apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata: { name: default-deny, namespace: uqo-chat }
spec: { podSelector: {}, policyTypes: [Ingress, Egress] }
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata: { name: sandbox-no-egress, namespace: uqo-chat }
spec:
  podSelector: { matchLabels: { app: sandbox-runner } }
  policyTypes: [Ingress, Egress]
  ingress: [{ from: [{ podSelector: { matchLabels: { app: api } } }, { podSelector: { matchLabels: { app: worker } } }], ports: [{ port: 8080 }] }]
  egress: []   # deny-all egress: executed code has no network
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata: { name: api-egress, namespace: uqo-chat }
spec:
  podSelector: { matchLabels: { app: api } }
  policyTypes: [Ingress, Egress]
  ingress: [{ from: [{ podSelector: { matchLabels: { app: web } } }, { namespaceSelector: { matchLabels: { kubernetes.io/metadata.name: ngrok-operator } } }] }]
  egress:
    - { to: [{ podSelector: { matchLabels: { app: postgres } } }], ports: [{ port: 5432 }] }
    - { to: [{ podSelector: { matchLabels: { app: redis } } }], ports: [{ port: 6379 }] }
    - { to: [{ podSelector: { matchLabels: { app: minio } } }], ports: [{ port: 9000 }] }
    - { to: [{ podSelector: { matchLabels: { app: sandbox-runner } } }], ports: [{ port: 8080 }] }
    - { to: [{ namespaceSelector: {} , podSelector: { matchLabels: { k8s-app: kube-dns } } }], ports: [{ port: 53, protocol: UDP }] }
    - { to: [{ ipBlock: { cidr: 0.0.0.0/0, except: [10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16] } }], ports: [{ port: 443 }] }   # OpenRouter, Firecrawl