apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: website-default-deny-egress
  namespace: website-production
spec:
  podSelector: {}
  policyTypes:
    - Egress
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: website-allow-required-egress
  namespace: website-production
spec:
  podSelector:
    matchLabels:
      app: php-website
  policyTypes:
    - Egress
  egress:
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
      ports:
        - protocol: UDP
          port: 53
        - protocol: TCP
          port: 53
    - to:
        - podSelector:
            matchLabels:
              app: website-redis
      ports:
        - protocol: TCP
          port: 6379
    - to:
        - ipBlock:
            cidr: 192.168.100.73/32
      ports:
        - protocol: TCP
          port: 11434
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: website-redis-deny-egress
  namespace: website-production
spec:
  podSelector:
    matchLabels:
      app: website-redis
  policyTypes:
    - Egress