# NetworkPolicy fixtures for validate-default-deny-shape (R-NET-01).
# The "good" baseline denies both directions; the "bad" baseline is labelled as the
# baseline but only covers Ingress -- leaving egress open -- and must be rejected.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: good-baseline-np
  namespace: app-ns
  labels:
    homelab.keithjackson.dev/baseline: default-deny
spec:
  podSelector: {}
  policyTypes:
    - Ingress
    - Egress
  ingress: []
  egress:
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
      ports:
        - protocol: UDP
          port: 53
        - protocol: TCP
          port: 53
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: bad-baseline-np
  namespace: app-ns
  labels:
    homelab.keithjackson.dev/baseline: default-deny
spec:
  podSelector: {}
  # Missing Egress -> egress is left wide open despite claiming to be the baseline.
  policyTypes:
    - Ingress
  ingress: []