apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
  name: api-server
spec:
  nodeSelector:
    # apply to manager nodes
    matchLabels:
      node.kubernetes.io/microk8s-controlplane: microk8s-controlplane
  ingress:
    # world -> api server
    - toPorts:
        - ports:
            - port: '16443'
              protocol: TCP
  egress:
    # api server -> kubelet
    - toEntities:
        - remote-node
      toPorts:
        - ports:
            - port: '10250'
              protocol: TCP