{
  "apiVersion": "projectcalico.org/v3",
  "kind": "NetworkPolicy",
  "metadata": {
    "name": "calico-system.kube-controller-access",
    "namespace": "calico-system"
  },
  "spec": {
    "order": 1,
    "tier": "calico-system",
    "selector": "k8s-app == 'calico-kube-controllers'",
    "types": [
      "Egress", "Ingress"
    ],
    "egress": [
      {
        "action": "Allow",
        "protocol": "UDP",
        "destination": {
          "namespaceSelector": "kubernetes.io/metadata.name == 'kube-system'",
          "selector": "k8s-app in { 'kube-dns', 'coredns' }",
          "ports": [
            53
          ]
        }
      },
      {
        "action": "Allow",
        "protocol": "TCP",
        "destination": {
          "ports": [
            443,
            6443,
            12388
          ]
        }
      }
    ],
    "ingress": [
      {
        "action": "Allow",
        "protocol": "TCP",
        "source": {
          "selector": "k8s-app == 'tigera-prometheus'",
          "namespaceSelector": "name == 'tigera-prometheus'"
        },
        "destination": {
          "ports": [
            "9094"
          ]
        }
      }
    ]
  }
}