apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    api-approved.kubernetes.io: https://github.com/kubernetes-sigs/network-policy-api/pull/300
    policy.networking.k8s.io/bundle-version: v0.1.7
    policy.networking.k8s.io/channel: standard
  name: clusternetworkpolicies.policy.networking.k8s.io
spec:
  group: policy.networking.k8s.io
  names:
    kind: ClusterNetworkPolicy
    listKind: ClusterNetworkPolicyList
    plural: clusternetworkpolicies
    shortNames:
      - cnp
    singular: clusternetworkpolicy
  scope: Cluster
  versions:
    - additionalPrinterColumns:
        - jsonPath: .spec.tier
          name: Tier
          type: string
        - jsonPath: .spec.priority
          name: Priority
          type: string
        - jsonPath: .metadata.creationTimestamp
          name: Age
          type: date
      name: v1alpha2
      schema:
        openAPIV3Schema:
          description: ClusterNetworkPolicy is a cluster-wide network policy resource.
          properties:
            apiVersion:
              description: |-
                APIVersion defines the versioned schema of this representation of an object.
                Servers should convert recognized schemas to the latest internal value, and
                may reject unrecognized values.
                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
              type: string
            kind:
              description: |-
                Kind is a string value representing the REST resource this object represents.
                Servers may infer this from the endpoint the client submits requests to.
                Cannot be updated.
                In CamelCase.
                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
              type: string
            metadata:
              type: object
            spec:
              description: Spec defines the desired behavior of ClusterNetworkPolicy.
              properties:
                egress:
                  description: |-
                    Egress is the list of Egress rules to be applied to the selected pods.

                    A maximum of 25 rules is allowed in this block.

                    The relative precedence of egress rules within a single CNP object
                    (all of which share the priority) will be determined by the order
                    in which the rule is written.
                    Thus, a rule that appears at the top of the egress rules
                    would take the highest precedence.
                    CNPs with no egress rules do not affect egress traffic.
                  items:
                    description: |-
                      ClusterNetworkPolicyEgressRule describes an action to take on a particular
                      set of traffic originating from pods selected by a ClusterNetworkPolicy's
                      Subject field.
                      <network-policy-api:experimental:validation>
                    properties:
                      action:
                        description: |-
                          Action specifies the effect this rule will have on matching
                          traffic.  Currently the following actions are supported:

                          - Accept: Accepts the selected traffic, allowing it to
                            egress. No further ClusterNetworkPolicy or NetworkPolicy
                            rules will be processed.

                          - Deny: Drops the selected traffic. No further
                            ClusterNetworkPolicy or NetworkPolicy rules will be
                            processed.

                          - Pass: Skips all further ClusterNetworkPolicy rules in the
                            current tier for the selected traffic, and passes
                            evaluation to the next tier.
                        enum:
                          - Accept
                          - Deny
                          - Pass
                        type: string
                      name:
                        description: |-
                          Name is an identifier for this rule, that may be no more than
                          100 characters in length. This field should be used by the implementation
                          to help improve observability, readability and error-reporting
                          for any applied AdminNetworkPolicies.
                        maxLength: 100
                        type: string
                      ports:
                        description: |-
                          Ports allows for matching traffic based on port and protocols.
                          This field is a list of destination ports for the outgoing egress traffic.
                          If Ports is not set then the rule does not filter traffic via port.
                        items:
                          description: |-
                            ClusterNetworkPolicyPort describes how to select destination network ports.
                            Exactly one field must be set.
                          maxProperties: 1
                          minProperties: 1
                          properties:
                            portNumber:
                              description:
                                Port selects a destination port based on
                                protocol and port number.
                              properties:
                                port:
                                  description: Number defines a network port value.
                                  format: int32
                                  maximum: 65535
                                  minimum: 1
                                  type: integer
                                protocol:
                                  default: TCP
                                  description: |-
                                    Protocol is the network protocol (TCP, UDP, or SCTP) which traffic must
                                    match. If not specified, this field defaults to TCP.
                                  type: string
                              required:
                                - port
                                - protocol
                              type: object
                            portRange:
                              description: |-
                                PortRange selects a destination port range based on protocol and
                                start and end port numbers.
                              properties:
                                end:
                                  description: |-
                                    End defines a network port that is the end of a port range, the End value
                                    must be greater than Start.
                                  format: int32
                                  maximum: 65535
                                  minimum: 1
                                  type: integer
                                protocol:
                                  default: TCP
                                  description: |-
                                    Protocol is the network protocol (TCP, UDP, or SCTP) which traffic must
                                    match. If not specified, this field defaults to TCP.
                                  type: string
                                start:
                                  description: |-
                                    Start defines a network port that is the start of a port range, the Start
                                    value must be less than End.
                                  format: int32
                                  maximum: 65535
                                  minimum: 1
                                  type: integer
                              required:
                                - end
                                - start
                              type: object
                              x-kubernetes-validations:
                                - message: Start port must be less than End port
                                  rule: self.start < self.end
                          type: object
                        maxItems: 25
                        minItems: 1
                        type: array
                      to:
                        description: |-
                          To is the List of destinations whose traffic this rule applies to.
                          If any element matches the destination of outgoing
                          traffic then the specified action is applied.
                          This field must be defined and contain at least one item.
                        items:
                          description: |-
                            ClusterNetworkPolicyEgressPeer defines a peer to allow traffic to.

