diff --git a/.github/workflows/binary-release.yml b/.github/workflows/binary-release.yml
new file mode 100644
index 0000000..6c58a16
--- /dev/null
+++ b/.github/workflows/binary-release.yml
@@ -0,0 +1,39 @@
+name: Release binaries
+
+# On a v* tag, build the CLI for linux (amd64, arm64) and darwin (amd64, arm64) and attach the archives to
+# the GitHub release of that tag — so a pipeline (E10: policy as code) can `curl` the binary instead of building
+# it. No goreleaser: four `go build`s and `gh release upload`.
+on:
+  push:
+    tags: ['v*']
+
+permissions:
+  contents: write
+
+jobs:
+  binaries:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+      - name: Build
+        run: |
+          set -eu
+          VERSION="${GITHUB_REF_NAME#v}"
+          mkdir -p dist
+          for target in linux/amd64 linux/arm64 darwin/amd64 darwin/arm64; do
+            os="${target%/*}"; arch="${target#*/}"
+            CGO_ENABLED=0 GOOS="$os" GOARCH="$arch" go build -trimpath -ldflags="-s -w -X main.version=${GITHUB_REF_NAME#v}" -o "dist/cf2cnp" ./cmd/cf2cnp
+            tar -C dist -czf "dist/cf2cnp_${VERSION}_${os}_${arch}.tar.gz" cf2cnp
+            rm dist/cf2cnp
+          done
+          (cd dist && sha256sum *.tar.gz > "cf2cnp_${VERSION}_checksums.txt")
+          ls -l dist
+      - name: Attach to the release of this tag
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh release view "$GITHUB_REF_NAME" >/dev/null 2>&1 || gh release create "$GITHUB_REF_NAME" --title "cf2cnp $GITHUB_REF_NAME" --notes "cf2cnp $GITHUB_REF_NAME — see the chart release for Helm."
+          gh release upload "$GITHUB_REF_NAME" dist/* --clobber
diff --git a/.github/workflows/chart-releaser.yml b/.github/workflows/chart-releaser.yml
new file mode 100644
index 0000000..7cd6369
--- /dev/null
+++ b/.github/workflows/chart-releaser.yml
@@ -0,0 +1,32 @@
+name: Release Helm Chart (GitHub Pages)
+
+# Publishes helm/cf2cnp as a classic Helm repository on the gh-pages branch (index.yaml) and as a GitHub
+# release carrying the chart .tgz, whenever the chart version on the default branch changes. This is the
+# fork's release path while the upstream pull request is pending; the OCI push (helm-publish.yml) stays.
+on:
+  push:
+    branches: [develop, main]
+    paths: ['helm/**', '.github/workflows/chart-releaser.yml']
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Configure git
+        run: |
+          git config user.name "$GITHUB_ACTOR"
+          git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
+      - uses: azure/setup-helm@v4
+      - uses: helm/chart-releaser-action@v1.7.0
+        with:
+          charts_dir: helm
+          skip_existing: true
+        env:
+          CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..3146173
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,96 @@
+# CI — the checks a change must pass before it is released. Three layers guard the spec:
+#   1. `go test ./...`: unit tests, and TestGolden — the /generate answer for 14 real Hubble captures must be byte for
+#      byte what 0.6.3 answered (a deliberate output change regenerates the fixtures in the same commit).
+#   2. Cilium's own Sanitize() runs inside those tests (internal/policy.Validate) — the agent's admission checks.
+#   3. The CRD schema of the pinned Cilium module: the embedded copy must be identical to the module's, and every
+#      golden output must validate against it offline (kubectl-validate --local-crds, the same mechanism the PoC's
+#      policy-PR template uses).
+# And one line that must never appear: the Kubernetes client machinery in the dependency graph (18 MB → 94 MB).
+name: CI
+
+on:
+  push:
+    branches: [develop, main]
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+      - name: Vet and test (unit, golden, Sanitize) — and say what ran, in the job summary
+        run: |
+          go vet ./...
+          set -o pipefail
+          go test ./... -count=1 -json | tee /tmp/go-test.json | grep -E '"Action":"(fail)"' || true
+          python3 - <<'PY' >> "$GITHUB_STEP_SUMMARY"
+          import json, collections
+          pk = collections.defaultdict(lambda: collections.Counter()); golden = []; failed = []
+          for l in open('/tmp/go-test.json'):
+              try: e = json.loads(l)
+              except ValueError: continue
+              if e.get('Test') and e.get('Action') in ('pass', 'fail', 'skip'):
+                  pk[e['Package'].split('/')[-1]][e['Action']] += 1
+                  if e['Action'] == 'fail': failed.append(e['Package'].split('/')[-1] + ' ' + e['Test'])
+                  if e['Test'].startswith('TestGolden/'): golden.append((e['Test'][len('TestGolden/'):], e['Action']))
+          print('## Tests\n'); print('| package | passed | failed | skipped |'); print('|---|---|---|---|')
+          for k, c in sorted(pk.items()): print(f"| {k} | {c['pass']} | {c['fail']} | {c['skip']} |")
+          print(f"\n**{sum(c['pass'] for c in pk.values())} passed, {sum(c['fail'] for c in pk.values())} failed.**")
+          if failed: print('\nFailed: ' + ', '.join(failed))
+          print('\n## The 14 golden captures (byte-for-byte against 0.6.3, deliberate changes named in internal/testdata/golden/README.md)\n')
+          print('| capture | result |'); print('|---|---|')
+          for n, a in sorted(golden): print(f"| {n} | {'✅ identical' if a == 'pass' else '❌ differs'} |")
+          PY
+          ! grep -q '"Action":"fail"' /tmp/go-test.json
+      - name: The embedded CRD is the pinned module's, byte for byte
+        run: |
+          set -eu
+          dir=$(go list -m -f '{{.Dir}}' github.com/cilium/cilium)
+          cmp internal/crd/ciliumnetworkpolicies.yaml "$dir/pkg/k8s/apis/cilium.io/client/crds/v2/ciliumnetworkpolicies.yaml"
+          test "$(cat internal/crd/VERSION)" = "$(go list -m -f '{{.Version}}' github.com/cilium/cilium)"
+          echo "CRD: cilium $(cat internal/crd/VERSION)"
+      - name: Every golden output validates against the CRD schema (offline)
+        run: |
+          set -eu
+          crds=$(mktemp -d); cp internal/crd/ciliumnetworkpolicies.yaml "$crds/"
+          echo "## Every golden output against the CRD schema (kubectl-validate, cilium $(cat internal/crd/VERSION))" >> "$GITHUB_STEP_SUMMARY"
+          echo "" >> "$GITHUB_STEP_SUMMARY"; echo "| file | documents | schema |" >> "$GITHUB_STEP_SUMMARY"; echo "|---|---|---|" >> "$GITHUB_STEP_SUMMARY"
+          for f in internal/testdata/golden/*/expected.yaml; do
+            n=$(grep -c '^kind: CiliumNetworkPolicy' "$f")
+            if go run sigs.k8s.io/kubectl-validate@v0.0.4 --local-crds "$crds" "$f"; then r="✅ valid"; else r="❌ INVALID"; fi
+            echo "| $(basename "$(dirname "$f")") | $n | $r |" >> "$GITHUB_STEP_SUMMARY"
+          done
+      - name: The Kubernetes client machinery stays out of the binary
+        # Two small helpers ride along with Cilium's policy API (k8s.io/client-go/util/jsonpath and its forked template,
+        # via github.com/cilium/cilium/pkg/command); the line not to cross is the client itself and Cilium's k8s client
+        # package, which pull the apiserver machinery in (18 MB → 94 MB, docs/CRD-SPEC-FORENSICS.md §3). The size ceiling
+        # is the real guard.
+        run: |
+          set -eu
+          if go list -deps ./cmd/cf2cnp | grep -E '^k8s.io/client-go/(kubernetes|rest|tools/clientcmd|dynamic|discovery)|^github.com/cilium/cilium/pkg/k8s/client($|/)'; then
+            echo "the client packages are imported — see docs/CRD-SPEC-FORENSICS.md §3"; exit 1
+          fi
+          go build -trimpath -ldflags="-s -w" -o /tmp/cf2cnp-size ./cmd/cf2cnp
+          size=$(stat -c %s /tmp/cf2cnp-size)
+          echo "binary: $size bytes"
+          test "$size" -lt 40000000 || { echo "the binary passed 40 MB: something heavy joined the graph"; exit 1; }
+      - name: The binary names the spec it supports, and validates every golden the way the agent would
+        run: |
+          go build -ldflags="-X main.version=ci" -o /tmp/cf2cnp ./cmd/cf2cnp
+          /tmp/cf2cnp version
+          /tmp/cf2cnp validate internal/testdata/golden/*/expected.yaml | tee /tmp/validate.txt
+          { echo "## cf2cnp validate (Sanitize, ObjectMeta, the protocol enum, apiVersion/kind, nodeSelector, specs)"; echo; echo '```'; /tmp/cf2cnp version; echo "$(grep -c ' ok$' /tmp/validate.txt) documents accepted, $(grep -vc ' ok$' /tmp/validate.txt) refused"; echo '```'; } >> "$GITHUB_STEP_SUMMARY"
+      - name: The policy-PR template's calls work (merge takes --l7)
+        run: |
+          set -eu
+          out=$(mktemp -d)
+          /tmp/cf2cnp generate --input internal/testdata/l7-http-request.json --output "$out"
+          existing=$(find "$out" -name '*.yaml' | head -1)
+          /tmp/cf2cnp merge --l7 --existing "$existing" --input internal/testdata/l7-http-request.json --output "$out/merged.yaml"
+          grep -q 'http:' "$out/merged.yaml"
diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index 9bd957e..2200e0b 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -61,4 +61,6 @@ jobs:
           cache-from: type=gha
           cache-to: type=gha,mode=max
           platforms: linux/amd64,linux/arm64
+          build-args: |
+            VERSION=${{ startsWith(github.ref, 'refs/tags/v') && github.ref_name || github.sha }}
 
diff --git a/CHANGELOG.md b/CHANGELOG.md
new file mode 100644
index 0000000..b1f069d
--- /dev/null
+++ b/CHANGELOG.md
@@ -0,0 +1,73 @@
+# Changelog — the fork's releases
+
+Every release below was built for a Cilium 1.20.1 ClusterMesh lab and proven there before it was tagged; each row
+names the demo of [cilium-implementation-poc](https://github.com/ephico2real2/cilium-implementation-poc) that
+exercises it (its README quotes the recorded transcript, the Hubble verdicts and the screenshots), and the review
+record where two independent reviewers (Cursor, Codex) went through the claims. The CI of this repository prints a
+test summary on every push (the workflow's job summary): the unit tests by package, the 14 golden captures that must
+answer byte for byte, the CRD check, and `cf2cnp validate` over every golden output.
+
+## 0.7.0 — 2026-09-13 · Cilium's own policy types, validated the way the agent validates
+
+- **The policy document is `github.com/cilium/cilium/pkg/policy/api` at the pinned Cilium version (v1.20.1).** Every
+  field of the CiliumNetworkPolicy spec exists (the 0.6.x hand-written structs modelled 20 of the schema's 291
+  paths); rendering keeps cf2cnp's field order through a precedence table (the kustomize/kyaml pattern); the CRD of
+  the same version is embedded and CI compares it byte for byte with the module's; `cf2cnp version` prints the spec
+  version the build supports. Output for the 14 recorded captures is byte-identical to 0.6.3 except two deliberate
+  changes named in `internal/testdata/golden/README.md`.
+- **Validation:** Cilium's own `Sanitize()` on every generated policy (on a copy — the file stays as a user writes
+  it), plus the object's checks: ObjectMeta (DNS-1123 names, label keys), the CRD's protocol enum, `apiVersion` and
+  `kind`, no `nodeSelector` on a namespaced policy, no namespace on a clusterwide one, `specs` rule by rule. A
+  refusal is a 400 on the API and exit 1 on the CLI. New: `cf2cnp validate <files…>`.
+- **`fromCIDR` for external sources:** an ingress flow from `reserved:world` (or `world-ipv4` / `world-ipv6` on a
+  dual-stack cluster) with an address becomes `fromCIDR: [<addr>/32]` (`/128` IPv6), what the receiver saw, instead
+  of `fromEntities: [world]`.
+- **The DNS resolver rule from the flows:** the rule `toFQDNs` and `--dns-visibility` need names the resolver the
+  workload actually asked — kube-dns by `k8s-app`, the CoreDNS Helm chart by `app.kubernetes.io/name`, NodeLocal
+  DNSCache, OpenShift's `openshift-dns` on 5353 without a label (Cilium's DNS guide) — on protocol `ANY`, as Cilium's
+  examples write it (a truncated UDP answer retries over TCP). Profiles `--dns-profile auto|kubernetes|openshift`,
+  any resolver with `--dns-resolver <ns>[/<label>=<v>]:<port>[/<proto>]`, the same on the API (`?dnsProfile=`,
+  `?dnsResolver=`), the page, and as a cluster-wide default on `serve` and in the chart (`dns.profile`,
+  `dns.resolver`, `networkPolicy.dnsEgress`).
+- **`merge --l7`**, the flag the policy-PR template already passed.
+- **Chart 0.7.0:** the DNS values above; the chart's own policy's DNS egress follows the profile and refuses to
+  render when a custom resolver is named without a matching `dnsEgress`.
+- Fixed: an IPv6 world peer got a `/32`; a dual-stack world peer was neither world nor an entity (an egress to it
+  produced no peer at all); the hard-coded kube-dns `53/UDP` rule selected nothing on OpenShift and with the CoreDNS
+  Helm chart and denied the TCP retry; a `specs`-only document was accepted as empty and merged into silently.
+- Tests: 104 (46 at 0.6.3); the goldens; `kubectl-validate` over every golden in CI; the dependency guard (no
+  Kubernetes client machinery, a 40 MB ceiling). Reviews: two passes,
+  [REVIEW_ENH-003](https://github.com/ephico2real2/cilium-implementation-poc/blob/main/docs/REVIEW_ENH-003.md);
+  forensics: [docs/CRD-SPEC-FORENSICS.md](docs/CRD-SPEC-FORENSICS.md). Demos: 35 (regenerated), the policy-PR
+  template on 0.7.0.
+
+## 0.6.3 — 2026-09-13 · descriptions from the rules
+
+- The description names its subject the way it names the peers (name / component / instance from the selector), the
+  peer's namespace or cluster when it differs, the ports and L7 rules; cut with "and N more" past six peers
+  (0.6.2 wrote it from the rules; 0.6.3 named the subject). Demo 35 Part 4.
+
+## 0.6.1 — 2026-09-13 · merge keeps the file as it was
+
+- `merge` edits the YAML node tree: key order, comments, quoting and indentation kept, so a pull request shows the
+  added rule only (0.6.0 re-serialised the whole file). One kube-dns rule when a pod's own lookups plus the
+  DNS-visibility rule met. Demo 32 Part 2b, demo 31 Part 1.
+
+## 0.6.0 — 2026-09-12 · enhancement 001, the enterprise set
+
+- Cluster-aware selectors for ClusterMesh flows (`io.cilium.k8s.policy.cluster`, demo 29); layer-7 rules from flows
+  that carry them, one port rule per port (demo 30); DNS visibility on demand (demo 31); review before generating
+  with `?exclude=` and the page's peer checklist (demo 32); `cf2cnp merge` (demo 32); CORS allow-list, a bearer
+  token, a CiliumNetworkPolicy for the pod (demo 33); release binaries for every `v*` tag (demo 32 Part 0).
+  Review: [REVIEW_ENH-001](https://github.com/ephico2real2/cilium-implementation-poc/blob/main/docs/REVIEW_ENH-001.md).
+
+## 0.5.1 — 2026-09-12
+
+- A `{}` body is refused; the proxy's `Forwarded` host is sanitised (review findings).
+
+## 0.5.0 — 2026-09-12 · the first fork release
+
+- `download_url` correct behind a TLS-terminating proxy (`--external-url`, `Forwarded`, `X-Forwarded-*` — the bug
+  of upstream #2); many flows per request merged per workload; policy names that cannot collide (a function of the
+  whole selector); `app.kubernetes.io/managed-by: cf2cnp` and the selector's labels on every policy; `?name=`.
+  Demos 26 and 27.
diff --git a/Dockerfile b/Dockerfile
index ddacf14..4093841 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,5 @@
 # Build stage
-FROM golang:1.25-alpine AS builder
+FROM golang:1.26-alpine AS builder
 
 WORKDIR /app
 
@@ -11,7 +11,8 @@ RUN go mod download
 COPY . .
 
 # Build the binary
-RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-s -w" -o cf2cnp ./cmd/cf2cnp
+ARG VERSION=dev
+RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-s -w -X main.version=${VERSION}" -o cf2cnp ./cmd/cf2cnp
 
 # Runtime stage - using distroless for minimal attack surface
 FROM gcr.io/distroless/static-debian12:nonroot
diff --git a/README.md b/README.md
index a8b7aee..c7ba81e 100644
--- a/README.md
+++ b/README.md
@@ -2,17 +2,60 @@
 
 A CLI tool that generates CiliumNetworkPolicies from Hubble flow data. This tool analyzes network traffic patterns captured by Hubble and automatically creates corresponding Cilium network policies.
 
+
+**Running-test captures.** cf2cnp runs on every CI run of a reference Cilium 1.20.1 lab (a two-cluster ClusterMesh on kind) and the results are captured — see the [`ci-captures` branch](https://github.com/ephico2real2/cilium-implementation-poc/tree/ci-captures) (newest run first): `cf2cnp.png` (the tool output), `grafana-policy-verdicts-cf2cnp-lab.png` (the generated policy under audit / enforce), `hubble-ui-cf2cnp-lab.png`.
+
 ## Features
 
 - **Automatic Policy Generation**: Reads Hubble flow JSON files and generates CiliumNetworkPolicy YAML files
 - **Smart Label Filtering**: Extracts only relevant app labels (see [label Selection](#label-selection))
 - **Cross-Namespace Support**: Automatically adds namespace labels for cross-namespace traffic
 - **FQDN Egress Support**: Generates proper `toFQDNs` rules with required DNS resolution rules for external traffic
-- **Flow Aggregation**: Combines multiple flows with the same source/destination into a single policy with multiple ports
+- **Flow Aggregation**: Combines multiple flows with the same source/destination into a single policy with multiple ports, and flows that select the same workload into one policy with one rule per peer (so two peers of one service are one object, not two objects with the same name)
+- **Many Flows at Once**: A file, a request body or a pasted text may hold one flow, a JSON array of flows, or one flow per line — the output of `hubble observe -o json`
 - **HTTP Server Mode**: Run as a containerized service to generate policies via HTTP API
 
 > **Caution:** This project was created with the help of AI. While I have extensive experience with Kubernetes and Cilium, I do not have the Go programming expertise to write this tool from scratch. AI assistance made it possible to bring this idea to life and share it with the community. Please be careful when using this tool in production environments. Always review generated policies before applying them to your cluster.
 
+## The spec this build supports
+
+cf2cnp's policy types are Cilium's own (`github.com/cilium/cilium/pkg/policy/api`, pinned in `go.mod`), so every
+field of the CiliumNetworkPolicy spec exists, Cilium's `Sanitize()` — the checks the agent applies at admission —
+runs on every generated or merged policy (on a copy; the agent's own message comes back as a 400 or an exit 1), and
+the CRD of the same Cilium version is embedded from the module (`internal/crd`, copied by `go generate`, checked in
+CI). `cf2cnp version` prints both:
+
+```text
+cf2cnp 0.7.0
+policy spec: CiliumNetworkPolicy cilium.io/v2 as of Cilium v1.20.1 (types: github.com/cilium/cilium/pkg/policy/api v1.20.1; CRD embedded from the same module)
+```
+
+| cf2cnp | Cilium policy spec | Notes |
+|---|---|---|
+| 0.7.0 | v1.20.1 | Cilium's types; `fromCIDR` for external sources; the DNS resolver from the flows (Kubernetes / OpenShift); `validate`, `version` |
+| 0.5.0 – 0.6.3 | hand-written subset | 20 of the spec's 291 fields (`docs/CRD-SPEC-FORENSICS.md`) |
+
+A Cilium bump is a release: Renovate proposes it (`renovate.json`), the embedded CRD follows, and the golden tests
+(`internal/testdata/golden`, 14 real captures whose answers must stay byte for byte) say what changed. Output is
+rendered in a fixed, readable field order (`internal/render`), not the alphabetical order Kubernetes' YAML library
+would give.
+
+`cf2cnp validate <file>…` runs the same checks on any policy file, generated or hand-written:
+
+```bash
+cf2cnp validate policies/*.yaml       # exit code = documents refused; each refusal carries Cilium's own sentence
+```
+
+## Binaries
+
+Every `v*` tag publishes `cf2cnp_<version>_<os>_<arch>.tar.gz` (linux and darwin, amd64 and arm64) with a
+checksums file on the tag's GitHub release, for pipelines that run `cf2cnp merge` without a Go toolchain:
+
+```bash
+curl -sSL -o cf2cnp.tgz https://github.com/ephico2real2/cf2cnp/releases/download/v0.6.0/cf2cnp_0.6.0_linux_amd64.tar.gz
+tar -xzf cf2cnp.tgz && sudo install cf2cnp /usr/local/bin/cf2cnp
+```
+
 ## Building
 
 Clone the repository and build the binary:
@@ -31,6 +74,10 @@ go build -o cf2cnp.exe ./cmd/cf2cnp
 
 ## Installation
 
+> **Fork note (ephico2real2/cf2cnp):** while the changes on this fork are pending upstream, the fork's chart is published as a
+> classic Helm repository at `https://ephico2real2.github.io/cf2cnp` (chart 0.7.0, appVersion 0.7.0) and its image as
+> `ghcr.io/ephico2real2/cf2cnp:0.7.0`. `helm repo add cf2cnp-fork https://ephico2real2.github.io/cf2cnp`.
+
 The easiest way to use `CF2CNP` is to deploy it together with the [hubble-observer Helm chart](https://github.com/onzack/hubble-observer). This chart installs both the Hubble observer (to collect network flow data) and `CF2CNP` into your Kubernetes cluster, so you can generate policies directly from observed traffic. You can find installation instructions and configuration options for the Helm chart in the [hubble-observer Helm chart repository](https://github.com/onzack/hubble-observer).
 
 ## Usage
@@ -59,6 +106,63 @@ cf2cnp generate --input <input-directory> --output <output-directory>
 cf2cnp generate --input ./inputfolder --output ./generated-policies
 ```
 
+### 1b. Merge into an existing policy (CLI)
+
+Evolve a policy that is already applied instead of regenerating it — every field of the existing document
+survives (`ingressDeny`, annotations, …), only rules that are not there yet are added, and running it
+twice changes nothing:
+
+```bash
+cf2cnp merge --existing policies/shop.yaml --input flows.json          # in place
+cf2cnp merge --existing policies/shop.yaml --input flows/ -o new.yaml  # to another file
+```
+
+### The DNS resolver rule (toFQDNs, --dns-visibility)
+
+A `toFQDNs` rule needs the pod's lookups to pass through Cilium's DNS proxy, which the egress rule to the cluster's DNS
+with `rules.dns` turns on. Where that DNS is differs by platform, and Cilium's DNS guide says so for OpenShift
+("match the namespace openshift-dns instead of kube-system, remove the match on k8s-app=kube-dns, and change the port to
+5353"). cf2cnp derives the rule from the observed DNS flows when the input has them — the pods the workload asked
+(CoreDNS by its `k8s-app: kube-dns` label, or `app.kubernetes.io/name: coredns` as the CoreDNS Helm chart labels it,
+NodeLocal DNSCache when a Local Redirect Policy sends the lookups there, OpenShift's DNS operator by its namespace), on the port it used — and takes a profile otherwise. The rule's protocol is `ANY`
+either way, as Cilium's own examples write it: a lookup whose UDP answer is truncated retries over TCP, and a
+UDP-only rule denies that retry under default-deny egress.
+
+```bash
+cf2cnp generate -i flows.ndjson -o out --dns-profile auto        # default: from the flows, else kubernetes
+cf2cnp generate -i flows.ndjson -o out --dns-profile kubernetes  # kube-system, k8s-app=kube-dns, 53/ANY
+cf2cnp generate -i flows.ndjson -o out --dns-profile openshift   # openshift-dns, 5353/ANY (no k8s-app label)
+cf2cnp generate -i flows.ndjson -o out --dns-resolver dns-system/app=coredns:5353/ANY   # any resolver
+```
+
+The API takes `?dnsProfile=` and `?dnsResolver=`; the page has a selector. `merge` takes the same flags. A deployed
+server takes them too (`serve --dns-profile` / `--dns-resolver`, env `CF2CNP_DNS_PROFILE` / `CF2CNP_DNS_RESOLVER`;
+chart values `dns.profile` / `dns.resolver`): the default a request gets when it names none — an OpenShift cluster
+sets `dns.profile: openshift` once, and the Grafana action needs no parameter.
+
+### External sources: fromCIDR
+
+An ingress flow whose source is outside the cluster (`reserved:world` — `reserved:world-ipv4` / `reserved:world-ipv6`
+on a dual-stack cluster — with an address: an egress-gateway IP, a load balancer's client, an office range) becomes
+`fromCIDR: [<address>/32]` (`/128` for IPv6), what the receiver actually saw; without an
+address it stays `fromEntities: [world]`. Cilium refuses a rule that mixes `fromEndpoints` and `fromCIDR`, so cf2cnp
+keeps them in separate rules (and `Sanitize` would say so).
+
+```bash
+cf2cnp merge --existing policies/shop.yaml --input flows/ -o new.yaml  # to another file
+```
+
+Every policy's `description` is written from its rules (0.6.2, 0.6.3): the subject, each peer the way the selector names it (with its namespace or cluster when they differ), the ports, and the L7 rules — `Allow ingress to shop/frontend in cf2cnp-lab27: from pos on TCP/80 (HTTP GET /, GET /checkout); from kiosk on TCP/80`.
+
+The merged file is the existing file plus the new rules — key order, comments, quoting and indentation are kept, so a pull
+request shows the rules that were added and nothing else (0.6.1; 0.6.0 re-serialised the whole document).
+
+```bash
+```
+
+The flows must produce exactly one policy, for the same target (namespace, name, endpointSelector) as the
+existing file; otherwise the command refuses.
+
 ### 2. HTTP Server Mode
 
 Start an HTTP server to generate policies via API:
@@ -69,9 +173,12 @@ cf2cnp serve --port 8080
 
 #### Server Flags
 
-| Flag      | Short | Type    | Description                | Default |
-|-----------|-------|---------|----------------------------|---------|
-| `--port`  | `-p`  | int     | Port number to listen on   | `8080`  |
+| Flag             | Short | Type   | Description                                                                                                                                                           | Default |
+|------------------|-------|--------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------|
+| `--port`         | `-p`  | int    | Port number to listen on                                                                                                                                              | `8080`  |
+| `--external-url` |       | string | Base URL clients reach the server at, used for `download_url` (env `CF2CNP_EXTERNAL_URL`). Empty: derived from the request and its `Forwarded` / `X-Forwarded-Proto` / `X-Forwarded-Host` headers | `""`    |
+| `--dns-profile`  |       | string | The DNS resolver profile a request gets when it omits `?dnsProfile=`: `auto`, `kubernetes`, `openshift` (env `CF2CNP_DNS_PROFILE`; a bad value stops the server at start) | `auto`  |
+| `--dns-resolver` |       | string | The DNS resolver a request gets when it omits `?dnsResolver=`, `<namespace>[/<label>=<value>]:<port>[/<protocol>]` (env `CF2CNP_DNS_RESOLVER`) | `""`    |
 
 ---
 
@@ -79,10 +186,15 @@ cf2cnp serve --port 8080
 
 | Method | Endpoint       | Description                                              | Request Body                  | Response            |
 |--------|---------------|-----------------------------------------------------------|-------------------------------|---------------------|
-| `POST` | `/generate`   | Generate policy from Hubble flow JSON                     | Hubble flow JSON              | CiliumNetworkPolicy |
+| `POST` | `/generate`   | Generate policies from Hubble flow JSON: one flow, a JSON array, or one flow per line. `?name=<name>` names the (single) resulting policy | Hubble flow JSON | CiliumNetworkPolicy YAML (one document per policy), or JSON when the request carries `Accept: application/json` or `X-Grafana-Action` |
+| `GET`  | `/download/{id}` | Download a policy generated by a JSON-mode request (cached for 10 minutes; `{id}` is the flow's UUID for a single flow) | _none_ | CiliumNetworkPolicy YAML as an attachment |
 | `GET`  | `/health`     | Health check for the service                              | _none_                        | Status message      |
 | `GET`  | `/`           | Access the integrated Web UI for testing and generation   | _none_                        | Web UI page         |
 
+The JSON answer is `{"download_url", "filename", "message", "flows", "policies", "yaml"}` — the YAML is in it, so a client
+need not follow the URL. `download_url` is built from `--external-url` when set, else from the request and the proxy
+headers a TLS-terminating ingress or gateway sets (`Forwarded: proto=…;host=…`, `X-Forwarded-Proto`, `X-Forwarded-Host`).
+
 #### Example: Using curl
 
