apiVersion: {{ include "networkpolicyversion" . }}
kind: NetworkPolicy
metadata:
  annotations:
    gardener.cloud/description: |
      Allows Egress from pods labeled with 'networking.gardener.cloud/to-blocked-cidrs=allowed'
      to CloudProvider's specific metadata service IP.
  name: allow-to-blocked-cidrs
  namespace: {{ .Release.Namespace }}
spec:
  podSelector:
    matchLabels:
      networking.gardener.cloud/to-blocked-cidrs: allowed
{{- if .Values.blockedAddresses }}
  egress:
{{- range $i, $address := .Values.blockedAddresses }}
  - to:
    - ipBlock:
        cidr: {{ $address }}
{{- end }}
{{- else }}
  egress: []
{{- end }}
  policyTypes:
  - Egress
  ingress: []