                            Exactly one of the fields must be set for a given peer and this is enforced
                            by the validation rules on the CRD. If an implementation sees no fields are
                            set then it can infer that the deployed CRD is of an incompatible version
                            with an unknown field.  In that case it should fail closed.

                            For "Accept" rules, "fail closed" means: "treat the rule as matching no
                            traffic". For "Deny" and "Pass" rules, "fail closed" means: "treat the rule
                            as a 'Deny all' rule".
                          maxProperties: 1
                          minProperties: 1
                          properties:
                            namespaces:
                              description: |-
                                Namespaces defines a way to select all pods within a set of Namespaces.
                                Note that host-networked pods are not included in this type of peer.
                              properties:
                                matchExpressions:
                                  description:
                                    matchExpressions is a list of label selector
                                    requirements. The requirements are ANDed.
                                  items:
                                    description: |-
                                      A label selector requirement is a selector that contains values, a key, and an operator that
                                      relates the key and values.
                                    properties:
                                      key:
                                        description:
                                          key is the label key that the selector
                                          applies to.
                                        type: string
                                      operator:
                                        description: |-
                                          operator represents a key's relationship to a set of values.
                                          Valid operators are In, NotIn, Exists and DoesNotExist.
                                        type: string
                                      values:
                                        description: |-
                                          values is an array of string values. If the operator is In or NotIn,
                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                          the values array must be empty. This array is replaced during a strategic
                                          merge patch.
                                        items:
                                          type: string
                                        type: array
                                        x-kubernetes-list-type: atomic
                                    required:
                                      - key
                                      - operator
                                    type: object
                                  type: array
                                  x-kubernetes-list-type: atomic
                                matchLabels:
                                  additionalProperties:
                                    type: string
                                  description: |-
                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
                                  type: object
                              type: object
                              x-kubernetes-map-type: atomic
                            networks:
                              description: |-
                                Networks defines a way to select peers via CIDR blocks.
                                This is intended for representing entities that live outside the cluster,
                                which can't be selected by pods, namespaces and nodes peers, but note
                                that cluster-internal traffic will be checked against the rule as
                                well. So if you Accept or Deny traffic to `"0.0.0.0/0"`, that will allow
                                or deny all IPv4 pod-to-pod traffic as well. If you don't want that,
                                add a rule that Passes all pod traffic before the Networks rule.

                                Each item in Networks should be provided in the CIDR format and should be
                                IPv4 or IPv6, for example "10.0.0.0/8" or "fd00::/8".