 ```bash
@@ -91,6 +203,13 @@ curl -X POST http://localhost:8080/generate \
   -H "Content-Type: application/json" \
   -d @flow.json \
   -o policy.yaml
+
+# Many flows at once (the output of `hubble observe -o json`): one policy per workload, one rule per peer
+hubble observe --namespace shop --last 200 -o json > flows.json
+curl -X POST http://localhost:8080/generate --data-binary @flows.json -o policies.yaml
+
+# Name the resulting policy yourself
+curl -X POST "http://localhost:8080/generate?name=shop-from-pos" -d @flow.json -o policy.yaml
 ```
 
 #### Example: Using the Web UI
diff --git a/cmd/cf2cnp/main.go b/cmd/cf2cnp/main.go
index 69408c1..f3e70f7 100644
--- a/cmd/cf2cnp/main.go
+++ b/cmd/cf2cnp/main.go
@@ -3,25 +3,48 @@ package main
 import (
 	"fmt"
 	"os"
+	"path/filepath"
+	"strings"
+
+	"runtime/debug"
 
 	"github.com/hubble-policy-gen/internal/aggregator"
+	"github.com/hubble-policy-gen/internal/crd"
 	"github.com/hubble-policy-gen/internal/flow"
 	"github.com/hubble-policy-gen/internal/policy"
 	"github.com/hubble-policy-gen/internal/server"
 	"github.com/spf13/cobra"
 )
 
+// version is set at build time: -ldflags "-X main.version=<tag>" (the release workflow and the Dockerfile do)
+var version = "dev"
+
 var (
-	inputDir      string
-	outputDir     string
-	port          int
-	yoloNamespace string
+	inputDir       string
+	outputDir      string
+	port           int
+	externalURL    string
+	l7             bool
+	dnsVisibility  bool
+	existingFile   string
+	outputFile     string
+	yoloNamespace  string
+	allowedOrigins string
+	authToken      string
+	dnsProfile     string
+	dnsResolver    string
+	// serve has its own pair: cobra's StringVar sets the variable to the flag's default at registration, so a variable
+	// shared with generate/merge would be reset to "auto" by whichever command registers last (measured: the env
+	// default was lost)
+	serveDNSProfile  string
+	serveDNSResolver string
 )
 
 func main() {
 	rootCmd := &cobra.Command{
-		Use:   "cf2cnp",
-		Short: "CF2CNP - Cilium Flow to CiliumNetworkPolicy",
+		SilenceUsage: true, // a runtime error is not a usage error: print the message, not the flags
+		Use:          "cf2cnp",
+		Short:        "CF2CNP - Cilium Flow to CiliumNetworkPolicy",
 		Long: `CF2CNP (Cilium Flow to CiliumNetworkPolicy) is a CLI tool that reads Hubble flow JSON files
 and generates CiliumNetworkPolicy YAML files based on the observed traffic.
 
@@ -43,8 +66,12 @@ or use the 'serve' command to run as an HTTP server.`,
 		Long:  "Read Hubble flow JSON files from an input directory and generate CiliumNetworkPolicy YAML files.",
 		RunE:  runGenerate,
 	}
-	generateCmd.Flags().StringVarP(&inputDir, "input", "i", "", "Input directory containing Hubble flow JSON files (required)")
+	generateCmd.Flags().StringVarP(&inputDir, "input", "i", "", "A Hubble flow file (one flow, an array, or one per line) or a directory of such files (required)")
 	generateCmd.Flags().StringVarP(&outputDir, "output", "o", "", "Output directory for generated CiliumNetworkPolicy YAML files (required)")
+	generateCmd.Flags().BoolVar(&l7, "l7", false, "Emit layer-7 rules (HTTP method+path, DNS names) from the flows' l7 records; the port then goes through the proxy")
+	generateCmd.Flags().BoolVar(&dnsVisibility, "dns-visibility", false, "For world traffic without DNS names, add the kube-dns L7 DNS rule so the next flows carry names (toFQDNs on the next run)")
+	generateCmd.Flags().StringVar(&dnsProfile, "dns-profile", "auto", "The DNS resolver rule toFQDNs and --dns-visibility write: auto (from the observed DNS flows, else kubernetes), kubernetes (kube-system, k8s-app=kube-dns, 53/ANY), openshift (openshift-dns, 5353/ANY)")
+	generateCmd.Flags().StringVar(&dnsResolver, "dns-resolver", "", "The DNS resolver explicitly, over --dns-profile: <namespace>[/<label>=<value>]:<port>[/<protocol>], e.g. openshift-dns:5353/ANY (no protocol: ANY)")
 	generateCmd.MarkFlagRequired("input")
 	generateCmd.MarkFlagRequired("output")
 
@@ -56,12 +83,27 @@ or use the 'serve' command to run as an HTTP server.`,
 and returns CiliumNetworkPolicy YAML files.
 
 Endpoints:
-  POST /generate - Send flow JSON, receive policy YAML
-  GET  /health   - Health check endpoint
-  GET  /         - Web UI for testing`,
+  POST /generate      - Send flow JSON (one flow, a JSON array, or one flow per line), receive policy YAML;
+                        with Accept: application/json, receive {download_url, filename, yaml, flows, policies}.
+                        ?name=<policy name> names the (single) resulting policy.
+  GET  /download/{id} - Download a generated policy (cached 10 minutes)
+  GET  /health        - Health check endpoint
+  GET  /              - Web UI`,
 		RunE: runServe,
 	}
 	serveCmd.Flags().IntVarP(&port, "port", "p", 8080, "Port to listen on")
+	serveCmd.Flags().StringVar(&externalURL, "external-url", os.Getenv("CF2CNP_EXTERNAL_URL"),
+		"Base URL clients reach the server at (e.g. https://cf2cnp.example.com); used for download_url. "+
+			"Default: derived from the request and its Forwarded / X-Forwarded-Proto / X-Forwarded-Host headers. "+
+			"Env: CF2CNP_EXTERNAL_URL")
+	serveCmd.Flags().StringVar(&allowedOrigins, "allowed-origins", os.Getenv("CF2CNP_ALLOWED_ORIGINS"),
+		"Comma-separated origins allowed by CORS (e.g. https://grafana.example.com). Empty or * = any origin. Env: CF2CNP_ALLOWED_ORIGINS")
+	serveCmd.Flags().StringVar(&authToken, "auth-token", os.Getenv("CF2CNP_AUTH_TOKEN"),
+		"When set, /generate and /download require Authorization: Bearer <token>. Env: CF2CNP_AUTH_TOKEN (prefer the env)")
+	serveCmd.Flags().StringVar(&serveDNSProfile, "dns-profile", envOr("CF2CNP_DNS_PROFILE", "auto"),
+		"The DNS resolver profile a request gets when it omits ?dnsProfile= (see generate --dns-profile). Env: CF2CNP_DNS_PROFILE")
+	serveCmd.Flags().StringVar(&serveDNSResolver, "dns-resolver", os.Getenv("CF2CNP_DNS_RESOLVER"),
+		"The DNS resolver a request gets when it omits ?dnsResolver= (see generate --dns-resolver). Env: CF2CNP_DNS_RESOLVER")
 
 	// YOLO command (easter egg)
 	yoloCmd := &cobra.Command{
@@ -85,8 +127,50 @@ Example:
 
 	yoloCmd.AddCommand(yoloNsCmd)
 
+	// Merge command (E5): evolve an existing policy instead of regenerating it
+	mergeCmd := &cobra.Command{
+		Use:   "merge",
+		Short: "Merge rules generated from flows into an existing CiliumNetworkPolicy file",
+		Long: `Read flows (a file or a directory), generate the policy for their workload, and add its rules to an
+existing CiliumNetworkPolicy YAML — keeping every field of the existing document, adding only rules that
+are not already there. Running it twice changes nothing. The existing policy must be the same target
+(namespace, name, endpointSelector); otherwise the command refuses.`,
+		RunE: runMerge,
+	}
+	mergeCmd.Flags().StringVar(&existingFile, "existing", "", "Existing CiliumNetworkPolicy YAML (required)")
+	mergeCmd.Flags().StringVarP(&inputDir, "input", "i", "", "Flow file (one flow, an array, or one per line) or a directory of such files (required)")
+	mergeCmd.Flags().StringVarP(&outputFile, "output", "o", "", "Where to write the merged policy (default: --existing, in place)")
+	mergeCmd.Flags().BoolVar(&l7, "l7", false, "Emit layer-7 rules (HTTP method+path, DNS names) from the flows' l7 records, as generate --l7 does")
+	mergeCmd.Flags().StringVar(&dnsProfile, "dns-profile", "auto", "The DNS resolver rule (see generate --dns-profile)")
+	mergeCmd.Flags().StringVar(&dnsResolver, "dns-resolver", "", "The DNS resolver explicitly (see generate --dns-resolver)")
+	mergeCmd.MarkFlagRequired("existing")
+	mergeCmd.MarkFlagRequired("input")
+
+	// Version: the tool's own version and the policy spec it supports — the Cilium module its types come from
+	// and the CRD embedded from it. A release states both; a Cilium bump is a release.
+	versionCmd := &cobra.Command{
+		Use:   "version",
+		Short: "Print the version and the CiliumNetworkPolicy spec this build supports",
+		Run: func(cmd *cobra.Command, args []string) {
+			fmt.Printf("cf2cnp %s\n", version)
+			fmt.Printf("policy spec: CiliumNetworkPolicy cilium.io/v2 as of Cilium %s (types: github.com/cilium/cilium/pkg/policy/api %s; CRD embedded from the same module)\n", crd.Version(), ciliumModuleVersion())
+		},
+	}
+
+	// Validate: the checks the agent applies at admission (Cilium's Rule.Sanitize), on any policy file — generated
+	// or hand-written. The CRD schema itself is checked in CI against the embedded copy (see .github/workflows/ci.yml).
+	validateCmd := &cobra.Command{
+		Use:   "validate <file>...",
+		Short: "Validate CiliumNetworkPolicy YAML files with Cilium's own rule checks",
+		Args:  cobra.MinimumNArgs(1),
+		RunE:  runValidate,
+	}
+
 	rootCmd.AddCommand(generateCmd)
+	rootCmd.AddCommand(mergeCmd)
 	rootCmd.AddCommand(serveCmd)
+	rootCmd.AddCommand(validateCmd)
+	rootCmd.AddCommand(versionCmd)
 	rootCmd.AddCommand(yoloCmd)
 
 	if err := rootCmd.Execute(); err != nil {
@@ -109,15 +193,10 @@ func runYoloNs(cmd *cobra.Command, args []string) error {
 }
 
 func runGenerate(cmd *cobra.Command, args []string) error {
-	// Validate input directory exists
-	if _, err := os.Stat(inputDir); os.IsNotExist(err) {
-		return fmt.Errorf("input directory does not exist: %s", inputDir)
-	}
-
 	fmt.Printf("Reading flows from: %s\n", inputDir)
 
-	// Parse all flow files from input directory
-	flows, err := flow.ParseFlowsFromDirectory(inputDir)
+	// A file or a directory (0.7.0: the directory-only form left the policy-PR template's first run without a policy)
+	flows, err := readFlows(inputDir)
 	if err != nil {
 		return fmt.Errorf("failed to parse flows: %w", err)
 	}
@@ -135,6 +214,15 @@ func runGenerate(cmd *cobra.Command, args []string) error {
 
 	// Generate policies
 	generator := policy.NewGenerator(outputDir)
+	if err := applyDNSFlags(generator); err != nil {
+		return err
+	}
+	if l7 {
+		generator = generator.WithL7()
+	}
+	if dnsVisibility {
+		generator = generator.WithDNSVisibility()
+	}
 	if err := generator.GeneratePolicies(aggregatedFlows); err != nil {
 		return fmt.Errorf("failed to generate policies: %w", err)
 	}
@@ -144,6 +232,147 @@ func runGenerate(cmd *cobra.Command, args []string) error {
 }
 
 func runServe(cmd *cobra.Command, args []string) error {
-	srv := server.NewServer(port)
+	var origins []string
+	for _, o := range strings.Split(allowedOrigins, ",") {
+		if o = strings.TrimSpace(o); o != "" {
+			origins = append(origins, o)
+		}
+	}
+	// refuse a bad default at start, not per request
+	if _, err := policy.NewGenerator("").WithDNSProfile(serveDNSProfile); err != nil {
+		return err
+	}
+	if serveDNSResolver != "" {
+		if _, err := policy.ParseDNSResolver(serveDNSResolver); err != nil {
+			return err
+		}
+	}
+	srv := server.NewServerWithOptions(port, externalURL, server.Options{
+		AllowedOrigins: origins, AuthToken: authToken, DNSProfile: serveDNSProfile, DNSResolver: serveDNSResolver,
+	})
 	return srv.Start()
 }
+
+// envOr is an environment variable's value, or the default when it is unset or empty
+func envOr(name, def string) string {
+	if v := os.Getenv(name); v != "" {
+		return v
+	}
+	return def
+}
+
+// readFlows reads a flows file or every .json file of a directory
+func readFlows(path string) ([]*flow.ParsedFlow, error) {
+	info, err := os.Stat(path)
+	if err != nil {
+		return nil, err
+	}
+	if info.IsDir() {
+		return flow.ParseFlowsFromDirectory(path)
+	}
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return nil, err
+	}
+	return flow.ParseFlowsFromBytes(data)
+}
+
+func runMerge(cmd *cobra.Command, args []string) error {
+	existingBytes, err := os.ReadFile(existingFile)
+	if err != nil {
+		return err
+	}
+	flows, err := readFlows(inputDir)
+	if err != nil {
+		return err
+	}
+	generator := policy.NewGenerator("")
+	if err := applyDNSFlags(generator); err != nil {
+		return err
+	}
+	if l7 {
+		generator = generator.WithL7() // review ENH-003 (Codex, second pass): the policy-PR template passes --l7 to merge
+	}
+	policies, err := generator.BuildPolicies(aggregator.AggregateFlows(flows))
+	if err != nil {
+		return err
+	}
+	if len(policies) != 1 {
+		return fmt.Errorf("the flows produce %d policies; merge takes exactly one target — filter the flows to one workload", len(policies))
+	}
+	out, added, err := policy.MergeDocument(existingBytes, policies[0])
+	if err != nil {
+		return err
+	}
+	target := outputFile
+	if target == "" {
+		target = existingFile
+	}
+	if err := os.MkdirAll(filepath.Dir(target), 0o755); err != nil {
+		return err
+	}
+	if err := os.WriteFile(target, out, 0o644); err != nil {
+		return err
+	}
+	fmt.Printf("%d rule(s) added → %s\n", added, target)
+	return nil
+}
+
+// ciliumModuleVersion is the version of github.com/cilium/cilium linked into this binary (the supported spec)
+func ciliumModuleVersion() string {
+	if bi, ok := debug.ReadBuildInfo(); ok {
+		for _, d := range bi.Deps {
+			if d.Path == "github.com/cilium/cilium" {
+				return d.Version
+			}
+		}
+	}
+	return "unknown"
+}
+
+// runValidate parses every document of every file as a CiliumNetworkPolicy and runs policy.Validate on it; the
+// exit code is the number of documents refused, and each refusal carries the agent's own sentence.
+func runValidate(cmd *cobra.Command, args []string) error {
+	failed := 0
+	for _, path := range args {
+		b, err := os.ReadFile(path)
+		if err != nil {
+			return err
+		}
+		docs, err := policy.DecodePolicyDocuments(b)
+		if err != nil {
+			fmt.Printf("%s: cannot parse: %v\n", path, err)
+			failed++
+		}
+		for i, p := range docs {
+			if p.Kind != "CiliumNetworkPolicy" && p.Kind != "CiliumClusterwideNetworkPolicy" {
+				fmt.Printf("%s (document %d): kind %q is not a Cilium policy\n", path, i+1, p.Kind)
+				failed++
+				continue
+			}
+			if err := policy.Validate(p); err != nil {
+				fmt.Printf("%s (document %d): %v\n", path, i+1, err)
+				failed++
+				continue
+			}
+			fmt.Printf("%s (document %d): %s/%s ok\n", path, i+1, p.Metadata.Namespace, p.Metadata.Name)
+		}
+	}
+	if failed > 0 {
+		return fmt.Errorf("%d document(s) refused", failed)
+	}
+	return nil
+}
+
+// applyDNSFlags sets the DNS resolver options shared by generate and merge (0.7.0, dns.go)
+func applyDNSFlags(g *policy.Generator) error {
+	if _, err := g.WithDNSProfile(dnsProfile); err != nil {
+		return err
+	}
+	if dnsResolver != "" {
+		if _, err := g.WithDNSResolver(dnsResolver); err != nil {
+			return err
+		}
+	}
+	return nil
+}
diff --git a/docs/CRD-SPEC-FORENSICS.md b/docs/CRD-SPEC-FORENSICS.md
new file mode 100644
index 0000000..86960c7
--- /dev/null
+++ b/docs/CRD-SPEC-FORENSICS.md
@@ -0,0 +1,240 @@
+# Forensic analysis — cf2cnp's policy types against the CiliumNetworkPolicy spec of Cilium 1.20.x
+
+Date: 2026-09-13. Branch `enh/E12-cilium-policy-api`. Every number below was measured on this machine
+(Go 1.27.1, darwin/amd64); the probe programs are under `hack/cilium-api-probe/` so the measurements can be repeated.
+
+## 1. The question
+
+cf2cnp writes CiliumNetworkPolicies from hand-written Go types (`internal/policy/types.go`, 20 fields). Cilium's
+CRD for `cilium.io/v2` `CiliumNetworkPolicy` at v1.20.1 has **291 schema paths** under `spec`
+(`pkg/k8s/apis/cilium.io/client/crds/v2/ciliumnetworkpolicies.yaml`, 398 532 bytes). Each field cf2cnp does not
+model is something it cannot write, cannot preserve on a round trip, and cannot say it supports. The operator's
+finding that started this: a world **source** becomes `fromEntities` because there is no `fromCIDR`, while a
+world **destination** becomes `toCIDR`. The question is not "add `fromCIDR`" but **how cf2cnp consumes the spec so
+that a release can state which Cilium spec it supports, and the next field is not a hand-written struct**.
+
+## 2. What cf2cnp models today, field by field, against the CRD
+
+Legend for the last column — how the field could be filled: **flows** = derivable from what Hubble reports today;
+**intent** = an operator option, never observed; **pass-through** = only preserved by `merge` (the YAML node edit),
+never generated; **n/a** = not applicable to a namespaced policy.
+
+### 2.1 `spec` — top level
+
+| CRD field | cf2cnp today | Source of a value |
+|---|---|---|
+| `description` | yes (0.6.2: written from the rules) | generated |
+| `endpointSelector.matchLabels` | yes | flows |
+| `endpointSelector.matchExpressions` | **no** | pass-through; intent |
+| `ingress[]` | partial (§2.2) | flows |
+| `egress[]` | partial (§2.3) | flows |
+| `ingressDeny[]`, `egressDeny[]` | **no** | intent — the natural home of `exclude=`: "the stranger is denied", not merely unlisted |
+| `enableDefaultDeny.{ingress,egress}` | **no** | intent — would replace the separate default-deny policy every demo applies by hand |
+| `labels[]` (Cilium's policy labels, not metadata labels) | **no** | pass-through |
+| `log.value` | **no** | pass-through; intent |
+| `nodeSelector` | **no** | n/a for CNP; CCNP for host flows (§6) |
+
+### 2.2 An ingress rule (`spec.ingress[]`; `ingressDeny[]` has the same peers and ports, no L7)
+
+| CRD field | cf2cnp today | Source of a value |
+|---|---|---|
+| `fromEndpoints[].matchLabels` | yes (namespace and cluster labels included) | flows |
+| `fromEndpoints[].matchExpressions` | **no** | pass-through |
+| `fromEntities[]` | yes (`host`+`remote-node` paired; any other entity, `world` included, written as itself — §2.5) | flows |
+| `fromCIDR[]` | **no** — the finding (0.7.0: yes) | **flows**: a `reserved:world` source with an address (an egress-gateway IP, a load-balancer client, an office range) |
+| `fromCIDRSet[].{cidr,except,cidrGroupRef,cidrGroupSelector}` | **no** | intent (`except`), pass-through |
+| `fromRequires[]` | **no** | intent |
+| `fromGroups[].aws` | **no** | n/a here |
+| `fromNodes[]` | **no** | flows (`reserved:host` / `remote-node` when node selectors are enabled), later |
+| `icmps[].fields[].{type,family}` | **no** | flows: Hubble reports `l4.ICMPv4` / `ICMPv6` type and code |
+| `toPorts[].ports[].port` | yes | flows |
+| `toPorts[].ports[].protocol` | yes | flows |
+| `toPorts[].ports[].endPort` | **no** | intent |
+| `toPorts[].rules.http[].{method,path}` | yes (0.6.0) | flows |
+| `toPorts[].rules.http[].{host,headers,headerMatches}` | **no** | flows (the URL's host, the request headers) — `host` deliberately not narrowed today (review) |
+| `toPorts[].rules.dns[]` | yes (0.6.0) | flows |
+| `toPorts[].rules.kafka[]`, `l7proto`, `l7[]` | **no** | flows if Kafka visibility is on; not in this PoC |
+| `toPorts[].{terminatingTLS,originatingTLS,serverNames,listener}` | **no** | intent, pass-through |
+| `authentication.mode` | **no** | intent (mutual authentication is deprecated in 1.20) |
+
+### 2.3 An egress rule (`spec.egress[]`)
+
+| CRD field | cf2cnp today | Source of a value |
+|---|---|---|
+| `toEndpoints[]` | yes | flows |
+| `toEntities[]` | yes | flows |
+| `toCIDR[]` | yes | flows |
+| `toCIDRSet[]` | **no** | intent |
+| `toFQDNs[].{matchName,matchPattern}` | yes | flows (with the DNS proxy) |
+| `toServices[].{k8sService,k8sServiceSelector}` | **no** | intent; Hubble flows are post-translation, the Service name is not on the flow |
+| `toRequires[]`, `toGroups[]`, `toNodes[]` | **no** | intent / later |
+| `icmps[]` | **no** | flows |
+| `toPorts[]` | as ingress | flows |
+| `authentication` | **no** | intent |
+
+### 2.4 The count
+
+Of the 291 schema paths, cf2cnp's types cover **20**. Of the rest, the ones a flow can fill are `fromCIDR`,
+`icmps`, `fromNodes`/`toNodes`, HTTP `host`/`headers`, Kafka; the ones an operator's intent fills are the deny
+lists, `enableDefaultDeny`, CIDR sets with `except`, `endPort`, `toServices`, TLS/SNI, `authentication`; the rest
+must at least survive a `merge` — which the 0.6.1 node-based merge already guarantees for any field it does not
+model, but which the *generator* cannot emit.
+
+### 2.5 Two mis-modellings found while reading the parser
+
+- **Retracted on implementation (2026-09-13):** an earlier revision of this note said a world source "produces no
+  peer at all". Re-reading `generateEntityIngressRules` with the code open: its `else` branch writes
+  `fromEntities: [<entity>]` for every entity that is not `host`/`remote-node`, so a world source produced
+  `fromEntities: [world]` — any external address, wider than the one address observed, but not an empty peer list.
+  The finding stands as first stated in the plan (`fromEntities` where `fromCIDR` was wanted); the "no peer" reading
+  was wrong and is withdrawn.
+- `Port.Protocol` is written as observed (`TCP`/`UDP`); nothing upper-cases a lower-case value. The CRD's enum is
+  upper-case only (measured below: `"tcp"` is rejected by the schema).
+- **Found by the review (2026-09-13, Cursor and Codex independently):** the parser knew one world label,
+  `reserved:world`. On a dual-stack Cilium (both address families enabled) an address outside the cluster carries
+  `reserved:world-ipv4` or `reserved:world-ipv6` instead — `pkg/labels/cidr.go` `getWorldLabel`, identities 9 and 10
+  (`cilium-dbg identity list` on the PoC's IPv4-only cluster lists all three as reserved) — and all three are the
+  `world` entity of a policy (`NumericIdentity.IsWorld`). 0.6.x and the first 0.7.0 head parsed such a peer as
+  neither world nor entity, so an egress to it produced no `toCIDR` and no `toEntities`. Fixed on the review:
+  `worldLabels` in the parser, fixtures `egress-pos-to-world-ipv4.json`, `ingress-world-ipv4-cidr-to-receiver.json`.
+
+## 3. Can cf2cnp consume Cilium's own spec? Measured
+
+Three probe programs, `hack/cilium-api-probe/`, built against `github.com/cilium/cilium@v1.20.1`.
+
+| Probe | Imports | `go get` + build | Binary | Modules | `replace` lines needed |
+|---|---|---|---|---|---|
+| cf2cnp 0.6.3 today | cobra, yaml.v3 | — | 11.6 MB | 9 | 0 |
+| 1 — `pkg/policy/api` only, rendered with `sigs.k8s.io/yaml` | policy/api, sigs yaml | 16 s get, 19 s cold build | 17.6 MB | 309 | **0** |
+| 2 — plus `pkg/k8s/apis/cilium.io/v2` (the typed object) and `…/client` (the embedded CRDs) | + k8s client machinery | 85 s build | **93.6 MB** | ~600 | 0 |
+| 3 — `pkg/policy/api` + `k8s.io/apimachinery` `ObjectMeta` + the CRD **file** embedded with `go:embed` | policy/api, apimachinery meta, sigs yaml | 4 s incremental build | 18.1 MB | 310 | 0 |
+
+Facts that fell out of the probes:
+
+1. **Zero `replace` directives.** `github.com/cilium/cilium v1.20.1` resolves as a plain dependency; the module's Go
+   requirement is **1.26.0** (cf2cnp's `go.mod` says 1.25.5 and must move to 1.26).
+2. **Rendering with `sigs.k8s.io/yaml`** (JSON tags → YAML) gives the CRD's own shapes — `fromCIDR`, `toCIDRSet`,
+   `enableDefaultDeny`, everything — with keys in alphabetical order, which is also `kubectl get -o yaml`'s order.
+   The document `apiVersion, kind, metadata, spec` stays in that order (alphabetical); within `metadata`, `labels`
+   comes before `name`. The 0.6.1 `merge` edits YAML nodes and does not care.
+3. **`api.Rule.Sanitize()` is Cilium's own admission-time validation**, available as a library call. On the probes it
+   caught a semantic rule no schema expresses: *"combining FromEndpoints and FromCIDR is not supported yet"* — a
+   generated rule that mixed a pod peer and a CIDR peer would be refused by the agent. **But `Sanitize` mutates:** it
+   rewrote selector keys with Cilium's internal source prefix (`any:app.kubernetes.io/name`), upper-cased the
+   protocol, and filled `enableDefaultDeny` on the rule. It must run on a **`DeepCopy()`** and its errors reported;
+   the original is what gets rendered. Measured on probe 2 (rendered after Sanitize: the prefix and the filled
+   fields appeared) and probe 3 (rendered the original: clean).
+4. **The CRD schema and `Sanitize` catch different things.** The schema (offline, `kubectl-validate --local-crds`
+   with the embedded file) rejected `protocol: tcp` ("supported values: TCP, UDP, SCTP, VRRP, IGMP, GRE, IPIP, IPV6,
+   ESP, AH, ANY") and accepted the `fromEndpoints`+`fromCIDR` rule; `Sanitize` accepted the lower-case protocol (it
+   fixes it) and rejected the mixed rule. A release needs **both** layers.
+5. **The CRD YAML is embedded in the module** (`pkg/k8s/apis/cilium.io/client/register.go`, `//go:embed
+   crds/v2/ciliumnetworkpolicies.yaml`, `GetPregeneratedCRD`), but importing that package costs 75 MB of client
+   machinery. Copying the **file** out of the module cache at `go generate` time and embedding it in cf2cnp costs
+   0.5 MB and stays byte-identical to the module's, which CI can assert (`cmp` against
+   `$(go list -m -f '{{.Dir}}' github.com/cilium/cilium)/pkg/k8s/apis/cilium.io/client/crds/v2/…`).
+6. **The typed object `v2.CiliumNetworkPolicy` renders `status: {}`** (no `omitempty`); an envelope of
+   `metav1.TypeMeta` + `metav1.ObjectMeta` + `*api.Rule` (probe 3) renders clean and costs nothing new — apimachinery
+   is already in `policy/api`'s graph.
+7. **The supported spec version is a build fact:** `debug.ReadBuildInfo()` yields `github.com/cilium/cilium v1.20.1`;
+   `cf2cnp version` can print "CiliumNetworkPolicy `cilium.io/v2` as of Cilium v1.20.1", and the embedded CRD file's
+   `metadata.annotations` / the module version in `go.mod` are the same number.
+
+## 4. The design
+
+**Replace `internal/policy/types.go` with Cilium's types.** `api.Rule`, `api.IngressRule`, `api.EgressRule`,
+`api.PortRule`, `api.L7Rules`, `api.EndpointSelector` (built as `EndpointSelector{LabelSelector: &slimv1.LabelSelector{MatchLabels: …}}`,
+never through the `NewES…` constructors, which prefix). One envelope struct in cf2cnp:
+
+```go
+type Policy struct {
+    metav1.TypeMeta   `json:",inline"`
+    metav1.ObjectMeta `json:"metadata"`
+    Spec              *api.Rule `json:"spec"`
+}
+```
+
+**Two validation layers, both in the binary and in CI.** `Sanitize()` on a deep copy before anything is written or
+served (an error is a 400 with Cilium's own message on `/generate`, an exit 1 on `generate`/`merge`); the CRD
+schema, embedded from the module's file, checked in CI on every fixture and on the demos' policies with
+`kubectl-validate --local-crds` (the E10 template's mechanism). The generator itself normalises what `Sanitize`
+would only fix on the copy (protocol upper-case) so the rendered document is what the agent would accept.
+
+**Rendering — researched.** `sigs.k8s.io/yaml` marshals Kubernetes types through JSON and orders keys alphabetically
+(it "does not respect original mapping key order"); tools that write Kubernetes YAML for humans own a canonical order
+instead — kustomize/kpt's `kyaml` formatter orders "commonly encountered Resource fields" by a precedence list and
+sorts the rest lexicographically. cf2cnp does the same: marshal with `sigs.k8s.io/yaml`, load the JSON into a
+`yaml.v3` node tree, re-order by a cf2cnp-owned precedence table (`apiVersion, kind, metadata{name, namespace, labels,
+annotations}, spec{description, endpointSelector, nodeSelector, enableDefaultDeny, ingress, egress, ingressDeny,
+egressDeny, labels, log}`; a rule's `from*`/`to*` before `toPorts`, `icmps`, `authentication`; a port's `port, endPort,
+protocol`, then `rules`; unknown keys lexicographically), add the comment lines as node comments, encode with a 2-space
+indent. Today's layout is preserved exactly, so the golden tests demand byte identity; `merge` is unchanged (nodes). Golden files: every policy under the PoC's
+`demos/2[6-9]*/policies` and `demos/3*/policies` regenerated from its saved flows and diffed — the only accepted
+differences are key order within `metadata` and the fields the new generator adds.
+
+**The supported spec, announced.** `cf2cnp version` prints the tool's version and the Cilium API version; the
+README carries a table "cf2cnp release → Cilium spec"; the chart's `appVersion` note names it; a Renovate/Dependabot
+rule bumps `github.com/cilium/cilium` and CI re-embeds the CRD and re-runs the golden tests, so a Cilium release
+becomes a cf2cnp release with a known diff.
+
+**What becomes generatable, in order of value** (each its own branch, tests, and a review claim):
+
+| Item | From | Notes |
+|---|---|---|
+| `fromCIDR` for a world source (the finding) | flows | one `/32` per observed source address; a `toCIDR`-style comment; never mixed with `fromEndpoints` in one rule (Cilium refuses it — the rule per peer class) |
+| `enableDefaultDeny` as an option | intent | `--default-deny` writes `enableDefaultDeny: {ingress: true}` on ingress policies: the demos' separate default-deny object disappears |
+| `ingressDeny` for excluded peers as an option | intent | `--deny-excluded`: an `exclude=` peer becomes a deny rule instead of an omission |
+| `icmps` | flows | Hubble `l4.ICMPv4`/`ICMPv6`; `ping` between services is a rule today only by accident |
+| HTTP `host` / `headers` as options | flows | off by default (the review's reasoning stands) |
+| `fromNodes`/`toNodes`, CCNP with `nodeSelector` | flows | host-network callers; a second output kind |
+| `toCIDRSet` with `except`, `endPort`, `toServices`, TLS/SNI, `authentication`, Kafka | intent / later | modelled by the types now, written by hand or preserved by `merge` |
+
+## 5. Risks and their measurements
+
+- **Dependency weight.** 9 → 310 modules, 11.6 → 18.1 MB. Measured; acceptable for a CLI and a small server. The
+  k8s **client** packages are the line not to cross (93.6 MB); the CRD file is copied, not imported.
+- **Go version.** The module needs Go 1.26; the Dockerfile and `binary-release.yml` (`go-version-file: go.mod`)
+  follow `go.mod`.
+- **Upstream cadence.** Cilium tags every few weeks; a cf2cnp release states the version it was built against, and
+  a newer agent accepts an older spec (CRDs are versioned `v2` and only add fields).
+- **Behaviour changes on the swap.** Caught by the golden tests over 40+ real policies from the demos; the review
+  brief for E12 lists them as claims.
+
+## 6. The DNS resolver rule — derived from flows, with platform profiles
+
+Cilium's DNS-policy guide gives the resolver rule for Kubernetes and adds, verbatim: "OpenShift users will need to
+modify the policies to match the namespace `openshift-dns` (instead of `kube-system`), remove the match on the
+`k8s:k8s-app=kube-dns` label, and change the port to 5353." OpenShift's DNS operator runs CoreDNS as the DaemonSet
+`dns-default` in `openshift-dns` listening on **5353** (`dns`/UDP, `dns-tcp`/TCP) behind the Service `dns-default:53`,
+with the operator's own labels. cf2cnp hard-codes one rule (`kube-system`, `k8s-app: kube-dns`, `53/UDP`) in
+`dnsVisibilityRule()` for both the `toFQDNs` path and `--dns-visibility`; on OpenShift that rule selects nothing
+and the FQDN policy cuts the pod off from DNS.
+
+Design: the resolver rule is **derived from the observed DNS flows** when the input has them (the destination pod's
+namespace and identifying labels, the destination port as Hubble reports it; the protocol `ANY` — see the review
+corrections below, which changed this from "as observed"), and from a **profile** otherwise — `--dns-profile auto` (default: from the flows, else
+`kubernetes`), `kubernetes` (the docs' rule, `53/ANY`), `openshift` (`openshift-dns`, no `k8s-app` label, `5353/ANY`),
+and `--dns-resolver <namespace>[/<label>=<value>]:<port>` for any other resolver. The same value is used by
+`?dnsProfile=` on the API and a selector on the page. The description names what was written. Fixtures: the
+Kubernetes DNS flow from the PoC's demo 31 and a synthesised OpenShift flow (destination in `openshift-dns`, labels
+`dns.operator.openshift.io/daemonset-dns=default`, port 5353).
+
+Review corrections (2026-09-13, `docs/REVIEW_ENH-003.md` in the PoC): the first head wrote the `kubernetes` profile
+as `53/UDP` where this section says `53/ANY` — the code now follows the design and Cilium's `dns-matchname.yaml`; a
+resolver derived from the flows keeps the protocols observed, so the goldens (all derived from UDP lookups) did not
+move — and then Codex refuted "as observed" for the derived rule too: a UDP-only rule denies the TCP retry of a
+truncated answer, a failure that appears only on the day a large answer comes; the derived rule is `ANY` as well,
+and the two goldens whose resolver rule 0.6.3 wrote as `UDP` were regenerated (`internal/testdata/golden/README.md`).
+The derivation took every `kube-system` peer on 53/5353 as the resolver; it now takes CoreDNS / kube-dns and
+NodeLocal DNSCache by their identifying label — `k8s-app`, or `app.kubernetes.io/name` / `app` as the CoreDNS Helm
+chart labels them, whichever the parser kept (second pass: `extractLabels` drops `k8s-app` beside the
+`app.kubernetes.io/*` labels, so the first fix missed that chart) (under a Local Redirect Policy the lookups reach the NodeLocal pod, and
+the rule must name what the lookups reach) and OpenShift's operator by its namespace, nothing else. And `serve` takes
+the same two flags as a cluster-wide default (`dns.profile` / `dns.resolver` in the chart, which also drive the
+chart's own policy's DNS egress rule), because a Grafana action on OpenShift sends no `?dnsProfile=`.
+
+## 7. Out of scope, noted
+
+CiliumClusterwideNetworkPolicy shares the rule types (`api.Rule` with `nodeSelector`); emitting it for
+`reserved:host` flows is a later item. `CiliumCIDRGroup` references (`cidrGroupRef`) and cloud `toGroups` are not
+observable here. Kafka L7 needs a Kafka workload.
diff --git a/go.mod b/go.mod
index c388c12..8045967 100644
--- a/go.mod
+++ b/go.mod
@@ -1,13 +1,83 @@
 module github.com/hubble-policy-gen
 
-go 1.25.5
+go 1.26.0
 
 require (
+	github.com/cilium/cilium v1.20.1
 	github.com/spf13/cobra v1.10.2
 	gopkg.in/yaml.v3 v3.0.1
+	k8s.io/apimachinery v0.37.0
+	sigs.k8s.io/yaml v1.6.0
 )
 
 require (
+	github.com/blang/semver/v4 v4.0.0 // indirect
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
+	github.com/cilium/ebpf v0.22.0 // indirect
+	github.com/cilium/hive v1.0.4 // indirect
+	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
+	github.com/fsnotify/fsnotify v1.10.1 // indirect
+	github.com/fxamacker/cbor/v2 v2.9.1 // indirect
+	github.com/go-logr/logr v1.4.3 // indirect
+	github.com/go-openapi/analysis v0.25.2 // indirect
+	github.com/go-openapi/errors v0.22.8 // indirect
+	github.com/go-openapi/jsonpointer v1.0.0 // indirect
+	github.com/go-openapi/jsonreference v1.0.0 // indirect
+	github.com/go-openapi/loads v0.24.0 // indirect
+	github.com/go-openapi/spec v0.22.6 // indirect
+	github.com/go-openapi/strfmt v0.26.3 // indirect
+	github.com/go-openapi/swag/conv v0.27.1 // indirect
+	github.com/go-openapi/swag/fileutils v0.27.1 // indirect
+	github.com/go-openapi/swag/jsonname v0.26.1 // indirect
+	github.com/go-openapi/swag/jsonutils v0.27.1 // indirect
+	github.com/go-openapi/swag/loading v0.27.1 // indirect
+	github.com/go-openapi/swag/mangling v0.27.1 // indirect
+	github.com/go-openapi/swag/pools v0.27.1 // indirect
+	github.com/go-openapi/swag/stringutils v0.27.1 // indirect
+	github.com/go-openapi/swag/typeutils v0.27.1 // indirect
+	github.com/go-openapi/swag/yamlutils v0.27.1 // indirect
+	github.com/go-openapi/validate v0.26.0 // indirect
+	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
+	github.com/google/go-cmp v0.7.0 // indirect
+	github.com/google/uuid v1.6.0 // indirect
+	github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
-	github.com/spf13/pflag v1.0.9 // indirect
+	github.com/json-iterator/go v1.1.12 // indirect
+	github.com/mackerelio/go-osstat v0.2.7 // indirect
+	github.com/mitchellh/mapstructure v1.5.0 // indirect
+	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
+	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
+	github.com/oklog/ulid/v2 v2.1.1 // indirect
+	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
+	github.com/petermattis/goid v0.0.0-20250813065127-a731cc31b4fe // indirect
+	github.com/sagikazarmark/locafero v0.11.0 // indirect
+	github.com/sasha-s/go-deadlock v0.3.9 // indirect
+	github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8 // indirect
+	github.com/spf13/afero v1.15.0 // indirect
+	github.com/spf13/cast v1.10.0 // indirect
+	github.com/spf13/pflag v1.0.10 // indirect
+	github.com/spf13/viper v1.21.0 // indirect
+	github.com/subosito/gotenv v1.6.0 // indirect
+	github.com/vishvananda/netlink v1.3.2-0.20260624190457-bab08b3566fc // indirect
+	github.com/vishvananda/netns v0.0.5 // indirect
+	github.com/x448/float16 v0.8.4 // indirect
+	go.uber.org/dig v1.17.1 // indirect
+	go.yaml.in/yaml/v2 v2.4.4 // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
+	go4.org/netipx v0.0.0-20231129151722-fdeea329fbba // indirect
+	golang.org/x/net v0.57.0 // indirect
+	golang.org/x/sync v0.22.0 // indirect
+	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/term v0.45.0 // indirect
+	golang.org/x/text v0.40.0 // indirect
+	golang.org/x/time v0.15.0 // indirect
+	golang.org/x/tools v0.47.0 // indirect
+	gopkg.in/inf.v0 v0.9.1 // indirect
+	k8s.io/client-go v0.36.3 // indirect
+	k8s.io/klog/v2 v2.140.0 // indirect
+	k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad // indirect
+	k8s.io/utils v0.0.0-20260707023825-cf1189d6abe3 // indirect
+	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
+	sigs.k8s.io/randfill v1.0.0 // indirect
+	sigs.k8s.io/structured-merge-diff/v6 v6.4.2 // indirect
 )
diff --git a/go.sum b/go.sum
index 47edb24..e74691d 100644
--- a/go.sum
+++ b/go.sum
@@ -1,13 +1,184 @@
+github.com/blang/semver/v4 v4.0.0 h1:1PFHFE6yCCTv8C1TeyNNarDzntLi7wMI5i/pzqYIsAM=
+github.com/blang/semver/v4 v4.0.0/go.mod h1:IbckMUScFkM3pff0VJDNKRiT6TG/YpiHIM2yvyW5YoQ=
+github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
+github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/cilium/cilium v1.20.1 h1:omXYGsC9nvDEdTXZpOVa3VlpB1QTok9OHDPSQbnPoJg=
+github.com/cilium/cilium v1.20.1/go.mod h1:b3q9uyjW+L8rGh0KlCSdNyiyE2kpSE2fa2A5cWqXhCo=
+github.com/cilium/ebpf v0.22.0 h1:v2ktp0roffpMOj2MMf3idtCQZOsAoC4BJbAJN+ke2bY=
+github.com/cilium/ebpf v0.22.0/go.mod h1:CDzZbe2hC5JjlDC+CY3KFCzlYwN4gbxppYM+Z10bQt4=
+github.com/cilium/hive v1.0.4 h1:Sw4loPv25qMnnYSA65+ybpvZMJHQuUMjQ9jcwoPmP7U=
+github.com/cilium/hive v1.0.4/go.mod h1:NY1wD3TQ4sya7zkhkB4QX6eIZ4FjwZPG+lnUB2IH5Xs=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
+github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
+github.com/fsnotify/fsnotify v1.10.1 h1:b0/UzAf9yR5rhf3RPm9gf3ehBPpf0oZKIjtpKrx59Ho=
+github.com/fsnotify/fsnotify v1.10.1/go.mod h1:TLheqan6HD6GBK6PrDWyDPBaEV8LspOxvPSjC+bVfgo=
+github.com/fxamacker/cbor/v2 v2.9.1 h1:2rWm8B193Ll4VdjsJY28jxs70IdDsHRWgQYAI80+rMQ=
+github.com/fxamacker/cbor/v2 v2.9.1/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
+github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
+github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-openapi/analysis v0.25.2 h1:I0vy4n3alz+DHTiN1PRhCb7QZxkK6g5YmswZKv2TKuw=
+github.com/go-openapi/analysis v0.25.2/go.mod h1:Uhs1t/2XR10EnwONYILGEzw8gcfGIG5Xk5K2AxnhqDo=
+github.com/go-openapi/errors v0.22.8 h1:oP7sW7TWc3wFFjrzzj0nI83H2qMBkNjNfSd+XRejk/I=
+github.com/go-openapi/errors v0.22.8/go.mod h1:BuUoHcYrU6E7V9gfj1I5wLQqgtIHnup/alXZ8KdgQ0w=
+github.com/go-openapi/jsonpointer v1.0.0 h1:kR9tHqY0CtZaOPVFm622dPVNhrvYpwr4uCxgL3h1H8s=
+github.com/go-openapi/jsonpointer v1.0.0/go.mod h1:Z3rw7dWu1p9IgitXCFamSlA5lmDiklEB6vkaxcNZW5Y=
+github.com/go-openapi/jsonreference v1.0.0 h1:jlmTr6torcd1YgDQvSfNmRtKzYDO4FGBkrAdlAVWnpY=
+github.com/go-openapi/jsonreference v1.0.0/go.mod h1:jtwdyGbJk0Xhe5Y+rwtglQP6Sb1WZST4rT32LWB+sv0=
+github.com/go-openapi/loads v0.24.0 h1:4LLorXRPTzIN9V6ngMUZbAscsBOUBk3Oa8cClu/bFrQ=
+github.com/go-openapi/loads v0.24.0/go.mod h1:xQMgX+hw5xRAhGrcDXxeMw78IFqUpIzhleu3HqPhyF4=
+github.com/go-openapi/spec v0.22.6 h1:Tyy1pLaNCM8GBCFLoGYLonjJi6zykqyLCjXLc19ZPic=
+github.com/go-openapi/spec v0.22.6/go.mod h1:HZvTHat+iH0PALQRWhrqIHtU/PEqxqd89fu0MxGlMeM=
+github.com/go-openapi/strfmt v0.26.3 h1:rzmslHarJgBbf2qfGge+X3htclQfmXqBZMm0Too0HhU=
+github.com/go-openapi/strfmt v0.26.3/go.mod h1:a5nsUw0oRpQzZeOwx8bi6cKbzFZslpbCKt1LEot+KnQ=
+github.com/go-openapi/swag v0.27.1 h1:VotvOLWW8q/EAxB0YdsBBGC8XYyeL1YwBj2ungAGPNg=
+github.com/go-openapi/swag/conv v0.27.1 h1:8wi9ZG+olmY1wXphl93EWniPtbSPkXM/feH7FgjsvrU=
+github.com/go-openapi/swag/conv v0.27.1/go.mod h1:QbqMivkpKhC3g1B1GGGOJ6ANewI3S62dbzYu3Duowqs=
+github.com/go-openapi/swag/fileutils v0.27.1 h1:QQqBSoi5mW4XpU85nS0mLcA+zAE6vLzrb0QkmLKf9oM=
+github.com/go-openapi/swag/fileutils v0.27.1/go.mod h1:VvJFZLTZS0AI854gEQz5tk7dBESdLjiNUMSZ/th2ry8=
+github.com/go-openapi/swag/jsonname v0.26.1 h1:VReupaV6WxlAsCn0e4DUfgV6bPmINnPpyJDLqSfNPcE=
+github.com/go-openapi/swag/jsonname v0.26.1/go.mod h1:OvdW6BoWoj33pTfi7x9vFrgmT+fk7aw0BRwvCE0YOuc=
+github.com/go-openapi/swag/jsonutils v0.27.1 h1:SVgK3i4USzCU5mibOOS/l4ea2h9UQXy7J7RNLTjuXjU=
+github.com/go-openapi/swag/jsonutils v0.27.1/go.mod h1:tdlEpZqdcQ17uj6J4YdK9vd8It5qWMwjWXOs0tjpRlk=
+github.com/go-openapi/swag/jsonutils/fixtures_test v0.27.1 h1:mJu3COL9WEaZVp/Kf2PRMi7tPszPEJfSr/OO75ynCs8=
+github.com/go-openapi/swag/jsonutils/fixtures_test v0.27.1/go.mod h1:mofwUWx70wvskwESqRJ//k/9kURmCgyJl5m5Ppoh5kY=
+github.com/go-openapi/swag/loading v0.27.1 h1:/DxUgDXKbBX4bcn7r9uEXfJyzN5XpiJmZplzQTjrRCY=
+github.com/go-openapi/swag/loading v0.27.1/go.mod h1:jvGh3iA2+zyUUycB5fgJWzeHnhrpvGnJJM0RVE9ZShE=
+github.com/go-openapi/swag/mangling v0.27.1 h1:yC9D0HyUE8gbP+BfmGx9+AA89ikwZTMjESK3OnnoaqA=
+github.com/go-openapi/swag/mangling v0.27.1/go.mod h1:jtBE2+V+3pILxOR7Vgce+Cwp6A2PgZbvVqfNntbVs0w=
+github.com/go-openapi/swag/pools v0.27.1 h1:9LeadcMyb2GJCbXX5hVQDbZ2Lq9TL4dCs/nx1j5DO0E=
+github.com/go-openapi/swag/pools v0.27.1/go.mod h1:kVQefhSK5RWuRe7BXsL8htgBPAMpN7HDGpGEknqugeE=
+github.com/go-openapi/swag/stringutils v0.27.1 h1:ZXePZ0r2p1qSjo8tD3Un4vFj8+FqlCkczxDrJIhYUp8=
+github.com/go-openapi/swag/stringutils v0.27.1/go.mod h1:lzRN95CxXmA03XcDWHLOb6nOMcxCqR5rGY0lOgsfRoM=
+github.com/go-openapi/swag/typeutils v0.27.1 h1:KSTdFlfnse4r6dP9IrEnwMldjE+zs71UeEB3//PtVXc=
+github.com/go-openapi/swag/typeutils v0.27.1/go.mod h1:Srm0xFNRZ1Y+vCxJclo5qzx8aj+1pAKda/YfFPrG0dQ=
+github.com/go-openapi/swag/yamlutils v0.27.1 h1:ftxv6xvXb1E3zohUc+okZ9nSqNb9StQX/FXnKZ98sQA=
+github.com/go-openapi/swag/yamlutils v0.27.1/go.mod h1:bnxFIB1qewGRiZHypXGZ3fNgf13/0HfRgnS/iZBDrOo=
+github.com/go-openapi/testify/enable/yaml/v2 v2.6.0 h1:gGHwAJ0R/5jU8BEGDbfRNR3hL68dAVi84WuOApp29B0=
+github.com/go-openapi/testify/enable/yaml/v2 v2.6.0/go.mod h1:tY+St1SGq4NFl0QIqdTY4aEdbChAHxhyB77XQi9iJCo=
+github.com/go-openapi/testify/v2 v2.6.0 h1:5PKH2HE7YJ/LuRPQGvSxBRlFXNQhSetBLlGAgUEu3ug=
+github.com/go-openapi/testify/v2 v2.6.0/go.mod h1:SgsVHtfooshd0tublTtJ50FPKhujf47YRqauXXOUxfw=
+github.com/go-openapi/validate v0.26.0 h1:dxWzQ3F+vb1SajqUxHjwb5T4mTpSHmdrtv5Bi7+ZNhw=
+github.com/go-openapi/validate v0.26.0/go.mod h1:b4o00uq7fJeJA+wWhVFCJpKTctzeFwzZImGGmHsl2JA=
+github.com/go-quicktest/qt v1.101.1-0.20240301121107-c6c8733fa1e6 h1:teYtXy9B7y5lHTp8V9KPxpYRAVA7dozigQcMiBust1s=
+github.com/go-quicktest/qt v1.101.1-0.20240301121107-c6c8733fa1e6/go.mod h1:p4lGIVX+8Wa6ZPNDvqcxq36XpUDLh42FLetFU7odllI=
+github.com/go-viper/mapstructure/v2 v2.5.0 h1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPEgAXnvj1Ro=
+github.com/go-viper/mapstructure/v2 v2.5.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
+github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
+github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
+github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/mackerelio/go-osstat v0.2.7 h1:TCavZi10wF49bT6iQZ9eT2keGZQpC69MTDfdJej5e94=
+github.com/mackerelio/go-osstat v0.2.7/go.mod h1:dwpYh5pIPmvk+IEwBKNIWRFMB92mrC08CmXOhDC7nQk=
+github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
+github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
+github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee h1:W5t00kpgFdJifH4BDsTlE89Zl93FEloxaWZfGcifgq8=
+github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/oklog/ulid/v2 v2.1.1 h1:suPZ4ARWLOJLegGFiZZ1dFAkqzhMjL3J1TzI+5wHz8s=
+github.com/oklog/ulid/v2 v2.1.1/go.mod h1:rcEKHmBBKfef9DhnvX7y1HZBYxjXb0cP5ExxNsTT1QQ=
+github.com/pborman/getopt v0.0.0-20170112200414-7148bc3a4c30/go.mod h1:85jBQOZwpVEaDAr341tbn15RS4fCAsIst0qp7i8ex1o=
+github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=
+github.com/pelletier/go-toml/v2 v2.2.4/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
+github.com/petermattis/goid v0.0.0-20250813065127-a731cc31b4fe h1:vHpqOnPlnkba8iSxU4j/CvDSS9J4+F4473esQsYLGoE=
+github.com/petermattis/goid v0.0.0-20250813065127-a731cc31b4fe/go.mod h1:pxMtw7cyUw6B2bRH0ZBANSPg+AoSud1I1iyJHI69jH4=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
+github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
+github.com/sagikazarmark/locafero v0.11.0 h1:1iurJgmM9G3PA/I+wWYIOw/5SyBtxapeHDcg+AAIFXc=
+github.com/sagikazarmark/locafero v0.11.0/go.mod h1:nVIGvgyzw595SUSUE6tvCp3YYTeHs15MvlmU87WwIik=
+github.com/sasha-s/go-deadlock v0.3.9 h1:fiaT9rB7g5sr5ddNZvlwheclN9IP86eFW9WgqlEQV+w=
+github.com/sasha-s/go-deadlock v0.3.9/go.mod h1:KuZj51ZFmx42q/mPaYbRk0P1xcwe697zsJKE03vD4/Y=
+github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8 h1:+jumHNA0Wrelhe64i8F6HNlS8pkoyMv5sreGx2Ry5Rw=
+github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8/go.mod h1:3n1Cwaq1E1/1lhQhtRK2ts/ZwZEhjcQeJQ1RuC6Q/8U=
+github.com/spf13/afero v1.15.0 h1:b/YBCLWAJdFWJTN9cLhiXXcD7mzKn9Dm86dNnfyQw1I=
+github.com/spf13/afero v1.15.0/go.mod h1:NC2ByUVxtQs4b3sIUphxK0NioZnmxgyCrfzeuq8lxMg=
+github.com/spf13/cast v1.10.0 h1:h2x0u2shc1QuLHfxi+cTJvs30+ZAHOGRic8uyGTDWxY=
+github.com/spf13/cast v1.10.0/go.mod h1:jNfB8QC9IA6ZuY2ZjDp0KtFO2LZZlg4S/7bzP6qqeHo=
 github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
 github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4=
-github.com/spf13/pflag v1.0.9 h1:9exaQaMOCwffKiiiYk6/BndUBv+iRViNW+4lEMi0PvY=
 github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
+github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/viper v1.21.0 h1:x5S+0EU27Lbphp4UKm1C+1oQO+rKx36vfCoaVebLFSU=
+github.com/spf13/viper v1.21.0/go.mod h1:P0lhsswPGWD/1lZJ9ny3fYnVqxiegrlNrEmgLjbTCAY=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8=
+github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU=
+github.com/vishvananda/netlink v1.3.2-0.20260624190457-bab08b3566fc h1:rz8YwESFhYgF7sjsKskrWDAve2WC8wA1cWcLLEdojks=
+github.com/vishvananda/netlink v1.3.2-0.20260624190457-bab08b3566fc/go.mod h1:lEui7SPMd9fgxzHVGRAvTxsBGCF6PRH81o2kLWLWHgw=
+github.com/vishvananda/netns v0.0.5 h1:DfiHV+j8bA32MFM7bfEunvT8IAqQ/NzSJHtcmW5zdEY=
+github.com/vishvananda/netns v0.0.5/go.mod h1:SpkAiCQRtJ6TvvxPnOSyH3BMl6unz3xZlaprSwhNNJM=
+github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
+github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
+go.uber.org/dig v1.17.1 h1:Tga8Lz8PcYNsWsyHMZ1Vm0OQOUaJNDyvPImgbAu9YSc=
+go.uber.org/dig v1.17.1/go.mod h1:Us0rSJiThwCv2GteUN0Q7OKvU7n5J4dxZ9JKUXozFdE=
+go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
+go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
+go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
+go4.org/netipx v0.0.0-20231129151722-fdeea329fbba h1:0b9z3AuHCjxk0x/opv64kcgZLBseWJUpBw5I82+2U4M=
+go4.org/netipx v0.0.0-20231129151722-fdeea329fbba/go.mod h1:PLyyIXexvUFg3Owu6p/WfdlivPbZJsZdgWZlrGope/Y=
+golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
+golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
+golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
+golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
+golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
+golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
+golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
+golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
+golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
+golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
+golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=
+golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
+gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
+gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+k8s.io/apimachinery v0.37.0 h1:Np2AbDtf8x6RDHiD8T9LbKJ9gaegeVNa8yNm5FuGKm0=
+k8s.io/apimachinery v0.37.0/go.mod h1:RN3nhprFSCxOi5Selxd7oMTXOe/c+ZbcE7Im+TS2zkE=
+k8s.io/client-go v0.36.3 h1:M4JdVzXxYcZk4fGpfDdYnxSwhLKWCFoQsHW6t+z8Hfg=
+k8s.io/client-go v0.36.3/go.mod h1:gcPwr0c87vjjG6HB6pWEqOeuYVoXSsREjzux2j6GF30=
+k8s.io/klog/v2 v2.140.0 h1:Tf+J3AH7xnUzZyVVXhTgGhEKnFqye14aadWv7bzXdzc=
+k8s.io/klog/v2 v2.140.0/go.mod h1:o+/RWfJ6PwpnFn7OyAG3QnO47BFsymfEfrz6XyYSSp0=
+k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad h1:oXImqH8mQNk7PmvzKhmN3ddJoY6OnyM225MXwGHPm0A=
+k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad/go.mod h1:0/mqHCVhlumdJ3BhCfnjSZQE037nAhNodh1/hK0T8/I=
+k8s.io/utils v0.0.0-20260707023825-cf1189d6abe3 h1:jVkFFVfXdXP74B/zbO3hM3hpSFD0xvhQ5U686DPurkE=
+k8s.io/utils v0.0.0-20260707023825-cf1189d6abe3/go.mod h1:M2s5JB1lIYP3jzZdorPLHXIPJzt9vv2muW5a6L9DtNM=
+sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5EXP7sU1kvOlxwZh5txg=
+sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
+sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
+sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
+sigs.k8s.io/structured-merge-diff/v6 v6.4.2 h1:qdOxHwrl2Kaag1aQEarlYcOA9vSyGCp3CIki3aW8c4Q=
+sigs.k8s.io/structured-merge-diff/v6 v6.4.2/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
+sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
+sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=
diff --git a/hack/cilium-api-probe/README.md b/hack/cilium-api-probe/README.md
new file mode 100644
index 0000000..aaf4593
--- /dev/null
+++ b/hack/cilium-api-probe/README.md
@@ -0,0 +1,17 @@
+# cilium-api-probe
+
+The measurement behind `docs/CRD-SPEC-FORENSICS.md` §3: a separate module (so the main module's dependencies are
+untouched) that builds against `github.com/cilium/cilium@v1.20.1`'s `pkg/policy/api`, renders a rule with
+`sigs.k8s.io/yaml`, runs Cilium's own `Rule.Sanitize()` on a deep copy, and embeds the CRD file copied from the module
+cache. Run it and validate its output against the same CRD offline:
+
+```bash
+cd hack/cilium-api-probe && go build -o probe . && ./probe
+go run sigs.k8s.io/kubectl-validate@v0.0.4 --local-crds ./crd <a file holding the rendered document>
+```
+
+The copy of `crd/ciliumnetworkpolicies.yaml` must stay byte-identical to the module's:
+
+```bash
+cmp crd/ciliumnetworkpolicies.yaml "$(go list -m -f '{{.Dir}}' github.com/cilium/cilium)/pkg/k8s/apis/cilium.io/client/crds/v2/ciliumnetworkpolicies.yaml"
+```
diff --git a/hack/cilium-api-probe/crd/ciliumnetworkpolicies.yaml b/hack/cilium-api-probe/crd/ciliumnetworkpolicies.yaml
new file mode 100644
index 0000000..071ae6c
--- /dev/null
+++ b/hack/cilium-api-probe/crd/ciliumnetworkpolicies.yaml
@@ -0,0 +1,6552 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.20.1
+  name: ciliumnetworkpolicies.cilium.io
+spec:
+  group: cilium.io
+  names:
+    categories:
+    - cilium
+    - ciliumpolicy
+    kind: CiliumNetworkPolicy
+    listKind: CiliumNetworkPolicyList
+    plural: ciliumnetworkpolicies
+    shortNames:
+    - cnp
+    - ciliumnp
+    singular: ciliumnetworkpolicy
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    - jsonPath: .status.conditions[?(@.type=='Valid')].status
+      name: Valid
+      type: string
+    name: v2
+    schema:
+      openAPIV3Schema:
+        description: |-
+          CiliumNetworkPolicy is a Kubernetes third-party resource with an extended
+          version of NetworkPolicy.
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            anyOf:
+            - properties:
+                ingress: {}
+              required:
+              - ingress
+            - properties:
+                ingressDeny: {}
+              required:
+              - ingressDeny
+            - properties:
+                egress: {}
+              required:
+              - egress
+            - properties:
+                egressDeny: {}
+              required:
+              - egressDeny
+            description: Spec is the desired Cilium specific rule specification.
+            oneOf:
+            - properties:
+                endpointSelector: {}
+              required:
+              - endpointSelector
+            - properties:
+                nodeSelector: {}
+              required:
+              - nodeSelector
+            properties:
+              description:
+                description: |-
+                  Description is a free form string, it can be used by the creator of
+                  the rule to store human readable explanation of the purpose of this
+                  rule. Rules cannot be identified by comment.
+                type: string
+              egress:
+                description: |-
+                  Egress is a list of EgressRule which are enforced at egress.
+                  If omitted or empty, this rule does not apply at egress.
+                items:
+                  description: |-
+                    EgressRule contains all rule types which can be applied at egress, i.e.
+                    network traffic that originates inside the endpoint and exits the endpoint
+                    selected by the endpointSelector.
+
+                      - All members of this structure are optional. If omitted or empty, the
+                        member will have no effect on the rule.
+
+                      - If multiple members of the structure are specified, then all members
+                        must match in order for the rule to take effect.
+
+                      - ToEndpoints, ToCIDR, ToCIDRSet, ToEntities, ToServices and ToGroups are
+                        mutually exclusive. Only one of these members may be present within an
+                        individual rule.
+                  properties:
+                    authentication:
+                      description: Authentication is the required authentication type
+                        for the allowed traffic, if any.
+                      properties:
+                        mode:
+                          description: Mode is the required authentication mode for
+                            the allowed traffic, if any.
+                          enum:
+                          - disabled
+                          - required
+                          - test-always-fail
+                          type: string
+                      required:
+                      - mode
+                      type: object
+                    icmps:
+                      description: |-
+                        ICMPs is a list of ICMP rule identified by type number
+                        which the endpoint subject to the rule is allowed to connect to.
+
+                        Example:
+                        Any endpoint with the label "app=httpd" is allowed to initiate
+                        type 8 ICMP connections.
+                      items:
+                        description: ICMPRule is a list of ICMP fields.
+                        properties:
+                          fields:
+                            description: Fields is a list of ICMP fields.
+                            items:
+                              description: ICMPField is a ICMP field.
+                              properties:
+                                family:
+                                  default: IPv4
+                                  description: |-
+                                    Family is a IP address version.
+                                    Currently, we support `IPv4` and `IPv6`.
+                                    `IPv4` is set as default.
+                                  enum:
+                                  - IPv4
+                                  - IPv6
+                                  type: string
+                                type:
+                                  anyOf:
+                                  - type: integer
+                                  - type: string
+                                  description: "Type is a ICMP-type.\nIt should be
+                                    an 8bit code (0-255), or it's CamelCase name (for
+                                    example, \"EchoReply\").\nAllowed ICMP types are:\n
+                                    \   Ipv4: EchoReply | DestinationUnreachable |
+                                    Redirect | Echo | EchoRequest |\n\t\t     RouterAdvertisement
+                                    | RouterSelection | TimeExceeded | ParameterProblem
+                                    |\n\t\t\t Timestamp | TimestampReply | Photuris
+                                    | ExtendedEcho Request | ExtendedEcho Reply\n
+                                    \   Ipv6: DestinationUnreachable | PacketTooBig
+                                    | TimeExceeded | ParameterProblem |\n\t\t\t EchoRequest
+                                    | EchoReply | MulticastListenerQuery| MulticastListenerReport
+                                    |\n\t\t\t MulticastListenerDone | RouterSolicitation
+                                    | RouterAdvertisement | NeighborSolicitation |\n\t\t\t
+                                    NeighborAdvertisement | RedirectMessage | RouterRenumbering
+                                    | ICMPNodeInformationQuery |\n\t\t\t ICMPNodeInformationResponse
+                                    | InverseNeighborDiscoverySolicitation | InverseNeighborDiscoveryAdvertisement
+                                    |\n\t\t\t HomeAgentAddressDiscoveryRequest | HomeAgentAddressDiscoveryReply
+                                    | MobilePrefixSolicitation |\n\t\t\t MobilePrefixAdvertisement
+                                    | DuplicateAddressRequestCodeSuffix | DuplicateAddressConfirmationCodeSuffix
+                                    |\n\t\t\t ExtendedEchoRequest | ExtendedEchoReply"
+                                  pattern: ^([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]|EchoReply|DestinationUnreachable|Redirect|Echo|RouterAdvertisement|RouterSelection|TimeExceeded|ParameterProblem|Timestamp|TimestampReply|Photuris|ExtendedEchoRequest|ExtendedEcho
+                                    Reply|PacketTooBig|ParameterProblem|EchoRequest|MulticastListenerQuery|MulticastListenerReport|MulticastListenerDone|RouterSolicitation|RouterAdvertisement|NeighborSolicitation|NeighborAdvertisement|RedirectMessage|RouterRenumbering|ICMPNodeInformationQuery|ICMPNodeInformationResponse|InverseNeighborDiscoverySolicitation|InverseNeighborDiscoveryAdvertisement|HomeAgentAddressDiscoveryRequest|HomeAgentAddressDiscoveryReply|MobilePrefixSolicitation|MobilePrefixAdvertisement|DuplicateAddressRequestCodeSuffix|DuplicateAddressConfirmationCodeSuffix)$
+                                  x-kubernetes-int-or-string: true
+                              required:
+                              - type
+                              type: object
+                            maxItems: 40
+                            type: array
+                        type: object
+                      type: array
+                    toCIDR:
+                      description: |-
+                        ToCIDR is a list of IP blocks which the endpoint subject to the rule
+                        is allowed to initiate connections. Only connections destined for
+                        outside of the cluster and not targeting the host will be subject
+                        to CIDR rules.  This will match on the destination IP address of
+                        outgoing connections. Adding a prefix into ToCIDR or into ToCIDRSet
+                        with no ExcludeCIDRs is equivalent. Overlaps are allowed between
+                        ToCIDR and ToCIDRSet.
+
+                        Example:
+                        Any endpoint with the label "app=database-proxy" is allowed to
+                        initiate connections to 10.2.3.0/24
+                      items:
+                        description: |-
+                          CIDR specifies a block of IP addresses.
+                          Example: 192.0.2.1/32
+                        format: cidr
+                        type: string
+                      type: array
+                    toCIDRSet:
+                      description: |-
+                        ToCIDRSet is a list of IP blocks which the endpoint subject to the rule
+                        is allowed to initiate connections to in addition to connections
+                        which are allowed via ToEndpoints, along with a list of subnets contained
+                        within their corresponding IP block to which traffic should not be
+                        allowed. This will match on the destination IP address of outgoing
+                        connections. Adding a prefix into ToCIDR or into ToCIDRSet with no
+                        ExcludeCIDRs is equivalent. Overlaps are allowed between ToCIDR and
+                        ToCIDRSet.
+
+                        Example:
+                        Any endpoint with the label "app=database-proxy" is allowed to
+                        initiate connections to 10.2.3.0/24 except from IPs in subnet 10.2.3.0/28.
+                      items:
+                        description: |-
+                          CIDRRule is a rule that specifies a CIDR prefix to/from which outside
+                          communication  is allowed, along with an optional list of subnets within that
+                          CIDR prefix to/from which outside communication is not allowed.
+                        oneOf:
+                        - properties:
+                            cidr: {}
+                          required:
+                          - cidr
+                        - properties:
+                            cidrGroupRef: {}
+                          required:
+                          - cidrGroupRef
+                        - properties:
+                            cidrGroupSelector: {}
+                          required:
+                          - cidrGroupSelector
+                        properties:
+                          cidr:
