apiVersion: "cilium.io/v2"
kind: CiliumClusterwideNetworkPolicy
metadata:
  name: "deny-cross-namespace-traffic-with-labeled-exceptions"
spec:
  description: "Cluster-wide policy to deny cross-namespace traffic, except for specific namespaces"
  endpointSelector:
    matchExpressions:
    - key: "kubernetes.io/metadata.name"
      operator: NotIn
      values:
      - kube-system
    - key: "heritage"
      operator: NotIn
      values:
      - deckhouse
  ingress:
  - fromEntities:
    - cluster
  - fromEndpoints:
    - matchLabels:
        kubernetes.io/metadata.name: kube-system
    - matchLabels:
        heritage: deckhouse