# Дополняет общую audit-collector (podSelector: {} — действует и на под Job'а: DNS, Vault, Kafka).
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: idp-actions-bootstrap
spec:
  podSelector:
    matchLabels:
      security-audit/job: idp-actions-bootstrap
  policyTypes: [Ingress, Egress]
  ingress:
    - ports:
        - {port: 15021, protocol: TCP}   # readiness istio-proxy (kubelet)
  egress:
    - to:
        - namespaceSelector:
            matchLabels: {kubernetes.io/metadata.name: zitadel}
          podSelector:
            matchLabels:
              app.kubernetes.io/name: idp-contour
              app.kubernetes.io/component: start
      ports:
        - {port: 8080, protocol: TCP}
    - to:
        - namespaceSelector:
            matchLabels: {kubernetes.io/metadata.name: istio-system}
          podSelector:
            matchLabels: {app: istiod}
      ports:
        - {port: 15012, protocol: TCP}   # xDS и сертификаты istio-proxy