# CiliumNetworkPolicy: allow Prometheus to reach hostNetwork pods (node-exporter).
#
# Vanilla K8s NetworkPolicy ipBlock rules don't match traffic to hostNetwork
# pods because Cilium assigns them the 'host'/'remote-node' identity, not 'world'.
# This CiliumNetworkPolicy uses toEntities to cover that gap.
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: prometheus-host-access
  namespace: foxhunt
spec:
  endpointSelector:
    matchLabels:
      app.kubernetes.io/name: prometheus
      app.kubernetes.io/part-of: foxhunt
  egress:
    - toEntities:
        - host
        - remote-node
      toPorts:
        - ports:
            - port: "9100"
              protocol: TCP
