# Golden expected output of the require-default-deny-baseline generate rule when the
# `app-ns` Namespace fixture is created. `kyverno test` compares the generated
# NetworkPolicy against this file.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny
  namespace: app-ns
  labels:
    homelab.keithjackson.dev/baseline: default-deny
spec:
  podSelector: {}
  policyTypes:
    - Ingress
    - Egress
  ingress: []
  egress:
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
      ports:
        - protocol: UDP
          port: 53
        - protocol: TCP
          port: 53