+                            description: CIDR is a CIDR prefix / IP Block.
+                            format: cidr
+                            type: string
+                          cidrGroupRef:
+                            description: |-
+                              CIDRGroupRef is a reference to a CiliumCIDRGroup object.
+                              A CiliumCIDRGroup contains a list of CIDRs that the endpoint, subject to
+                              the rule, can (Ingress/Egress) or cannot (IngressDeny/EgressDeny) receive
+                              connections from.
+                            maxLength: 253
+                            pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                            type: string
+                          cidrGroupSelector:
+                            description: |-
+                              CIDRGroupSelector selects CiliumCIDRGroups by their labels,
+                              rather than by name.
+                            properties:
+                              matchExpressions:
+                                description: matchExpressions is a list of label selector
+                                  requirements. The requirements are ANDed.
+                                items:
+                                  description: |-
+                                    A label selector requirement is a selector that contains values, a key, and an operator that
+                                    relates the key and values.
+                                  properties:
+                                    key:
+                                      description: key is the label key that the selector
+                                        applies to.
+                                      type: string
+                                    operator:
+                                      description: |-
+                                        operator represents a key's relationship to a set of values.
+                                        Valid operators are In, NotIn, Exists and DoesNotExist.
+                                      enum:
+                                      - In
+                                      - NotIn
+                                      - Exists
+                                      - DoesNotExist
+                                      type: string
+                                    values:
+                                      description: |-
+                                        values is an array of string values. If the operator is In or NotIn,
+                                        the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                        the values array must be empty. This array is replaced during a strategic
+                                        merge patch.
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                  required:
+                                  - key
+                                  - operator
+                                  type: object
+                                type: array
+                                x-kubernetes-list-type: atomic
+                              matchLabels:
+                                additionalProperties:
+                                  description: MatchLabelsValue represents the value
+                                    from the MatchLabels {key,value} pair.
+                                  maxLength: 63
+                                  pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
+                                  type: string
+                                description: |-
+                                  matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                  map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                  operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                type: object
+                            type: object
+                            x-kubernetes-map-type: atomic
+                          except:
+                            description: |-
+                              ExceptCIDRs is a list of IP blocks which the endpoint subject to the rule
+                              is not allowed to initiate connections to. These CIDR prefixes should be
+                              contained within Cidr, using ExceptCIDRs together with CIDRGroupRef is not
+                              supported yet.
+                              These exceptions are only applied to the Cidr in this CIDRRule, and do not
+                              apply to any other CIDR prefixes in any other CIDRRules.
+                            items:
+                              description: |-
+                                CIDR specifies a block of IP addresses.
+                                Example: 192.0.2.1/32
+                              format: cidr
+                              type: string
+                            type: array
+                        type: object
+                      type: array
+                    toEndpoints:
+                      description: |-
+                        ToEndpoints is a list of endpoints identified by an EndpointSelector to
+                        which the endpoints subject to the rule are allowed to communicate.
+
+                        Example:
+                        Any endpoint with the label "role=frontend" can communicate with any
+                        endpoint carrying the label "role=backend".
+
+                        Note that while an empty non-nil ToEndpoints does not select anything,
+                        nil ToEndpoints is implicitly treated as a wildcard selector if ToPorts
+                        are also specified.
+                        To select everything, use one EndpointSelector without any match requirements.
+                      items:
+                        description: EndpointSelector is a wrapper for k8s LabelSelector.
+                        properties:
+                          matchExpressions:
+                            description: matchExpressions is a list of label selector
+                              requirements. The requirements are ANDed.
+                            items:
+                              description: |-
+                                A label selector requirement is a selector that contains values, a key, and an operator that
+                                relates the key and values.
+                              properties:
+                                key:
+                                  description: key is the label key that the selector
+                                    applies to.
+                                  type: string
+                                operator:
+                                  description: |-
+                                    operator represents a key's relationship to a set of values.
+                                    Valid operators are In, NotIn, Exists and DoesNotExist.
+                                  enum:
+                                  - In
+                                  - NotIn
+                                  - Exists
+                                  - DoesNotExist
+                                  type: string
+                                values:
+                                  description: |-
+                                    values is an array of string values. If the operator is In or NotIn,
+                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                    the values array must be empty. This array is replaced during a strategic
+                                    merge patch.
+                                  items:
+                                    type: string
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                              required:
+                              - key
+                              - operator
+                              type: object
+                            type: array
+                            x-kubernetes-list-type: atomic
+                          matchLabels:
+                            additionalProperties:
+                              description: MatchLabelsValue represents the value from
+                                the MatchLabels {key,value} pair.
+                              maxLength: 63
+                              pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
+                              type: string
+                            description: |-
+                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                              map is equivalent to an element of matchExpressions, whose key field is "key", the
+                              operator is "In", and the values array contains only "value". The requirements are ANDed.
+                            type: object
+                        type: object
+                        x-kubernetes-map-type: atomic
+                      type: array
+                    toEntities:
+                      description: |-
+                        ToEntities is a list of special entities to which the endpoint subject
+                        to the rule is allowed to initiate connections. Supported entities are
+                        `world`, `cluster`, `cluster-mesh`, `host`, `remote-node`, `kube-apiserver`, `ingress`, `init`,
+                        `health`, `unmanaged`, `none` and `all`.
+                      items:
+                        description: |-
+                          Entity specifies the class of receiver/sender endpoints that do not have
+                          individual identities.  Entities are used to describe "outside of cluster",
+                          "host", etc.
+                        enum:
+                        - all
+                        - world
+                        - cluster
+                        - cluster-mesh
+                        - host
+                        - init
+                        - ingress
+                        - unmanaged
+                        - remote-node
+                        - health
+                        - none
+                        - kube-apiserver
+                        type: string
+                      type: array
+                    toFQDNs:
+                      description: |-
+                        ToFQDN allows whitelisting DNS names in place of IPs. The IPs that result
+                        from DNS resolution of `ToFQDN.MatchName`s are added to the same
+                        EgressRule object as ToCIDRSet entries, and behave accordingly. Any L4 and
+                        L7 rules within this EgressRule will also apply to these IPs.
+                        The DNS -> IP mapping is re-resolved periodically from within the
+                        cilium-agent, and the IPs in the DNS response are effected in the policy
+                        for selected pods as-is (i.e. the list of IPs is not modified in any way).
+                        Note: An explicit rule to allow for DNS traffic is needed for the pods, as
+                        ToFQDN counts as an egress rule and will enforce egress policy when
+                        PolicyEnforcment=default.
+                        Note: If the resolved IPs are IPs within the kubernetes cluster, the
+                        ToFQDN rule will not apply to that IP.
+                        Note: ToFQDN cannot occur in the same policy as other To* rules.
+                      items:
+                        oneOf:
+                        - properties:
+                            matchName: {}
+                          required:
+                          - matchName
+                        - properties:
+                            matchPattern: {}
+                          required:
+                          - matchPattern
+                        properties:
+                          matchName:
+                            description: |-
+                              MatchName matches literal DNS names. A trailing "." is automatically added
+                              when missing.
+                            maxLength: 255
+                            pattern: ^([-a-zA-Z0-9_]+[.]?)+$
+                            type: string
+                          matchPattern:
+                            description: |-
+                              MatchPattern allows using wildcards to match DNS names. All wildcards are
+                              case insensitive. The wildcards are:
+                              - "*" matches 0 or more DNS valid characters, and may occur anywhere in
+                              the pattern. As a special case a "*" as the leftmost character, without a
+                              following "." matches all subdomains as well as the name to the right.
+                              A trailing "." is automatically added when missing.
+                              - "**." is a special prefix which matches all multilevel subdomains in the prefix.
+
+                              Examples:
+                              1. `*.cilium.io` matches subdomains of cilium at that level
+                                www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
+                              2. `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
+                                except those containing "." separator, subcilium.io and sub-cilium.io match,
+                                www.cilium.io and blog.cilium.io does not
+                              3. `sub*.cilium.io` matches subdomains of cilium where the subdomain component
+                                begins with "sub". sub.cilium.io and subdomain.cilium.io match while www.cilium.io,
+                                blog.cilium.io, cilium.io and google.com do not
+                              4. `**.cilium.io` matches all multilevel subdomains of cilium.io.
+                                "app.cilium.io" and "test.app.cilium.io" match but not "cilium.io"
+                            maxLength: 255
+                            pattern: ^([-a-zA-Z0-9_*]+[.]?)+$
+                            type: string
+                        type: object
+                      type: array
+                    toGroups:
+                      description: |-
+                        ToGroups allows policies to reference CIDRs provided by external integrations.
+                        Currently, only AWS is supported, and the rule can select by multiple sub directives.
+                        ToGroups entries are functionally equivalent to toCIDR, and have the same
+                        limitiations. They cannot select traffic originating from within the cluster.
+
+                        Example:
+                        toGroups:
+                        - aws:
+                            securityGroupsIds:
+                            - 'sg-XXXXXXXXXXXXX'
+                      items:
+                        description: Groups allows referencing CIDRs that are resolved
+                          from an external integration.
+                        properties:
+                          aws:
+                            description: AWSGroup is an structure that can be used
+                              to whitelisting information from AWS integration
+                            properties:
+                              labels:
+                                additionalProperties:
+                                  type: string
+                                description: |-
+                                  Labels selects AWS ENIs by labels.
+                                  Multiple labels are AND-ed together.
+                                type: object
+                              region:
+                                description: 'Deprecated: Region is unused.'
+                                type: string
+                              securityGroupsIds:
+                                description: |-
+                                  SecurityGroupsIds selects VPC SecurityGroups by IDs.
+                                  If multiple IDs are specified, they are OR-ed together.
+
+                                  Note that this may be AND-ed with any Names specified. Specifying both
+                                  IDs and Names is not recommended.
+                                items:
+                                  type: string
+                                type: array
+                              securityGroupsNames:
+                                description: |-
+                                  SecurityGroupsNames selects VPC SecurityGroups by name.
+                                  If multiple names are specified, they are OR-ed together.
+
+                                  Note that this may be AND-ed with any IDs specified. Specifying both
+                                  IDs and Names is not recommended.
+                                items:
+                                  type: string
+                                type: array
+                            type: object
+                        type: object
+                      type: array
+                    toNodes:
+                      description: |-
+                        ToNodes is a list of nodes identified by an
+                        EndpointSelector to which endpoints subject to the rule is allowed to communicate.
+                      items:
+                        description: EndpointSelector is a wrapper for k8s LabelSelector.
+                        properties:
+                          matchExpressions:
+                            description: matchExpressions is a list of label selector
+                              requirements. The requirements are ANDed.
+                            items:
+                              description: |-
+                                A label selector requirement is a selector that contains values, a key, and an operator that
+                                relates the key and values.
+                              properties:
+                                key:
+                                  description: key is the label key that the selector
+                                    applies to.
+                                  type: string
+                                operator:
+                                  description: |-
+                                    operator represents a key's relationship to a set of values.
+                                    Valid operators are In, NotIn, Exists and DoesNotExist.
+                                  enum:
+                                  - In
+                                  - NotIn
+                                  - Exists
+                                  - DoesNotExist
+                                  type: string
+                                values:
+                                  description: |-
+                                    values is an array of string values. If the operator is In or NotIn,
+                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                    the values array must be empty. This array is replaced during a strategic
+                                    merge patch.
+                                  items:
+                                    type: string
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                              required:
+                              - key
+                              - operator
+                              type: object
+                            type: array
+                            x-kubernetes-list-type: atomic
+                          matchLabels:
+                            additionalProperties:
+                              description: MatchLabelsValue represents the value from
+                                the MatchLabels {key,value} pair.
+                              maxLength: 63
+                              pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
+                              type: string
+                            description: |-
+                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                              map is equivalent to an element of matchExpressions, whose key field is "key", the
+                              operator is "In", and the values array contains only "value". The requirements are ANDed.
+                            type: object
+                        type: object
+                        x-kubernetes-map-type: atomic
+                      type: array
+                    toPorts:
+                      description: |-
+                        ToPorts is a list of destination ports identified by port number and
+                        protocol which the endpoint subject to the rule is allowed to
+                        connect to.
+
+                        Example:
+                        Any endpoint with the label "role=frontend" is allowed to initiate
+                        connections to destination port 8080/tcp
+                      items:
+                        description: |-
+                          PortRule is a list of ports/protocol combinations with optional Layer 7
+                          rules which must be met.
+                        properties:
+                          listener:
+                            description: |-
+                              listener specifies the name of a custom Envoy listener to which this traffic should be
+                              redirected to.
+                            properties:
+                              envoyConfig:
+                                description: |-
+                                  EnvoyConfig is a reference to the CEC or CCEC resource in which
+                                  the listener is defined.
+                                properties:
+                                  kind:
+                                    description: |-
+                                      Kind is the resource type being referred to. Defaults to CiliumEnvoyConfig or
+                                      CiliumClusterwideEnvoyConfig for CiliumNetworkPolicy and CiliumClusterwideNetworkPolicy,
+                                      respectively. The only case this is currently explicitly needed is when referring to a
+                                      CiliumClusterwideEnvoyConfig from CiliumNetworkPolicy, as using a namespaced listener
+                                      from a cluster scoped policy is not allowed.
+                                    enum:
+                                    - CiliumEnvoyConfig
+                                    - CiliumClusterwideEnvoyConfig
+                                    type: string
+                                  name:
+                                    description: |-
+                                      Name is the resource name of the CiliumEnvoyConfig or CiliumClusterwideEnvoyConfig where
+                                      the listener is defined in.
+                                    minLength: 1
+                                    type: string
+                                required:
+                                - name
+                                type: object
+                              name:
+                                description: Name is the name of the listener.
+                                minLength: 1
+                                type: string
+                              priority:
+                                description: |-
+                                  Priority for this Listener that is used when multiple rules would apply different
+                                  listeners to a policy map entry. Behavior of this is implementation dependent.
+                                maximum: 100
+                                minimum: 1
+                                type: integer
+                            required:
+                            - envoyConfig
+                            - name
+                            type: object
+                          originatingTLS:
+                            description: |-
+                              OriginatingTLS is the TLS context for the connections originated by
+                              the L7 proxy.  For egress policy this specifies the client-side TLS
+                              parameters for the upstream connection originating from the L7 proxy
+                              to the remote destination. For ingress policy this specifies the
+                              client-side TLS parameters for the connection from the L7 proxy to
+                              the local endpoint.
+                            properties:
+                              certificate:
+                                description: |-
+                                  Certificate is the file name or k8s secret item name for the certificate
+                                  chain. If omitted, 'tls.crt' is assumed, if it exists. If given, the
+                                  item must exist.
+                                type: string
+                              privateKey:
+                                description: |-
+                                  PrivateKey is the file name or k8s secret item name for the private key
+                                  matching the certificate chain. If omitted, 'tls.key' is assumed, if it
+                                  exists. If given, the item must exist.
+                                type: string
+                              secret:
+                                description: |-
+                                  Secret is the secret that contains the certificates and private key for
+                                  the TLS context.
+                                  By default, Cilium will search in this secret for the following items:
+                                   - 'ca.crt'  - Which represents the trusted CA to verify remote source.
+                                   - 'tls.crt' - Which represents the public key certificate.
+                                   - 'tls.key' - Which represents the private key matching the public key
+                                                 certificate.
+                                properties:
+                                  name:
+                                    description: Name is the name of the secret.
+                                    type: string
+                                  namespace:
+                                    description: |-
+                                      Namespace is the namespace in which the secret exists. Context of use
+                                      determines the default value if left out (e.g., "default").
+                                    type: string
+                                required:
+                                - name
+                                type: object
+                              trustedCA:
+                                description: |-
+                                  TrustedCA is the file name or k8s secret item name for the trusted CA.
+                                  If omitted, 'ca.crt' is assumed, if it exists. If given, the item must
+                                  exist.
+                                type: string
+                            required:
+                            - secret
+                            type: object
+                          ports:
+                            description: Ports is a list of L4 port/protocol
+                            items:
+                              description: PortProtocol specifies an L4 port with
+                                an optional transport protocol
+                              properties:
+                                endPort:
+                                  description: EndPort can only be an L4 port number.
+                                  format: int32
+                                  maximum: 65535
+                                  minimum: 0
+                                  type: integer
+                                port:
+                                  description: |-
+                                    Port can be an L4 port number, or a name in the form of "http"
+                                    or "http-8080".
+                                  pattern: ^(6553[0-5]|655[0-2][0-9]|65[0-4][0-9]{2}|6[0-4][0-9]{3}|[1-5][0-9]{4}|[0-9]{1,4})|([a-zA-Z0-9]-?)*[a-zA-Z](-?[a-zA-Z0-9])*$
+                                  type: string
+                                protocol:
+                                  description: |-
+                                    Protocol is the L4 protocol. If "ANY", omitted or empty, any protocols
+                                    with transport ports (TCP, UDP, SCTP) match.
+
+                                    Accepted values: "TCP", "UDP", "SCTP", "VRRP", "IGMP", "GRE", "IPIP",
+                                    "IPV6", "ESP", "AH", "ANY"
+
+                                    Tunnel/encapsulation protocols (GRE, IPIP, IPV6, ESP, AH) and other
+                                    extended IP protocols (VRRP, IGMP) require the --enable-extended-ip-protocols
+                                    flag to be set. These protocols do not use transport-layer ports.
+
+                                    Matching on ICMP is not supported.
+
+                                    Named port specified for a container may narrow this down, but may not
+                                    contradict this.
+                                  enum:
+                                  - TCP
+                                  - UDP
+                                  - SCTP
+                                  - VRRP
+                                  - IGMP
+                                  - GRE
+                                  - IPIP
+                                  - IPV6
+                                  - ESP
+                                  - AH
+                                  - ANY
+                                  type: string
+                              type: object
+                            maxItems: 40
+                            type: array
+                          rules:
+                            description: |-
+                              Rules is a list of additional port level rules which must be met in
+                              order for the PortRule to allow the traffic. If omitted or empty,
+                              no layer 7 rules are enforced.
+                            oneOf:
+                            - properties:
+                                http: {}
+                              required:
+                              - http
+                            - properties:
+                                dns: {}
+                              required:
+                              - dns
+                            properties:
+                              dns:
+                                description: DNS-specific rules.
+                                items:
+                                  description: PortRuleDNS is a list of allowed DNS
+                                    lookups.
+                                  oneOf:
+                                  - properties:
+                                      matchName: {}
+                                    required:
+                                    - matchName
+                                  - properties:
+                                      matchPattern: {}
+                                    required:
+                                    - matchPattern
+                                  properties:
+                                    matchName:
+                                      description: |-
+                                        MatchName matches literal DNS names. A trailing "." is automatically added
+                                        when missing.
+                                      maxLength: 255
+                                      pattern: ^([-a-zA-Z0-9_]+[.]?)+$
+                                      type: string
+                                    matchPattern:
+                                      description: |-
+                                        MatchPattern allows using wildcards to match DNS names. All wildcards are
+                                        case insensitive. The wildcards are:
+                                        - "*" matches 0 or more DNS valid characters, and may occur anywhere in
+                                        the pattern. As a special case a "*" as the leftmost character, without a
+                                        following "." matches all subdomains as well as the name to the right.
+                                        A trailing "." is automatically added when missing.
+                                        - "**." is a special prefix which matches all multilevel subdomains in the prefix.
+
+                                        Examples:
+                                        1. `*.cilium.io` matches subdomains of cilium at that level
+                                          www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
+                                        2. `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
+                                          except those containing "." separator, subcilium.io and sub-cilium.io match,
+                                          www.cilium.io and blog.cilium.io does not
+                                        3. `sub*.cilium.io` matches subdomains of cilium where the subdomain component
+                                          begins with "sub". sub.cilium.io and subdomain.cilium.io match while www.cilium.io,
+                                          blog.cilium.io, cilium.io and google.com do not
+                                        4. `**.cilium.io` matches all multilevel subdomains of cilium.io.
+                                          "app.cilium.io" and "test.app.cilium.io" match but not "cilium.io"
+                                      maxLength: 255
+                                      pattern: ^([-a-zA-Z0-9_*]+[.]?)+$
+                                      type: string
+                                  type: object
+                                type: array
+                              http:
+                                description: HTTP specific rules.
+                                items:
+                                  description: |-
+                                    PortRuleHTTP is a list of HTTP protocol constraints. All fields are
+                                    optional, if all fields are empty or missing, the rule does not have any
+                                    effect.
+
+                                    All fields of this type are extended POSIX regex as defined by IEEE Std
+                                    1003.1, (i.e this follows the egrep/unix syntax, not the perl syntax)
+                                    matched against the path of an incoming request. Currently it can contain
+                                    characters disallowed from the conventional "path" part of a URL as defined
+                                    by RFC 3986.
+                                  properties:
+                                    headerMatches:
+                                      description: |-
+                                        HeaderMatches is a list of HTTP headers which must be
+                                        present and match against the given values. Mismatch field can be used
+                                        to specify what to do when there is no match.
+                                      items:
+                                        description: |-
+                                          HeaderMatch extends the HeaderValue for matching requirement of a
+                                          named header field against an immediate string or a secret value.
+                                          If none of the optional fields is present, then the
+                                          header value is not matched, only presence of the header is enough.
+                                        properties:
+                                          mismatch:
+                                            description: |-
+                                              Mismatch identifies what to do in case there is no match. The default is
+                                              to drop the request. Otherwise the overall rule is still considered as
+                                              matching, but the mismatches are logged in the access log.
+                                            enum:
+                                            - LOG
+                                            - ADD
+                                            - DELETE
+                                            - REPLACE
+                                            type: string
+                                          name:
+                                            description: Name identifies the header.
+                                            minLength: 1
+                                            type: string
+                                          secret:
+                                            description: |-
+                                              Secret refers to a secret that contains the value to be matched against.
+                                              The secret must only contain one entry. If the referred secret does not
+                                              exist, and there is no "Value" specified, the match will fail.
+                                            properties:
+                                              name:
+                                                description: Name is the name of the
+                                                  secret.
+                                                type: string
+                                              namespace:
+                                                description: |-
+                                                  Namespace is the namespace in which the secret exists. Context of use
+                                                  determines the default value if left out (e.g., "default").
+                                                type: string
+                                            required:
+                                            - name
+                                            type: object
+                                          value:
+                                            description: |-
+                                              Value matches the exact value of the header. Can be specified either
+                                              alone or together with "Secret"; will be used as the header value if the
+                                              secret can not be found in the latter case.
+                                            type: string
+                                        required:
+                                        - name
+                                        type: object
+                                      type: array
+                                    headers:
+                                      description: |-
+                                        Headers is a list of HTTP headers which must be present in the
+                                        request. If omitted or empty, requests are allowed regardless of
+                                        headers present.
+                                      items:
+                                        type: string
+                                      type: array
+                                    host:
+                                      description: |-
+                                        Host is an extended POSIX regex matched against the host header of a
+                                        request. Examples:
+
+                                        - foo.bar.com will match the host fooXbar.com or foo-bar.com
+                                        - foo\.bar\.com will only match the host foo.bar.com
+
+                                        If omitted or empty, the value of the host header is ignored.
+                                      format: idn-hostname
+                                      type: string
+                                    method:
+                                      description: |-
+                                        Method is an extended POSIX regex matched against the method of a
+                                        request, e.g. "GET", "POST", "PUT", "PATCH", "DELETE", ...
+
+                                        If omitted or empty, all methods are allowed.
+                                      type: string
+                                    path:
+                                      description: |-
+                                        Path is an extended POSIX regex matched against the path of a
+                                        request. Currently it can contain characters disallowed from the
+                                        conventional "path" part of a URL as defined by RFC 3986.
+
+                                        If omitted or empty, all paths are all allowed.
+                                      type: string
+                                  type: object
+                                type: array
+                            type: object
+                          serverNames:
+                            description: |-
+                              ServerNames is a list of allowed TLS SNI values. If not empty, then
+                              TLS must be present and one of the provided SNIs must be indicated in the
+                              TLS handshake.
+                            items:
+                              description: |-
+                                ServerName allows using '*' wildcard specifier for matching server names with
+                                the below semantics.
+
+                                - `*` matches 0 or more DNS valid characters, and may occur anywhere in the pattern.
+                                - `**.` is a special prefix which matches all multilevel subdomains in the prefix.
+
+                                As a special case the name "*" matches all valid DNS names.
+
+                                Examples:
+                                 1. `*.cilium.io` matches subdomains of cilium at that level
+                                    www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
+                                 2. `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
+                                    except those containing "." separator, subcilium.io and sub-cilium.io match,
+                                    www.cilium.io and blog.cilium.io does not
+                                 3. `sub*.cilium.io` matches subdomains of cilium where the subdomain component
+                                    begins with "sub". sub.cilium.io and subdomain.cilium.io match while www.cilium.io,
+                                    blog.cilium.io, cilium.io and google.com do not
+                                 4. `**.cilium.io` matches all multilevel subdomains of cilium.io.
+                                    "app.cilium.io" and "test.app.cilium.io" match but not "cilium.io"
+                              maxLength: 255
+                              pattern: ^([-a-zA-Z0-9_*]+[.]?)+$
+                              type: string
+                            minItems: 1
+                            type: array
+                            x-kubernetes-list-type: set
+                          terminatingTLS:
+                            description: |-
+                              TerminatingTLS is the TLS context for the connection terminated by
+                              the L7 proxy.  For egress policy this specifies the server-side TLS
+                              parameters to be applied on the connections originated from the local
+                              endpoint and terminated by the L7 proxy. For ingress policy this specifies
+                              the server-side TLS parameters to be applied on the connections
+                              originated from a remote source and terminated by the L7 proxy.
+                            properties:
+                              certificate:
+                                description: |-
+                                  Certificate is the file name or k8s secret item name for the certificate
+                                  chain. If omitted, 'tls.crt' is assumed, if it exists. If given, the
+                                  item must exist.
+                                type: string
+                              privateKey:
+                                description: |-
+                                  PrivateKey is the file name or k8s secret item name for the private key
+                                  matching the certificate chain. If omitted, 'tls.key' is assumed, if it
+                                  exists. If given, the item must exist.
+                                type: string
+                              secret:
+                                description: |-
+                                  Secret is the secret that contains the certificates and private key for
+                                  the TLS context.
+                                  By default, Cilium will search in this secret for the following items:
+                                   - 'ca.crt'  - Which represents the trusted CA to verify remote source.
+                                   - 'tls.crt' - Which represents the public key certificate.
+                                   - 'tls.key' - Which represents the private key matching the public key
+                                                 certificate.
+                                properties:
+                                  name:
+                                    description: Name is the name of the secret.
+                                    type: string
+                                  namespace:
+                                    description: |-
+                                      Namespace is the namespace in which the secret exists. Context of use
+                                      determines the default value if left out (e.g., "default").
+                                    type: string
+                                required:
+                                - name
+                                type: object
+                              trustedCA:
+                                description: |-
+                                  TrustedCA is the file name or k8s secret item name for the trusted CA.
+                                  If omitted, 'ca.crt' is assumed, if it exists. If given, the item must
+                                  exist.
+                                type: string
+                            required:
+                            - secret
+                            type: object
+                        type: object
+                      type: array
+                    toRequires:
+                      description: Deprecated.
+                      items:
+                        type: string
+                      maxItems: 0
+                      type: array
+                    toServices:
+                      description: |-
+                        ToServices is a list of services to which the endpoint subject
+                        to the rule is allowed to initiate connections.
+                        Currently Cilium only supports toServices for K8s services.
+                      items:
+                        description: |-
+                          Service selects policy targets that are bundled as part of a
+                          logical load-balanced service.
+
+                          Currently only Kubernetes-based Services are supported.
+                        properties:
+                          k8sService:
+                            description: K8sService selects service by name and namespace
+                              pair
+                            properties:
+                              namespace:
+                                type: string
+                              serviceName:
+                                type: string
+                            type: object
+                          k8sServiceSelector:
+                            description: K8sServiceSelector selects services by k8s
+                              labels and namespace
+                            properties:
+                              namespace:
+                                type: string
+                              selector:
+                                description: ServiceSelector is a label selector for
+                                  k8s services
+                                properties:
+                                  matchExpressions:
+                                    description: matchExpressions is a list of label
+                                      selector requirements. The requirements are
+                                      ANDed.
+                                    items:
+                                      description: |-
+                                        A label selector requirement is a selector that contains values, a key, and an operator that
+                                        relates the key and values.
+                                      properties:
+                                        key:
+                                          description: key is the label key that the
+                                            selector applies to.
+                                          type: string
+                                        operator:
+                                          description: |-
+                                            operator represents a key's relationship to a set of values.
+                                            Valid operators are In, NotIn, Exists and DoesNotExist.
+                                          enum:
+                                          - In
+                                          - NotIn
+                                          - Exists
+                                          - DoesNotExist
+                                          type: string
+                                        values:
+                                          description: |-
+                                            values is an array of string values. If the operator is In or NotIn,
+                                            the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                            the values array must be empty. This array is replaced during a strategic
+                                            merge patch.
+                                          items:
+                                            type: string
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                      required:
+                                      - key
+                                      - operator
+                                      type: object
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                  matchLabels:
+                                    additionalProperties:
+                                      description: MatchLabelsValue represents the
+                                        value from the MatchLabels {key,value} pair.
+                                      maxLength: 63
+                                      pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
+                                      type: string
+                                    description: |-
+                                      matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                      map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                      operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                    type: object
+                                type: object
+                                x-kubernetes-map-type: atomic
+                            required:
+                            - selector
+                            type: object
+                        type: object
+                      type: array
+                  type: object
+                type: array
+              egressDeny:
+                description: |-
+                  EgressDeny is a list of EgressDenyRule which are enforced at egress.
+                  Any rule inserted here will be denied regardless of the allowed egress
+                  rules in the 'egress' field.
+                  If omitted or empty, this rule does not apply at egress.
+                items:
+                  description: |-
+                    EgressDenyRule contains all rule types which can be applied at egress, i.e.
+                    network traffic that originates inside the endpoint and exits the endpoint
+                    selected by the endpointSelector.
+
+                      - All members of this structure are optional. If omitted or empty, the
+                        member will have no effect on the rule.
+
+                      - If multiple members of the structure are specified, then all members
+                        must match in order for the rule to take effect.
+
+                      - ToEndpoints, ToCIDR, ToCIDRSet, ToEntities, ToServices and ToGroups are
+                        mutually exclusive. Only one of these members may be present within an
+                        individual rule.
+                  properties:
+                    icmps:
+                      description: |-
+                        ICMPs is a list of ICMP rule identified by type number
+                        which the endpoint subject to the rule is not allowed to connect to.
+
+                        Example:
+                        Any endpoint with the label "app=httpd" is not allowed to initiate
+                        type 8 ICMP connections.
+                      items:
+                        description: ICMPRule is a list of ICMP fields.
+                        properties:
+                          fields:
+                            description: Fields is a list of ICMP fields.
+                            items:
+                              description: ICMPField is a ICMP field.
+                              properties:
+                                family:
+                                  default: IPv4
+                                  description: |-
+                                    Family is a IP address version.
+                                    Currently, we support `IPv4` and `IPv6`.
+                                    `IPv4` is set as default.
+                                  enum:
+                                  - IPv4
+                                  - IPv6
+                                  type: string
+                                type:
+                                  anyOf:
+                                  - type: integer
+                                  - type: string
+                                  description: "Type is a ICMP-type.\nIt should be
+                                    an 8bit code (0-255), or it's CamelCase name (for
+                                    example, \"EchoReply\").\nAllowed ICMP types are:\n
+                                    \   Ipv4: EchoReply | DestinationUnreachable |
+                                    Redirect | Echo | EchoRequest |\n\t\t     RouterAdvertisement
+                                    | RouterSelection | TimeExceeded | ParameterProblem
+                                    |\n\t\t\t Timestamp | TimestampReply | Photuris
+                                    | ExtendedEcho Request | ExtendedEcho Reply\n
+                                    \   Ipv6: DestinationUnreachable | PacketTooBig
+                                    | TimeExceeded | ParameterProblem |\n\t\t\t EchoRequest
+                                    | EchoReply | MulticastListenerQuery| MulticastListenerReport
+                                    |\n\t\t\t MulticastListenerDone | RouterSolicitation
+                                    | RouterAdvertisement | NeighborSolicitation |\n\t\t\t
+                                    NeighborAdvertisement | RedirectMessage | RouterRenumbering
+                                    | ICMPNodeInformationQuery |\n\t\t\t ICMPNodeInformationResponse
+                                    | InverseNeighborDiscoverySolicitation | InverseNeighborDiscoveryAdvertisement
+                                    |\n\t\t\t HomeAgentAddressDiscoveryRequest | HomeAgentAddressDiscoveryReply
+                                    | MobilePrefixSolicitation |\n\t\t\t MobilePrefixAdvertisement
+                                    | DuplicateAddressRequestCodeSuffix | DuplicateAddressConfirmationCodeSuffix
+                                    |\n\t\t\t ExtendedEchoRequest | ExtendedEchoReply"
+                                  pattern: ^([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]|EchoReply|DestinationUnreachable|Redirect|Echo|RouterAdvertisement|RouterSelection|TimeExceeded|ParameterProblem|Timestamp|TimestampReply|Photuris|ExtendedEchoRequest|ExtendedEcho
+                                    Reply|PacketTooBig|ParameterProblem|EchoRequest|MulticastListenerQuery|MulticastListenerReport|MulticastListenerDone|RouterSolicitation|RouterAdvertisement|NeighborSolicitation|NeighborAdvertisement|RedirectMessage|RouterRenumbering|ICMPNodeInformationQuery|ICMPNodeInformationResponse|InverseNeighborDiscoverySolicitation|InverseNeighborDiscoveryAdvertisement|HomeAgentAddressDiscoveryRequest|HomeAgentAddressDiscoveryReply|MobilePrefixSolicitation|MobilePrefixAdvertisement|DuplicateAddressRequestCodeSuffix|DuplicateAddressConfirmationCodeSuffix)$
+                                  x-kubernetes-int-or-string: true
+                              required:
+                              - type
+                              type: object
+                            maxItems: 40
+                            type: array
+                        type: object
+                      type: array
+                    toCIDR:
+                      description: |-
+                        ToCIDR is a list of IP blocks which the endpoint subject to the rule
+                        is allowed to initiate connections. Only connections destined for
+                        outside of the cluster and not targeting the host will be subject
+                        to CIDR rules.  This will match on the destination IP address of
+                        outgoing connections. Adding a prefix into ToCIDR or into ToCIDRSet
+                        with no ExcludeCIDRs is equivalent. Overlaps are allowed between
+                        ToCIDR and ToCIDRSet.
+
+                        Example:
+                        Any endpoint with the label "app=database-proxy" is allowed to
+                        initiate connections to 10.2.3.0/24
+                      items:
+                        description: |-
+                          CIDR specifies a block of IP addresses.
+                          Example: 192.0.2.1/32
+                        format: cidr
+                        type: string
+                      type: array
+                    toCIDRSet:
+                      description: |-
+                        ToCIDRSet is a list of IP blocks which the endpoint subject to the rule
+                        is allowed to initiate connections to in addition to connections
+                        which are allowed via ToEndpoints, along with a list of subnets contained
+                        within their corresponding IP block to which traffic should not be
+                        allowed. This will match on the destination IP address of outgoing
+                        connections. Adding a prefix into ToCIDR or into ToCIDRSet with no
+                        ExcludeCIDRs is equivalent. Overlaps are allowed between ToCIDR and
+                        ToCIDRSet.
+
+                        Example:
+                        Any endpoint with the label "app=database-proxy" is allowed to
+                        initiate connections to 10.2.3.0/24 except from IPs in subnet 10.2.3.0/28.
+                      items:
+                        description: |-
+                          CIDRRule is a rule that specifies a CIDR prefix to/from which outside
+                          communication  is allowed, along with an optional list of subnets within that
+                          CIDR prefix to/from which outside communication is not allowed.
+                        oneOf:
+                        - properties:
+                            cidr: {}
+                          required:
+                          - cidr
+                        - properties:
+                            cidrGroupRef: {}
+                          required:
+                          - cidrGroupRef
+                        - properties:
+                            cidrGroupSelector: {}
+                          required:
+                          - cidrGroupSelector
+                        properties:
+                          cidr:
+                            description: CIDR is a CIDR prefix / IP Block.
