apiVersion: {{ include "networkpolicyversion" . }}
kind: NetworkPolicy
metadata:
  annotations:
    gardener.cloud/description: |
      Allows Egress from pods labeled with 'networking.gardener.cloud/to-seed-apiserver=allowed'
      to Seed's Kubernetes API Server.
  name: allow-to-seed-apiserver
  namespace: {{ .Release.Namespace }}
spec:
  podSelector:
    matchLabels:
      networking.gardener.cloud/to-seed-apiserver: allowed
  egress:
    # TODO (mvladev): write a controller which reconciles this policy with
    # the IP of the 'kubernetes' endpoint in 'default' namespace in the Seed cluster.
    # - to:
    # - ipBlock:
    #     cidr: 1.2.3.4/32
    # TODO (mvladev): We can't be 100% sure what IP the Seed API server might have.
    # In some cases it might be in the private IP range.
  - to:
    - ipBlock:
        cidr: 0.0.0.0/0
        except:
        - 10.0.0.0/8
        - 172.16.0.0/12
        - 192.168.0.0/16
        - 100.64.0.0/10
{{- if .Values.blockedAddresses }}
{{- range $i, $address := .Values.blockedAddresses }}
        - {{ $address }}
{{- end }}
{{- end }}
{{ template "global-network-policies.except-networks" .Values.privateNetworks }}
  # TODO (mvladev): discover ports on every Seed cluster dynamically.
  # ports:
  # - protocol: TCP
  #   port: 443
  policyTypes:
  - Egress
  ingress: []