apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: unbound-netpol
  labels:
    project: unbound-combo

spec:
  podSelector:
    matchLabels:
      pod-project: unbound-combo
  egress:
    # Allow all egress
    # - {}

    # Allow egress only to public networks
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
          podSelector:
            matchLabels:
              k8s-app: kube-dns
      ports:
        - protocol: UDP
          port: 53
        - protocol: TCP
          port: 53    

    - to:
      - ipBlock:
          cidr: 0.0.0.0/0
          except:
            - 10.0.0.0/8
            - 172.16.0.0/12
            - 192.168.0.0/16

  ingress:

  - from:
      - ipBlock: 
          cidr: 192.168.0.0/16 
    ports:
    - protocol: UDP
      port: 53
    - protocol: TCP
      port: 53
      
  - from: 
      - ipBlock: 
          cidr: 10.0.0.0/8
    ports:
    - protocol: UDP
      port: 53
    - protocol: TCP
      port: 53
      
  - from:
      - ipBlock: 
          cidr: 172.16.0.0/12
    ports:
    - protocol: UDP
      port: 53
    - protocol: TCP
      port: 53
      

  policyTypes:
    - Ingress
    - Egress