+                            format: cidr
+                            type: string
+                          cidrGroupRef:
+                            description: |-
+                              CIDRGroupRef is a reference to a CiliumCIDRGroup object.
+                              A CiliumCIDRGroup contains a list of CIDRs that the endpoint, subject to
+                              the rule, can (Ingress/Egress) or cannot (IngressDeny/EgressDeny) receive
+                              connections from.
+                            maxLength: 253
+                            pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                            type: string
+                          cidrGroupSelector:
+                            description: |-
+                              CIDRGroupSelector selects CiliumCIDRGroups by their labels,
+                              rather than by name.
+                            properties:
+                              matchExpressions:
+                                description: matchExpressions is a list of label selector
+                                  requirements. The requirements are ANDed.
+                                items:
+                                  description: |-
+                                    A label selector requirement is a selector that contains values, a key, and an operator that
+                                    relates the key and values.
+                                  properties:
+                                    key:
+                                      description: key is the label key that the selector
+                                        applies to.
+                                      type: string
+                                    operator:
+                                      description: |-
+                                        operator represents a key's relationship to a set of values.
+                                        Valid operators are In, NotIn, Exists and DoesNotExist.
+                                      enum:
+                                      - In
+                                      - NotIn
+                                      - Exists
+                                      - DoesNotExist
+                                      type: string
+                                    values:
+                                      description: |-
+                                        values is an array of string values. If the operator is In or NotIn,
+                                        the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                        the values array must be empty. This array is replaced during a strategic
+                                        merge patch.
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                  required:
+                                  - key
+                                  - operator
+                                  type: object
+                                type: array
+                                x-kubernetes-list-type: atomic
+                              matchLabels:
+                                additionalProperties:
+                                  description: MatchLabelsValue represents the value
+                                    from the MatchLabels {key,value} pair.
+                                  maxLength: 63
+                                  pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
+                                  type: string
+                                description: |-
+                                  matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                  map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                  operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                type: object
+                            type: object
+                            x-kubernetes-map-type: atomic
+                          except:
+                            description: |-
+                              ExceptCIDRs is a list of IP blocks which the endpoint subject to the rule
+                              is not allowed to initiate connections to. These CIDR prefixes should be
+                              contained within Cidr, using ExceptCIDRs together with CIDRGroupRef is not
+                              supported yet.
+                              These exceptions are only applied to the Cidr in this CIDRRule, and do not
+                              apply to any other CIDR prefixes in any other CIDRRules.
+                            items:
+                              description: |-
+                                CIDR specifies a block of IP addresses.
+                                Example: 192.0.2.1/32
+                              format: cidr
+                              type: string
+                            type: array
+                        type: object
+                      type: array
+                    toEndpoints:
+                      description: |-
+                        ToEndpoints is a list of endpoints identified by an EndpointSelector to
+                        which the endpoints subject to the rule are allowed to communicate.
+
+                        Example:
+                        Any endpoint with the label "role=frontend" can communicate with any
+                        endpoint carrying the label "role=backend".
+
+                        Note that while an empty non-nil ToEndpoints does not select anything,
+                        nil ToEndpoints is implicitly treated as a wildcard selector if ToPorts
+                        are also specified.
+                        To select everything, use one EndpointSelector without any match requirements.
+                      items:
+                        description: EndpointSelector is a wrapper for k8s LabelSelector.
+                        properties:
+                          matchExpressions:
+                            description: matchExpressions is a list of label selector
+                              requirements. The requirements are ANDed.
+                            items:
+                              description: |-
+                                A label selector requirement is a selector that contains values, a key, and an operator that
+                                relates the key and values.
+                              properties:
+                                key:
+                                  description: key is the label key that the selector
+                                    applies to.
+                                  type: string
+                                operator:
+                                  description: |-
+                                    operator represents a key's relationship to a set of values.
+                                    Valid operators are In, NotIn, Exists and DoesNotExist.
+                                  enum:
+                                  - In
+                                  - NotIn
+                                  - Exists
+                                  - DoesNotExist
+                                  type: string
+                                values:
+                                  description: |-
+                                    values is an array of string values. If the operator is In or NotIn,
+                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                    the values array must be empty. This array is replaced during a strategic
+                                    merge patch.
+                                  items:
+                                    type: string
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                              required:
+                              - key
+                              - operator
+                              type: object
+                            type: array
+                            x-kubernetes-list-type: atomic
+                          matchLabels:
+                            additionalProperties:
+                              description: MatchLabelsValue represents the value from
+                                the MatchLabels {key,value} pair.
+                              maxLength: 63
+                              pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
+                              type: string
+                            description: |-
+                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                              map is equivalent to an element of matchExpressions, whose key field is "key", the
+                              operator is "In", and the values array contains only "value". The requirements are ANDed.
+                            type: object
+                        type: object
+                        x-kubernetes-map-type: atomic
+                      type: array
+                    toEntities:
+                      description: |-
+                        ToEntities is a list of special entities to which the endpoint subject
+                        to the rule is allowed to initiate connections. Supported entities are
+                        `world`, `cluster`, `cluster-mesh`, `host`, `remote-node`, `kube-apiserver`, `ingress`, `init`,
+                        `health`, `unmanaged`, `none` and `all`.
+                      items:
+                        description: |-
+                          Entity specifies the class of receiver/sender endpoints that do not have
+                          individual identities.  Entities are used to describe "outside of cluster",
+                          "host", etc.
+                        enum:
+                        - all
+                        - world
+                        - cluster
+                        - cluster-mesh
+                        - host
+                        - init
+                        - ingress
+                        - unmanaged
+                        - remote-node
+                        - health
+                        - none
+                        - kube-apiserver
+                        type: string
+                      type: array
+                    toGroups:
+                      description: |-
+                        ToGroups allows policies to reference CIDRs provided by external integrations.
+                        Currently, only AWS is supported, and the rule can select by multiple sub directives.
+                        ToGroups entries are functionally equivalent to toCIDR, and have the same
+                        limitiations. They cannot select traffic originating from within the cluster.
+
+                        Example:
+                        toGroups:
+                        - aws:
+                            securityGroupsIds:
+                            - 'sg-XXXXXXXXXXXXX'
+                      items:
+                        description: Groups allows referencing CIDRs that are resolved
+                          from an external integration.
+                        properties:
+                          aws:
+                            description: AWSGroup is an structure that can be used
+                              to whitelisting information from AWS integration
+                            properties:
+                              labels:
+                                additionalProperties:
+                                  type: string
+                                description: |-
+                                  Labels selects AWS ENIs by labels.
+                                  Multiple labels are AND-ed together.
+                                type: object
+                              region:
+                                description: 'Deprecated: Region is unused.'
+                                type: string
+                              securityGroupsIds:
+                                description: |-
+                                  SecurityGroupsIds selects VPC SecurityGroups by IDs.
+                                  If multiple IDs are specified, they are OR-ed together.
+
+                                  Note that this may be AND-ed with any Names specified. Specifying both
+                                  IDs and Names is not recommended.
+                                items:
+                                  type: string
+                                type: array
+                              securityGroupsNames:
+                                description: |-
+                                  SecurityGroupsNames selects VPC SecurityGroups by name.
+                                  If multiple names are specified, they are OR-ed together.
+
+                                  Note that this may be AND-ed with any IDs specified. Specifying both
+                                  IDs and Names is not recommended.
+                                items:
+                                  type: string
+                                type: array
+                            type: object
+                        type: object
+                      type: array
+                    toNodes:
+                      description: |-
+                        ToNodes is a list of nodes identified by an
+                        EndpointSelector to which endpoints subject to the rule is allowed to communicate.
+                      items:
+                        description: EndpointSelector is a wrapper for k8s LabelSelector.
+                        properties:
+                          matchExpressions:
+                            description: matchExpressions is a list of label selector
+                              requirements. The requirements are ANDed.
+                            items:
+                              description: |-
+                                A label selector requirement is a selector that contains values, a key, and an operator that
+                                relates the key and values.
+                              properties:
+                                key:
+                                  description: key is the label key that the selector
+                                    applies to.
+                                  type: string
+                                operator:
+                                  description: |-
+                                    operator represents a key's relationship to a set of values.
+                                    Valid operators are In, NotIn, Exists and DoesNotExist.
+                                  enum:
+                                  - In
+                                  - NotIn
+                                  - Exists
+                                  - DoesNotExist
+                                  type: string
+                                values:
+                                  description: |-
+                                    values is an array of string values. If the operator is In or NotIn,
+                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                    the values array must be empty. This array is replaced during a strategic
+                                    merge patch.
+                                  items:
+                                    type: string
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                              required:
+                              - key
+                              - operator
+                              type: object
+                            type: array
+                            x-kubernetes-list-type: atomic
+                          matchLabels:
+                            additionalProperties:
+                              description: MatchLabelsValue represents the value from
+                                the MatchLabels {key,value} pair.
+                              maxLength: 63
+                              pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
+                              type: string
+                            description: |-
+                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                              map is equivalent to an element of matchExpressions, whose key field is "key", the
+                              operator is "In", and the values array contains only "value". The requirements are ANDed.
+                            type: object
+                        type: object
+                        x-kubernetes-map-type: atomic
+                      type: array
+                    toPorts:
+                      description: |-
+                        ToPorts is a list of destination ports identified by port number and
+                        protocol which the endpoint subject to the rule is not allowed to connect
+                        to.
+
+                        Example:
+                        Any endpoint with the label "role=frontend" is not allowed to initiate
+                        connections to destination port 8080/tcp
+                      items:
+                        description: |-
+                          PortDenyRule is a list of ports/protocol that should be used for deny
+                          policies. This structure lacks the L7Rules since it's not supported in deny
+                          policies.
+                        properties:
+                          ports:
+                            description: Ports is a list of L4 port/protocol
+                            items:
+                              description: PortProtocol specifies an L4 port with
+                                an optional transport protocol
+                              properties:
+                                endPort:
+                                  description: EndPort can only be an L4 port number.
+                                  format: int32
+                                  maximum: 65535
+                                  minimum: 0
+                                  type: integer
+                                port:
+                                  description: |-
+                                    Port can be an L4 port number, or a name in the form of "http"
+                                    or "http-8080".
+                                  pattern: ^(6553[0-5]|655[0-2][0-9]|65[0-4][0-9]{2}|6[0-4][0-9]{3}|[1-5][0-9]{4}|[0-9]{1,4})|([a-zA-Z0-9]-?)*[a-zA-Z](-?[a-zA-Z0-9])*$
+                                  type: string
+                                protocol:
+                                  description: |-
+                                    Protocol is the L4 protocol. If "ANY", omitted or empty, any protocols
+                                    with transport ports (TCP, UDP, SCTP) match.
+
+                                    Accepted values: "TCP", "UDP", "SCTP", "VRRP", "IGMP", "GRE", "IPIP",
+                                    "IPV6", "ESP", "AH", "ANY"
+
+                                    Tunnel/encapsulation protocols (GRE, IPIP, IPV6, ESP, AH) and other
+                                    extended IP protocols (VRRP, IGMP) require the --enable-extended-ip-protocols
+                                    flag to be set. These protocols do not use transport-layer ports.
+
+                                    Matching on ICMP is not supported.
+
+                                    Named port specified for a container may narrow this down, but may not
+                                    contradict this.
+                                  enum:
+                                  - TCP
+                                  - UDP
+                                  - SCTP
+                                  - VRRP
+                                  - IGMP
+                                  - GRE
+                                  - IPIP
+                                  - IPV6
+                                  - ESP
+                                  - AH
+                                  - ANY
+                                  type: string
+                              type: object
+                            type: array
+                        type: object
+                      type: array
+                    toRequires:
+                      description: Deprecated.
+                      items:
+                        type: string
+                      maxItems: 0
+                      type: array
+                    toServices:
+                      description: |-
+                        ToServices is a list of services to which the endpoint subject
+                        to the rule is allowed to initiate connections.
+                        Currently Cilium only supports toServices for K8s services.
+                      items:
+                        description: |-
+                          Service selects policy targets that are bundled as part of a
+                          logical load-balanced service.
+
+                          Currently only Kubernetes-based Services are supported.
+                        properties:
+                          k8sService:
+                            description: K8sService selects service by name and namespace
+                              pair
+                            properties:
+                              namespace:
+                                type: string
+                              serviceName:
+                                type: string
+                            type: object
+                          k8sServiceSelector:
+                            description: K8sServiceSelector selects services by k8s
+                              labels and namespace
+                            properties:
+                              namespace:
+                                type: string
+                              selector:
+                                description: ServiceSelector is a label selector for
+                                  k8s services
+                                properties:
+                                  matchExpressions:
+                                    description: matchExpressions is a list of label
+                                      selector requirements. The requirements are
+                                      ANDed.
+                                    items:
+                                      description: |-
+                                        A label selector requirement is a selector that contains values, a key, and an operator that
+                                        relates the key and values.
+                                      properties:
+                                        key:
+                                          description: key is the label key that the
+                                            selector applies to.
+                                          type: string
+                                        operator:
+                                          description: |-
+                                            operator represents a key's relationship to a set of values.
+                                            Valid operators are In, NotIn, Exists and DoesNotExist.
+                                          enum:
+                                          - In
+                                          - NotIn
+                                          - Exists
+                                          - DoesNotExist
+                                          type: string
+                                        values:
+                                          description: |-
+                                            values is an array of string values. If the operator is In or NotIn,
+                                            the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                            the values array must be empty. This array is replaced during a strategic
+                                            merge patch.
+                                          items:
+                                            type: string
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                      required:
+                                      - key
+                                      - operator
+                                      type: object
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                  matchLabels:
+                                    additionalProperties:
+                                      description: MatchLabelsValue represents the
+                                        value from the MatchLabels {key,value} pair.
+                                      maxLength: 63
+                                      pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
+                                      type: string
+                                    description: |-
+                                      matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                      map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                      operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                    type: object
+                                type: object
+                                x-kubernetes-map-type: atomic
+                            required:
+                            - selector
+                            type: object
+                        type: object
+                      type: array
+                  type: object
+                type: array
+              enableDefaultDeny:
+                description: |-
+                  EnableDefaultDeny determines whether this policy configures the
+                  subject endpoint(s) to have a default deny mode. If enabled,
+                  this causes all traffic not explicitly allowed by a network policy
+                  to be dropped.
+
+                  If not specified, the default is true for each traffic direction
+                  that has rules, and false otherwise. For example, if a policy
+                  only has Ingress or IngressDeny rules, then the default for
+                  ingress is true and egress is false.
+
+                  If multiple policies apply to an endpoint, that endpoint's default deny
+                  will be enabled if any policy requests it.
+
+                  This is useful for creating broad-based network policies that will not
+                  cause endpoints to enter default-deny mode.
+                properties:
+                  egress:
+                    description: |-
+                      Whether or not the endpoint should have a default-deny rule applied
+                      to egress traffic.
+                    type: boolean
+                  ingress:
+                    description: |-
+                      Whether or not the endpoint should have a default-deny rule applied
+                      to ingress traffic.
+                    type: boolean
+                type: object
+              endpointSelector:
+                description: |-
+                  EndpointSelector selects all endpoints which should be subject to
+                  this rule. EndpointSelector and NodeSelector cannot be both empty and
+                  are mutually exclusive.
+                properties:
+                  matchExpressions:
+                    description: matchExpressions is a list of label selector requirements.
+                      The requirements are ANDed.
+                    items:
+                      description: |-
+                        A label selector requirement is a selector that contains values, a key, and an operator that
+                        relates the key and values.
+                      properties:
+                        key:
+                          description: key is the label key that the selector applies
+                            to.
+                          type: string
+                        operator:
+                          description: |-
+                            operator represents a key's relationship to a set of values.
+                            Valid operators are In, NotIn, Exists and DoesNotExist.
+                          enum:
+                          - In
+                          - NotIn
+                          - Exists
+                          - DoesNotExist
+                          type: string
+                        values:
+                          description: |-
+                            values is an array of string values. If the operator is In or NotIn,
+                            the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                            the values array must be empty. This array is replaced during a strategic
+                            merge patch.
+                          items:
+                            type: string
+                          type: array
+                          x-kubernetes-list-type: atomic
+                      required:
+                      - key
+                      - operator
+                      type: object
+                    type: array
+                    x-kubernetes-list-type: atomic
+                  matchLabels:
+                    additionalProperties:
+                      description: MatchLabelsValue represents the value from the
+                        MatchLabels {key,value} pair.
+                      maxLength: 63
+                      pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
+                      type: string
+                    description: |-
+                      matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                      map is equivalent to an element of matchExpressions, whose key field is "key", the
+                      operator is "In", and the values array contains only "value". The requirements are ANDed.
+                    type: object
+                type: object
+                x-kubernetes-map-type: atomic
+              ingress:
+                description: |-
+                  Ingress is a list of IngressRule which are enforced at ingress.
+                  If omitted or empty, this rule does not apply at ingress.
+                items:
+                  description: |-
+                    IngressRule contains all rule types which can be applied at ingress,
+                    i.e. network traffic that originates outside of the endpoint and
+                    is entering the endpoint selected by the endpointSelector.
+
+                      - All members of this structure are optional. If omitted or empty, the
+                        member will have no effect on the rule.
+
+                      - If multiple members are set, all of them need to match in order for
+                        the rule to take effect.
+
+                      - FromEndpoints, FromCIDR, FromCIDRSet and FromEntities are mutually
+                        exclusive. Only one of these members may be present within an individual
+                        rule.
+                  properties:
+                    authentication:
+                      description: Authentication is the required authentication type
+                        for the allowed traffic, if any.
+                      properties:
+                        mode:
+                          description: Mode is the required authentication mode for
+                            the allowed traffic, if any.
+                          enum:
+                          - disabled
+                          - required
+                          - test-always-fail
+                          type: string
+                      required:
+                      - mode
+                      type: object
+                    fromCIDR:
+                      description: |-
+                        FromCIDR is a list of IP blocks which the endpoint subject to the
+                        rule is allowed to receive connections from. Only connections which
+                        do *not* originate from the cluster or from the local host are subject
+                        to CIDR rules. In order to allow in-cluster connectivity, use the
+                        FromEndpoints field.  This will match on the source IP address of
+                        incoming connections. Adding  a prefix into FromCIDR or into
+                        FromCIDRSet with no ExcludeCIDRs is  equivalent.  Overlaps are
+                        allowed between FromCIDR and FromCIDRSet.
+
+                        Example:
+                        Any endpoint with the label "app=my-legacy-pet" is allowed to receive
+                        connections from 10.3.9.1
+                      items:
+                        description: |-
+                          CIDR specifies a block of IP addresses.
+                          Example: 192.0.2.1/32
+                        format: cidr
+                        type: string
+                      type: array
+                    fromCIDRSet:
+                      description: |-
+                        FromCIDRSet is a list of IP blocks which the endpoint subject to the
+                        rule is allowed to receive connections from in addition to FromEndpoints,
+                        along with a list of subnets contained within their corresponding IP block
+                        from which traffic should not be allowed.
+                        This will match on the source IP address of incoming connections. Adding
+                        a prefix into FromCIDR or into FromCIDRSet with no ExcludeCIDRs is
+                        equivalent. Overlaps are allowed between FromCIDR and FromCIDRSet.
+
+                        Example:
+                        Any endpoint with the label "app=my-legacy-pet" is allowed to receive
+                        connections from 10.0.0.0/8 except from IPs in subnet 10.96.0.0/12.
+                      items:
+                        description: |-
+                          CIDRRule is a rule that specifies a CIDR prefix to/from which outside
+                          communication  is allowed, along with an optional list of subnets within that
+                          CIDR prefix to/from which outside communication is not allowed.
+                        oneOf:
+                        - properties:
+                            cidr: {}
+                          required:
+                          - cidr
+                        - properties:
+                            cidrGroupRef: {}
+                          required:
+                          - cidrGroupRef
+                        - properties:
+                            cidrGroupSelector: {}
+                          required:
+                          - cidrGroupSelector
+                        properties:
+                          cidr:
+                            description: CIDR is a CIDR prefix / IP Block.
+                            format: cidr
+                            type: string
+                          cidrGroupRef:
+                            description: |-
+                              CIDRGroupRef is a reference to a CiliumCIDRGroup object.
+                              A CiliumCIDRGroup contains a list of CIDRs that the endpoint, subject to
+                              the rule, can (Ingress/Egress) or cannot (IngressDeny/EgressDeny) receive
+                              connections from.
+                            maxLength: 253
+                            pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                            type: string
+                          cidrGroupSelector:
+                            description: |-
+                              CIDRGroupSelector selects CiliumCIDRGroups by their labels,
+                              rather than by name.
+                            properties:
+                              matchExpressions:
+                                description: matchExpressions is a list of label selector
+                                  requirements. The requirements are ANDed.
+                                items:
+                                  description: |-
+                                    A label selector requirement is a selector that contains values, a key, and an operator that
+                                    relates the key and values.
+                                  properties:
+                                    key:
+                                      description: key is the label key that the selector
+                                        applies to.
+                                      type: string
+                                    operator:
+                                      description: |-
+                                        operator represents a key's relationship to a set of values.
+                                        Valid operators are In, NotIn, Exists and DoesNotExist.
+                                      enum:
+                                      - In
+                                      - NotIn
+                                      - Exists
+                                      - DoesNotExist
+                                      type: string
+                                    values:
+                                      description: |-
+                                        values is an array of string values. If the operator is In or NotIn,
+                                        the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                        the values array must be empty. This array is replaced during a strategic
+                                        merge patch.
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                  required:
+                                  - key
+                                  - operator
+                                  type: object
+                                type: array
+                                x-kubernetes-list-type: atomic
+                              matchLabels:
+                                additionalProperties:
+                                  description: MatchLabelsValue represents the value
+                                    from the MatchLabels {key,value} pair.
+                                  maxLength: 63
+                                  pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
+                                  type: string
+                                description: |-
+                                  matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                  map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                  operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                type: object
+                            type: object
+                            x-kubernetes-map-type: atomic
+                          except:
+                            description: |-
+                              ExceptCIDRs is a list of IP blocks which the endpoint subject to the rule
+                              is not allowed to initiate connections to. These CIDR prefixes should be
+                              contained within Cidr, using ExceptCIDRs together with CIDRGroupRef is not
+                              supported yet.
+                              These exceptions are only applied to the Cidr in this CIDRRule, and do not
+                              apply to any other CIDR prefixes in any other CIDRRules.
+                            items:
+                              description: |-
+                                CIDR specifies a block of IP addresses.
+                                Example: 192.0.2.1/32
+                              format: cidr
+                              type: string
+                            type: array
+                        type: object
+                      type: array
+                    fromEndpoints:
+                      description: |-
+                        FromEndpoints is a list of endpoints identified by an
+                        EndpointSelector which are allowed to communicate with the endpoint
+                        subject to the rule.
+
+                        Example:
+                        Any endpoint with the label "role=backend" can be consumed by any
+                        endpoint carrying the label "role=frontend".
+
+                        Note that while an empty non-nil FromEndpoints does not select anything,
+                        nil FromEndpoints is implicitly treated as a wildcard selector if ToPorts
+                        are also specified.
+                        To select everything, use one EndpointSelector without any match requirements.
+                      items:
+                        description: EndpointSelector is a wrapper for k8s LabelSelector.
+                        properties:
+                          matchExpressions:
+                            description: matchExpressions is a list of label selector
+                              requirements. The requirements are ANDed.
+                            items:
+                              description: |-
+                                A label selector requirement is a selector that contains values, a key, and an operator that
+                                relates the key and values.
+                              properties:
+                                key:
+                                  description: key is the label key that the selector
+                                    applies to.
+                                  type: string
+                                operator:
+                                  description: |-
+                                    operator represents a key's relationship to a set of values.
+                                    Valid operators are In, NotIn, Exists and DoesNotExist.
+                                  enum:
+                                  - In
+                                  - NotIn
+                                  - Exists
+                                  - DoesNotExist
+                                  type: string
+                                values:
+                                  description: |-
+                                    values is an array of string values. If the operator is In or NotIn,
+                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                    the values array must be empty. This array is replaced during a strategic
+                                    merge patch.
+                                  items:
+                                    type: string
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                              required:
+                              - key
+                              - operator
+                              type: object
+                            type: array
+                            x-kubernetes-list-type: atomic
+                          matchLabels:
+                            additionalProperties:
+                              description: MatchLabelsValue represents the value from
+                                the MatchLabels {key,value} pair.
+                              maxLength: 63
+                              pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
+                              type: string
+                            description: |-
+                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                              map is equivalent to an element of matchExpressions, whose key field is "key", the
+                              operator is "In", and the values array contains only "value". The requirements are ANDed.
+                            type: object
+                        type: object
+                        x-kubernetes-map-type: atomic
+                      type: array
+                    fromEntities:
+                      description: |-
+                        FromEntities is a list of special entities which the endpoint subject
+                        to the rule is allowed to receive connections from. Supported entities are
+                        `world`, `cluster`, `cluster-mesh`, `host`, `remote-node`, `kube-apiserver`, `ingress`, `init`,
+                        `health`, `unmanaged`, `none` and `all`.
+                      items:
+                        description: |-
+                          Entity specifies the class of receiver/sender endpoints that do not have
+                          individual identities.  Entities are used to describe "outside of cluster",
+                          "host", etc.
+                        enum:
+                        - all
+                        - world
+                        - cluster
+                        - cluster-mesh
+                        - host
+                        - init
+                        - ingress
+                        - unmanaged
+                        - remote-node
+                        - health
+                        - none
+                        - kube-apiserver
+                        type: string
+                      type: array
+                    fromGroups:
+                      description: |-
+                        FromGroups allows policies to reference CIDRs provided by external integrations.
+                        Currently, only AWS is supported, and the rule can select by multiple sub directives.
+                        FromGroups entries are functionally equivalent to FromCIDR, and have the same
+                        limitiations. They cannot select traffic originating from within the cluster.
+
+                        Example:
+                        fromGroups:
+                        - aws:
+                            securityGroupsIds:
+                            - 'sg-XXXXXXXXXXXXX'
+                      items:
+                        description: Groups allows referencing CIDRs that are resolved
+                          from an external integration.
+                        properties:
+                          aws:
+                            description: AWSGroup is an structure that can be used
+                              to whitelisting information from AWS integration
+                            properties:
+                              labels:
+                                additionalProperties:
+                                  type: string
+                                description: |-
+                                  Labels selects AWS ENIs by labels.
+                                  Multiple labels are AND-ed together.
+                                type: object
+                              region:
+                                description: 'Deprecated: Region is unused.'
+                                type: string
+                              securityGroupsIds:
+                                description: |-
+                                  SecurityGroupsIds selects VPC SecurityGroups by IDs.
+                                  If multiple IDs are specified, they are OR-ed together.
+
+                                  Note that this may be AND-ed with any Names specified. Specifying both
+                                  IDs and Names is not recommended.
+                                items:
+                                  type: string
+                                type: array
+                              securityGroupsNames:
+                                description: |-
+                                  SecurityGroupsNames selects VPC SecurityGroups by name.
+                                  If multiple names are specified, they are OR-ed together.
+
+                                  Note that this may be AND-ed with any IDs specified. Specifying both
+                                  IDs and Names is not recommended.
+                                items:
+                                  type: string
+                                type: array
+                            type: object
+                        type: object
+                      type: array
+                    fromNodes:
+                      description: |-
+                        FromNodes is a list of nodes identified by an
+                        EndpointSelector which are allowed to communicate with the endpoint
+                        subject to the rule.
+                      items:
+                        description: EndpointSelector is a wrapper for k8s LabelSelector.
+                        properties:
+                          matchExpressions:
+                            description: matchExpressions is a list of label selector
+                              requirements. The requirements are ANDed.
+                            items:
+                              description: |-
+                                A label selector requirement is a selector that contains values, a key, and an operator that
+                                relates the key and values.
+                              properties:
+                                key:
+                                  description: key is the label key that the selector
+                                    applies to.
+                                  type: string
+                                operator:
+                                  description: |-
+                                    operator represents a key's relationship to a set of values.
+                                    Valid operators are In, NotIn, Exists and DoesNotExist.
+                                  enum:
+                                  - In
+                                  - NotIn
+                                  - Exists
+                                  - DoesNotExist
+                                  type: string
+                                values:
+                                  description: |-
+                                    values is an array of string values. If the operator is In or NotIn,
+                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                    the values array must be empty. This array is replaced during a strategic
+                                    merge patch.
+                                  items:
+                                    type: string
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                              required:
+                              - key
+                              - operator
+                              type: object
+                            type: array
+                            x-kubernetes-list-type: atomic
+                          matchLabels:
+                            additionalProperties:
+                              description: MatchLabelsValue represents the value from
+                                the MatchLabels {key,value} pair.
+                              maxLength: 63
+                              pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
+                              type: string
+                            description: |-
+                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                              map is equivalent to an element of matchExpressions, whose key field is "key", the
+                              operator is "In", and the values array contains only "value". The requirements are ANDed.
+                            type: object
+                        type: object
+                        x-kubernetes-map-type: atomic
+                      type: array
+                    fromRequires:
+                      description: Deprecated.
+                      items:
+                        type: string
+                      maxItems: 0
+                      type: array
+                    icmps:
+                      description: |-
+                        ICMPs is a list of ICMP rule identified by type number
+                        which the endpoint subject to the rule is allowed to
+                        receive connections on.
+
+                        Example:
+                        Any endpoint with the label "app=httpd" can only accept incoming
+                        type 8 ICMP connections.
+                      items:
+                        description: ICMPRule is a list of ICMP fields.
+                        properties:
+                          fields:
+                            description: Fields is a list of ICMP fields.
+                            items:
+                              description: ICMPField is a ICMP field.
+                              properties:
+                                family:
+                                  default: IPv4
+                                  description: |-
+                                    Family is a IP address version.
+                                    Currently, we support `IPv4` and `IPv6`.
+                                    `IPv4` is set as default.
+                                  enum:
+                                  - IPv4
+                                  - IPv6
+                                  type: string
+                                type:
+                                  anyOf:
+                                  - type: integer
+                                  - type: string
+                                  description: "Type is a ICMP-type.\nIt should be
+                                    an 8bit code (0-255), or it's CamelCase name (for
+                                    example, \"EchoReply\").\nAllowed ICMP types are:\n
+                                    \   Ipv4: EchoReply | DestinationUnreachable |
+                                    Redirect | Echo | EchoRequest |\n\t\t     RouterAdvertisement
+                                    | RouterSelection | TimeExceeded | ParameterProblem
+                                    |\n\t\t\t Timestamp | TimestampReply | Photuris
+                                    | ExtendedEcho Request | ExtendedEcho Reply\n
+                                    \   Ipv6: DestinationUnreachable | PacketTooBig
+                                    | TimeExceeded | ParameterProblem |\n\t\t\t EchoRequest
+                                    | EchoReply | MulticastListenerQuery| MulticastListenerReport
+                                    |\n\t\t\t MulticastListenerDone | RouterSolicitation
+                                    | RouterAdvertisement | NeighborSolicitation |\n\t\t\t
+                                    NeighborAdvertisement | RedirectMessage | RouterRenumbering
+                                    | ICMPNodeInformationQuery |\n\t\t\t ICMPNodeInformationResponse
+                                    | InverseNeighborDiscoverySolicitation | InverseNeighborDiscoveryAdvertisement
+                                    |\n\t\t\t HomeAgentAddressDiscoveryRequest | HomeAgentAddressDiscoveryReply
+                                    | MobilePrefixSolicitation |\n\t\t\t MobilePrefixAdvertisement
+                                    | DuplicateAddressRequestCodeSuffix | DuplicateAddressConfirmationCodeSuffix
+                                    |\n\t\t\t ExtendedEchoRequest | ExtendedEchoReply"
+                                  pattern: ^([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]|EchoReply|DestinationUnreachable|Redirect|Echo|RouterAdvertisement|RouterSelection|TimeExceeded|ParameterProblem|Timestamp|TimestampReply|Photuris|ExtendedEchoRequest|ExtendedEcho
+                                    Reply|PacketTooBig|ParameterProblem|EchoRequest|MulticastListenerQuery|MulticastListenerReport|MulticastListenerDone|RouterSolicitation|RouterAdvertisement|NeighborSolicitation|NeighborAdvertisement|RedirectMessage|RouterRenumbering|ICMPNodeInformationQuery|ICMPNodeInformationResponse|InverseNeighborDiscoverySolicitation|InverseNeighborDiscoveryAdvertisement|HomeAgentAddressDiscoveryRequest|HomeAgentAddressDiscoveryReply|MobilePrefixSolicitation|MobilePrefixAdvertisement|DuplicateAddressRequestCodeSuffix|DuplicateAddressConfirmationCodeSuffix)$
+                                  x-kubernetes-int-or-string: true
+                              required:
+                              - type
+                              type: object
+                            maxItems: 40
+                            type: array
+                        type: object
+                      type: array
+                    toPorts:
+                      description: |-
+                        ToPorts is a list of destination ports identified by port number and
+                        protocol which the endpoint subject to the rule is allowed to
+                        receive connections on.
+
+                        Example:
+                        Any endpoint with the label "app=httpd" can only accept incoming
+                        connections on port 80/tcp.
+                      items:
+                        description: |-
+                          PortRule is a list of ports/protocol combinations with optional Layer 7
+                          rules which must be met.
+                        properties:
+                          listener:
+                            description: |-
+                              listener specifies the name of a custom Envoy listener to which this traffic should be
+                              redirected to.
+                            properties:
+                              envoyConfig:
+                                description: |-
+                                  EnvoyConfig is a reference to the CEC or CCEC resource in which
+                                  the listener is defined.
+                                properties:
+                                  kind:
+                                    description: |-
+                                      Kind is the resource type being referred to. Defaults to CiliumEnvoyConfig or
+                                      CiliumClusterwideEnvoyConfig for CiliumNetworkPolicy and CiliumClusterwideNetworkPolicy,
+                                      respectively. The only case this is currently explicitly needed is when referring to a
+                                      CiliumClusterwideEnvoyConfig from CiliumNetworkPolicy, as using a namespaced listener
+                                      from a cluster scoped policy is not allowed.
+                                    enum:
+                                    - CiliumEnvoyConfig
+                                    - CiliumClusterwideEnvoyConfig
+                                    type: string
+                                  name:
+                                    description: |-
+                                      Name is the resource name of the CiliumEnvoyConfig or CiliumClusterwideEnvoyConfig where
+                                      the listener is defined in.
+                                    minLength: 1
+                                    type: string
+                                required:
+                                - name
+                                type: object
+                              name:
+                                description: Name is the name of the listener.
+                                minLength: 1
+                                type: string
+                              priority:
+                                description: |-
+                                  Priority for this Listener that is used when multiple rules would apply different
+                                  listeners to a policy map entry. Behavior of this is implementation dependent.
+                                maximum: 100
+                                minimum: 1
+                                type: integer
+                            required:
+                            - envoyConfig
+                            - name
+                            type: object
+                          originatingTLS:
+                            description: |-
+                              OriginatingTLS is the TLS context for the connections originated by
+                              the L7 proxy.  For egress policy this specifies the client-side TLS
+                              parameters for the upstream connection originating from the L7 proxy
+                              to the remote destination. For ingress policy this specifies the
+                              client-side TLS parameters for the connection from the L7 proxy to
+                              the local endpoint.
+                            properties:
+                              certificate:
+                                description: |-
+                                  Certificate is the file name or k8s secret item name for the certificate
+                                  chain. If omitted, 'tls.crt' is assumed, if it exists. If given, the
+                                  item must exist.
+                                type: string
+                              privateKey:
+                                description: |-
+                                  PrivateKey is the file name or k8s secret item name for the private key
+                                  matching the certificate chain. If omitted, 'tls.key' is assumed, if it
+                                  exists. If given, the item must exist.
+                                type: string
+                              secret:
+                                description: |-
+                                  Secret is the secret that contains the certificates and private key for
+                                  the TLS context.
+                                  By default, Cilium will search in this secret for the following items:
