allow-to-public-web.yaml

---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-to-public-web
spec:
  egress:
  - to:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: nginx-system
      podSelector:
        matchLabels:
          app.kubernetes.io/name: haproxy
    ports:
      - protocol: TCP
        port: 80
      - protocol: TCP
        port: 443
  - to:
    - ipBlock:
        except:
          - "192.168.0.0/16"
          - "172.16.0.0/12"
          - "10.0.0.0/8"
          - "169.254.0.0/16"
          - "100.64.0.0/10"
        cidr: 0.0.0.0/0
    ports:
      - protocol: TCP
        port: 80
      - protocol: TCP
        port: 443
  - to:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: kube-system
      podSelector:
        matchLabels:
          k8s-app: kube-dns
      ports:
        - port: 53
          protocol: UDP
        - port: 53
          protocol: TCP
  policyTypes:
  - Egress