                                Networks can have upto 25 CIDRs specified.
                              items:
                                description: |-
                                  CIDR is an IP address range in CIDR notation
                                  (for example, "10.0.0.0/8" or "fd00::/8").
                                maxLength: 43
                                type: string
                                x-kubernetes-validations:
                                  - message: Invalid CIDR format provided
                                    rule: isCIDR(self)
                              maxItems: 25
                              minItems: 1
                              type: array
                              x-kubernetes-list-type: set
                            pods:
                              description: |-
                                Pods defines a way to select a set of pods in
                                a set of namespaces. Note that host-networked pods
                                are not included in this type of peer.
                              properties:
                                namespaceSelector:
                                  description: |-
                                    NamespaceSelector follows standard label selector semantics; if empty,
                                    it selects all Namespaces.
                                  properties:
                                    matchExpressions:
                                      description:
                                        matchExpressions is a list of label
                                        selector requirements. The requirements are
                                        ANDed.
                                      items:
                                        description: |-
                                          A label selector requirement is a selector that contains values, a key, and an operator that
                                          relates the key and values.
                                        properties:
                                          key:
                                            description:
                                              key is the label key that the
                                              selector applies to.
                                            type: string
                                          operator:
                                            description: |-
                                              operator represents a key's relationship to a set of values.
                                              Valid operators are In, NotIn, Exists and DoesNotExist.
                                            type: string
                                          values:
                                            description: |-
                                              values is an array of string values. If the operator is In or NotIn,
                                              the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                              the values array must be empty. This array is replaced during a strategic
                                              merge patch.
                                            items:
                                              type: string
                                            type: array
                                            x-kubernetes-list-type: atomic
                                        required:
                                          - key
                                          - operator
                                        type: object
                                      type: array
                                      x-kubernetes-list-type: atomic
                                    matchLabels:
                                      additionalProperties:
                                        type: string
                                      description: |-
                                        matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                        map is equivalent to an element of matchExpressions, whose key field is "key", the
                                        operator is "In", and the values array contains only "value". The requirements are ANDed.
                                      type: object
                                  type: object
                                  x-kubernetes-map-type: atomic
                                podSelector:
                                  description: |-
                                    PodSelector is used to explicitly select pods within a namespace;
                                    if empty, it selects all Pods.
                                  properties:
                                    matchExpressions:
                                      description:
                                        matchExpressions is a list of label
                                        selector requirements. The requirements are
                                        ANDed.
                                      items:
                                        description: |-
                                          A label selector requirement is a selector that contains values, a key, and an operator that
                                          relates the key and values.
                                        properties:
                                          key:
                                            description:
                                              key is the label key that the
                                              selector applies to.
                                            type: string
                                          operator:
                                            description: |-
                                              operator represents a key's relationship to a set of values.
                                              Valid operators are In, NotIn, Exists and DoesNotExist.
                                            type: string
                                          values:
                                            description: |-
                                              values is an array of string values. If the operator is In or NotIn,
                                              the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                              the values array must be empty. This array is replaced during a strategic
                                              merge patch.
                                            items:
                                              type: string
                                            type: array
                                            x-kubernetes-list-type: atomic
                                        required:
                                          - key
                                          - operator
                                        type: object
                                      type: array
                                      x-kubernetes-list-type: atomic
                                    matchLabels:
                                      additionalProperties:
                                        type: string
                                      description: |-
                                        matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                        map is equivalent to an element of matchExpressions, whose key field is "key", the
                                        operator is "In", and the values array contains only "value". The requirements are ANDed.
                                      type: object
                                  type: object
                                  x-kubernetes-map-type: atomic
                              required:
                                - namespaceSelector
                                - podSelector
                              type: object
                          type: object
                        maxItems: 25
                        minItems: 1
                        type: array
                    required:
                      - action
                      - to
                    type: object
                  maxItems: 25
                  type: array
                ingress:
                  description: |-
                    Ingress is the list of Ingress rules to be applied to the selected pods.

                    A maximum of 25 rules is allowed in this block.

                    The relative precedence of ingress rules within a single CNP object
                    (all of which share the priority) will be determined by the order
                    in which the rule is written.
                    Thus, a rule that appears at the top of the ingress rules
                    would take the highest precedence.
                    CNPs with no ingress rules do not affect ingress traffic.
                  items:
                    description: |-
                      ClusterNetworkPolicyIngressRule describes an action to take on a particular
                      set of traffic destined for pods selected by a ClusterNetworkPolicy's
                      Subject field.
                    properties:
                      action:
                        description: |-
                          Action specifies the effect this rule will have on matching
                          traffic. Currently the following actions are supported:

                          - Accept: Accepts the selected traffic, allowing it into
                            the destination. No further ClusterNetworkPolicy or
                            NetworkPolicy rules will be processed.