+                                   - 'ca.crt'  - Which represents the trusted CA to verify remote source.
+                                   - 'tls.crt' - Which represents the public key certificate.
+                                   - 'tls.key' - Which represents the private key matching the public key
+                                                 certificate.
+                                properties:
+                                  name:
+                                    description: Name is the name of the secret.
+                                    type: string
+                                  namespace:
+                                    description: |-
+                                      Namespace is the namespace in which the secret exists. Context of use
+                                      determines the default value if left out (e.g., "default").
+                                    type: string
+                                required:
+                                - name
+                                type: object
+                              trustedCA:
+                                description: |-
+                                  TrustedCA is the file name or k8s secret item name for the trusted CA.
+                                  If omitted, 'ca.crt' is assumed, if it exists. If given, the item must
+                                  exist.
+                                type: string
+                            required:
+                            - secret
+                            type: object
+                          ports:
+                            description: Ports is a list of L4 port/protocol
+                            items:
+                              description: PortProtocol specifies an L4 port with
+                                an optional transport protocol
+                              properties:
+                                endPort:
+                                  description: EndPort can only be an L4 port number.
+                                  format: int32
+                                  maximum: 65535
+                                  minimum: 0
+                                  type: integer
+                                port:
+                                  description: |-
+                                    Port can be an L4 port number, or a name in the form of "http"
+                                    or "http-8080".
+                                  pattern: ^(6553[0-5]|655[0-2][0-9]|65[0-4][0-9]{2}|6[0-4][0-9]{3}|[1-5][0-9]{4}|[0-9]{1,4})|([a-zA-Z0-9]-?)*[a-zA-Z](-?[a-zA-Z0-9])*$
+                                  type: string
+                                protocol:
+                                  description: |-
+                                    Protocol is the L4 protocol. If "ANY", omitted or empty, any protocols
+                                    with transport ports (TCP, UDP, SCTP) match.
+
+                                    Accepted values: "TCP", "UDP", "SCTP", "VRRP", "IGMP", "GRE", "IPIP",
+                                    "IPV6", "ESP", "AH", "ANY"
+
+                                    Tunnel/encapsulation protocols (GRE, IPIP, IPV6, ESP, AH) and other
+                                    extended IP protocols (VRRP, IGMP) require the --enable-extended-ip-protocols
+                                    flag to be set. These protocols do not use transport-layer ports.
+
+                                    Matching on ICMP is not supported.
+
+                                    Named port specified for a container may narrow this down, but may not
+                                    contradict this.
+                                  enum:
+                                  - TCP
+                                  - UDP
+                                  - SCTP
+                                  - VRRP
+                                  - IGMP
+                                  - GRE
+                                  - IPIP
+                                  - IPV6
+                                  - ESP
+                                  - AH
+                                  - ANY
+                                  type: string
+                              type: object
+                            maxItems: 40
+                            type: array
+                          rules:
+                            description: |-
+                              Rules is a list of additional port level rules which must be met in
+                              order for the PortRule to allow the traffic. If omitted or empty,
+                              no layer 7 rules are enforced.
+                            oneOf:
+                            - properties:
+                                http: {}
+                              required:
+                              - http
+                            - properties:
+                                dns: {}
+                              required:
+                              - dns
+                            properties:
+                              dns:
+                                description: DNS-specific rules.
+                                items:
+                                  description: PortRuleDNS is a list of allowed DNS
+                                    lookups.
+                                  oneOf:
+                                  - properties:
+                                      matchName: {}
+                                    required:
+                                    - matchName
+                                  - properties:
+                                      matchPattern: {}
+                                    required:
+                                    - matchPattern
+                                  properties:
+                                    matchName:
+                                      description: |-
+                                        MatchName matches literal DNS names. A trailing "." is automatically added
+                                        when missing.
+                                      maxLength: 255
+                                      pattern: ^([-a-zA-Z0-9_]+[.]?)+$
+                                      type: string
+                                    matchPattern:
+                                      description: |-
+                                        MatchPattern allows using wildcards to match DNS names. All wildcards are
+                                        case insensitive. The wildcards are:
+                                        - "*" matches 0 or more DNS valid characters, and may occur anywhere in
+                                        the pattern. As a special case a "*" as the leftmost character, without a
+                                        following "." matches all subdomains as well as the name to the right.
+                                        A trailing "." is automatically added when missing.
+                                        - "**." is a special prefix which matches all multilevel subdomains in the prefix.
+
+                                        Examples:
+                                        1. `*.cilium.io` matches subdomains of cilium at that level
+                                          www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
+                                        2. `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
+                                          except those containing "." separator, subcilium.io and sub-cilium.io match,
+                                          www.cilium.io and blog.cilium.io does not
+                                        3. `sub*.cilium.io` matches subdomains of cilium where the subdomain component
+                                          begins with "sub". sub.cilium.io and subdomain.cilium.io match while www.cilium.io,
+                                          blog.cilium.io, cilium.io and google.com do not
+                                        4. `**.cilium.io` matches all multilevel subdomains of cilium.io.
+                                          "app.cilium.io" and "test.app.cilium.io" match but not "cilium.io"
+                                      maxLength: 255
+                                      pattern: ^([-a-zA-Z0-9_*]+[.]?)+$
+                                      type: string
+                                  type: object
+                                type: array
+                              http:
+                                description: HTTP specific rules.
+                                items:
+                                  description: |-
+                                    PortRuleHTTP is a list of HTTP protocol constraints. All fields are
+                                    optional, if all fields are empty or missing, the rule does not have any
+                                    effect.
+
+                                    All fields of this type are extended POSIX regex as defined by IEEE Std
+                                    1003.1, (i.e this follows the egrep/unix syntax, not the perl syntax)
+                                    matched against the path of an incoming request. Currently it can contain
+                                    characters disallowed from the conventional "path" part of a URL as defined
+                                    by RFC 3986.
+                                  properties:
+                                    headerMatches:
+                                      description: |-
+                                        HeaderMatches is a list of HTTP headers which must be
+                                        present and match against the given values. Mismatch field can be used
+                                        to specify what to do when there is no match.
+                                      items:
+                                        description: |-
+                                          HeaderMatch extends the HeaderValue for matching requirement of a
+                                          named header field against an immediate string or a secret value.
+                                          If none of the optional fields is present, then the
+                                          header value is not matched, only presence of the header is enough.
+                                        properties:
+                                          mismatch:
+                                            description: |-
+                                              Mismatch identifies what to do in case there is no match. The default is
+                                              to drop the request. Otherwise the overall rule is still considered as
+                                              matching, but the mismatches are logged in the access log.
+                                            enum:
+                                            - LOG
+                                            - ADD
+                                            - DELETE
+                                            - REPLACE
+                                            type: string
+                                          name:
+                                            description: Name identifies the header.
+                                            minLength: 1
+                                            type: string
+                                          secret:
+                                            description: |-
+                                              Secret refers to a secret that contains the value to be matched against.
+                                              The secret must only contain one entry. If the referred secret does not
+                                              exist, and there is no "Value" specified, the match will fail.
+                                            properties:
+                                              name:
+                                                description: Name is the name of the
+                                                  secret.
+                                                type: string
+                                              namespace:
+                                                description: |-
+                                                  Namespace is the namespace in which the secret exists. Context of use
+                                                  determines the default value if left out (e.g., "default").
+                                                type: string
+                                            required:
+                                            - name
+                                            type: object
+                                          value:
+                                            description: |-
+                                              Value matches the exact value of the header. Can be specified either
+                                              alone or together with "Secret"; will be used as the header value if the
+                                              secret can not be found in the latter case.
+                                            type: string
+                                        required:
+                                        - name
+                                        type: object
+                                      type: array
+                                    headers:
+                                      description: |-
+                                        Headers is a list of HTTP headers which must be present in the
+                                        request. If omitted or empty, requests are allowed regardless of
+                                        headers present.
+                                      items:
+                                        type: string
+                                      type: array
+                                    host:
+                                      description: |-
+                                        Host is an extended POSIX regex matched against the host header of a
+                                        request. Examples:
+
+                                        - foo.bar.com will match the host fooXbar.com or foo-bar.com
+                                        - foo\.bar\.com will only match the host foo.bar.com
+
+                                        If omitted or empty, the value of the host header is ignored.
+                                      format: idn-hostname
+                                      type: string
+                                    method:
+                                      description: |-
+                                        Method is an extended POSIX regex matched against the method of a
+                                        request, e.g. "GET", "POST", "PUT", "PATCH", "DELETE", ...
+
+                                        If omitted or empty, all methods are allowed.
+                                      type: string
+                                    path:
+                                      description: |-
+                                        Path is an extended POSIX regex matched against the path of a
+                                        request. Currently it can contain characters disallowed from the
+                                        conventional "path" part of a URL as defined by RFC 3986.
+
+                                        If omitted or empty, all paths are all allowed.
+                                      type: string
+                                  type: object
+                                type: array
+                            type: object
+                          serverNames:
+                            description: |-
+                              ServerNames is a list of allowed TLS SNI values. If not empty, then
+                              TLS must be present and one of the provided SNIs must be indicated in the
+                              TLS handshake.
+                            items:
+                              description: |-
+                                ServerName allows using '*' wildcard specifier for matching server names with
+                                the below semantics.
+
+                                - `*` matches 0 or more DNS valid characters, and may occur anywhere in the pattern.
+                                - `**.` is a special prefix which matches all multilevel subdomains in the prefix.
+
+                                As a special case the name "*" matches all valid DNS names.
+
+                                Examples:
+                                 1. `*.cilium.io` matches subdomains of cilium at that level
+                                    www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
+                                 2. `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
+                                    except those containing "." separator, subcilium.io and sub-cilium.io match,
+                                    www.cilium.io and blog.cilium.io does not
+                                 3. `sub*.cilium.io` matches subdomains of cilium where the subdomain component
+                                    begins with "sub". sub.cilium.io and subdomain.cilium.io match while www.cilium.io,
+                                    blog.cilium.io, cilium.io and google.com do not
+                                 4. `**.cilium.io` matches all multilevel subdomains of cilium.io.
+                                    "app.cilium.io" and "test.app.cilium.io" match but not "cilium.io"
+                              maxLength: 255
+                              pattern: ^([-a-zA-Z0-9_*]+[.]?)+$
+                              type: string
+                            minItems: 1
+                            type: array
+                            x-kubernetes-list-type: set
+                          terminatingTLS:
+                            description: |-
+                              TerminatingTLS is the TLS context for the connection terminated by
+                              the L7 proxy.  For egress policy this specifies the server-side TLS
+                              parameters to be applied on the connections originated from the local
+                              endpoint and terminated by the L7 proxy. For ingress policy this specifies
+                              the server-side TLS parameters to be applied on the connections
+                              originated from a remote source and terminated by the L7 proxy.
+                            properties:
+                              certificate:
+                                description: |-
+                                  Certificate is the file name or k8s secret item name for the certificate
+                                  chain. If omitted, 'tls.crt' is assumed, if it exists. If given, the
+                                  item must exist.
+                                type: string
+                              privateKey:
+                                description: |-
+                                  PrivateKey is the file name or k8s secret item name for the private key
+                                  matching the certificate chain. If omitted, 'tls.key' is assumed, if it
+                                  exists. If given, the item must exist.
+                                type: string
+                              secret:
+                                description: |-
+                                  Secret is the secret that contains the certificates and private key for
+                                  the TLS context.
+                                  By default, Cilium will search in this secret for the following items:
+                                   - 'ca.crt'  - Which represents the trusted CA to verify remote source.
+                                   - 'tls.crt' - Which represents the public key certificate.
+                                   - 'tls.key' - Which represents the private key matching the public key
+                                                 certificate.
+                                properties:
+                                  name:
+                                    description: Name is the name of the secret.
+                                    type: string
+                                  namespace:
+                                    description: |-
+                                      Namespace is the namespace in which the secret exists. Context of use
+                                      determines the default value if left out (e.g., "default").
+                                    type: string
+                                required:
+                                - name
+                                type: object
+                              trustedCA:
+                                description: |-
+                                  TrustedCA is the file name or k8s secret item name for the trusted CA.
+                                  If omitted, 'ca.crt' is assumed, if it exists. If given, the item must
+                                  exist.
+                                type: string
+                            required:
+                            - secret
+                            type: object
+                        type: object
+                      type: array
+                  type: object
+                type: array
+              ingressDeny:
+                description: |-
+                  IngressDeny is a list of IngressDenyRule which are enforced at ingress.
+                  Any rule inserted here will be denied regardless of the allowed ingress
+                  rules in the 'ingress' field.
+                  If omitted or empty, this rule does not apply at ingress.
+                items:
+                  description: |-
+                    IngressDenyRule contains all rule types which can be applied at ingress,
+                    i.e. network traffic that originates outside of the endpoint and
+                    is entering the endpoint selected by the endpointSelector.
+
+                      - All members of this structure are optional. If omitted or empty, the
+                        member will have no effect on the rule.
+
+                      - If multiple members are set, all of them need to match in order for
+                        the rule to take effect.
+
+                      - FromEndpoints, FromCIDR, FromCIDRSet, FromGroups and FromEntities are mutually
+                        exclusive. Only one of these members may be present within an individual
+                        rule.
+                  properties:
+                    fromCIDR:
+                      description: |-
+                        FromCIDR is a list of IP blocks which the endpoint subject to the
+                        rule is allowed to receive connections from. Only connections which
+                        do *not* originate from the cluster or from the local host are subject
+                        to CIDR rules. In order to allow in-cluster connectivity, use the
+                        FromEndpoints field.  This will match on the source IP address of
+                        incoming connections. Adding  a prefix into FromCIDR or into
+                        FromCIDRSet with no ExcludeCIDRs is  equivalent.  Overlaps are
+                        allowed between FromCIDR and FromCIDRSet.
+
+                        Example:
+                        Any endpoint with the label "app=my-legacy-pet" is allowed to receive
+                        connections from 10.3.9.1
+                      items:
+                        description: |-
+                          CIDR specifies a block of IP addresses.
+                          Example: 192.0.2.1/32
+                        format: cidr
+                        type: string
+                      type: array
+                    fromCIDRSet:
+                      description: |-
+                        FromCIDRSet is a list of IP blocks which the endpoint subject to the
+                        rule is allowed to receive connections from in addition to FromEndpoints,
+                        along with a list of subnets contained within their corresponding IP block
+                        from which traffic should not be allowed.
+                        This will match on the source IP address of incoming connections. Adding
+                        a prefix into FromCIDR or into FromCIDRSet with no ExcludeCIDRs is
+                        equivalent. Overlaps are allowed between FromCIDR and FromCIDRSet.
+
+                        Example:
+                        Any endpoint with the label "app=my-legacy-pet" is allowed to receive
+                        connections from 10.0.0.0/8 except from IPs in subnet 10.96.0.0/12.
+                      items:
+                        description: |-
+                          CIDRRule is a rule that specifies a CIDR prefix to/from which outside
+                          communication  is allowed, along with an optional list of subnets within that
+                          CIDR prefix to/from which outside communication is not allowed.
+                        oneOf:
+                        - properties:
+                            cidr: {}
+                          required:
+                          - cidr
+                        - properties:
+                            cidrGroupRef: {}
+                          required:
+                          - cidrGroupRef
+                        - properties:
+                            cidrGroupSelector: {}
+                          required:
+                          - cidrGroupSelector
+                        properties:
+                          cidr:
+                            description: CIDR is a CIDR prefix / IP Block.
+                            format: cidr
+                            type: string
+                          cidrGroupRef:
+                            description: |-
+                              CIDRGroupRef is a reference to a CiliumCIDRGroup object.
+                              A CiliumCIDRGroup contains a list of CIDRs that the endpoint, subject to
+                              the rule, can (Ingress/Egress) or cannot (IngressDeny/EgressDeny) receive
+                              connections from.
+                            maxLength: 253
+                            pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                            type: string
+                          cidrGroupSelector:
+                            description: |-
+                              CIDRGroupSelector selects CiliumCIDRGroups by their labels,
+                              rather than by name.
+                            properties:
+                              matchExpressions:
+                                description: matchExpressions is a list of label selector
+                                  requirements. The requirements are ANDed.
+                                items:
+                                  description: |-
+                                    A label selector requirement is a selector that contains values, a key, and an operator that
+                                    relates the key and values.
+                                  properties:
+                                    key:
+                                      description: key is the label key that the selector
+                                        applies to.
+                                      type: string
+                                    operator:
+                                      description: |-
+                                        operator represents a key's relationship to a set of values.
+                                        Valid operators are In, NotIn, Exists and DoesNotExist.
+                                      enum:
+                                      - In
+                                      - NotIn
+                                      - Exists
+                                      - DoesNotExist
+                                      type: string
+                                    values:
+                                      description: |-
+                                        values is an array of string values. If the operator is In or NotIn,
+                                        the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                        the values array must be empty. This array is replaced during a strategic
+                                        merge patch.
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                  required:
+                                  - key
+                                  - operator
+                                  type: object
+                                type: array
+                                x-kubernetes-list-type: atomic
+                              matchLabels:
+                                additionalProperties:
+                                  description: MatchLabelsValue represents the value
+                                    from the MatchLabels {key,value} pair.
+                                  maxLength: 63
+                                  pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
+                                  type: string
+                                description: |-
+                                  matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                  map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                  operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                type: object
+                            type: object
+                            x-kubernetes-map-type: atomic
+                          except:
+                            description: |-
+                              ExceptCIDRs is a list of IP blocks which the endpoint subject to the rule
+                              is not allowed to initiate connections to. These CIDR prefixes should be
+                              contained within Cidr, using ExceptCIDRs together with CIDRGroupRef is not
+                              supported yet.
+                              These exceptions are only applied to the Cidr in this CIDRRule, and do not
+                              apply to any other CIDR prefixes in any other CIDRRules.
+                            items:
+                              description: |-
+                                CIDR specifies a block of IP addresses.
+                                Example: 192.0.2.1/32
+                              format: cidr
+                              type: string
+                            type: array
+                        type: object
+                      type: array
+                    fromEndpoints:
+                      description: |-
+                        FromEndpoints is a list of endpoints identified by an
+                        EndpointSelector which are allowed to communicate with the endpoint
+                        subject to the rule.
+
+                        Example:
+                        Any endpoint with the label "role=backend" can be consumed by any
+                        endpoint carrying the label "role=frontend".
+
+                        Note that while an empty non-nil FromEndpoints does not select anything,
+                        nil FromEndpoints is implicitly treated as a wildcard selector if ToPorts
+                        are also specified.
+                        To select everything, use one EndpointSelector without any match requirements.
+                      items:
+                        description: EndpointSelector is a wrapper for k8s LabelSelector.
+                        properties:
+                          matchExpressions:
+                            description: matchExpressions is a list of label selector
+                              requirements. The requirements are ANDed.
+                            items:
+                              description: |-
+                                A label selector requirement is a selector that contains values, a key, and an operator that
+                                relates the key and values.
+                              properties:
+                                key:
+                                  description: key is the label key that the selector
+                                    applies to.
+                                  type: string
+                                operator:
+                                  description: |-
+                                    operator represents a key's relationship to a set of values.
+                                    Valid operators are In, NotIn, Exists and DoesNotExist.
+                                  enum:
+                                  - In
+                                  - NotIn
+                                  - Exists
+                                  - DoesNotExist
+                                  type: string
+                                values:
+                                  description: |-
+                                    values is an array of string values. If the operator is In or NotIn,
+                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                    the values array must be empty. This array is replaced during a strategic
+                                    merge patch.
+                                  items:
+                                    type: string
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                              required:
+                              - key
+                              - operator
+                              type: object
+                            type: array
+                            x-kubernetes-list-type: atomic
+                          matchLabels:
+                            additionalProperties:
+                              description: MatchLabelsValue represents the value from
+                                the MatchLabels {key,value} pair.
+                              maxLength: 63
+                              pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
+                              type: string
+                            description: |-
+                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                              map is equivalent to an element of matchExpressions, whose key field is "key", the
+                              operator is "In", and the values array contains only "value". The requirements are ANDed.
+                            type: object
+                        type: object
+                        x-kubernetes-map-type: atomic
+                      type: array
+                    fromEntities:
+                      description: |-
+                        FromEntities is a list of special entities which the endpoint subject
+                        to the rule is allowed to receive connections from. Supported entities are
+                        `world`, `cluster`, `cluster-mesh`, `host`, `remote-node`, `kube-apiserver`, `ingress`, `init`,
+                        `health`, `unmanaged`, `none` and `all`.
+                      items:
+                        description: |-
+                          Entity specifies the class of receiver/sender endpoints that do not have
+                          individual identities.  Entities are used to describe "outside of cluster",
+                          "host", etc.
+                        enum:
+                        - all
+                        - world
+                        - cluster
+                        - cluster-mesh
+                        - host
+                        - init
+                        - ingress
+                        - unmanaged
+                        - remote-node
+                        - health
+                        - none
+                        - kube-apiserver
+                        type: string
+                      type: array
+                    fromGroups:
+                      description: |-
+                        FromGroups allows policies to reference CIDRs provided by external integrations.
+                        Currently, only AWS is supported, and the rule can select by multiple sub directives.
+                        FromGroups entries are functionally equivalent to FromCIDR, and have the same
+                        limitiations. They cannot select traffic originating from within the cluster.
+
+                        Example:
+                        fromGroups:
+                        - aws:
+                            securityGroupsIds:
+                            - 'sg-XXXXXXXXXXXXX'
+                      items:
+                        description: Groups allows referencing CIDRs that are resolved
+                          from an external integration.
+                        properties:
+                          aws:
+                            description: AWSGroup is an structure that can be used
+                              to whitelisting information from AWS integration
+                            properties:
+                              labels:
+                                additionalProperties:
+                                  type: string
+                                description: |-
+                                  Labels selects AWS ENIs by labels.
+                                  Multiple labels are AND-ed together.
+                                type: object
+                              region:
+                                description: 'Deprecated: Region is unused.'
+                                type: string
+                              securityGroupsIds:
+                                description: |-
+                                  SecurityGroupsIds selects VPC SecurityGroups by IDs.
+                                  If multiple IDs are specified, they are OR-ed together.
+
+                                  Note that this may be AND-ed with any Names specified. Specifying both
+                                  IDs and Names is not recommended.
+                                items:
+                                  type: string
+                                type: array
+                              securityGroupsNames:
+                                description: |-
+                                  SecurityGroupsNames selects VPC SecurityGroups by name.
+                                  If multiple names are specified, they are OR-ed together.
+
+                                  Note that this may be AND-ed with any IDs specified. Specifying both
+                                  IDs and Names is not recommended.
+                                items:
+                                  type: string
+                                type: array
+                            type: object
+                        type: object
+                      type: array
+                    fromNodes:
+                      description: |-
+                        FromNodes is a list of nodes identified by an
+                        EndpointSelector which are allowed to communicate with the endpoint
+                        subject to the rule.
+                      items:
+                        description: EndpointSelector is a wrapper for k8s LabelSelector.
+                        properties:
+                          matchExpressions:
+                            description: matchExpressions is a list of label selector
+                              requirements. The requirements are ANDed.
+                            items:
+                              description: |-
+                                A label selector requirement is a selector that contains values, a key, and an operator that
+                                relates the key and values.
+                              properties:
+                                key:
+                                  description: key is the label key that the selector
+                                    applies to.
+                                  type: string
+                                operator:
+                                  description: |-
+                                    operator represents a key's relationship to a set of values.
+                                    Valid operators are In, NotIn, Exists and DoesNotExist.
+                                  enum:
+                                  - In
+                                  - NotIn
+                                  - Exists
+                                  - DoesNotExist
+                                  type: string
+                                values:
+                                  description: |-
+                                    values is an array of string values. If the operator is In or NotIn,
+                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                    the values array must be empty. This array is replaced during a strategic
+                                    merge patch.
+                                  items:
+                                    type: string
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                              required:
+                              - key
+                              - operator
+                              type: object
+                            type: array
+                            x-kubernetes-list-type: atomic
+                          matchLabels:
+                            additionalProperties:
+                              description: MatchLabelsValue represents the value from
+                                the MatchLabels {key,value} pair.
+                              maxLength: 63
+                              pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
+                              type: string
+                            description: |-
+                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                              map is equivalent to an element of matchExpressions, whose key field is "key", the
+                              operator is "In", and the values array contains only "value". The requirements are ANDed.
+                            type: object
+                        type: object
+                        x-kubernetes-map-type: atomic
+                      type: array
+                    fromRequires:
+                      description: Deprecated.
+                      items:
+                        type: string
+                      maxItems: 0
+                      type: array
+                    icmps:
+                      description: |-
+                        ICMPs is a list of ICMP rule identified by type number
+                        which the endpoint subject to the rule is not allowed to
+                        receive connections on.
+
+                        Example:
+                        Any endpoint with the label "app=httpd" can not accept incoming
+                        type 8 ICMP connections.
+                      items:
+                        description: ICMPRule is a list of ICMP fields.
+                        properties:
+                          fields:
+                            description: Fields is a list of ICMP fields.
+                            items:
+                              description: ICMPField is a ICMP field.
+                              properties:
+                                family:
+                                  default: IPv4
+                                  description: |-
+                                    Family is a IP address version.
+                                    Currently, we support `IPv4` and `IPv6`.
+                                    `IPv4` is set as default.
+                                  enum:
+                                  - IPv4
+                                  - IPv6
+                                  type: string
+                                type:
+                                  anyOf:
+                                  - type: integer
+                                  - type: string
+                                  description: "Type is a ICMP-type.\nIt should be
+                                    an 8bit code (0-255), or it's CamelCase name (for
+                                    example, \"EchoReply\").\nAllowed ICMP types are:\n
+                                    \   Ipv4: EchoReply | DestinationUnreachable |
+                                    Redirect | Echo | EchoRequest |\n\t\t     RouterAdvertisement
+                                    | RouterSelection | TimeExceeded | ParameterProblem
+                                    |\n\t\t\t Timestamp | TimestampReply | Photuris
+                                    | ExtendedEcho Request | ExtendedEcho Reply\n
+                                    \   Ipv6: DestinationUnreachable | PacketTooBig
+                                    | TimeExceeded | ParameterProblem |\n\t\t\t EchoRequest
+                                    | EchoReply | MulticastListenerQuery| MulticastListenerReport
+                                    |\n\t\t\t MulticastListenerDone | RouterSolicitation
+                                    | RouterAdvertisement | NeighborSolicitation |\n\t\t\t
+                                    NeighborAdvertisement | RedirectMessage | RouterRenumbering
+                                    | ICMPNodeInformationQuery |\n\t\t\t ICMPNodeInformationResponse
+                                    | InverseNeighborDiscoverySolicitation | InverseNeighborDiscoveryAdvertisement
+                                    |\n\t\t\t HomeAgentAddressDiscoveryRequest | HomeAgentAddressDiscoveryReply
+                                    | MobilePrefixSolicitation |\n\t\t\t MobilePrefixAdvertisement
+                                    | DuplicateAddressRequestCodeSuffix | DuplicateAddressConfirmationCodeSuffix
+                                    |\n\t\t\t ExtendedEchoRequest | ExtendedEchoReply"
+                                  pattern: ^([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]|EchoReply|DestinationUnreachable|Redirect|Echo|RouterAdvertisement|RouterSelection|TimeExceeded|ParameterProblem|Timestamp|TimestampReply|Photuris|ExtendedEchoRequest|ExtendedEcho
+                                    Reply|PacketTooBig|ParameterProblem|EchoRequest|MulticastListenerQuery|MulticastListenerReport|MulticastListenerDone|RouterSolicitation|RouterAdvertisement|NeighborSolicitation|NeighborAdvertisement|RedirectMessage|RouterRenumbering|ICMPNodeInformationQuery|ICMPNodeInformationResponse|InverseNeighborDiscoverySolicitation|InverseNeighborDiscoveryAdvertisement|HomeAgentAddressDiscoveryRequest|HomeAgentAddressDiscoveryReply|MobilePrefixSolicitation|MobilePrefixAdvertisement|DuplicateAddressRequestCodeSuffix|DuplicateAddressConfirmationCodeSuffix)$
+                                  x-kubernetes-int-or-string: true
+                              required:
+                              - type
+                              type: object
+                            maxItems: 40
+                            type: array
+                        type: object
+                      type: array
+                    toPorts:
+                      description: |-
+                        ToPorts is a list of destination ports identified by port number and
+                        protocol which the endpoint subject to the rule is not allowed to
+                        receive connections on.
+
+                        Example:
+                        Any endpoint with the label "app=httpd" can not accept incoming
+                        connections on port 80/tcp.
+                      items:
+                        description: |-
+                          PortDenyRule is a list of ports/protocol that should be used for deny
+                          policies. This structure lacks the L7Rules since it's not supported in deny
+                          policies.
+                        properties:
+                          ports:
+                            description: Ports is a list of L4 port/protocol
+                            items:
+                              description: PortProtocol specifies an L4 port with
+                                an optional transport protocol
+                              properties:
+                                endPort:
+                                  description: EndPort can only be an L4 port number.
+                                  format: int32
+                                  maximum: 65535
+                                  minimum: 0
+                                  type: integer
+                                port:
+                                  description: |-
+                                    Port can be an L4 port number, or a name in the form of "http"
+                                    or "http-8080".
+                                  pattern: ^(6553[0-5]|655[0-2][0-9]|65[0-4][0-9]{2}|6[0-4][0-9]{3}|[1-5][0-9]{4}|[0-9]{1,4})|([a-zA-Z0-9]-?)*[a-zA-Z](-?[a-zA-Z0-9])*$
+                                  type: string
+                                protocol:
+                                  description: |-
+                                    Protocol is the L4 protocol. If "ANY", omitted or empty, any protocols
+                                    with transport ports (TCP, UDP, SCTP) match.
+
+                                    Accepted values: "TCP", "UDP", "SCTP", "VRRP", "IGMP", "GRE", "IPIP",
+                                    "IPV6", "ESP", "AH", "ANY"
+
+                                    Tunnel/encapsulation protocols (GRE, IPIP, IPV6, ESP, AH) and other
+                                    extended IP protocols (VRRP, IGMP) require the --enable-extended-ip-protocols
+                                    flag to be set. These protocols do not use transport-layer ports.
+
+                                    Matching on ICMP is not supported.
+
+                                    Named port specified for a container may narrow this down, but may not
+                                    contradict this.
+                                  enum:
+                                  - TCP
+                                  - UDP
+                                  - SCTP
+                                  - VRRP
+                                  - IGMP
+                                  - GRE
+                                  - IPIP
+                                  - IPV6
+                                  - ESP
+                                  - AH
+                                  - ANY
+                                  type: string
+                              type: object
+                            type: array
+                        type: object
+                      type: array
+                  type: object
+                type: array
+              labels:
+                description: |-
+                  Labels is a list of optional strings which can be used to
+                  re-identify the rule or to store metadata. It is possible to lookup
+                  or delete strings based on labels. Labels are not required to be
+                  unique, multiple rules can have overlapping or identical labels.
+                items:
+                  description: Label is Cilium's representation of a label.
+                  properties:
+                    key:
+                      type: string
+                    source:
+                      description: 'Source can be one of the above values (e.g.: LabelSourceK8s).'
+                      type: string
+                    value:
+                      type: string
+                  required:
+                  - key
+                  type: object
+                type: array
+              log:
+                description: Log specifies custom policy-specific Hubble logging configuration.
+                properties:
+                  value:
+                    description: |-
+                      Value is a free-form string that is included in Hubble flows
+                      that match this policy. The string is limited to 32 printable characters.
+                    maxLength: 32
+                    pattern: ^\PC*$
+                    type: string
+                type: object
+              nodeSelector:
+                description: |-
+                  NodeSelector selects all nodes which should be subject to this rule.
+                  EndpointSelector and NodeSelector cannot be both empty and are mutually
+                  exclusive. Can only be used in CiliumClusterwideNetworkPolicies.
+                properties:
+                  matchExpressions:
+                    description: matchExpressions is a list of label selector requirements.
+                      The requirements are ANDed.
+                    items:
+                      description: |-
+                        A label selector requirement is a selector that contains values, a key, and an operator that
+                        relates the key and values.
+                      properties:
+                        key:
+                          description: key is the label key that the selector applies
+                            to.
+                          type: string
+                        operator:
+                          description: |-
+                            operator represents a key's relationship to a set of values.
+                            Valid operators are In, NotIn, Exists and DoesNotExist.
+                          enum:
+                          - In
+                          - NotIn
+                          - Exists
+                          - DoesNotExist
+                          type: string
+                        values:
+                          description: |-
+                            values is an array of string values. If the operator is In or NotIn,
+                            the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                            the values array must be empty. This array is replaced during a strategic
+                            merge patch.
+                          items:
+                            type: string
+                          type: array
+                          x-kubernetes-list-type: atomic
+                      required:
+                      - key
+                      - operator
+                      type: object
+                    type: array
+                    x-kubernetes-list-type: atomic
+                  matchLabels:
+                    additionalProperties:
+                      description: MatchLabelsValue represents the value from the
+                        MatchLabels {key,value} pair.
+                      maxLength: 63
+                      pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
+                      type: string
+                    description: |-
+                      matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                      map is equivalent to an element of matchExpressions, whose key field is "key", the
+                      operator is "In", and the values array contains only "value". The requirements are ANDed.
+                    type: object
+                type: object
+                x-kubernetes-map-type: atomic
+            type: object
+          specs:
+            description: Specs is a list of desired Cilium specific rule specification.
+            items:
+              anyOf:
+              - properties:
+                  ingress: {}
+                required:
+                - ingress
+              - properties:
+                  ingressDeny: {}
+                required:
+                - ingressDeny
+              - properties:
+                  egress: {}
+                required:
+                - egress
+              - properties:
+                  egressDeny: {}
+                required:
+                - egressDeny
+              description: |-
+                Rule is a policy rule which must be applied to all endpoints which match the
+                labels contained in the endpointSelector
+
+                Each rule is split into an ingress section which contains all rules
+                applicable at ingress, and an egress section applicable at egress. For rule
+                types such as `L4Rule` and `CIDR` which can be applied at both ingress and
+                egress, both ingress and egress side have to either specifically allow the
+                connection or one side has to be omitted.
+
+                Either ingress, egress, or both can be provided. If both ingress and egress
+                are omitted, the rule has no effect.
+              oneOf:
+              - properties:
+                  endpointSelector: {}
+                required:
+                - endpointSelector
+              - properties:
+                  nodeSelector: {}
+                required:
+                - nodeSelector
+              properties:
+                description:
+                  description: |-
+                    Description is a free form string, it can be used by the creator of
+                    the rule to store human readable explanation of the purpose of this
+                    rule. Rules cannot be identified by comment.
+                  type: string
+                egress:
+                  description: |-
+                    Egress is a list of EgressRule which are enforced at egress.
+                    If omitted or empty, this rule does not apply at egress.
+                  items:
+                    description: |-
+                      EgressRule contains all rule types which can be applied at egress, i.e.
+                      network traffic that originates inside the endpoint and exits the endpoint
+                      selected by the endpointSelector.
+
+                        - All members of this structure are optional. If omitted or empty, the
+                          member will have no effect on the rule.
+
+                        - If multiple members of the structure are specified, then all members
+                          must match in order for the rule to take effect.
+
+                        - ToEndpoints, ToCIDR, ToCIDRSet, ToEntities, ToServices and ToGroups are
+                          mutually exclusive. Only one of these members may be present within an
+                          individual rule.
+                    properties:
+                      authentication:
+                        description: Authentication is the required authentication
+                          type for the allowed traffic, if any.
+                        properties:
+                          mode:
+                            description: Mode is the required authentication mode
+                              for the allowed traffic, if any.
+                            enum:
+                            - disabled
+                            - required
+                            - test-always-fail
+                            type: string
+                        required:
+                        - mode
+                        type: object
+                      icmps:
+                        description: |-
+                          ICMPs is a list of ICMP rule identified by type number
+                          which the endpoint subject to the rule is allowed to connect to.
+
+                          Example:
+                          Any endpoint with the label "app=httpd" is allowed to initiate
+                          type 8 ICMP connections.
+                        items:
+                          description: ICMPRule is a list of ICMP fields.
+                          properties:
+                            fields:
+                              description: Fields is a list of ICMP fields.
+                              items:
+                                description: ICMPField is a ICMP field.
+                                properties:
+                                  family:
+                                    default: IPv4
+                                    description: |-
+                                      Family is a IP address version.
+                                      Currently, we support `IPv4` and `IPv6`.
+                                      `IPv4` is set as default.
+                                    enum:
+                                    - IPv4
+                                    - IPv6
+                                    type: string
+                                  type:
+                                    anyOf:
+                                    - type: integer
+                                    - type: string
+                                    description: "Type is a ICMP-type.\nIt should
+                                      be an 8bit code (0-255), or it's CamelCase name
+                                      (for example, \"EchoReply\").\nAllowed ICMP
+                                      types are:\n    Ipv4: EchoReply | DestinationUnreachable
+                                      | Redirect | Echo | EchoRequest |\n\t\t     RouterAdvertisement
+                                      | RouterSelection | TimeExceeded | ParameterProblem
+                                      |\n\t\t\t Timestamp | TimestampReply | Photuris
+                                      | ExtendedEcho Request | ExtendedEcho Reply\n
