apiVersion: {{ include "networkpolicyversion" . }}
kind: NetworkPolicy
metadata:
  annotations:
    gardener.cloud/description: |
      Allows Egress from pods labeled with 'networking.gardener.cloud/to-all-shoot-apiservers=allowed'
      to all the shoot apiservers running in the seed cluster.
  name: allow-to-all-shoot-apiservers
  namespace: {{ .Release.Namespace }}
spec:
  podSelector:
    matchLabels:
      networking.gardener.cloud/to-all-shoot-apiservers: allowed
  egress:
  - to:
    - namespaceSelector: {}
      podSelector:
        matchLabels:
          garden.sapcloud.io/role: controlplane
          app: kubernetes
          role: apiserver
  policyTypes:
  - Egress
  ingress: []