apiVersion: {{ include "networkpolicyversion" . }}
kind: NetworkPolicy
metadata:
  annotations:
    gardener.cloud/description: |
      Allows Egress from pods labeled with 'networking.gardener.cloud/to-private-networks=allowed'
      to the Private networks (RFC1918), Carrier-grade NAT (RFC6598) except for
      - CloudProvider's specific metadata service IP
      - Seed networks
      - Shoot networks
  name: allow-to-private-networks
  namespace: {{ .Release.Namespace }}
spec:
  podSelector:
    matchLabels:
      networking.gardener.cloud/to-private-networks: allowed
  egress:
  - to:
{{ template "global-network-policies.except-networks" .Values.privateNetworks }}
  policyTypes:
  - Egress
  ingress: []