From c6f2567ca3405a4e88216d39e5b8d85d78a042ec Mon Sep 17 00:00:00 2001
From: Linus Vogel <linus@linvogel.ch>
Date: Mon, 29 Jun 2026 21:44:46 +0200
Subject: [PATCH] still fixing stuff

---
 network_policies/default.yaml | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/network_policies/default.yaml b/network_policies/default.yaml
index e69de29..f27d5fb 100644
--- a/network_policies/default.yaml
+++ b/network_policies/default.yaml
@@ -0,0 +1,23 @@
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  # TODO: this should be a default deny rule once the istio stuff works
+  name: default-allow-all
+spec:
+  endpointSelector: {}  # Empty selector matches ALL endpoints
+  ingress:
+    - fromEntities:
+        #- "host"             # Allow kubelet probes from the local node
+        - "all"
+  egress:
+    - toEntities:
+        #- "kube-apiserver"   # Allow API server access
+        - "all"
+#    - toEndpoints:
+#        - matchLabels:
+#            "k8s:io.kubernetes.pod.namespace": kube-system
+#            k8s-app: kube-dns
+#      toPorts:
+#        - ports:
+#            - port: "53"
+#              protocol: UDP
\ No newline at end of file