{{- if .Values.cilium.enabled }}
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: kube-dns
  namespace: kube-system
specs:
  - endpointSelector:
      # apply to core dns pods
      matchLabels:
        io.cilium.k8s.policy.serviceaccount: "coredns"
    ingress:
      # kubelet -> core dns probes
      - fromEntities:
          - host
        toPorts:
          - ports:
              - port: '8080'
                protocol: TCP
              - port: '8181'
                protocol: TCP
      # prometheus -> dns metrics
      - fromEndpoints:
        - matchLabels:
            io.cilium.k8s.policy.serviceaccount: "prometheus-kube-prometheus-prometheus"
            io.kubernetes.pod.namespace: "observability"
        toPorts:
          - ports:
              - port: '9153'
                protocol: TCP
      # cluster -> dns
      - fromEntities:
          - cluster
        toPorts:
          - ports:
              - port: '53'
                protocol: TCP
              - port: '53'
                protocol: UDP
{{- end }}