                            Note: while Accept ensures traffic is accepted by
                            Kubernetes network policy, it is still possible that the
                            packet is blocked in other ways: custom nftable rules,
                            high-layers e.g. service mesh.

                          - Deny: Drops the selected traffic. No further
                            ClusterNetworkPolicy or NetworkPolicy rules will be
                            processed.

                          - Pass: Skips all further ClusterNetworkPolicy rules in the
                            current tier for the selected traffic, and passes
                            evaluation to the next tier.
                        enum:
                          - Accept
                          - Deny
                          - Pass
                        type: string
                      from:
                        description: |-
                          From is the list of sources whose traffic this rule applies to.
                          If any element matches the source of incoming
                          traffic then the specified action is applied.
                          This field must be defined and contain at least one item.
                        items:
                          description: |-
                            ClusterNetworkPolicyIngressPeer defines a peer to allow traffic from.

                            Exactly one of the fields must be set for a given peer and this is enforced
                            by the validation rules on the CRD. If an implementation sees no fields are
                            set then it can infer that the deployed CRD is of an incompatible version
                            with an unknown field.  In that case it should fail closed.

                            For "Accept" rules, "fail closed" means: "treat the rule as matching no
                            traffic". For "Deny" and "Pass" rules, "fail closed" means: "treat the rule
                            as a 'Deny all' rule".
                          maxProperties: 1
                          minProperties: 1
                          properties:
                            namespaces:
                              description: |-
                                Namespaces defines a way to select all pods within a set of Namespaces.
                                Note that host-networked pods are not included in this type of peer.
                              properties:
                                matchExpressions:
                                  description:
                                    matchExpressions is a list of label selector
                                    requirements. The requirements are ANDed.
                                  items:
                                    description: |-
                                      A label selector requirement is a selector that contains values, a key, and an operator that
                                      relates the key and values.
                                    properties:
                                      key:
                                        description:
                                          key is the label key that the selector
                                          applies to.
                                        type: string
                                      operator:
                                        description: |-
                                          operator represents a key's relationship to a set of values.
                                          Valid operators are In, NotIn, Exists and DoesNotExist.
                                        type: string
                                      values:
                                        description: |-
                                          values is an array of string values. If the operator is In or NotIn,
                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                          the values array must be empty. This array is replaced during a strategic
                                          merge patch.
                                        items:
                                          type: string
                                        type: array
                                        x-kubernetes-list-type: atomic
                                    required:
                                      - key
                                      - operator
                                    type: object
                                  type: array
                                  x-kubernetes-list-type: atomic
                                matchLabels:
                                  additionalProperties:
                                    type: string
                                  description: |-
                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
                                  type: object
                              type: object
                              x-kubernetes-map-type: atomic
                            pods:
                              description: |-
                                Pods defines a way to select a set of pods in
                                a set of namespaces. Note that host-networked pods
                                are not included in this type of peer.
                              properties:
                                namespaceSelector:
                                  description: |-
                                    NamespaceSelector follows standard label selector semantics; if empty,
                                    it selects all Namespaces.
                                  properties:
                                    matchExpressions:
                                      description:
                                        matchExpressions is a list of label
                                        selector requirements. The requirements are
                                        ANDed.
                                      items:
                                        description: |-
                                          A label selector requirement is a selector that contains values, a key, and an operator that
                                          relates the key and values.
                                        properties:
                                          key:
                                            description:
                                              key is the label key that the
                                              selector applies to.
                                            type: string
                                          operator:
                                            description: |-
                                              operator represents a key's relationship to a set of values.
                                              Valid operators are In, NotIn, Exists and DoesNotExist.
                                            type: string
                                          values:
                                            description: |-
                                              values is an array of string values. If the operator is In or NotIn,
                                              the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                              the values array must be empty. This array is replaced during a strategic
                                              merge patch.
                                            items:
                                              type: string
                                            type: array
                                            x-kubernetes-list-type: atomic
                                        required:
                                          - key
                                          - operator
                                        type: object
                                      type: array
                                      x-kubernetes-list-type: atomic
                                    matchLabels:
                                      additionalProperties:
                                        type: string
                                      description: |-
                                        matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                        map is equivalent to an element of matchExpressions, whose key field is "key", the
                                        operator is "In", and the values array contains only "value". The requirements are ANDed.
                                      type: object
                                  type: object
                                  x-kubernetes-map-type: atomic
                                podSelector:
                                  description: |-
                                    PodSelector is used to explicitly select pods within a namespace;
                                    if empty, it selects all Pods.
                                  properties:
                                    matchExpressions:
                                      description:
