---
# Gateways (public IPs, see smarthost/gateways.cidr), lab networks (incl. node IPs for kubelet probes) and opted-in pods in any namespace.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: smarthost
  namespace: mail
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: smarthost
  policyTypes:
    - Ingress
  ingress:
    - from:
        - ipBlock:
            cidr: 192.0.2.1/32
        - ipBlock:
            cidr: 192.0.2.2/32
        - ipBlock:
            cidr: 10.10.12.200/32
        - ipBlock:
            cidr: 198.18.1.10/32
        - ipBlock:
            cidr: 198.18.2.160/27
        - ipBlock:
            cidr: 198.18.2.192/27
        - ipBlock:
            cidr: 198.18.13.0/24
        - ipBlock:
            cidr: 198.18.14.0/24
        - ipBlock:
            cidr: 198.18.15.0/24
        - ipBlock:
            cidr: 198.18.16.0/24
        - ipBlock:
            cidr: 198.18.17.0/24
        - ipBlock:
            cidr: 198.18.18.0/24
        - ipBlock:
            cidr: 198.18.19.0/24
        - ipBlock:
            cidr: 198.18.20.0/24
        - ipBlock:
            cidr: 198.18.21.0/24
        - ipBlock:
            cidr: 198.18.22.0/24
        - ipBlock:
            cidr: 198.18.23.0/24
        - ipBlock:
            cidr: 198.18.25.0/24
        - ipBlock:
            cidr: 198.18.26.0/24
        - ipBlock:
            cidr: 198.18.27.0/24
        - ipBlock:
            cidr: 198.18.28.0/24
        - ipBlock:
            cidr: 198.18.29.0/24
        - ipBlock:
            cidr: 198.18.64.0/24
        - ipBlock:
            cidr: 198.18.65.0/24
        - ipBlock:
            cidr: 198.18.66.0/24
        - ipBlock:
            cidr: 198.18.67.0/24
        - ipBlock:
            cidr: 198.18.68.0/24
        - ipBlock:
            cidr: 198.18.69.0/24
        - namespaceSelector: {}
          podSelector:
            matchLabels:
              mail.unkin.net/smarthost-client: "true"
      ports:
        - port: smtp
          protocol: TCP