kube-system.yaml

# apiVersion: v1
# kind: Namespace
# metadata:
#   name: kube-system

---
kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
  name: default-ingress
  namespace: kube-system
spec:
  podSelector: {}
  ingress:
  - from:
    # Only allow ingress from K8S (DNS server)
    - ipBlock:
        cidr: "10.0.0.0/8"
  policyTypes:
  - Ingress

---
kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
  name: default-egress
  namespace: kube-system
spec:
  podSelector: {}
  egress:
  - to:
    # Allow all egress (multus has to pull CNI plugins, DNS server)
    - ipBlock:
        cidr: "0.0.0.0/0"
  policyTypes:
  - Egress