apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
  # TODO: this should be a default deny rule once the istio stuff works
  name: default-allow-all
spec:
  endpointSelector: {}  # Empty selector matches ALL endpoints
  ingress:
    - fromEntities:
        #- "host"             # Allow kubelet probes from the local node
        - "all"
  egress:
    - toEntities:
        #- "kube-apiserver"   # Allow API server access
        - "all"
#    - toEndpoints:
#        - matchLabels:
#            "k8s:io.kubernetes.pod.namespace": kube-system
#            k8s-app: kube-dns
#      toPorts:
#        - ports:
#            - port: "53"
#              protocol: UDP