{{- if .Values.cilium.enabled }}
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: hubble-relay
  namespace: kube-system
specs:
  - endpointSelector:
      # apply to hubble relay pods
      matchLabels:
        io.cilium.k8s.policy.serviceaccount: hubble-relay
    ingress:
      # kubelet -> hubble relay probes
      - fromEntities:
          - host
        toPorts:
          - ports:
              - port: '4245'
                protocol: TCP
    egress:
      # hubble relay -> hubble agent
      - toEntities:
          - host
          - remote-node
        toPorts:
          - ports:
              - port: '4244'
                protocol: TCP
{{- end }}