      port: 53

  policyTypes:
    - Ingress
    - Egress