# CI executor pods need broad egress: git clone (GitLab webservice), container
# registries, kubectl (K8s API), MinIO S3, and external tool downloads.
# These pods are ephemeral (minutes) — fine-grained egress adds little value.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: ci-egress
  namespace: foxhunt
  labels:
    app.kubernetes.io/part-of: foxhunt
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/part-of: foxhunt-ci
  policyTypes:
    - Egress
  egress:
    - {}