+                                      \   Ipv6: DestinationUnreachable | PacketTooBig
+                                      | TimeExceeded | ParameterProblem |\n\t\t\t
+                                      EchoRequest | EchoReply | MulticastListenerQuery|
+                                      MulticastListenerReport |\n\t\t\t MulticastListenerDone
+                                      | RouterSolicitation | RouterAdvertisement |
+                                      NeighborSolicitation |\n\t\t\t NeighborAdvertisement
+                                      | RedirectMessage | RouterRenumbering | ICMPNodeInformationQuery
+                                      |\n\t\t\t ICMPNodeInformationResponse | InverseNeighborDiscoverySolicitation
+                                      | InverseNeighborDiscoveryAdvertisement |\n\t\t\t
+                                      HomeAgentAddressDiscoveryRequest | HomeAgentAddressDiscoveryReply
+                                      | MobilePrefixSolicitation |\n\t\t\t MobilePrefixAdvertisement
+                                      | DuplicateAddressRequestCodeSuffix | DuplicateAddressConfirmationCodeSuffix
+                                      |\n\t\t\t ExtendedEchoRequest | ExtendedEchoReply"
+                                    pattern: ^([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]|EchoReply|DestinationUnreachable|Redirect|Echo|RouterAdvertisement|RouterSelection|TimeExceeded|ParameterProblem|Timestamp|TimestampReply|Photuris|ExtendedEchoRequest|ExtendedEcho
+                                      Reply|PacketTooBig|ParameterProblem|EchoRequest|MulticastListenerQuery|MulticastListenerReport|MulticastListenerDone|RouterSolicitation|RouterAdvertisement|NeighborSolicitation|NeighborAdvertisement|RedirectMessage|RouterRenumbering|ICMPNodeInformationQuery|ICMPNodeInformationResponse|InverseNeighborDiscoverySolicitation|InverseNeighborDiscoveryAdvertisement|HomeAgentAddressDiscoveryRequest|HomeAgentAddressDiscoveryReply|MobilePrefixSolicitation|MobilePrefixAdvertisement|DuplicateAddressRequestCodeSuffix|DuplicateAddressConfirmationCodeSuffix)$
+                                    x-kubernetes-int-or-string: true
+                                required:
+                                - type
+                                type: object
+                              maxItems: 40
+                              type: array
+                          type: object
+                        type: array
+                      toCIDR:
+                        description: |-
+                          ToCIDR is a list of IP blocks which the endpoint subject to the rule
+                          is allowed to initiate connections. Only connections destined for
+                          outside of the cluster and not targeting the host will be subject
+                          to CIDR rules.  This will match on the destination IP address of
+                          outgoing connections. Adding a prefix into ToCIDR or into ToCIDRSet
+                          with no ExcludeCIDRs is equivalent. Overlaps are allowed between
+                          ToCIDR and ToCIDRSet.
+
+                          Example:
+                          Any endpoint with the label "app=database-proxy" is allowed to
+                          initiate connections to 10.2.3.0/24
+                        items:
+                          description: |-
+                            CIDR specifies a block of IP addresses.
+                            Example: 192.0.2.1/32
+                          format: cidr
+                          type: string
+                        type: array
+                      toCIDRSet:
+                        description: |-
+                          ToCIDRSet is a list of IP blocks which the endpoint subject to the rule
+                          is allowed to initiate connections to in addition to connections
+                          which are allowed via ToEndpoints, along with a list of subnets contained
+                          within their corresponding IP block to which traffic should not be
+                          allowed. This will match on the destination IP address of outgoing
+                          connections. Adding a prefix into ToCIDR or into ToCIDRSet with no
+                          ExcludeCIDRs is equivalent. Overlaps are allowed between ToCIDR and
+                          ToCIDRSet.
+
+                          Example:
+                          Any endpoint with the label "app=database-proxy" is allowed to
+                          initiate connections to 10.2.3.0/24 except from IPs in subnet 10.2.3.0/28.
+                        items:
+                          description: |-
+                            CIDRRule is a rule that specifies a CIDR prefix to/from which outside
+                            communication  is allowed, along with an optional list of subnets within that
+                            CIDR prefix to/from which outside communication is not allowed.
+                          oneOf:
+                          - properties:
+                              cidr: {}
+                            required:
+                            - cidr
+                          - properties:
+                              cidrGroupRef: {}
+                            required:
+                            - cidrGroupRef
+                          - properties:
+                              cidrGroupSelector: {}
+                            required:
+                            - cidrGroupSelector
+                          properties:
+                            cidr:
+                              description: CIDR is a CIDR prefix / IP Block.
+                              format: cidr
+                              type: string
+                            cidrGroupRef:
+                              description: |-
+                                CIDRGroupRef is a reference to a CiliumCIDRGroup object.
+                                A CiliumCIDRGroup contains a list of CIDRs that the endpoint, subject to
+                                the rule, can (Ingress/Egress) or cannot (IngressDeny/EgressDeny) receive
+                                connections from.
+                              maxLength: 253
+                              pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                              type: string
+                            cidrGroupSelector:
+                              description: |-
+                                CIDRGroupSelector selects CiliumCIDRGroups by their labels,
+                                rather than by name.
+                              properties:
+                                matchExpressions:
+                                  description: matchExpressions is a list of label
+                                    selector requirements. The requirements are ANDed.
+                                  items:
+                                    description: |-
+                                      A label selector requirement is a selector that contains values, a key, and an operator that
+                                      relates the key and values.
+                                    properties:
+                                      key:
+                                        description: key is the label key that the
+                                          selector applies to.
+                                        type: string
+                                      operator:
+                                        description: |-
+                                          operator represents a key's relationship to a set of values.
+                                          Valid operators are In, NotIn, Exists and DoesNotExist.
+                                        enum:
+                                        - In
+                                        - NotIn
+                                        - Exists
+                                        - DoesNotExist
+                                        type: string
+                                      values:
+                                        description: |-
+                                          values is an array of string values. If the operator is In or NotIn,
+                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                          the values array must be empty. This array is replaced during a strategic
+                                          merge patch.
+                                        items:
+                                          type: string
+                                        type: array
+                                        x-kubernetes-list-type: atomic
+                                    required:
+                                    - key
+                                    - operator
+                                    type: object
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                matchLabels:
+                                  additionalProperties:
+                                    description: MatchLabelsValue represents the value
+                                      from the MatchLabels {key,value} pair.
+                                    maxLength: 63
+                                    pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
+                                    type: string
+                                  description: |-
+                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                  type: object
+                              type: object
+                              x-kubernetes-map-type: atomic
+                            except:
+                              description: |-
+                                ExceptCIDRs is a list of IP blocks which the endpoint subject to the rule
+                                is not allowed to initiate connections to. These CIDR prefixes should be
+                                contained within Cidr, using ExceptCIDRs together with CIDRGroupRef is not
+                                supported yet.
+                                These exceptions are only applied to the Cidr in this CIDRRule, and do not
+                                apply to any other CIDR prefixes in any other CIDRRules.
+                              items:
+                                description: |-
+                                  CIDR specifies a block of IP addresses.
+                                  Example: 192.0.2.1/32
+                                format: cidr
+                                type: string
+                              type: array
+                          type: object
+                        type: array
+                      toEndpoints:
+                        description: |-
+                          ToEndpoints is a list of endpoints identified by an EndpointSelector to
+                          which the endpoints subject to the rule are allowed to communicate.
+
+                          Example:
+                          Any endpoint with the label "role=frontend" can communicate with any
+                          endpoint carrying the label "role=backend".
+
+                          Note that while an empty non-nil ToEndpoints does not select anything,
+                          nil ToEndpoints is implicitly treated as a wildcard selector if ToPorts
+                          are also specified.
+                          To select everything, use one EndpointSelector without any match requirements.
+                        items:
+                          description: EndpointSelector is a wrapper for k8s LabelSelector.
+                          properties:
+                            matchExpressions:
+                              description: matchExpressions is a list of label selector
+                                requirements. The requirements are ANDed.
+                              items:
+                                description: |-
+                                  A label selector requirement is a selector that contains values, a key, and an operator that
+                                  relates the key and values.
+                                properties:
+                                  key:
+                                    description: key is the label key that the selector
+                                      applies to.
+                                    type: string
+                                  operator:
+                                    description: |-
+                                      operator represents a key's relationship to a set of values.
+                                      Valid operators are In, NotIn, Exists and DoesNotExist.
+                                    enum:
+                                    - In
+                                    - NotIn
+                                    - Exists
+                                    - DoesNotExist
+                                    type: string
+                                  values:
+                                    description: |-
+                                      values is an array of string values. If the operator is In or NotIn,
+                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                      the values array must be empty. This array is replaced during a strategic
+                                      merge patch.
+                                    items:
+                                      type: string
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                required:
+                                - key
+                                - operator
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
+                            matchLabels:
+                              additionalProperties:
+                                description: MatchLabelsValue represents the value
+                                  from the MatchLabels {key,value} pair.
+                                maxLength: 63
+                                pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
+                                type: string
+                              description: |-
+                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                operator is "In", and the values array contains only "value". The requirements are ANDed.
+                              type: object
+                          type: object
+                          x-kubernetes-map-type: atomic
+                        type: array
+                      toEntities:
+                        description: |-
+                          ToEntities is a list of special entities to which the endpoint subject
+                          to the rule is allowed to initiate connections. Supported entities are
+                          `world`, `cluster`, `cluster-mesh`, `host`, `remote-node`, `kube-apiserver`, `ingress`, `init`,
+                          `health`, `unmanaged`, `none` and `all`.
+                        items:
+                          description: |-
+                            Entity specifies the class of receiver/sender endpoints that do not have
+                            individual identities.  Entities are used to describe "outside of cluster",
+                            "host", etc.
+                          enum:
+                          - all
+                          - world
+                          - cluster
+                          - cluster-mesh
+                          - host
+                          - init
+                          - ingress
+                          - unmanaged
+                          - remote-node
+                          - health
+                          - none
+                          - kube-apiserver
+                          type: string
+                        type: array
+                      toFQDNs:
+                        description: |-
+                          ToFQDN allows whitelisting DNS names in place of IPs. The IPs that result
+                          from DNS resolution of `ToFQDN.MatchName`s are added to the same
+                          EgressRule object as ToCIDRSet entries, and behave accordingly. Any L4 and
+                          L7 rules within this EgressRule will also apply to these IPs.
+                          The DNS -> IP mapping is re-resolved periodically from within the
+                          cilium-agent, and the IPs in the DNS response are effected in the policy
+                          for selected pods as-is (i.e. the list of IPs is not modified in any way).
+                          Note: An explicit rule to allow for DNS traffic is needed for the pods, as
+                          ToFQDN counts as an egress rule and will enforce egress policy when
+                          PolicyEnforcment=default.
+                          Note: If the resolved IPs are IPs within the kubernetes cluster, the
+                          ToFQDN rule will not apply to that IP.
+                          Note: ToFQDN cannot occur in the same policy as other To* rules.
+                        items:
+                          oneOf:
+                          - properties:
+                              matchName: {}
+                            required:
+                            - matchName
+                          - properties:
+                              matchPattern: {}
+                            required:
+                            - matchPattern
+                          properties:
+                            matchName:
+                              description: |-
+                                MatchName matches literal DNS names. A trailing "." is automatically added
+                                when missing.
+                              maxLength: 255
+                              pattern: ^([-a-zA-Z0-9_]+[.]?)+$
+                              type: string
+                            matchPattern:
+                              description: |-
+                                MatchPattern allows using wildcards to match DNS names. All wildcards are
+                                case insensitive. The wildcards are:
+                                - "*" matches 0 or more DNS valid characters, and may occur anywhere in
+                                the pattern. As a special case a "*" as the leftmost character, without a
+                                following "." matches all subdomains as well as the name to the right.
+                                A trailing "." is automatically added when missing.
+                                - "**." is a special prefix which matches all multilevel subdomains in the prefix.
+
+                                Examples:
+                                1. `*.cilium.io` matches subdomains of cilium at that level
+                                  www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
+                                2. `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
+                                  except those containing "." separator, subcilium.io and sub-cilium.io match,
+                                  www.cilium.io and blog.cilium.io does not
+                                3. `sub*.cilium.io` matches subdomains of cilium where the subdomain component
+                                  begins with "sub". sub.cilium.io and subdomain.cilium.io match while www.cilium.io,
+                                  blog.cilium.io, cilium.io and google.com do not
+                                4. `**.cilium.io` matches all multilevel subdomains of cilium.io.
+                                  "app.cilium.io" and "test.app.cilium.io" match but not "cilium.io"
+                              maxLength: 255
+                              pattern: ^([-a-zA-Z0-9_*]+[.]?)+$
+                              type: string
+                          type: object
+                        type: array
+                      toGroups:
+                        description: |-
+                          ToGroups allows policies to reference CIDRs provided by external integrations.
+                          Currently, only AWS is supported, and the rule can select by multiple sub directives.
+                          ToGroups entries are functionally equivalent to toCIDR, and have the same
+                          limitiations. They cannot select traffic originating from within the cluster.
+
+                          Example:
+                          toGroups:
+                          - aws:
+                              securityGroupsIds:
+                              - 'sg-XXXXXXXXXXXXX'
+                        items:
+                          description: Groups allows referencing CIDRs that are resolved
+                            from an external integration.
+                          properties:
+                            aws:
+                              description: AWSGroup is an structure that can be used
+                                to whitelisting information from AWS integration
+                              properties:
+                                labels:
+                                  additionalProperties:
+                                    type: string
+                                  description: |-
+                                    Labels selects AWS ENIs by labels.
+                                    Multiple labels are AND-ed together.
+                                  type: object
+                                region:
+                                  description: 'Deprecated: Region is unused.'
+                                  type: string
+                                securityGroupsIds:
+                                  description: |-
+                                    SecurityGroupsIds selects VPC SecurityGroups by IDs.
+                                    If multiple IDs are specified, they are OR-ed together.
+
+                                    Note that this may be AND-ed with any Names specified. Specifying both
+                                    IDs and Names is not recommended.
+                                  items:
+                                    type: string
+                                  type: array
+                                securityGroupsNames:
+                                  description: |-
+                                    SecurityGroupsNames selects VPC SecurityGroups by name.
+                                    If multiple names are specified, they are OR-ed together.
+
+                                    Note that this may be AND-ed with any IDs specified. Specifying both
+                                    IDs and Names is not recommended.
+                                  items:
+                                    type: string
+                                  type: array
+                              type: object
+                          type: object
+                        type: array
+                      toNodes:
+                        description: |-
+                          ToNodes is a list of nodes identified by an
+                          EndpointSelector to which endpoints subject to the rule is allowed to communicate.
+                        items:
+                          description: EndpointSelector is a wrapper for k8s LabelSelector.
+                          properties:
+                            matchExpressions:
+                              description: matchExpressions is a list of label selector
+                                requirements. The requirements are ANDed.
+                              items:
+                                description: |-
+                                  A label selector requirement is a selector that contains values, a key, and an operator that
+                                  relates the key and values.
+                                properties:
+                                  key:
+                                    description: key is the label key that the selector
+                                      applies to.
+                                    type: string
+                                  operator:
+                                    description: |-
+                                      operator represents a key's relationship to a set of values.
+                                      Valid operators are In, NotIn, Exists and DoesNotExist.
+                                    enum:
+                                    - In
+                                    - NotIn
+                                    - Exists
+                                    - DoesNotExist
+                                    type: string
+                                  values:
+                                    description: |-
+                                      values is an array of string values. If the operator is In or NotIn,
+                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                      the values array must be empty. This array is replaced during a strategic
+                                      merge patch.
+                                    items:
+                                      type: string
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                required:
+                                - key
+                                - operator
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
+                            matchLabels:
+                              additionalProperties:
+                                description: MatchLabelsValue represents the value
+                                  from the MatchLabels {key,value} pair.
+                                maxLength: 63
+                                pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
+                                type: string
+                              description: |-
+                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                operator is "In", and the values array contains only "value". The requirements are ANDed.
+                              type: object
+                          type: object
+                          x-kubernetes-map-type: atomic
+                        type: array
+                      toPorts:
+                        description: |-
+                          ToPorts is a list of destination ports identified by port number and
+                          protocol which the endpoint subject to the rule is allowed to
+                          connect to.
+
+                          Example:
+                          Any endpoint with the label "role=frontend" is allowed to initiate
+                          connections to destination port 8080/tcp
+                        items:
+                          description: |-
+                            PortRule is a list of ports/protocol combinations with optional Layer 7
+                            rules which must be met.
+                          properties:
+                            listener:
+                              description: |-
+                                listener specifies the name of a custom Envoy listener to which this traffic should be
+                                redirected to.
+                              properties:
+                                envoyConfig:
+                                  description: |-
+                                    EnvoyConfig is a reference to the CEC or CCEC resource in which
+                                    the listener is defined.
+                                  properties:
+                                    kind:
+                                      description: |-
+                                        Kind is the resource type being referred to. Defaults to CiliumEnvoyConfig or
+                                        CiliumClusterwideEnvoyConfig for CiliumNetworkPolicy and CiliumClusterwideNetworkPolicy,
+                                        respectively. The only case this is currently explicitly needed is when referring to a
+                                        CiliumClusterwideEnvoyConfig from CiliumNetworkPolicy, as using a namespaced listener
+                                        from a cluster scoped policy is not allowed.
+                                      enum:
+                                      - CiliumEnvoyConfig
+                                      - CiliumClusterwideEnvoyConfig
+                                      type: string
+                                    name:
+                                      description: |-
+                                        Name is the resource name of the CiliumEnvoyConfig or CiliumClusterwideEnvoyConfig where
+                                        the listener is defined in.
+                                      minLength: 1
+                                      type: string
+                                  required:
+                                  - name
+                                  type: object
+                                name:
+                                  description: Name is the name of the listener.
+                                  minLength: 1
+                                  type: string
+                                priority:
+                                  description: |-
+                                    Priority for this Listener that is used when multiple rules would apply different
+                                    listeners to a policy map entry. Behavior of this is implementation dependent.
+                                  maximum: 100
+                                  minimum: 1
+                                  type: integer
+                              required:
+                              - envoyConfig
+                              - name
+                              type: object
+                            originatingTLS:
+                              description: |-
+                                OriginatingTLS is the TLS context for the connections originated by
+                                the L7 proxy.  For egress policy this specifies the client-side TLS
+                                parameters for the upstream connection originating from the L7 proxy
+                                to the remote destination. For ingress policy this specifies the
+                                client-side TLS parameters for the connection from the L7 proxy to
+                                the local endpoint.
+                              properties:
+                                certificate:
+                                  description: |-
+                                    Certificate is the file name or k8s secret item name for the certificate
+                                    chain. If omitted, 'tls.crt' is assumed, if it exists. If given, the
+                                    item must exist.
+                                  type: string
+                                privateKey:
+                                  description: |-
+                                    PrivateKey is the file name or k8s secret item name for the private key
+                                    matching the certificate chain. If omitted, 'tls.key' is assumed, if it
+                                    exists. If given, the item must exist.
+                                  type: string
+                                secret:
+                                  description: |-
+                                    Secret is the secret that contains the certificates and private key for
+                                    the TLS context.
+                                    By default, Cilium will search in this secret for the following items:
+                                     - 'ca.crt'  - Which represents the trusted CA to verify remote source.
+                                     - 'tls.crt' - Which represents the public key certificate.
+                                     - 'tls.key' - Which represents the private key matching the public key
+                                                   certificate.
+                                  properties:
+                                    name:
+                                      description: Name is the name of the secret.
+                                      type: string
+                                    namespace:
+                                      description: |-
+                                        Namespace is the namespace in which the secret exists. Context of use
+                                        determines the default value if left out (e.g., "default").
+                                      type: string
+                                  required:
+                                  - name
+                                  type: object
+                                trustedCA:
+                                  description: |-
+                                    TrustedCA is the file name or k8s secret item name for the trusted CA.
+                                    If omitted, 'ca.crt' is assumed, if it exists. If given, the item must
+                                    exist.
+                                  type: string
+                              required:
+                              - secret
+                              type: object
+                            ports:
+                              description: Ports is a list of L4 port/protocol
+                              items:
+                                description: PortProtocol specifies an L4 port with
+                                  an optional transport protocol
+                                properties:
+                                  endPort:
+                                    description: EndPort can only be an L4 port number.
+                                    format: int32
+                                    maximum: 65535
+                                    minimum: 0
+                                    type: integer
+                                  port:
+                                    description: |-
+                                      Port can be an L4 port number, or a name in the form of "http"
+                                      or "http-8080".
+                                    pattern: ^(6553[0-5]|655[0-2][0-9]|65[0-4][0-9]{2}|6[0-4][0-9]{3}|[1-5][0-9]{4}|[0-9]{1,4})|([a-zA-Z0-9]-?)*[a-zA-Z](-?[a-zA-Z0-9])*$
+                                    type: string
+                                  protocol:
+                                    description: |-
+                                      Protocol is the L4 protocol. If "ANY", omitted or empty, any protocols
+                                      with transport ports (TCP, UDP, SCTP) match.
+
+                                      Accepted values: "TCP", "UDP", "SCTP", "VRRP", "IGMP", "GRE", "IPIP",
+                                      "IPV6", "ESP", "AH", "ANY"
+
+                                      Tunnel/encapsulation protocols (GRE, IPIP, IPV6, ESP, AH) and other
+                                      extended IP protocols (VRRP, IGMP) require the --enable-extended-ip-protocols
+                                      flag to be set. These protocols do not use transport-layer ports.
+
+                                      Matching on ICMP is not supported.
+
+                                      Named port specified for a container may narrow this down, but may not
+                                      contradict this.
+                                    enum:
+                                    - TCP
+                                    - UDP
+                                    - SCTP
+                                    - VRRP
+                                    - IGMP
+                                    - GRE
+                                    - IPIP
+                                    - IPV6
+                                    - ESP
+                                    - AH
+                                    - ANY
+                                    type: string
+                                type: object
+                              maxItems: 40
+                              type: array
+                            rules:
+                              description: |-
+                                Rules is a list of additional port level rules which must be met in
+                                order for the PortRule to allow the traffic. If omitted or empty,
+                                no layer 7 rules are enforced.
+                              oneOf:
+                              - properties:
+                                  http: {}
+                                required:
+                                - http
+                              - properties:
+                                  dns: {}
+                                required:
+                                - dns
+                              properties:
+                                dns:
+                                  description: DNS-specific rules.
+                                  items:
+                                    description: PortRuleDNS is a list of allowed
+                                      DNS lookups.
+                                    oneOf:
+                                    - properties:
+                                        matchName: {}
+                                      required:
+                                      - matchName
+                                    - properties:
+                                        matchPattern: {}
+                                      required:
+                                      - matchPattern
+                                    properties:
+                                      matchName:
+                                        description: |-
+                                          MatchName matches literal DNS names. A trailing "." is automatically added
+                                          when missing.
+                                        maxLength: 255
+                                        pattern: ^([-a-zA-Z0-9_]+[.]?)+$
+                                        type: string
+                                      matchPattern:
+                                        description: |-
+                                          MatchPattern allows using wildcards to match DNS names. All wildcards are
+                                          case insensitive. The wildcards are:
+                                          - "*" matches 0 or more DNS valid characters, and may occur anywhere in
+                                          the pattern. As a special case a "*" as the leftmost character, without a
+                                          following "." matches all subdomains as well as the name to the right.
+                                          A trailing "." is automatically added when missing.
+                                          - "**." is a special prefix which matches all multilevel subdomains in the prefix.
+
+                                          Examples:
+                                          1. `*.cilium.io` matches subdomains of cilium at that level
+                                            www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
+                                          2. `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
+                                            except those containing "." separator, subcilium.io and sub-cilium.io match,
+                                            www.cilium.io and blog.cilium.io does not
+                                          3. `sub*.cilium.io` matches subdomains of cilium where the subdomain component
+                                            begins with "sub". sub.cilium.io and subdomain.cilium.io match while www.cilium.io,
+                                            blog.cilium.io, cilium.io and google.com do not
+                                          4. `**.cilium.io` matches all multilevel subdomains of cilium.io.
+                                            "app.cilium.io" and "test.app.cilium.io" match but not "cilium.io"
+                                        maxLength: 255
+                                        pattern: ^([-a-zA-Z0-9_*]+[.]?)+$
+                                        type: string
+                                    type: object
+                                  type: array
+                                http:
+                                  description: HTTP specific rules.
+                                  items:
+                                    description: |-
+                                      PortRuleHTTP is a list of HTTP protocol constraints. All fields are
+                                      optional, if all fields are empty or missing, the rule does not have any
+                                      effect.
+
+                                      All fields of this type are extended POSIX regex as defined by IEEE Std
+                                      1003.1, (i.e this follows the egrep/unix syntax, not the perl syntax)
+                                      matched against the path of an incoming request. Currently it can contain
+                                      characters disallowed from the conventional "path" part of a URL as defined
+                                      by RFC 3986.
+                                    properties:
+                                      headerMatches:
+                                        description: |-
+                                          HeaderMatches is a list of HTTP headers which must be
+                                          present and match against the given values. Mismatch field can be used
+                                          to specify what to do when there is no match.
+                                        items:
+                                          description: |-
+                                            HeaderMatch extends the HeaderValue for matching requirement of a
+                                            named header field against an immediate string or a secret value.
+                                            If none of the optional fields is present, then the
+                                            header value is not matched, only presence of the header is enough.
+                                          properties:
+                                            mismatch:
+                                              description: |-
+                                                Mismatch identifies what to do in case there is no match. The default is
+                                                to drop the request. Otherwise the overall rule is still considered as
+                                                matching, but the mismatches are logged in the access log.
+                                              enum:
+                                              - LOG
+                                              - ADD
+                                              - DELETE
+                                              - REPLACE
+                                              type: string
+                                            name:
+                                              description: Name identifies the header.
+                                              minLength: 1
+                                              type: string
+                                            secret:
+                                              description: |-
+                                                Secret refers to a secret that contains the value to be matched against.
+                                                The secret must only contain one entry. If the referred secret does not
+                                                exist, and there is no "Value" specified, the match will fail.
+                                              properties:
+                                                name:
+                                                  description: Name is the name of
+                                                    the secret.
+                                                  type: string
+                                                namespace:
+                                                  description: |-
+                                                    Namespace is the namespace in which the secret exists. Context of use
+                                                    determines the default value if left out (e.g., "default").
+                                                  type: string
+                                              required:
+                                              - name
+                                              type: object
+                                            value:
+                                              description: |-
+                                                Value matches the exact value of the header. Can be specified either
+                                                alone or together with "Secret"; will be used as the header value if the
+                                                secret can not be found in the latter case.
+                                              type: string
+                                          required:
+                                          - name
+                                          type: object
+                                        type: array
+                                      headers:
+                                        description: |-
+                                          Headers is a list of HTTP headers which must be present in the
+                                          request. If omitted or empty, requests are allowed regardless of
+                                          headers present.
+                                        items:
+                                          type: string
+                                        type: array
+                                      host:
+                                        description: |-
+                                          Host is an extended POSIX regex matched against the host header of a
+                                          request. Examples:
+
+                                          - foo.bar.com will match the host fooXbar.com or foo-bar.com
+                                          - foo\.bar\.com will only match the host foo.bar.com
+
+                                          If omitted or empty, the value of the host header is ignored.
+                                        format: idn-hostname
+                                        type: string
+                                      method:
+                                        description: |-
+                                          Method is an extended POSIX regex matched against the method of a
+                                          request, e.g. "GET", "POST", "PUT", "PATCH", "DELETE", ...
+
+                                          If omitted or empty, all methods are allowed.
+                                        type: string
+                                      path:
+                                        description: |-
+                                          Path is an extended POSIX regex matched against the path of a
+                                          request. Currently it can contain characters disallowed from the
+                                          conventional "path" part of a URL as defined by RFC 3986.
+
+                                          If omitted or empty, all paths are all allowed.
+                                        type: string
+                                    type: object
+                                  type: array
+                              type: object
+                            serverNames:
+                              description: |-
+                                ServerNames is a list of allowed TLS SNI values. If not empty, then
+                                TLS must be present and one of the provided SNIs must be indicated in the
+                                TLS handshake.
+                              items:
+                                description: |-
+                                  ServerName allows using '*' wildcard specifier for matching server names with
+                                  the below semantics.
+
+                                  - `*` matches 0 or more DNS valid characters, and may occur anywhere in the pattern.
+                                  - `**.` is a special prefix which matches all multilevel subdomains in the prefix.
+
+                                  As a special case the name "*" matches all valid DNS names.
+
+                                  Examples:
+                                   1. `*.cilium.io` matches subdomains of cilium at that level
+                                      www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
+                                   2. `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
+                                      except those containing "." separator, subcilium.io and sub-cilium.io match,
+                                      www.cilium.io and blog.cilium.io does not
+                                   3. `sub*.cilium.io` matches subdomains of cilium where the subdomain component
+                                      begins with "sub". sub.cilium.io and subdomain.cilium.io match while www.cilium.io,
+                                      blog.cilium.io, cilium.io and google.com do not
+                                   4. `**.cilium.io` matches all multilevel subdomains of cilium.io.
+                                      "app.cilium.io" and "test.app.cilium.io" match but not "cilium.io"
+                                maxLength: 255
+                                pattern: ^([-a-zA-Z0-9_*]+[.]?)+$
+                                type: string
+                              minItems: 1
+                              type: array
+                              x-kubernetes-list-type: set
+                            terminatingTLS:
+                              description: |-
+                                TerminatingTLS is the TLS context for the connection terminated by
+                                the L7 proxy.  For egress policy this specifies the server-side TLS
+                                parameters to be applied on the connections originated from the local
+                                endpoint and terminated by the L7 proxy. For ingress policy this specifies
+                                the server-side TLS parameters to be applied on the connections
+                                originated from a remote source and terminated by the L7 proxy.
+                              properties:
+                                certificate:
+                                  description: |-
+                                    Certificate is the file name or k8s secret item name for the certificate
+                                    chain. If omitted, 'tls.crt' is assumed, if it exists. If given, the
+                                    item must exist.
+                                  type: string
+                                privateKey:
+                                  description: |-
+                                    PrivateKey is the file name or k8s secret item name for the private key
+                                    matching the certificate chain. If omitted, 'tls.key' is assumed, if it
+                                    exists. If given, the item must exist.
+                                  type: string
+                                secret:
+                                  description: |-
+                                    Secret is the secret that contains the certificates and private key for
+                                    the TLS context.
+                                    By default, Cilium will search in this secret for the following items:
+                                     - 'ca.crt'  - Which represents the trusted CA to verify remote source.
+                                     - 'tls.crt' - Which represents the public key certificate.
+                                     - 'tls.key' - Which represents the private key matching the public key
+                                                   certificate.
+                                  properties:
+                                    name:
+                                      description: Name is the name of the secret.
+                                      type: string
+                                    namespace:
+                                      description: |-
+                                        Namespace is the namespace in which the secret exists. Context of use
+                                        determines the default value if left out (e.g., "default").
+                                      type: string
+                                  required:
+                                  - name
+                                  type: object
+                                trustedCA:
+                                  description: |-
+                                    TrustedCA is the file name or k8s secret item name for the trusted CA.
+                                    If omitted, 'ca.crt' is assumed, if it exists. If given, the item must
+                                    exist.
+                                  type: string
+                              required:
+                              - secret
+                              type: object
+                          type: object
+                        type: array
+                      toRequires:
+                        description: Deprecated.
+                        items:
+                          type: string
+                        maxItems: 0
+                        type: array
+                      toServices:
+                        description: |-
+                          ToServices is a list of services to which the endpoint subject
+                          to the rule is allowed to initiate connections.
+                          Currently Cilium only supports toServices for K8s services.
+                        items:
+                          description: |-
+                            Service selects policy targets that are bundled as part of a
+                            logical load-balanced service.
+
+                            Currently only Kubernetes-based Services are supported.
+                          properties:
+                            k8sService:
+                              description: K8sService selects service by name and
+                                namespace pair
+                              properties:
+                                namespace:
+                                  type: string
+                                serviceName:
+                                  type: string
+                              type: object
+                            k8sServiceSelector:
+                              description: K8sServiceSelector selects services by
+                                k8s labels and namespace
+                              properties:
+                                namespace:
+                                  type: string
+                                selector:
+                                  description: ServiceSelector is a label selector
+                                    for k8s services
+                                  properties:
+                                    matchExpressions:
+                                      description: matchExpressions is a list of label
+                                        selector requirements. The requirements are
+                                        ANDed.
+                                      items:
+                                        description: |-
+                                          A label selector requirement is a selector that contains values, a key, and an operator that
+                                          relates the key and values.
+                                        properties:
+                                          key:
+                                            description: key is the label key that
+                                              the selector applies to.
+                                            type: string
+                                          operator:
+                                            description: |-
+                                              operator represents a key's relationship to a set of values.
+                                              Valid operators are In, NotIn, Exists and DoesNotExist.
+                                            enum:
+                                            - In
+                                            - NotIn
+                                            - Exists
+                                            - DoesNotExist
+                                            type: string
+                                          values:
+                                            description: |-
+                                              values is an array of string values. If the operator is In or NotIn,
+                                              the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                              the values array must be empty. This array is replaced during a strategic
+                                              merge patch.
+                                            items:
+                                              type: string
+                                            type: array
+                                            x-kubernetes-list-type: atomic
+                                        required:
+                                        - key
+                                        - operator
+                                        type: object
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    matchLabels:
+                                      additionalProperties:
+                                        description: MatchLabelsValue represents the
+                                          value from the MatchLabels {key,value} pair.
+                                        maxLength: 63
+                                        pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
+                                        type: string
+                                      description: |-
+                                        matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                        map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                        operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                      type: object
+                                  type: object
+                                  x-kubernetes-map-type: atomic
+                              required:
+                              - selector
+                              type: object
+                          type: object
+                        type: array
+                    type: object
+                  type: array
+                egressDeny:
+                  description: |-
+                    EgressDeny is a list of EgressDenyRule which are enforced at egress.
+                    Any rule inserted here will be denied regardless of the allowed egress
+                    rules in the 'egress' field.
+                    If omitted or empty, this rule does not apply at egress.
+                  items:
+                    description: |-
+                      EgressDenyRule contains all rule types which can be applied at egress, i.e.
+                      network traffic that originates inside the endpoint and exits the endpoint
+                      selected by the endpointSelector.
+
+                        - All members of this structure are optional. If omitted or empty, the
+                          member will have no effect on the rule.
+
+                        - If multiple members of the structure are specified, then all members
+                          must match in order for the rule to take effect.
+
+                        - ToEndpoints, ToCIDR, ToCIDRSet, ToEntities, ToServices and ToGroups are
+                          mutually exclusive. Only one of these members may be present within an
+                          individual rule.
+                    properties:
+                      icmps:
+                        description: |-
+                          ICMPs is a list of ICMP rule identified by type number
+                          which the endpoint subject to the rule is not allowed to connect to.
+
+                          Example:
+                          Any endpoint with the label "app=httpd" is not allowed to initiate
+                          type 8 ICMP connections.
+                        items:
+                          description: ICMPRule is a list of ICMP fields.
+                          properties:
+                            fields:
+                              description: Fields is a list of ICMP fields.
+                              items:
+                                description: ICMPField is a ICMP field.
+                                properties:
+                                  family:
+                                    default: IPv4
+                                    description: |-
+                                      Family is a IP address version.
+                                      Currently, we support `IPv4` and `IPv6`.
+                                      `IPv4` is set as default.
+                                    enum:
+                                    - IPv4
+                                    - IPv6
+                                    type: string
+                                  type:
+                                    anyOf:
+                                    - type: integer
+                                    - type: string
+                                    description: "Type is a ICMP-type.\nIt should
+                                      be an 8bit code (0-255), or it's CamelCase name
+                                      (for example, \"EchoReply\").\nAllowed ICMP
+                                      types are:\n    Ipv4: EchoReply | DestinationUnreachable
+                                      | Redirect | Echo | EchoRequest |\n\t\t     RouterAdvertisement
+                                      | RouterSelection | TimeExceeded | ParameterProblem
+                                      |\n\t\t\t Timestamp | TimestampReply | Photuris
+                                      | ExtendedEcho Request | ExtendedEcho Reply\n
+                                      \   Ipv6: DestinationUnreachable | PacketTooBig
+                                      | TimeExceeded | ParameterProblem |\n\t\t\t
+                                      EchoRequest | EchoReply | MulticastListenerQuery|
+                                      MulticastListenerReport |\n\t\t\t MulticastListenerDone
+                                      | RouterSolicitation | RouterAdvertisement |
+                                      NeighborSolicitation |\n\t\t\t NeighborAdvertisement
+                                      | RedirectMessage | RouterRenumbering | ICMPNodeInformationQuery
+                                      |\n\t\t\t ICMPNodeInformationResponse | InverseNeighborDiscoverySolicitation
+                                      | InverseNeighborDiscoveryAdvertisement |\n\t\t\t
+                                      HomeAgentAddressDiscoveryRequest | HomeAgentAddressDiscoveryReply
+                                      | MobilePrefixSolicitation |\n\t\t\t MobilePrefixAdvertisement
+                                      | DuplicateAddressRequestCodeSuffix | DuplicateAddressConfirmationCodeSuffix
+                                      |\n\t\t\t ExtendedEchoRequest | ExtendedEchoReply"
+                                    pattern: ^([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]|EchoReply|DestinationUnreachable|Redirect|Echo|RouterAdvertisement|RouterSelection|TimeExceeded|ParameterProblem|Timestamp|TimestampReply|Photuris|ExtendedEchoRequest|ExtendedEcho
+                                      Reply|PacketTooBig|ParameterProblem|EchoRequest|MulticastListenerQuery|MulticastListenerReport|MulticastListenerDone|RouterSolicitation|RouterAdvertisement|NeighborSolicitation|NeighborAdvertisement|RedirectMessage|RouterRenumbering|ICMPNodeInformationQuery|ICMPNodeInformationResponse|InverseNeighborDiscoverySolicitation|InverseNeighborDiscoveryAdvertisement|HomeAgentAddressDiscoveryRequest|HomeAgentAddressDiscoveryReply|MobilePrefixSolicitation|MobilePrefixAdvertisement|DuplicateAddressRequestCodeSuffix|DuplicateAddressConfirmationCodeSuffix)$
+                                    x-kubernetes-int-or-string: true
+                                required:
+                                - type
+                                type: object
+                              maxItems: 40
+                              type: array
+                          type: object
+                        type: array
+                      toCIDR:
+                        description: |-
+                          ToCIDR is a list of IP blocks which the endpoint subject to the rule
+                          is allowed to initiate connections. Only connections destined for
+                          outside of the cluster and not targeting the host will be subject
+                          to CIDR rules.  This will match on the destination IP address of
+                          outgoing connections. Adding a prefix into ToCIDR or into ToCIDRSet
+                          with no ExcludeCIDRs is equivalent. Overlaps are allowed between
+                          ToCIDR and ToCIDRSet.
+
+                          Example:
+                          Any endpoint with the label "app=database-proxy" is allowed to
+                          initiate connections to 10.2.3.0/24
+                        items:
+                          description: |-
+                            CIDR specifies a block of IP addresses.
+                            Example: 192.0.2.1/32
+                          format: cidr
+                          type: string
+                        type: array
+                      toCIDRSet:
+                        description: |-
+                          ToCIDRSet is a list of IP blocks which the endpoint subject to the rule
+                          is allowed to initiate connections to in addition to connections
+                          which are allowed via ToEndpoints, along with a list of subnets contained
+                          within their corresponding IP block to which traffic should not be
+                          allowed. This will match on the destination IP address of outgoing
+                          connections. Adding a prefix into ToCIDR or into ToCIDRSet with no
+                          ExcludeCIDRs is equivalent. Overlaps are allowed between ToCIDR and
+                          ToCIDRSet.
+
+                          Example:
+                          Any endpoint with the label "app=database-proxy" is allowed to
+                          initiate connections to 10.2.3.0/24 except from IPs in subnet 10.2.3.0/28.
+                        items:
+                          description: |-
+                            CIDRRule is a rule that specifies a CIDR prefix to/from which outside
+                            communication  is allowed, along with an optional list of subnets within that
+                            CIDR prefix to/from which outside communication is not allowed.
+                          oneOf:
+                          - properties:
+                              cidr: {}
+                            required:
+                            - cidr
+                          - properties:
+                              cidrGroupRef: {}
+                            required:
+                            - cidrGroupRef
+                          - properties:
+                              cidrGroupSelector: {}
+                            required:
+                            - cidrGroupSelector
+                          properties:
+                            cidr:
+                              description: CIDR is a CIDR prefix / IP Block.
+                              format: cidr
+                              type: string
+                            cidrGroupRef:
+                              description: |-
+                                CIDRGroupRef is a reference to a CiliumCIDRGroup object.
+                                A CiliumCIDRGroup contains a list of CIDRs that the endpoint, subject to
+                                the rule, can (Ingress/Egress) or cannot (IngressDeny/EgressDeny) receive
+                                connections from.
+                              maxLength: 253
+                              pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                              type: string
+                            cidrGroupSelector:
+                              description: |-
+                                CIDRGroupSelector selects CiliumCIDRGroups by their labels,
+                                rather than by name.
+                              properties:
+                                matchExpressions:
+                                  description: matchExpressions is a list of label
+                                    selector requirements. The requirements are ANDed.
+                                  items:
+                                    description: |-
+                                      A label selector requirement is a selector that contains values, a key, and an operator that
+                                      relates the key and values.
+                                    properties:
+                                      key:
+                                        description: key is the label key that the
+                                          selector applies to.
+                                        type: string
+                                      operator:
+                                        description: |-
+                                          operator represents a key's relationship to a set of values.
+                                          Valid operators are In, NotIn, Exists and DoesNotExist.
+                                        enum:
+                                        - In
+                                        - NotIn
+                                        - Exists
+                                        - DoesNotExist
+                                        type: string
+                                      values:
+                                        description: |-
+                                          values is an array of string values. If the operator is In or NotIn,
+                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                          the values array must be empty. This array is replaced during a strategic
+                                          merge patch.
+                                        items:
+                                          type: string
+                                        type: array
+                                        x-kubernetes-list-type: atomic
+                                    required:
+                                    - key
+                                    - operator
+                                    type: object
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                matchLabels:
+                                  additionalProperties:
+                                    description: MatchLabelsValue represents the value
+                                      from the MatchLabels {key,value} pair.
+                                    maxLength: 63
+                                    pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
+                                    type: string
+                                  description: |-
+                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                  type: object
+                              type: object
+                              x-kubernetes-map-type: atomic
+                            except:
+                              description: |-
+                                ExceptCIDRs is a list of IP blocks which the endpoint subject to the rule
+                                is not allowed to initiate connections to. These CIDR prefixes should be
+                                contained within Cidr, using ExceptCIDRs together with CIDRGroupRef is not
+                                supported yet.
+                                These exceptions are only applied to the Cidr in this CIDRRule, and do not
+                                apply to any other CIDR prefixes in any other CIDRRules.
+                              items:
+                                description: |-
+                                  CIDR specifies a block of IP addresses.
+                                  Example: 192.0.2.1/32
+                                format: cidr
+                                type: string
+                              type: array
+                          type: object
+                        type: array
+                      toEndpoints:
+                        description: |-
+                          ToEndpoints is a list of endpoints identified by an EndpointSelector to
+                          which the endpoints subject to the rule are allowed to communicate.
+
+                          Example:
+                          Any endpoint with the label "role=frontend" can communicate with any
+                          endpoint carrying the label "role=backend".
+
+                          Note that while an empty non-nil ToEndpoints does not select anything,
+                          nil ToEndpoints is implicitly treated as a wildcard selector if ToPorts
+                          are also specified.
+                          To select everything, use one EndpointSelector without any match requirements.
+                        items:
+                          description: EndpointSelector is a wrapper for k8s LabelSelector.
+                          properties:
+                            matchExpressions:
+                              description: matchExpressions is a list of label selector
+                                requirements. The requirements are ANDed.
+                              items:
+                                description: |-
+                                  A label selector requirement is a selector that contains values, a key, and an operator that
+                                  relates the key and values.
+                                properties:
+                                  key:
+                                    description: key is the label key that the selector
+                                      applies to.
+                                    type: string
+                                  operator:
+                                    description: |-
+                                      operator represents a key's relationship to a set of values.
+                                      Valid operators are In, NotIn, Exists and DoesNotExist.
+                                    enum:
+                                    - In
+                                    - NotIn
+                                    - Exists
+                                    - DoesNotExist
+                                    type: string
+                                  values:
+                                    description: |-
+                                      values is an array of string values. If the operator is In or NotIn,
+                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                      the values array must be empty. This array is replaced during a strategic
+                                      merge patch.
+                                    items:
+                                      type: string
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                required:
+                                - key
+                                - operator
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
+                            matchLabels:
+                              additionalProperties:
+                                description: MatchLabelsValue represents the value
+                                  from the MatchLabels {key,value} pair.
+                                maxLength: 63
+                                pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
+                                type: string
+                              description: |-
+                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                operator is "In", and the values array contains only "value". The requirements are ANDed.
+                              type: object
+                          type: object
+                          x-kubernetes-map-type: atomic
+                        type: array
+                      toEntities:
+                        description: |-
+                          ToEntities is a list of special entities to which the endpoint subject
+                          to the rule is allowed to initiate connections. Supported entities are
+                          `world`, `cluster`, `cluster-mesh`, `host`, `remote-node`, `kube-apiserver`, `ingress`, `init`,
+                          `health`, `unmanaged`, `none` and `all`.
+                        items:
+                          description: |-
+                            Entity specifies the class of receiver/sender endpoints that do not have
+                            individual identities.  Entities are used to describe "outside of cluster",
+                            "host", etc.
+                          enum:
+                          - all
+                          - world
+                          - cluster
+                          - cluster-mesh
+                          - host
+                          - init
+                          - ingress
+                          - unmanaged
+                          - remote-node
+                          - health
+                          - none
+                          - kube-apiserver
+                          type: string
+                        type: array
+                      toGroups:
+                        description: |-
+                          ToGroups allows policies to reference CIDRs provided by external integrations.
+                          Currently, only AWS is supported, and the rule can select by multiple sub directives.
+                          ToGroups entries are functionally equivalent to toCIDR, and have the same
+                          limitiations. They cannot select traffic originating from within the cluster.
+
+                          Example:
+                          toGroups:
+                          - aws:
+                              securityGroupsIds:
+                              - 'sg-XXXXXXXXXXXXX'
+                        items:
+                          description: Groups allows referencing CIDRs that are resolved
+                            from an external integration.
+                          properties:
+                            aws:
+                              description: AWSGroup is an structure that can be used
+                                to whitelisting information from AWS integration
+                              properties:
+                                labels:
+                                  additionalProperties:
+                                    type: string
+                                  description: |-
+                                    Labels selects AWS ENIs by labels.
+                                    Multiple labels are AND-ed together.
+                                  type: object
+                                region:
+                                  description: 'Deprecated: Region is unused.'
+                                  type: string
+                                securityGroupsIds:
+                                  description: |-
+                                    SecurityGroupsIds selects VPC SecurityGroups by IDs.
+                                    If multiple IDs are specified, they are OR-ed together.
+
+                                    Note that this may be AND-ed with any Names specified. Specifying both
+                                    IDs and Names is not recommended.
+                                  items:
+                                    type: string
+                                  type: array
+                                securityGroupsNames:
+                                  description: |-
+                                    SecurityGroupsNames selects VPC SecurityGroups by name.
+                                    If multiple names are specified, they are OR-ed together.
+
+                                    Note that this may be AND-ed with any IDs specified. Specifying both
+                                    IDs and Names is not recommended.
+                                  items:
+                                    type: string
+                                  type: array
+                              type: object
+                          type: object
+                        type: array
+                      toNodes:
+                        description: |-
+                          ToNodes is a list of nodes identified by an
+                          EndpointSelector to which endpoints subject to the rule is allowed to communicate.
+                        items:
+                          description: EndpointSelector is a wrapper for k8s LabelSelector.
+                          properties:
+                            matchExpressions:
+                              description: matchExpressions is a list of label selector
+                                requirements. The requirements are ANDed.
+                              items:
+                                description: |-
+                                  A label selector requirement is a selector that contains values, a key, and an operator that
+                                  relates the key and values.
+                                properties:
+                                  key:
+                                    description: key is the label key that the selector
+                                      applies to.
+                                    type: string
+                                  operator:
+                                    description: |-
+                                      operator represents a key's relationship to a set of values.
+                                      Valid operators are In, NotIn, Exists and DoesNotExist.
+                                    enum:
+                                    - In
+                                    - NotIn
+                                    - Exists
+                                    - DoesNotExist
+                                    type: string
+                                  values:
+                                    description: |-
+                                      values is an array of string values. If the operator is In or NotIn,
+                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                      the values array must be empty. This array is replaced during a strategic
+                                      merge patch.
+                                    items:
+                                      type: string
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                required:
+                                - key
+                                - operator
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
+                            matchLabels:
+                              additionalProperties:
+                                description: MatchLabelsValue represents the value
+                                  from the MatchLabels {key,value} pair.
+                                maxLength: 63
+                                pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
+                                type: string
+                              description: |-
+                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                operator is "In", and the values array contains only "value". The requirements are ANDed.
+                              type: object
+                          type: object
+                          x-kubernetes-map-type: atomic
+                        type: array
+                      toPorts:
+                        description: |-
+                          ToPorts is a list of destination ports identified by port number and
+                          protocol which the endpoint subject to the rule is not allowed to connect
+                          to.
+
+                          Example:
+                          Any endpoint with the label "role=frontend" is not allowed to initiate
+                          connections to destination port 8080/tcp
+                        items:
+                          description: |-
+                            PortDenyRule is a list of ports/protocol that should be used for deny
+                            policies. This structure lacks the L7Rules since it's not supported in deny
+                            policies.
+                          properties:
+                            ports:
+                              description: Ports is a list of L4 port/protocol
+                              items:
+                                description: PortProtocol specifies an L4 port with
+                                  an optional transport protocol
+                                properties:
+                                  endPort:
+                                    description: EndPort can only be an L4 port number.
+                                    format: int32
+                                    maximum: 65535
+                                    minimum: 0
+                                    type: integer
+                                  port:
+                                    description: |-
+                                      Port can be an L4 port number, or a name in the form of "http"
+                                      or "http-8080".
+                                    pattern: ^(6553[0-5]|655[0-2][0-9]|65[0-4][0-9]{2}|6[0-4][0-9]{3}|[1-5][0-9]{4}|[0-9]{1,4})|([a-zA-Z0-9]-?)*[a-zA-Z](-?[a-zA-Z0-9])*$
+                                    type: string
+                                  protocol:
+                                    description: |-
+                                      Protocol is the L4 protocol. If "ANY", omitted or empty, any protocols
+                                      with transport ports (TCP, UDP, SCTP) match.
+
+                                      Accepted values: "TCP", "UDP", "SCTP", "VRRP", "IGMP", "GRE", "IPIP",
+                                      "IPV6", "ESP", "AH", "ANY"
+
+                                      Tunnel/encapsulation protocols (GRE, IPIP, IPV6, ESP, AH) and other
+                                      extended IP protocols (VRRP, IGMP) require the --enable-extended-ip-protocols
+                                      flag to be set. These protocols do not use transport-layer ports.
+
+                                      Matching on ICMP is not supported.
+
+                                      Named port specified for a container may narrow this down, but may not
+                                      contradict this.
+                                    enum:
+                                    - TCP
+                                    - UDP
+                                    - SCTP
+                                    - VRRP
+                                    - IGMP
+                                    - GRE
+                                    - IPIP
+                                    - IPV6
+                                    - ESP
+                                    - AH
+                                    - ANY
+                                    type: string
+                                type: object
+                              type: array
+                          type: object
+                        type: array
+                      toRequires:
+                        description: Deprecated.
+                        items:
+                          type: string
+                        maxItems: 0
+                        type: array
+                      toServices:
+                        description: |-
+                          ToServices is a list of services to which the endpoint subject
+                          to the rule is allowed to initiate connections.
+                          Currently Cilium only supports toServices for K8s services.
+                        items:
+                          description: |-
+                            Service selects policy targets that are bundled as part of a
+                            logical load-balanced service.
+
+                            Currently only Kubernetes-based Services are supported.
+                          properties:
+                            k8sService:
+                              description: K8sService selects service by name and
+                                namespace pair
+                              properties:
+                                namespace:
+                                  type: string
+                                serviceName:
+                                  type: string
+                              type: object
+                            k8sServiceSelector:
+                              description: K8sServiceSelector selects services by
+                                k8s labels and namespace
+                              properties:
+                                namespace:
+                                  type: string
+                                selector:
+                                  description: ServiceSelector is a label selector
+                                    for k8s services
+                                  properties:
+                                    matchExpressions:
+                                      description: matchExpressions is a list of label
+                                        selector requirements. The requirements are
+                                        ANDed.
+                                      items:
+                                        description: |-
+                                          A label selector requirement is a selector that contains values, a key, and an operator that
+                                          relates the key and values.
+                                        properties:
+                                          key:
+                                            description: key is the label key that
+                                              the selector applies to.
+                                            type: string
+                                          operator:
+                                            description: |-
+                                              operator represents a key's relationship to a set of values.
+                                              Valid operators are In, NotIn, Exists and DoesNotExist.
+                                            enum:
+                                            - In
+                                            - NotIn
+                                            - Exists
+                                            - DoesNotExist
+                                            type: string
+                                          values:
+                                            description: |-
+                                              values is an array of string values. If the operator is In or NotIn,
+                                              the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                              the values array must be empty. This array is replaced during a strategic
+                                              merge patch.
+                                            items:
+                                              type: string
+                                            type: array
+                                            x-kubernetes-list-type: atomic
+                                        required:
+                                        - key
+                                        - operator
+                                        type: object
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    matchLabels:
+                                      additionalProperties:
+                                        description: MatchLabelsValue represents the
+                                          value from the MatchLabels {key,value} pair.
+                                        maxLength: 63
+                                        pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
+                                        type: string
+                                      description: |-
+                                        matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                        map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                        operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                      type: object
+                                  type: object
+                                  x-kubernetes-map-type: atomic
+                              required:
+                              - selector
+                              type: object
+                          type: object
+                        type: array
+                    type: object
+                  type: array
+                enableDefaultDeny:
+                  description: |-
+                    EnableDefaultDeny determines whether this policy configures the
+                    subject endpoint(s) to have a default deny mode. If enabled,
+                    this causes all traffic not explicitly allowed by a network policy
+                    to be dropped.
+
+                    If not specified, the default is true for each traffic direction
+                    that has rules, and false otherwise. For example, if a policy
+                    only has Ingress or IngressDeny rules, then the default for
+                    ingress is true and egress is false.
+
+                    If multiple policies apply to an endpoint, that endpoint's default deny
+                    will be enabled if any policy requests it.
+
+                    This is useful for creating broad-based network policies that will not
+                    cause endpoints to enter default-deny mode.
+                  properties:
+                    egress:
+                      description: |-
+                        Whether or not the endpoint should have a default-deny rule applied
+                        to egress traffic.
+                      type: boolean
+                    ingress:
+                      description: |-
+                        Whether or not the endpoint should have a default-deny rule applied
+                        to ingress traffic.
+                      type: boolean
+                  type: object
+                endpointSelector:
+                  description: |-
+                    EndpointSelector selects all endpoints which should be subject to
+                    this rule. EndpointSelector and NodeSelector cannot be both empty and
+                    are mutually exclusive.
+                  properties:
+                    matchExpressions:
+                      description: matchExpressions is a list of label selector requirements.
+                        The requirements are ANDed.
+                      items:
+                        description: |-
+                          A label selector requirement is a selector that contains values, a key, and an operator that
+                          relates the key and values.
+                        properties:
+                          key:
+                            description: key is the label key that the selector applies
+                              to.
+                            type: string
+                          operator:
+                            description: |-
+                              operator represents a key's relationship to a set of values.
+                              Valid operators are In, NotIn, Exists and DoesNotExist.
+                            enum:
+                            - In
+                            - NotIn
+                            - Exists
+                            - DoesNotExist
+                            type: string
+                          values:
+                            description: |-
+                              values is an array of string values. If the operator is In or NotIn,
+                              the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                              the values array must be empty. This array is replaced during a strategic
+                              merge patch.
+                            items:
+                              type: string
+                            type: array
+                            x-kubernetes-list-type: atomic
+                        required:
+                        - key
+                        - operator
+                        type: object
+                      type: array
+                      x-kubernetes-list-type: atomic
+                    matchLabels:
+                      additionalProperties:
+                        description: MatchLabelsValue represents the value from the
+                          MatchLabels {key,value} pair.
+                        maxLength: 63
+                        pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
+                        type: string
+                      description: |-
+                        matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                        map is equivalent to an element of matchExpressions, whose key field is "key", the
+                        operator is "In", and the values array contains only "value". The requirements are ANDed.
+                      type: object
+                  type: object
+                  x-kubernetes-map-type: atomic
+                ingress:
+                  description: |-
+                    Ingress is a list of IngressRule which are enforced at ingress.
+                    If omitted or empty, this rule does not apply at ingress.
+                  items:
+                    description: |-
+                      IngressRule contains all rule types which can be applied at ingress,
+                      i.e. network traffic that originates outside of the endpoint and
+                      is entering the endpoint selected by the endpointSelector.
+
+                        - All members of this structure are optional. If omitted or empty, the
+                          member will have no effect on the rule.
+
+                        - If multiple members are set, all of them need to match in order for
+                          the rule to take effect.
+
+                        - FromEndpoints, FromCIDR, FromCIDRSet and FromEntities are mutually
+                          exclusive. Only one of these members may be present within an individual
+                          rule.
+                    properties:
+                      authentication:
+                        description: Authentication is the required authentication
+                          type for the allowed traffic, if any.
+                        properties:
+                          mode:
+                            description: Mode is the required authentication mode
+                              for the allowed traffic, if any.
+                            enum:
+                            - disabled
+                            - required
+                            - test-always-fail
+                            type: string
+                        required:
+                        - mode
+                        type: object
+                      fromCIDR:
+                        description: |-
+                          FromCIDR is a list of IP blocks which the endpoint subject to the
+                          rule is allowed to receive connections from. Only connections which
+                          do *not* originate from the cluster or from the local host are subject
+                          to CIDR rules. In order to allow in-cluster connectivity, use the
+                          FromEndpoints field.  This will match on the source IP address of
+                          incoming connections. Adding  a prefix into FromCIDR or into
+                          FromCIDRSet with no ExcludeCIDRs is  equivalent.  Overlaps are
+                          allowed between FromCIDR and FromCIDRSet.
+
+                          Example:
+                          Any endpoint with the label "app=my-legacy-pet" is allowed to receive
+                          connections from 10.3.9.1
+                        items:
+                          description: |-
+                            CIDR specifies a block of IP addresses.
+                            Example: 192.0.2.1/32
+                          format: cidr
+                          type: string
+                        type: array
+                      fromCIDRSet:
+                        description: |-
+                          FromCIDRSet is a list of IP blocks which the endpoint subject to the
+                          rule is allowed to receive connections from in addition to FromEndpoints,
+                          along with a list of subnets contained within their corresponding IP block
+                          from which traffic should not be allowed.
+                          This will match on the source IP address of incoming connections. Adding
+                          a prefix into FromCIDR or into FromCIDRSet with no ExcludeCIDRs is
+                          equivalent. Overlaps are allowed between FromCIDR and FromCIDRSet.
+
+                          Example:
+                          Any endpoint with the label "app=my-legacy-pet" is allowed to receive
+                          connections from 10.0.0.0/8 except from IPs in subnet 10.96.0.0/12.
+                        items:
+                          description: |-
+                            CIDRRule is a rule that specifies a CIDR prefix to/from which outside
+                            communication  is allowed, along with an optional list of subnets within that
+                            CIDR prefix to/from which outside communication is not allowed.
+                          oneOf:
+                          - properties:
+                              cidr: {}
+                            required:
+                            - cidr
+                          - properties:
+                              cidrGroupRef: {}
+                            required:
+                            - cidrGroupRef
+                          - properties:
+                              cidrGroupSelector: {}
+                            required:
+                            - cidrGroupSelector
+                          properties:
+                            cidr:
+                              description: CIDR is a CIDR prefix / IP Block.
+                              format: cidr
+                              type: string
+                            cidrGroupRef:
+                              description: |-
+                                CIDRGroupRef is a reference to a CiliumCIDRGroup object.
+                                A CiliumCIDRGroup contains a list of CIDRs that the endpoint, subject to
+                                the rule, can (Ingress/Egress) or cannot (IngressDeny/EgressDeny) receive
+                                connections from.
+                              maxLength: 253
+                              pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                              type: string
+                            cidrGroupSelector:
+                              description: |-
+                                CIDRGroupSelector selects CiliumCIDRGroups by their labels,
+                                rather than by name.
+                              properties:
+                                matchExpressions:
+                                  description: matchExpressions is a list of label
+                                    selector requirements. The requirements are ANDed.
+                                  items:
+                                    description: |-
+                                      A label selector requirement is a selector that contains values, a key, and an operator that
+                                      relates the key and values.
+                                    properties:
+                                      key:
+                                        description: key is the label key that the
+                                          selector applies to.
+                                        type: string
+                                      operator:
+                                        description: |-
+                                          operator represents a key's relationship to a set of values.
+                                          Valid operators are In, NotIn, Exists and DoesNotExist.
+                                        enum:
+                                        - In
+                                        - NotIn
+                                        - Exists
+                                        - DoesNotExist
+                                        type: string
+                                      values:
+                                        description: |-
+                                          values is an array of string values. If the operator is In or NotIn,
+                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                          the values array must be empty. This array is replaced during a strategic
+                                          merge patch.
+                                        items:
+                                          type: string
+                                        type: array
+                                        x-kubernetes-list-type: atomic
+                                    required:
+                                    - key
+                                    - operator
+                                    type: object
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                matchLabels:
+                                  additionalProperties:
+                                    description: MatchLabelsValue represents the value
+                                      from the MatchLabels {key,value} pair.
+                                    maxLength: 63
+                                    pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
+                                    type: string
+                                  description: |-
+                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                  type: object
+                              type: object
+                              x-kubernetes-map-type: atomic
+                            except:
+                              description: |-
+                                ExceptCIDRs is a list of IP blocks which the endpoint subject to the rule
+                                is not allowed to initiate connections to. These CIDR prefixes should be
+                                contained within Cidr, using ExceptCIDRs together with CIDRGroupRef is not
+                                supported yet.
+                                These exceptions are only applied to the Cidr in this CIDRRule, and do not
+                                apply to any other CIDR prefixes in any other CIDRRules.
+                              items:
+                                description: |-
+                                  CIDR specifies a block of IP addresses.
+                                  Example: 192.0.2.1/32
+                                format: cidr
+                                type: string
+                              type: array
+                          type: object
+                        type: array
+                      fromEndpoints:
+                        description: |-
+                          FromEndpoints is a list of endpoints identified by an
+                          EndpointSelector which are allowed to communicate with the endpoint
+                          subject to the rule.
+
+                          Example:
+                          Any endpoint with the label "role=backend" can be consumed by any
+                          endpoint carrying the label "role=frontend".
+
+                          Note that while an empty non-nil FromEndpoints does not select anything,
+                          nil FromEndpoints is implicitly treated as a wildcard selector if ToPorts
+                          are also specified.
+                          To select everything, use one EndpointSelector without any match requirements.
+                        items:
+                          description: EndpointSelector is a wrapper for k8s LabelSelector.
+                          properties:
+                            matchExpressions:
+                              description: matchExpressions is a list of label selector
+                                requirements. The requirements are ANDed.
+                              items:
+                                description: |-
+                                  A label selector requirement is a selector that contains values, a key, and an operator that
+                                  relates the key and values.
+                                properties:
+                                  key:
+                                    description: key is the label key that the selector
+                                      applies to.
+                                    type: string
+                                  operator:
+                                    description: |-
+                                      operator represents a key's relationship to a set of values.
+                                      Valid operators are In, NotIn, Exists and DoesNotExist.
+                                    enum:
+                                    - In
+                                    - NotIn
+                                    - Exists
+                                    - DoesNotExist
+                                    type: string
+                                  values:
+                                    description: |-
+                                      values is an array of string values. If the operator is In or NotIn,
+                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                      the values array must be empty. This array is replaced during a strategic
+                                      merge patch.
+                                    items:
+                                      type: string
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                required:
+                                - key
+                                - operator
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
+                            matchLabels:
+                              additionalProperties:
+                                description: MatchLabelsValue represents the value
+                                  from the MatchLabels {key,value} pair.
+                                maxLength: 63
+                                pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
+                                type: string
+                              description: |-
+                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                operator is "In", and the values array contains only "value". The requirements are ANDed.
+                              type: object
+                          type: object
+                          x-kubernetes-map-type: atomic
+                        type: array
+                      fromEntities:
+                        description: |-
+                          FromEntities is a list of special entities which the endpoint subject
+                          to the rule is allowed to receive connections from. Supported entities are
+                          `world`, `cluster`, `cluster-mesh`, `host`, `remote-node`, `kube-apiserver`, `ingress`, `init`,
+                          `health`, `unmanaged`, `none` and `all`.
+                        items:
+                          description: |-
+                            Entity specifies the class of receiver/sender endpoints that do not have
+                            individual identities.  Entities are used to describe "outside of cluster",
+                            "host", etc.
+                          enum:
+                          - all
+                          - world
+                          - cluster
+                          - cluster-mesh
+                          - host
+                          - init
+                          - ingress
+                          - unmanaged
+                          - remote-node
+                          - health
+                          - none
+                          - kube-apiserver
+                          type: string
+                        type: array
+                      fromGroups:
+                        description: |-
+                          FromGroups allows policies to reference CIDRs provided by external integrations.
+                          Currently, only AWS is supported, and the rule can select by multiple sub directives.
+                          FromGroups entries are functionally equivalent to FromCIDR, and have the same
+                          limitiations. They cannot select traffic originating from within the cluster.
+
+                          Example:
+                          fromGroups:
+                          - aws:
+                              securityGroupsIds:
+                              - 'sg-XXXXXXXXXXXXX'
+                        items:
+                          description: Groups allows referencing CIDRs that are resolved
+                            from an external integration.
+                          properties:
+                            aws:
+                              description: AWSGroup is an structure that can be used
+                                to whitelisting information from AWS integration
+                              properties:
+                                labels:
+                                  additionalProperties:
+                                    type: string
+                                  description: |-
+                                    Labels selects AWS ENIs by labels.
+                                    Multiple labels are AND-ed together.
+                                  type: object
+                                region:
+                                  description: 'Deprecated: Region is unused.'
+                                  type: string
+                                securityGroupsIds:
+                                  description: |-
+                                    SecurityGroupsIds selects VPC SecurityGroups by IDs.
+                                    If multiple IDs are specified, they are OR-ed together.
+
+                                    Note that this may be AND-ed with any Names specified. Specifying both
+                                    IDs and Names is not recommended.
+                                  items:
+                                    type: string
+                                  type: array
+                                securityGroupsNames:
+                                  description: |-
+                                    SecurityGroupsNames selects VPC SecurityGroups by name.
+                                    If multiple names are specified, they are OR-ed together.
+
+                                    Note that this may be AND-ed with any IDs specified. Specifying both
+                                    IDs and Names is not recommended.
+                                  items:
+                                    type: string
+                                  type: array
+                              type: object
+                          type: object
+                        type: array
+                      fromNodes:
+                        description: |-
+                          FromNodes is a list of nodes identified by an
+                          EndpointSelector which are allowed to communicate with the endpoint
+                          subject to the rule.
+                        items:
+                          description: EndpointSelector is a wrapper for k8s LabelSelector.
+                          properties:
+                            matchExpressions:
+                              description: matchExpressions is a list of label selector
+                                requirements. The requirements are ANDed.
+                              items:
+                                description: |-
+                                  A label selector requirement is a selector that contains values, a key, and an operator that
+                                  relates the key and values.
+                                properties:
+                                  key:
+                                    description: key is the label key that the selector
+                                      applies to.
+                                    type: string
+                                  operator:
+                                    description: |-
+                                      operator represents a key's relationship to a set of values.
+                                      Valid operators are In, NotIn, Exists and DoesNotExist.
+                                    enum:
+                                    - In
+                                    - NotIn
+                                    - Exists
+                                    - DoesNotExist
+                                    type: string
+                                  values:
+                                    description: |-
+                                      values is an array of string values. If the operator is In or NotIn,
+                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                      the values array must be empty. This array is replaced during a strategic
+                                      merge patch.
+                                    items:
+                                      type: string
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                required:
+                                - key
+                                - operator
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
+                            matchLabels:
+                              additionalProperties:
+                                description: MatchLabelsValue represents the value
+                                  from the MatchLabels {key,value} pair.
+                                maxLength: 63
+                                pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
+                                type: string
+                              description: |-
+                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                operator is "In", and the values array contains only "value". The requirements are ANDed.
+                              type: object
+                          type: object
+                          x-kubernetes-map-type: atomic
+                        type: array
+                      fromRequires:
+                        description: Deprecated.
+                        items:
+                          type: string
+                        maxItems: 0
+                        type: array
+                      icmps:
+                        description: |-
+                          ICMPs is a list of ICMP rule identified by type number
+                          which the endpoint subject to the rule is allowed to
+                          receive connections on.
+
+                          Example:
+                          Any endpoint with the label "app=httpd" can only accept incoming
+                          type 8 ICMP connections.
+                        items:
+                          description: ICMPRule is a list of ICMP fields.
+                          properties:
+                            fields:
+                              description: Fields is a list of ICMP fields.
+                              items:
+                                description: ICMPField is a ICMP field.
+                                properties:
+                                  family:
+                                    default: IPv4
+                                    description: |-
+                                      Family is a IP address version.
+                                      Currently, we support `IPv4` and `IPv6`.
+                                      `IPv4` is set as default.
+                                    enum:
+                                    - IPv4
+                                    - IPv6
+                                    type: string
+                                  type:
+                                    anyOf:
+                                    - type: integer
+                                    - type: string
+                                    description: "Type is a ICMP-type.\nIt should
+                                      be an 8bit code (0-255), or it's CamelCase name
+                                      (for example, \"EchoReply\").\nAllowed ICMP
+                                      types are:\n    Ipv4: EchoReply | DestinationUnreachable
+                                      | Redirect | Echo | EchoRequest |\n\t\t     RouterAdvertisement
+                                      | RouterSelection | TimeExceeded | ParameterProblem