                                        matchExpressions is a list of label
                                        selector requirements. The requirements are
                                        ANDed.
                                      items:
                                        description: |-
                                          A label selector requirement is a selector that contains values, a key, and an operator that
                                          relates the key and values.
                                        properties:
                                          key:
                                            description:
                                              key is the label key that the
                                              selector applies to.
                                            type: string
                                          operator:
                                            description: |-
                                              operator represents a key's relationship to a set of values.
                                              Valid operators are In, NotIn, Exists and DoesNotExist.
                                            type: string
                                          values:
                                            description: |-
                                              values is an array of string values. If the operator is In or NotIn,
                                              the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                              the values array must be empty. This array is replaced during a strategic
                                              merge patch.
                                            items:
                                              type: string
                                            type: array
                                            x-kubernetes-list-type: atomic
                                        required:
                                          - key
                                          - operator
                                        type: object
                                      type: array
                                      x-kubernetes-list-type: atomic
                                    matchLabels:
                                      additionalProperties:
                                        type: string
                                      description: |-
                                        matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                        map is equivalent to an element of matchExpressions, whose key field is "key", the
                                        operator is "In", and the values array contains only "value". The requirements are ANDed.
                                      type: object
                                  type: object
                                  x-kubernetes-map-type: atomic
                              required:
                                - namespaceSelector
                                - podSelector
                              type: object
                          type: object
                        maxItems: 25
                        minItems: 1
                        type: array
                      name:
                        description: |-
                          Name is an identifier for this rule, that may be no more than
                          100 characters in length. This field should be used by the implementation
                          to help improve observability, readability and error-reporting
                          for any applied AdminNetworkPolicies.
                        maxLength: 100
                        type: string
                      ports:
                        description: |-
                          Ports allows for matching traffic based on port and protocols.
                          This field is a list of ports which should be matched on
                          the pods selected for this policy i.e the subject of the policy.
                          So it matches on the destination port for the ingress traffic.
                          If Ports is not set then the rule does not filter traffic via port.
                        items:
                          description: |-
                            ClusterNetworkPolicyPort describes how to select destination network ports.
                            Exactly one field must be set.
                          maxProperties: 1
                          minProperties: 1
                          properties:
                            portNumber:
                              description:
                                Port selects a destination port based on
                                protocol and port number.
                              properties:
                                port:
                                  description: Number defines a network port value.
                                  format: int32
                                  maximum: 65535
                                  minimum: 1
                                  type: integer
                                protocol:
                                  default: TCP
                                  description: |-
                                    Protocol is the network protocol (TCP, UDP, or SCTP) which traffic must
                                    match. If not specified, this field defaults to TCP.
                                  type: string
                              required:
                                - port
                                - protocol
                              type: object
                            portRange:
                              description: |-
                                PortRange selects a destination port range based on protocol and
                                start and end port numbers.
                              properties:
                                end:
                                  description: |-
                                    End defines a network port that is the end of a port range, the End value
                                    must be greater than Start.
                                  format: int32
                                  maximum: 65535
                                  minimum: 1
                                  type: integer
                                protocol:
                                  default: TCP
                                  description: |-
                                    Protocol is the network protocol (TCP, UDP, or SCTP) which traffic must
                                    match. If not specified, this field defaults to TCP.
                                  type: string
                                start:
                                  description: |-
                                    Start defines a network port that is the start of a port range, the Start
                                    value must be less than End.
                                  format: int32
                                  maximum: 65535
                                  minimum: 1
                                  type: integer
                              required:
                                - end
                                - start
                              type: object
                              x-kubernetes-validations:
                                - message: Start port must be less than End port
                                  rule: self.start < self.end
                          type: object
                        maxItems: 25
                        minItems: 1
                        type: array
                    required:
                      - action
                      - from
                    type: object
                  maxItems: 25
                  type: array
                priority:
                  description: |-
                    Priority is a value from 0 to 1000 indicating the precedence of
                    the policy within its tier. Policies with lower priority values have
                    higher precedence, and are checked before policies with higher priority
                    values in the same tier. All Admin tier rules have higher precedence than
                    NetworkPolicy or Baseline tier rules.
                    If two (or more) policies in the same tier with the same priority
                    could match a connection, then the implementation can apply any of the
                    matching policies to the connection, and there is no way for the user to
                    reliably determine which one it will choose. Administrators must be
                    careful about assigning the priorities for policies with rules that will
                    match many connections, and ensure that policies have unique priority
                    values in cases where ambiguity would be unacceptable.
                  format: int32
                  maximum: 1000
                  minimum: 0
                  type: integer
                subject:
                  description:
                    Subject defines the pods to which this ClusterNetworkPolicy
                    applies.
                  maxProperties: 1
                  minProperties: 1
                  properties:
                    namespaces:
                      description: Namespaces is used to select pods via namespace selectors.
                      properties:
                        matchExpressions:
                          description:
                            matchExpressions is a list of label selector
                            requirements. The requirements are ANDed.
                          items:
                            description: |-
                              A label selector requirement is a selector that contains values, a key, and an operator that
                              relates the key and values.
                            properties:
                              key:
                                description:
                                  key is the label key that the selector
                                  applies to.
                                type: string
                              operator:
                                description: |-
                                  operator represents a key's relationship to a set of values.
                                  Valid operators are In, NotIn, Exists and DoesNotExist.
                                type: string
                              values:
                                description: |-
                                  values is an array of string values. If the operator is In or NotIn,
                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                  the values array must be empty. This array is replaced during a strategic
                                  merge patch.
                                items:
                                  type: string
                                type: array
                                x-kubernetes-list-type: atomic
                            required:
                              - key
                              - operator
                            type: object
                          type: array
                          x-kubernetes-list-type: atomic
                        matchLabels:
                          additionalProperties:
                            type: string
                          description: |-
                            matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                            map is equivalent to an element of matchExpressions, whose key field is "key", the
                            operator is "In", and the values array contains only "value". The requirements are ANDed.
                          type: object
                      type: object
                      x-kubernetes-map-type: atomic
                    pods:
                      description:
                        Pods is used to select pods via namespace AND pod
                        selectors.
                      properties:
                        namespaceSelector:
                          description: |-
                            NamespaceSelector follows standard label selector semantics; if empty,
                            it selects all Namespaces.
                          properties:
                            matchExpressions:
                              description:
                                matchExpressions is a list of label selector
                                requirements. The requirements are ANDed.
                              items:
                                description: |-
                                  A label selector requirement is a selector that contains values, a key, and an operator that
                                  relates the key and values.
                                properties:
                                  key:
                                    description:
                                      key is the label key that the selector
                                      applies to.
                                    type: string
                                  operator:
                                    description: |-
                                      operator represents a key's relationship to a set of values.
                                      Valid operators are In, NotIn, Exists and DoesNotExist.
                                    type: string
                                  values:
                                    description: |-
                                      values is an array of string values. If the operator is In or NotIn,
                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                      the values array must be empty. This array is replaced during a strategic
                                      merge patch.
                                    items:
                                      type: string
                                    type: array
                                    x-kubernetes-list-type: atomic
                                required:
                                  - key
                                  - operator
                                type: object
                              type: array
                              x-kubernetes-list-type: atomic
                            matchLabels:
                              additionalProperties:
                                type: string
                              description: |-
                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                map is equivalent to an element of matchExpressions, whose key field is "key", the
                                operator is "In", and the values array contains only "value". The requirements are ANDed.
                              type: object
                          type: object
                          x-kubernetes-map-type: atomic
                        podSelector:
                          description: |-
                            PodSelector is used to explicitly select pods within a namespace;
                            if empty, it selects all Pods.
                          properties:
                            matchExpressions:
                              description:
                                matchExpressions is a list of label selector
                                requirements. The requirements are ANDed.
                              items:
                                description: |-
                                  A label selector requirement is a selector that contains values, a key, and an operator that
                                  relates the key and values.
                                properties:
                                  key:
                                    description:
                                      key is the label key that the selector
                                      applies to.
                                    type: string
                                  operator:
                                    description: |-
                                      operator represents a key's relationship to a set of values.
                                      Valid operators are In, NotIn, Exists and DoesNotExist.
                                    type: string
                                  values:
                                    description: |-
                                      values is an array of string values. If the operator is In or NotIn,
                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                      the values array must be empty. This array is replaced during a strategic
                                      merge patch.
                                    items:
                                      type: string
                                    type: array
                                    x-kubernetes-list-type: atomic
                                required:
                                  - key
                                  - operator
                                type: object
                              type: array
                              x-kubernetes-list-type: atomic
                            matchLabels:
                              additionalProperties:
                                type: string
                              description: |-
                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                map is equivalent to an element of matchExpressions, whose key field is "key", the
                                operator is "In", and the values array contains only "value". The requirements are ANDed.
                              type: object
                          type: object
                          x-kubernetes-map-type: atomic
                      required:
                        - namespaceSelector
                        - podSelector
                      type: object
                  type: object
                tier:
                  description: |-
                    Tier is used as the top-level grouping for network policy prioritization.

