diff --git a/helm/cluster_setup/templates/allow-all-egress-clusterwide-networkpolicy.yaml b/helm/cluster_setup/templates/allow-all-egress-clusterwide-networkpolicy.yaml
new file mode 100644
index 0000000..45a4db3
--- /dev/null
+++ b/helm/cluster_setup/templates/allow-all-egress-clusterwide-networkpolicy.yaml
@@ -0,0 +1,12 @@
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: world
+spec:
+  nodeSelector:
+    # apply to all nodes
+    matchLabels: {}
+  egress:
+    # node -> world
+    - toEntities:
+        - world
\ No newline at end of file
diff --git a/helm/cluster_setup/templates/apiserver-clusterwide-networkpolicy.yaml b/helm/cluster_setup/templates/apiserver-clusterwide-networkpolicy.yaml
new file mode 100644
index 0000000..bff5f5b
--- /dev/null
+++ b/helm/cluster_setup/templates/apiserver-clusterwide-networkpolicy.yaml
@@ -0,0 +1,23 @@
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: api-server
+spec:
+  nodeSelector:
+    # apply to manager nodes
+    matchLabels:
+      node.kubernetes.io/microk8s-controlplane: microk8s-controlplane
+  ingress:
+    # world -> api server
+    - toPorts:
+        - ports:
+            - port: '16443'
+              protocol: TCP
+  egress:
+    # api server -> kubelet
+    - toEntities:
+        - remote-node
+      toPorts:
+        - ports:
+            - port: '10250'
+              protocol: TCP
\ No newline at end of file
diff --git a/helm/cluster_setup/templates/cilium-health-clusterwide-networkpolicy.yaml b/helm/cluster_setup/templates/cilium-health-clusterwide-networkpolicy.yaml
new file mode 100644
index 0000000..9f9bfd8
--- /dev/null
+++ b/helm/cluster_setup/templates/cilium-health-clusterwide-networkpolicy.yaml
@@ -0,0 +1,39 @@
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: cilium-health
+specs:
+  - endpointSelector:
+      # apply to health endpoints
+      matchLabels:
+        reserved:health: ''
+    ingress:
+      # cilium agent -> cilium agent
+      - fromEntities:
+          - host
+          - remote-node
+        toPorts:
+          - ports:
+              - port: '4240'
+                protocol: TCP
+  - nodeSelector:
+      # apply to all nodes
+      matchLabels: {}
+    ingress:
+      # cilium agent -> cilium agent
+      - fromEntities:
+          - health
+          - remote-node
+        toPorts:
+          - ports:
+              - port: '4240'
+                protocol: TCP
+    egress:
+      # cilium agent -> cilium agent
+      - toEntities:
+          - health
+          - remote-node
+        toPorts:
+          - ports:
+              - port: '4240'
+                protocol: TCP
\ No newline at end of file
diff --git a/helm/cluster_setup/templates/hubble-relay-networkpolicy.yaml b/helm/cluster_setup/templates/hubble-relay-networkpolicy.yaml
new file mode 100644
index 0000000..4cedc5c
--- /dev/null
+++ b/helm/cluster_setup/templates/hubble-relay-networkpolicy.yaml
@@ -0,0 +1,48 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: hubble-relay
+  namespace: kube-system
+specs:
+  - nodeSelector:
+      # apply to all nodes
+      matchLabels: {}
+    ingress:
+      # hubble relay -> hubble agent
+      - fromEndpoints:
+          - matchLabels:
+              io.cilium.k8s.policy.serviceaccount: hubble-relay
+        toPorts:
+          - ports:
+              - port: '4244'
+                protocol: TCP
+    egress:
+      # kubelet -> hubble relay probes
+      - toEndpoints:
+          - matchLabels:
+              io.cilium.k8s.policy.serviceaccount: hubble-relay
+        toPorts:
+          - ports:
+              - port: '4245'
+                protocol: TCP
+  - endpointSelector:
+      # apply to hubble relay pods
+      matchLabels:
+        io.cilium.k8s.policy.serviceaccount: hubble-relay
+    ingress:
+      # kubelet -> hubble relay probes
+      - fromEntities:
+          - host
+        toPorts:
+          - ports:
+              - port: '4245'
+                protocol: TCP
+    egress:
+      # hubble relay -> hubble agent
+      - toEntities:
+          - host
+          - remote-node
+        toPorts:
+          - ports:
+              - port: '4244'
+                protocol: TCP
\ No newline at end of file
diff --git a/helm/cluster_setup/templates/hubble-ui-networkpolicy.yaml b/helm/cluster_setup/templates/hubble-ui-networkpolicy.yaml
new file mode 100644
index 0000000..917c8ee
--- /dev/null
+++ b/helm/cluster_setup/templates/hubble-ui-networkpolicy.yaml
@@ -0,0 +1,73 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: hubble-ui
+  namespace: kube-system
+specs:
+  - nodeSelector:
+      # apply to master nodes
+      matchLabels:
+        node.kubernetes.io/microk8s-controlplane: microk8s-controlplane
+    ingress:
+      # hubble ui -> api server
+      - fromEndpoints:
+          - matchLabels:
+              io.cilium.k8s.policy.serviceaccount: hubble-ui
+        toPorts:
+          - ports:
+              - port: '16443'
+                protocol: TCP
+  - endpointSelector:
+      # apply to core dns endpoints
+      matchLabels:
+        io.cilium.k8s.policy.serviceaccount: coredns
+    ingress:
+      # hubble ui -> core dns
+      - fromEndpoints:
+          - matchLabels:
+              io.cilium.k8s.policy.serviceaccount: hubble-ui
+        toPorts:
+          - ports:
+              - port: '53'
+                protocol: UDP
+  - endpointSelector:
+      # apply to hubble relay endpoints
+      matchLabels:
+        io.cilium.k8s.policy.serviceaccount: hubble-relay
+    ingress:
+      # hubble ui -> hubble relay
+      - fromEndpoints:
+          - matchLabels:
+              io.cilium.k8s.policy.serviceaccount: hubble-ui
+        toPorts:
+          - ports:
+              - port: '4245'
+                protocol: TCP
+  - endpointSelector:
+      # apply to hubble ui endpoints
+      matchLabels:
+        io.cilium.k8s.policy.serviceaccount: hubble-ui
+    egress:
+      # hubble ui -> api server
+      - toEntities:
+          - kube-apiserver
+        toPorts:
+          - ports:
+              - port: '16443'
+                protocol: TCP
+      # hubble ui -> hubble relay
+      - toEndpoints:
+          - matchLabels:
+              io.cilium.k8s.policy.serviceaccount: hubble-relay
+        toPorts:
+          - ports:
+              - port: '4245'
+                protocol: TCP
+      # hubble ui -> core dns
+      - toEndpoints:
+          - matchLabels:
+              io.cilium.k8s.policy.serviceaccount: coredns
+        toPorts:
+          - ports:
+              - port: '53'
+                protocol: UDP
\ No newline at end of file
diff --git a/helm/cluster_setup/templates/kubedns-networkpolicy.yaml b/helm/cluster_setup/templates/kubedns-networkpolicy.yaml
new file mode 100644
index 0000000..9aa9337
--- /dev/null
+++ b/helm/cluster_setup/templates/kubedns-networkpolicy.yaml
@@ -0,0 +1,65 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: kube-dns
+  namespace: kube-system
+specs:
+  - nodeSelector:
+      # apply to master nodes
+      matchLabels:
+        node.kubernetes.io/microk8s-controlplane: microk8s-controlplane
+    ingress:
+      # core dns -> api server
+      - fromEndpoints:
+          - matchLabels:
+              k8s:io.cilium.k8s.policy.serviceaccount: coredns
+        toPorts:
+          - ports:
+              - port: '16443'
+                protocol: TCP
+  - nodeSelector:
+      # apply to all nodes
+      matchLabels: {}
+    egress:
+      # kubelet -> core dns probes
+      - toEndpoints:
+          - matchLabels:
+              k8s:io.cilium.k8s.policy.serviceaccount: coredns
+        toPorts:
+          - ports:
+              - port: '8080'
+                protocol: TCP
+              - port: '8181'
+                protocol: TCP
+  - endpointSelector:
+      # apply to core dns pods
+      matchLabels:
+        k8s:io.cilium.k8s.policy.serviceaccount: coredns
+    ingress:
+      # kubelet -> core dns probes
+      - fromEntities:
+          - host
+        toPorts:
+          - ports:
+              - port: '8080'
+                protocol: TCP
+              - port: '8181'
+                protocol: TCP
+      # prometheus -> dns metrics
+      - fromEndpoints:
+        - matchLabels:
+            k8s:io.cilium.k8s.policy.serviceaccount: prometheus-kube-prometheus-prometheus
+            k8s:io.kubernetes.pod.namespace: observability
+        toPorts:
+          - ports:
+              - port: '9153'
+                protocol: TCP
+      # cluster -> dns
+      - fromEntities:
+          - cluster
+        toPorts:
+          - ports:
+              - port: '53'
+                protocol: TCP
+              - port: '53'
+                protocol: UDP
\ No newline at end of file
diff --git a/helm/cluster_setup/templates/kubelet-clusterwide-networkpolicy.yaml b/helm/cluster_setup/templates/kubelet-clusterwide-networkpolicy.yaml
new file mode 100644
index 0000000..7d58dde
--- /dev/null
+++ b/helm/cluster_setup/templates/kubelet-clusterwide-networkpolicy.yaml
@@ -0,0 +1,24 @@
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: kubelet
+spec:
+  nodeSelector:
+    # apply to all nodes
+    matchLabels: {}
+  ingress:
+    # prometheus -> kubelet
+    - fromEndpoints:
+        - matchLabels:
+            app: kube-prometheus-stack-prometheus
+      toPorts:
+        - ports:
+            - port: '10250'
+              protocol: TCP
+    # api server -> kubelet
+    - fromEntities:
+        - kube-apiserver
+      toPorts:
+        - ports:
+            - port: '10250'
+              protocol: TCP
diff --git a/helm/cluster_setup/templates/vxlan-clusterwide-networkpolicy.yaml b/helm/cluster_setup/templates/vxlan-clusterwide-networkpolicy.yaml
new file mode 100644
index 0000000..84877a6
--- /dev/null
+++ b/helm/cluster_setup/templates/vxlan-clusterwide-networkpolicy.yaml
@@ -0,0 +1,24 @@
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: cilium-vxlan
+spec:
+  nodeSelector:
+    # apply to all nodes
+    matchLabels: {}
+  ingress:
+    # node -> vxlan
+    - fromEntities:
+        - remote-node
+      toPorts:
+        - ports:
+            - port: '8472'
+              protocol: UDP
+  egress:
+    # node -> vxlan
+    - toEntities:
+        - remote-node
+      toPorts:
+        - ports:
+            - port: '8472'
+              protocol: UDP
\ No newline at end of file