---
# LIVE — reconciled by the non-gating `apps-vms` Flux Kustomization (see namespace.yaml header).
#
# Default-deny baseline (R-NET-01): deny all ingress + egress, allow ONLY DNS to the
# in-cluster resolver. Identical shape to the rendered pihole/app baseline. The VM's
# datapath egresses via the virt-launcher pod netns, so this podSelector:{} policy
# governs the VM exactly as it governs a pod (proven by the vm-default-deny test).
# The specific ingress/egress ALLOWS the controller needs are added additively by the
# CiliumNetworkPolicies in 40-networkpolicy.yaml.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny
  namespace: unifi
  labels:
    homelab.keithjackson.dev/baseline: default-deny
spec:
  podSelector: {}
  policyTypes:
    - Ingress
    - Egress
  ingress: []
  egress:
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
      ports:
        - protocol: UDP
          port: 53
        - protocol: TCP
          port: 53