                    Policy tiers are evaluated in the following order:
                    * Admin tier
                    * NetworkPolicy tier
                    * Baseline tier

                    ClusterNetworkPolicy can use 2 of these tiers: Admin and Baseline.

                    The Admin tier takes precedence over all other policies. Policies
                    defined in this tier are used to set cluster-wide security rules
                    that cannot be overridden in the other tiers. If Admin tier has
                    made a final decision (Accept or Deny) on a connection, then no
                    further evaluation is done.

                    NetworkPolicy tier is the tier for the namespaced v1.NetworkPolicy.
                    These policies are intended for the application developer to describe
                    the security policy associated with their deployments inside their
                    namespace. v1.NetworkPolicy always makes a final decision for selected
                    pods. Further evaluation only happens for Pods not selected by a
                    v1.NetworkPolicy.

                    Baseline tier is a cluster-wide policy that can be overridden by the
                    v1.NetworkPolicy. If Baseline tier has made a final decision (Accept or
                    Deny) on a connection, then no further evaluation is done.

                    If a given connection wasn't allowed or denied by any of the tiers,
                    the default kubernetes policy is applied, which says that
                    all pods can communicate with each other.
                  enum:
                    - Admin
                    - Baseline
                  type: string
              required:
                - priority
                - subject
                - tier
              type: object
            status:
              description: Status is the status to be reported by the implementation.
              properties:
                conditions:
                  items:
                    description:
                      Condition contains details for one aspect of the current
                      state of this API Resource.
                    properties:
                      lastTransitionTime:
                        description: |-
                          lastTransitionTime is the last time the condition transitioned from one status to another.
                          This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
                        format: date-time
                        type: string
                      message:
                        description: |-
                          message is a human readable message indicating details about the transition.
                          This may be an empty string.
                        maxLength: 32768
                        type: string
                      observedGeneration:
                        description: |-
                          observedGeneration represents the .metadata.generation that the condition was set based upon.
                          For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
                          with respect to the current state of the instance.
                        format: int64
                        minimum: 0
                        type: integer
                      reason:
                        description: |-
                          reason contains a programmatic identifier indicating the reason for the condition's last transition.
                          Producers of specific condition types may define expected values and meanings for this field,
                          and whether the values are considered a guaranteed API.
                          The value should be a CamelCase string.
                          This field may not be empty.
                        maxLength: 1024
                        minLength: 1
                        pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
                        type: string
                      status:
                        description: status of the condition, one of True, False, Unknown.
                        enum:
                          - "True"
                          - "False"
                          - Unknown
                        type: string
                      type:
                        description: type of condition in CamelCase or in foo.example.com/CamelCase.
                        maxLength: 316
                        pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
                        type: string
                    required:
                      - lastTransitionTime
                      - message
                      - reason
                      - status
                      - type
                    type: object
                  type: array
                  x-kubernetes-list-map-keys:
                    - type
                  x-kubernetes-list-type: map
              required:
                - conditions
              type: object
          required:
            - metadata
            - spec
          type: object
      served: true
      storage: true
      subresources:
        status: {}
status:
  acceptedNames:
    kind: ""
    plural: ""
  conditions: null
  storedVersions: null