+                                      |\n\t\t\t Timestamp | TimestampReply | Photuris
+                                      | ExtendedEcho Request | ExtendedEcho Reply\n
+                                      \   Ipv6: DestinationUnreachable | PacketTooBig
+                                      | TimeExceeded | ParameterProblem |\n\t\t\t
+                                      EchoRequest | EchoReply | MulticastListenerQuery|
+                                      MulticastListenerReport |\n\t\t\t MulticastListenerDone
+                                      | RouterSolicitation | RouterAdvertisement |
+                                      NeighborSolicitation |\n\t\t\t NeighborAdvertisement
+                                      | RedirectMessage | RouterRenumbering | ICMPNodeInformationQuery
+                                      |\n\t\t\t ICMPNodeInformationResponse | InverseNeighborDiscoverySolicitation
+                                      | InverseNeighborDiscoveryAdvertisement |\n\t\t\t
+                                      HomeAgentAddressDiscoveryRequest | HomeAgentAddressDiscoveryReply
+                                      | MobilePrefixSolicitation |\n\t\t\t MobilePrefixAdvertisement
+                                      | DuplicateAddressRequestCodeSuffix | DuplicateAddressConfirmationCodeSuffix
+                                      |\n\t\t\t ExtendedEchoRequest | ExtendedEchoReply"
+                                    pattern: ^([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]|EchoReply|DestinationUnreachable|Redirect|Echo|RouterAdvertisement|RouterSelection|TimeExceeded|ParameterProblem|Timestamp|TimestampReply|Photuris|ExtendedEchoRequest|ExtendedEcho
+                                      Reply|PacketTooBig|ParameterProblem|EchoRequest|MulticastListenerQuery|MulticastListenerReport|MulticastListenerDone|RouterSolicitation|RouterAdvertisement|NeighborSolicitation|NeighborAdvertisement|RedirectMessage|RouterRenumbering|ICMPNodeInformationQuery|ICMPNodeInformationResponse|InverseNeighborDiscoverySolicitation|InverseNeighborDiscoveryAdvertisement|HomeAgentAddressDiscoveryRequest|HomeAgentAddressDiscoveryReply|MobilePrefixSolicitation|MobilePrefixAdvertisement|DuplicateAddressRequestCodeSuffix|DuplicateAddressConfirmationCodeSuffix)$
+                                    x-kubernetes-int-or-string: true
+                                required:
+                                - type
+                                type: object
+                              maxItems: 40
+                              type: array
+                          type: object
+                        type: array
+                      toPorts:
+                        description: |-
+                          ToPorts is a list of destination ports identified by port number and
+                          protocol which the endpoint subject to the rule is allowed to
+                          receive connections on.
+
+                          Example:
+                          Any endpoint with the label "app=httpd" can only accept incoming
+                          connections on port 80/tcp.
+                        items:
+                          description: |-
+                            PortRule is a list of ports/protocol combinations with optional Layer 7
+                            rules which must be met.
+                          properties:
+                            listener:
+                              description: |-
+                                listener specifies the name of a custom Envoy listener to which this traffic should be
+                                redirected to.
+                              properties:
+                                envoyConfig:
+                                  description: |-
+                                    EnvoyConfig is a reference to the CEC or CCEC resource in which
+                                    the listener is defined.
+                                  properties:
+                                    kind:
+                                      description: |-
+                                        Kind is the resource type being referred to. Defaults to CiliumEnvoyConfig or
+                                        CiliumClusterwideEnvoyConfig for CiliumNetworkPolicy and CiliumClusterwideNetworkPolicy,
+                                        respectively. The only case this is currently explicitly needed is when referring to a
+                                        CiliumClusterwideEnvoyConfig from CiliumNetworkPolicy, as using a namespaced listener
+                                        from a cluster scoped policy is not allowed.
+                                      enum:
+                                      - CiliumEnvoyConfig
+                                      - CiliumClusterwideEnvoyConfig
+                                      type: string
+                                    name:
+                                      description: |-
+                                        Name is the resource name of the CiliumEnvoyConfig or CiliumClusterwideEnvoyConfig where
+                                        the listener is defined in.
+                                      minLength: 1
+                                      type: string
+                                  required:
+                                  - name
+                                  type: object
+                                name:
+                                  description: Name is the name of the listener.
+                                  minLength: 1
+                                  type: string
+                                priority:
+                                  description: |-
+                                    Priority for this Listener that is used when multiple rules would apply different
+                                    listeners to a policy map entry. Behavior of this is implementation dependent.
+                                  maximum: 100
+                                  minimum: 1
+                                  type: integer
+                              required:
+                              - envoyConfig
+                              - name
+                              type: object
+                            originatingTLS:
+                              description: |-
+                                OriginatingTLS is the TLS context for the connections originated by
+                                the L7 proxy.  For egress policy this specifies the client-side TLS
+                                parameters for the upstream connection originating from the L7 proxy
+                                to the remote destination. For ingress policy this specifies the
+                                client-side TLS parameters for the connection from the L7 proxy to
+                                the local endpoint.
+                              properties:
+                                certificate:
+                                  description: |-
+                                    Certificate is the file name or k8s secret item name for the certificate
+                                    chain. If omitted, 'tls.crt' is assumed, if it exists. If given, the
+                                    item must exist.
+                                  type: string
+                                privateKey:
+                                  description: |-
+                                    PrivateKey is the file name or k8s secret item name for the private key
+                                    matching the certificate chain. If omitted, 'tls.key' is assumed, if it
+                                    exists. If given, the item must exist.
+                                  type: string
+                                secret:
+                                  description: |-
+                                    Secret is the secret that contains the certificates and private key for
+                                    the TLS context.
+                                    By default, Cilium will search in this secret for the following items:
+                                     - 'ca.crt'  - Which represents the trusted CA to verify remote source.
+                                     - 'tls.crt' - Which represents the public key certificate.
+                                     - 'tls.key' - Which represents the private key matching the public key
+                                                   certificate.
+                                  properties:
+                                    name:
+                                      description: Name is the name of the secret.
+                                      type: string
+                                    namespace:
+                                      description: |-
+                                        Namespace is the namespace in which the secret exists. Context of use
+                                        determines the default value if left out (e.g., "default").
+                                      type: string
+                                  required:
+                                  - name
+                                  type: object
+                                trustedCA:
+                                  description: |-
+                                    TrustedCA is the file name or k8s secret item name for the trusted CA.
+                                    If omitted, 'ca.crt' is assumed, if it exists. If given, the item must
+                                    exist.
+                                  type: string
+                              required:
+                              - secret
+                              type: object
+                            ports:
+                              description: Ports is a list of L4 port/protocol
+                              items:
+                                description: PortProtocol specifies an L4 port with
+                                  an optional transport protocol
+                                properties:
+                                  endPort:
+                                    description: EndPort can only be an L4 port number.
+                                    format: int32
+                                    maximum: 65535
+                                    minimum: 0
+                                    type: integer
+                                  port:
+                                    description: |-
+                                      Port can be an L4 port number, or a name in the form of "http"
+                                      or "http-8080".
+                                    pattern: ^(6553[0-5]|655[0-2][0-9]|65[0-4][0-9]{2}|6[0-4][0-9]{3}|[1-5][0-9]{4}|[0-9]{1,4})|([a-zA-Z0-9]-?)*[a-zA-Z](-?[a-zA-Z0-9])*$
+                                    type: string
+                                  protocol:
+                                    description: |-
+                                      Protocol is the L4 protocol. If "ANY", omitted or empty, any protocols
+                                      with transport ports (TCP, UDP, SCTP) match.
+
+                                      Accepted values: "TCP", "UDP", "SCTP", "VRRP", "IGMP", "GRE", "IPIP",
+                                      "IPV6", "ESP", "AH", "ANY"
+
+                                      Tunnel/encapsulation protocols (GRE, IPIP, IPV6, ESP, AH) and other
+                                      extended IP protocols (VRRP, IGMP) require the --enable-extended-ip-protocols
+                                      flag to be set. These protocols do not use transport-layer ports.
+
+                                      Matching on ICMP is not supported.
+
+                                      Named port specified for a container may narrow this down, but may not
+                                      contradict this.
+                                    enum:
+                                    - TCP
+                                    - UDP
+                                    - SCTP
+                                    - VRRP
+                                    - IGMP
+                                    - GRE
+                                    - IPIP
+                                    - IPV6
+                                    - ESP
+                                    - AH
+                                    - ANY
+                                    type: string
+                                type: object
+                              maxItems: 40
+                              type: array
+                            rules:
+                              description: |-
+                                Rules is a list of additional port level rules which must be met in
+                                order for the PortRule to allow the traffic. If omitted or empty,
+                                no layer 7 rules are enforced.
+                              oneOf:
+                              - properties:
+                                  http: {}
+                                required:
+                                - http
+                              - properties:
+                                  dns: {}
+                                required:
+                                - dns
+                              properties:
+                                dns:
+                                  description: DNS-specific rules.
+                                  items:
+                                    description: PortRuleDNS is a list of allowed
+                                      DNS lookups.
+                                    oneOf:
+                                    - properties:
+                                        matchName: {}
+                                      required:
+                                      - matchName
+                                    - properties:
+                                        matchPattern: {}
+                                      required:
+                                      - matchPattern
+                                    properties:
+                                      matchName:
+                                        description: |-
+                                          MatchName matches literal DNS names. A trailing "." is automatically added
+                                          when missing.
+                                        maxLength: 255
+                                        pattern: ^([-a-zA-Z0-9_]+[.]?)+$
+                                        type: string
+                                      matchPattern:
+                                        description: |-
+                                          MatchPattern allows using wildcards to match DNS names. All wildcards are
+                                          case insensitive. The wildcards are:
+                                          - "*" matches 0 or more DNS valid characters, and may occur anywhere in
+                                          the pattern. As a special case a "*" as the leftmost character, without a
+                                          following "." matches all subdomains as well as the name to the right.
+                                          A trailing "." is automatically added when missing.
+                                          - "**." is a special prefix which matches all multilevel subdomains in the prefix.
+
+                                          Examples:
+                                          1. `*.cilium.io` matches subdomains of cilium at that level
+                                            www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
+                                          2. `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
+                                            except those containing "." separator, subcilium.io and sub-cilium.io match,
+                                            www.cilium.io and blog.cilium.io does not
+                                          3. `sub*.cilium.io` matches subdomains of cilium where the subdomain component
+                                            begins with "sub". sub.cilium.io and subdomain.cilium.io match while www.cilium.io,
+                                            blog.cilium.io, cilium.io and google.com do not
+                                          4. `**.cilium.io` matches all multilevel subdomains of cilium.io.
+                                            "app.cilium.io" and "test.app.cilium.io" match but not "cilium.io"
+                                        maxLength: 255
+                                        pattern: ^([-a-zA-Z0-9_*]+[.]?)+$
+                                        type: string
+                                    type: object
+                                  type: array
+                                http:
+                                  description: HTTP specific rules.
+                                  items:
+                                    description: |-
+                                      PortRuleHTTP is a list of HTTP protocol constraints. All fields are
+                                      optional, if all fields are empty or missing, the rule does not have any
+                                      effect.
+
+                                      All fields of this type are extended POSIX regex as defined by IEEE Std
+                                      1003.1, (i.e this follows the egrep/unix syntax, not the perl syntax)
+                                      matched against the path of an incoming request. Currently it can contain
+                                      characters disallowed from the conventional "path" part of a URL as defined
+                                      by RFC 3986.
+                                    properties:
+                                      headerMatches:
+                                        description: |-
+                                          HeaderMatches is a list of HTTP headers which must be
+                                          present and match against the given values. Mismatch field can be used
+                                          to specify what to do when there is no match.
+                                        items:
+                                          description: |-
+                                            HeaderMatch extends the HeaderValue for matching requirement of a
+                                            named header field against an immediate string or a secret value.
+                                            If none of the optional fields is present, then the
+                                            header value is not matched, only presence of the header is enough.
+                                          properties:
+                                            mismatch:
+                                              description: |-
+                                                Mismatch identifies what to do in case there is no match. The default is
+                                                to drop the request. Otherwise the overall rule is still considered as
+                                                matching, but the mismatches are logged in the access log.
+                                              enum:
+                                              - LOG
+                                              - ADD
+                                              - DELETE
+                                              - REPLACE
+                                              type: string
+                                            name:
+                                              description: Name identifies the header.
+                                              minLength: 1
+                                              type: string
+                                            secret:
+                                              description: |-
+                                                Secret refers to a secret that contains the value to be matched against.
+                                                The secret must only contain one entry. If the referred secret does not
+                                                exist, and there is no "Value" specified, the match will fail.
+                                              properties:
+                                                name:
+                                                  description: Name is the name of
+                                                    the secret.
+                                                  type: string
+                                                namespace:
+                                                  description: |-
+                                                    Namespace is the namespace in which the secret exists. Context of use
+                                                    determines the default value if left out (e.g., "default").
+                                                  type: string
+                                              required:
+                                              - name
+                                              type: object
+                                            value:
+                                              description: |-
+                                                Value matches the exact value of the header. Can be specified either
+                                                alone or together with "Secret"; will be used as the header value if the
+                                                secret can not be found in the latter case.
+                                              type: string
+                                          required:
+                                          - name
+                                          type: object
+                                        type: array
+                                      headers:
+                                        description: |-
+                                          Headers is a list of HTTP headers which must be present in the
+                                          request. If omitted or empty, requests are allowed regardless of
+                                          headers present.
+                                        items:
+                                          type: string
+                                        type: array
+                                      host:
+                                        description: |-
+                                          Host is an extended POSIX regex matched against the host header of a
+                                          request. Examples:
+
+                                          - foo.bar.com will match the host fooXbar.com or foo-bar.com
+                                          - foo\.bar\.com will only match the host foo.bar.com
+
+                                          If omitted or empty, the value of the host header is ignored.
+                                        format: idn-hostname
+                                        type: string
+                                      method:
+                                        description: |-
+                                          Method is an extended POSIX regex matched against the method of a
+                                          request, e.g. "GET", "POST", "PUT", "PATCH", "DELETE", ...
+
+                                          If omitted or empty, all methods are allowed.
+                                        type: string
+                                      path:
+                                        description: |-
+                                          Path is an extended POSIX regex matched against the path of a
+                                          request. Currently it can contain characters disallowed from the
+                                          conventional "path" part of a URL as defined by RFC 3986.
+
+                                          If omitted or empty, all paths are all allowed.
+                                        type: string
+                                    type: object
+                                  type: array
+                              type: object
+                            serverNames:
+                              description: |-
+                                ServerNames is a list of allowed TLS SNI values. If not empty, then
+                                TLS must be present and one of the provided SNIs must be indicated in the
+                                TLS handshake.
+                              items:
+                                description: |-
+                                  ServerName allows using '*' wildcard specifier for matching server names with
+                                  the below semantics.
+
+                                  - `*` matches 0 or more DNS valid characters, and may occur anywhere in the pattern.
+                                  - `**.` is a special prefix which matches all multilevel subdomains in the prefix.
+
+                                  As a special case the name "*" matches all valid DNS names.
+
+                                  Examples:
+                                   1. `*.cilium.io` matches subdomains of cilium at that level
+                                      www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
+                                   2. `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
+                                      except those containing "." separator, subcilium.io and sub-cilium.io match,
+                                      www.cilium.io and blog.cilium.io does not
+                                   3. `sub*.cilium.io` matches subdomains of cilium where the subdomain component
+                                      begins with "sub". sub.cilium.io and subdomain.cilium.io match while www.cilium.io,
+                                      blog.cilium.io, cilium.io and google.com do not
+                                   4. `**.cilium.io` matches all multilevel subdomains of cilium.io.
+                                      "app.cilium.io" and "test.app.cilium.io" match but not "cilium.io"
+                                maxLength: 255
+                                pattern: ^([-a-zA-Z0-9_*]+[.]?)+$
+                                type: string
+                              minItems: 1
+                              type: array
+                              x-kubernetes-list-type: set
+                            terminatingTLS:
+                              description: |-
+                                TerminatingTLS is the TLS context for the connection terminated by
+                                the L7 proxy.  For egress policy this specifies the server-side TLS
+                                parameters to be applied on the connections originated from the local
+                                endpoint and terminated by the L7 proxy. For ingress policy this specifies
+                                the server-side TLS parameters to be applied on the connections
+                                originated from a remote source and terminated by the L7 proxy.
+                              properties:
+                                certificate:
+                                  description: |-
+                                    Certificate is the file name or k8s secret item name for the certificate
+                                    chain. If omitted, 'tls.crt' is assumed, if it exists. If given, the
+                                    item must exist.
+                                  type: string
+                                privateKey:
+                                  description: |-
+                                    PrivateKey is the file name or k8s secret item name for the private key
+                                    matching the certificate chain. If omitted, 'tls.key' is assumed, if it
+                                    exists. If given, the item must exist.
+                                  type: string
+                                secret:
+                                  description: |-
+                                    Secret is the secret that contains the certificates and private key for
+                                    the TLS context.
+                                    By default, Cilium will search in this secret for the following items:
+                                     - 'ca.crt'  - Which represents the trusted CA to verify remote source.
+                                     - 'tls.crt' - Which represents the public key certificate.
+                                     - 'tls.key' - Which represents the private key matching the public key
+                                                   certificate.
+                                  properties:
+                                    name:
+                                      description: Name is the name of the secret.
+                                      type: string
+                                    namespace:
+                                      description: |-
+                                        Namespace is the namespace in which the secret exists. Context of use
+                                        determines the default value if left out (e.g., "default").
+                                      type: string
+                                  required:
+                                  - name
+                                  type: object
+                                trustedCA:
+                                  description: |-
+                                    TrustedCA is the file name or k8s secret item name for the trusted CA.
+                                    If omitted, 'ca.crt' is assumed, if it exists. If given, the item must
+                                    exist.
+                                  type: string
+                              required:
+                              - secret
+                              type: object
+                          type: object
+                        type: array
+                    type: object
+                  type: array
+                ingressDeny:
+                  description: |-
+                    IngressDeny is a list of IngressDenyRule which are enforced at ingress.
+                    Any rule inserted here will be denied regardless of the allowed ingress
+                    rules in the 'ingress' field.
+                    If omitted or empty, this rule does not apply at ingress.
+                  items:
+                    description: |-
+                      IngressDenyRule contains all rule types which can be applied at ingress,
+                      i.e. network traffic that originates outside of the endpoint and
+                      is entering the endpoint selected by the endpointSelector.
+
+                        - All members of this structure are optional. If omitted or empty, the
+                          member will have no effect on the rule.
+
+                        - If multiple members are set, all of them need to match in order for
+                          the rule to take effect.
+
+                        - FromEndpoints, FromCIDR, FromCIDRSet, FromGroups and FromEntities are mutually
+                          exclusive. Only one of these members may be present within an individual
+                          rule.
+                    properties:
+                      fromCIDR:
+                        description: |-
+                          FromCIDR is a list of IP blocks which the endpoint subject to the
+                          rule is allowed to receive connections from. Only connections which
+                          do *not* originate from the cluster or from the local host are subject
+                          to CIDR rules. In order to allow in-cluster connectivity, use the
+                          FromEndpoints field.  This will match on the source IP address of
+                          incoming connections. Adding  a prefix into FromCIDR or into
+                          FromCIDRSet with no ExcludeCIDRs is  equivalent.  Overlaps are
+                          allowed between FromCIDR and FromCIDRSet.
+
+                          Example:
+                          Any endpoint with the label "app=my-legacy-pet" is allowed to receive
+                          connections from 10.3.9.1
+                        items:
+                          description: |-
+                            CIDR specifies a block of IP addresses.
+                            Example: 192.0.2.1/32
+                          format: cidr
+                          type: string
+                        type: array
+                      fromCIDRSet:
+                        description: |-
+                          FromCIDRSet is a list of IP blocks which the endpoint subject to the
+                          rule is allowed to receive connections from in addition to FromEndpoints,
+                          along with a list of subnets contained within their corresponding IP block
+                          from which traffic should not be allowed.
+                          This will match on the source IP address of incoming connections. Adding
+                          a prefix into FromCIDR or into FromCIDRSet with no ExcludeCIDRs is
+                          equivalent. Overlaps are allowed between FromCIDR and FromCIDRSet.
+
+                          Example:
+                          Any endpoint with the label "app=my-legacy-pet" is allowed to receive
+                          connections from 10.0.0.0/8 except from IPs in subnet 10.96.0.0/12.
+                        items:
+                          description: |-
+                            CIDRRule is a rule that specifies a CIDR prefix to/from which outside
+                            communication  is allowed, along with an optional list of subnets within that
+                            CIDR prefix to/from which outside communication is not allowed.
+                          oneOf:
+                          - properties:
+                              cidr: {}
+                            required:
+                            - cidr
+                          - properties:
+                              cidrGroupRef: {}
+                            required:
+                            - cidrGroupRef
+                          - properties:
+                              cidrGroupSelector: {}
+                            required:
+                            - cidrGroupSelector
+                          properties:
+                            cidr:
+                              description: CIDR is a CIDR prefix / IP Block.
+                              format: cidr
+                              type: string
+                            cidrGroupRef:
+                              description: |-
+                                CIDRGroupRef is a reference to a CiliumCIDRGroup object.
+                                A CiliumCIDRGroup contains a list of CIDRs that the endpoint, subject to
+                                the rule, can (Ingress/Egress) or cannot (IngressDeny/EgressDeny) receive
+                                connections from.
+                              maxLength: 253
+                              pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                              type: string
+                            cidrGroupSelector:
+                              description: |-
+                                CIDRGroupSelector selects CiliumCIDRGroups by their labels,
+                                rather than by name.
+                              properties:
+                                matchExpressions:
+                                  description: matchExpressions is a list of label
+                                    selector requirements. The requirements are ANDed.
+                                  items:
+                                    description: |-
+                                      A label selector requirement is a selector that contains values, a key, and an operator that
+                                      relates the key and values.
+                                    properties:
+                                      key:
+                                        description: key is the label key that the
+                                          selector applies to.
+                                        type: string
+                                      operator:
+                                        description: |-
+                                          operator represents a key's relationship to a set of values.
+                                          Valid operators are In, NotIn, Exists and DoesNotExist.
+                                        enum:
+                                        - In
+                                        - NotIn
+                                        - Exists
+                                        - DoesNotExist
+                                        type: string
+                                      values:
+                                        description: |-
+                                          values is an array of string values. If the operator is In or NotIn,
+                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                          the values array must be empty. This array is replaced during a strategic
+                                          merge patch.
+                                        items:
+                                          type: string
+                                        type: array
+                                        x-kubernetes-list-type: atomic
+                                    required:
+                                    - key
+                                    - operator
+                                    type: object
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                matchLabels:
+                                  additionalProperties:
+                                    description: MatchLabelsValue represents the value
+                                      from the MatchLabels {key,value} pair.
+                                    maxLength: 63
+                                    pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
+                                    type: string
+                                  description: |-
+                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                  type: object
+                              type: object
+                              x-kubernetes-map-type: atomic
+                            except:
+                              description: |-
+                                ExceptCIDRs is a list of IP blocks which the endpoint subject to the rule
+                                is not allowed to initiate connections to. These CIDR prefixes should be
+                                contained within Cidr, using ExceptCIDRs together with CIDRGroupRef is not
+                                supported yet.
+                                These exceptions are only applied to the Cidr in this CIDRRule, and do not
+                                apply to any other CIDR prefixes in any other CIDRRules.
+                              items:
+                                description: |-
+                                  CIDR specifies a block of IP addresses.
+                                  Example: 192.0.2.1/32
+                                format: cidr
+                                type: string
+                              type: array
+                          type: object
+                        type: array
+                      fromEndpoints:
+                        description: |-
+                          FromEndpoints is a list of endpoints identified by an
+                          EndpointSelector which are allowed to communicate with the endpoint
+                          subject to the rule.
+
+                          Example:
+                          Any endpoint with the label "role=backend" can be consumed by any
+                          endpoint carrying the label "role=frontend".
+
+                          Note that while an empty non-nil FromEndpoints does not select anything,
+                          nil FromEndpoints is implicitly treated as a wildcard selector if ToPorts
+                          are also specified.
+                          To select everything, use one EndpointSelector without any match requirements.
+                        items:
+                          description: EndpointSelector is a wrapper for k8s LabelSelector.
+                          properties:
+                            matchExpressions:
+                              description: matchExpressions is a list of label selector
+                                requirements. The requirements are ANDed.
+                              items:
+                                description: |-
+                                  A label selector requirement is a selector that contains values, a key, and an operator that
+                                  relates the key and values.
+                                properties:
+                                  key:
+                                    description: key is the label key that the selector
+                                      applies to.
+                                    type: string
+                                  operator:
+                                    description: |-
+                                      operator represents a key's relationship to a set of values.
+                                      Valid operators are In, NotIn, Exists and DoesNotExist.
+                                    enum:
+                                    - In
+                                    - NotIn
+                                    - Exists
+                                    - DoesNotExist
+                                    type: string
+                                  values:
+                                    description: |-
+                                      values is an array of string values. If the operator is In or NotIn,
+                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                      the values array must be empty. This array is replaced during a strategic
+                                      merge patch.
+                                    items:
+                                      type: string
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                required:
+                                - key
+                                - operator
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
+                            matchLabels:
+                              additionalProperties:
+                                description: MatchLabelsValue represents the value
+                                  from the MatchLabels {key,value} pair.
+                                maxLength: 63
+                                pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
+                                type: string
+                              description: |-
+                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                operator is "In", and the values array contains only "value". The requirements are ANDed.
+                              type: object
+                          type: object
+                          x-kubernetes-map-type: atomic
+                        type: array
+                      fromEntities:
+                        description: |-
+                          FromEntities is a list of special entities which the endpoint subject
+                          to the rule is allowed to receive connections from. Supported entities are
+                          `world`, `cluster`, `cluster-mesh`, `host`, `remote-node`, `kube-apiserver`, `ingress`, `init`,
+                          `health`, `unmanaged`, `none` and `all`.
+                        items:
+                          description: |-
+                            Entity specifies the class of receiver/sender endpoints that do not have
+                            individual identities.  Entities are used to describe "outside of cluster",
+                            "host", etc.
+                          enum:
+                          - all
+                          - world
+                          - cluster
+                          - cluster-mesh
+                          - host
+                          - init
+                          - ingress
+                          - unmanaged
+                          - remote-node
+                          - health
+                          - none
+                          - kube-apiserver
+                          type: string
+                        type: array
+                      fromGroups:
+                        description: |-
+                          FromGroups allows policies to reference CIDRs provided by external integrations.
+                          Currently, only AWS is supported, and the rule can select by multiple sub directives.
+                          FromGroups entries are functionally equivalent to FromCIDR, and have the same
+                          limitiations. They cannot select traffic originating from within the cluster.
+
+                          Example:
+                          fromGroups:
+                          - aws:
+                              securityGroupsIds:
+                              - 'sg-XXXXXXXXXXXXX'
+                        items:
+                          description: Groups allows referencing CIDRs that are resolved
+                            from an external integration.
+                          properties:
+                            aws:
+                              description: AWSGroup is an structure that can be used
+                                to whitelisting information from AWS integration
+                              properties:
+                                labels:
+                                  additionalProperties:
+                                    type: string
+                                  description: |-
+                                    Labels selects AWS ENIs by labels.
+                                    Multiple labels are AND-ed together.
+                                  type: object
+                                region:
+                                  description: 'Deprecated: Region is unused.'
+                                  type: string
+                                securityGroupsIds:
+                                  description: |-
+                                    SecurityGroupsIds selects VPC SecurityGroups by IDs.
+                                    If multiple IDs are specified, they are OR-ed together.
+
+                                    Note that this may be AND-ed with any Names specified. Specifying both
+                                    IDs and Names is not recommended.
+                                  items:
+                                    type: string
+                                  type: array
+                                securityGroupsNames:
+                                  description: |-
+                                    SecurityGroupsNames selects VPC SecurityGroups by name.
+                                    If multiple names are specified, they are OR-ed together.
+
+                                    Note that this may be AND-ed with any IDs specified. Specifying both
+                                    IDs and Names is not recommended.
+                                  items:
+                                    type: string
+                                  type: array
+                              type: object
+                          type: object
+                        type: array
+                      fromNodes:
+                        description: |-
+                          FromNodes is a list of nodes identified by an
+                          EndpointSelector which are allowed to communicate with the endpoint
+                          subject to the rule.
+                        items:
+                          description: EndpointSelector is a wrapper for k8s LabelSelector.
+                          properties:
+                            matchExpressions:
+                              description: matchExpressions is a list of label selector
+                                requirements. The requirements are ANDed.
+                              items:
+                                description: |-
+                                  A label selector requirement is a selector that contains values, a key, and an operator that
+                                  relates the key and values.
+                                properties:
+                                  key:
+                                    description: key is the label key that the selector
+                                      applies to.
+                                    type: string
+                                  operator:
+                                    description: |-
+                                      operator represents a key's relationship to a set of values.
+                                      Valid operators are In, NotIn, Exists and DoesNotExist.
+                                    enum:
+                                    - In
+                                    - NotIn
+                                    - Exists
+                                    - DoesNotExist
+                                    type: string
+                                  values:
+                                    description: |-
+                                      values is an array of string values. If the operator is In or NotIn,
+                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                      the values array must be empty. This array is replaced during a strategic
+                                      merge patch.
+                                    items:
+                                      type: string
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                required:
+                                - key
+                                - operator
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
+                            matchLabels:
+                              additionalProperties:
+                                description: MatchLabelsValue represents the value
+                                  from the MatchLabels {key,value} pair.
+                                maxLength: 63
+                                pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
+                                type: string
+                              description: |-
+                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                operator is "In", and the values array contains only "value". The requirements are ANDed.
+                              type: object
+                          type: object
+                          x-kubernetes-map-type: atomic
+                        type: array
+                      fromRequires:
+                        description: Deprecated.
+                        items:
+                          type: string
+                        maxItems: 0
+                        type: array
+                      icmps:
+                        description: |-
+                          ICMPs is a list of ICMP rule identified by type number
+                          which the endpoint subject to the rule is not allowed to
+                          receive connections on.
+
+                          Example:
+                          Any endpoint with the label "app=httpd" can not accept incoming
+                          type 8 ICMP connections.
+                        items:
+                          description: ICMPRule is a list of ICMP fields.
+                          properties:
+                            fields:
+                              description: Fields is a list of ICMP fields.
+                              items:
+                                description: ICMPField is a ICMP field.
+                                properties:
+                                  family:
+                                    default: IPv4
+                                    description: |-
+                                      Family is a IP address version.
+                                      Currently, we support `IPv4` and `IPv6`.
+                                      `IPv4` is set as default.
+                                    enum:
+                                    - IPv4
+                                    - IPv6
+                                    type: string
+                                  type:
+                                    anyOf:
+                                    - type: integer
+                                    - type: string
+                                    description: "Type is a ICMP-type.\nIt should
+                                      be an 8bit code (0-255), or it's CamelCase name
+                                      (for example, \"EchoReply\").\nAllowed ICMP
+                                      types are:\n    Ipv4: EchoReply | DestinationUnreachable
+                                      | Redirect | Echo | EchoRequest |\n\t\t     RouterAdvertisement
+                                      | RouterSelection | TimeExceeded | ParameterProblem
+                                      |\n\t\t\t Timestamp | TimestampReply | Photuris
+                                      | ExtendedEcho Request | ExtendedEcho Reply\n
+                                      \   Ipv6: DestinationUnreachable | PacketTooBig
+                                      | TimeExceeded | ParameterProblem |\n\t\t\t
+                                      EchoRequest | EchoReply | MulticastListenerQuery|
+                                      MulticastListenerReport |\n\t\t\t MulticastListenerDone
+                                      | RouterSolicitation | RouterAdvertisement |
+                                      NeighborSolicitation |\n\t\t\t NeighborAdvertisement
+                                      | RedirectMessage | RouterRenumbering | ICMPNodeInformationQuery
+                                      |\n\t\t\t ICMPNodeInformationResponse | InverseNeighborDiscoverySolicitation
+                                      | InverseNeighborDiscoveryAdvertisement |\n\t\t\t
+                                      HomeAgentAddressDiscoveryRequest | HomeAgentAddressDiscoveryReply
+                                      | MobilePrefixSolicitation |\n\t\t\t MobilePrefixAdvertisement
+                                      | DuplicateAddressRequestCodeSuffix | DuplicateAddressConfirmationCodeSuffix
+                                      |\n\t\t\t ExtendedEchoRequest | ExtendedEchoReply"
+                                    pattern: ^([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]|EchoReply|DestinationUnreachable|Redirect|Echo|RouterAdvertisement|RouterSelection|TimeExceeded|ParameterProblem|Timestamp|TimestampReply|Photuris|ExtendedEchoRequest|ExtendedEcho
+                                      Reply|PacketTooBig|ParameterProblem|EchoRequest|MulticastListenerQuery|MulticastListenerReport|MulticastListenerDone|RouterSolicitation|RouterAdvertisement|NeighborSolicitation|NeighborAdvertisement|RedirectMessage|RouterRenumbering|ICMPNodeInformationQuery|ICMPNodeInformationResponse|InverseNeighborDiscoverySolicitation|InverseNeighborDiscoveryAdvertisement|HomeAgentAddressDiscoveryRequest|HomeAgentAddressDiscoveryReply|MobilePrefixSolicitation|MobilePrefixAdvertisement|DuplicateAddressRequestCodeSuffix|DuplicateAddressConfirmationCodeSuffix)$
+                                    x-kubernetes-int-or-string: true
+                                required:
+                                - type
+                                type: object
+                              maxItems: 40
+                              type: array
+                          type: object
+                        type: array
+                      toPorts:
+                        description: |-
+                          ToPorts is a list of destination ports identified by port number and
+                          protocol which the endpoint subject to the rule is not allowed to
+                          receive connections on.
+
+                          Example:
+                          Any endpoint with the label "app=httpd" can not accept incoming
+                          connections on port 80/tcp.
+                        items:
+                          description: |-
+                            PortDenyRule is a list of ports/protocol that should be used for deny
+                            policies. This structure lacks the L7Rules since it's not supported in deny
+                            policies.
+                          properties:
+                            ports:
+                              description: Ports is a list of L4 port/protocol
+                              items:
+                                description: PortProtocol specifies an L4 port with
+                                  an optional transport protocol
+                                properties:
+                                  endPort:
+                                    description: EndPort can only be an L4 port number.
+                                    format: int32
+                                    maximum: 65535
+                                    minimum: 0
+                                    type: integer
+                                  port:
+                                    description: |-
+                                      Port can be an L4 port number, or a name in the form of "http"
+                                      or "http-8080".
+                                    pattern: ^(6553[0-5]|655[0-2][0-9]|65[0-4][0-9]{2}|6[0-4][0-9]{3}|[1-5][0-9]{4}|[0-9]{1,4})|([a-zA-Z0-9]-?)*[a-zA-Z](-?[a-zA-Z0-9])*$
+                                    type: string
+                                  protocol:
+                                    description: |-
+                                      Protocol is the L4 protocol. If "ANY", omitted or empty, any protocols
+                                      with transport ports (TCP, UDP, SCTP) match.
+
+                                      Accepted values: "TCP", "UDP", "SCTP", "VRRP", "IGMP", "GRE", "IPIP",
+                                      "IPV6", "ESP", "AH", "ANY"
+
+                                      Tunnel/encapsulation protocols (GRE, IPIP, IPV6, ESP, AH) and other
+                                      extended IP protocols (VRRP, IGMP) require the --enable-extended-ip-protocols
+                                      flag to be set. These protocols do not use transport-layer ports.
+
+                                      Matching on ICMP is not supported.
+
+                                      Named port specified for a container may narrow this down, but may not
+                                      contradict this.
+                                    enum:
+                                    - TCP
+                                    - UDP
+                                    - SCTP
+                                    - VRRP
+                                    - IGMP
+                                    - GRE
+                                    - IPIP
+                                    - IPV6
+                                    - ESP
+                                    - AH
+                                    - ANY
+                                    type: string
+                                type: object
+                              type: array
+                          type: object
+                        type: array
+                    type: object
+                  type: array
+                labels:
+                  description: |-
+                    Labels is a list of optional strings which can be used to
+                    re-identify the rule or to store metadata. It is possible to lookup
+                    or delete strings based on labels. Labels are not required to be
+                    unique, multiple rules can have overlapping or identical labels.
+                  items:
+                    description: Label is Cilium's representation of a label.
+                    properties:
+                      key:
+                        type: string
+                      source:
+                        description: 'Source can be one of the above values (e.g.:
+                          LabelSourceK8s).'
+                        type: string
+                      value:
+                        type: string
+                    required:
+                    - key
+                    type: object
+                  type: array
+                log:
+                  description: Log specifies custom policy-specific Hubble logging
+                    configuration.
+                  properties:
+                    value:
+                      description: |-
+                        Value is a free-form string that is included in Hubble flows
+                        that match this policy. The string is limited to 32 printable characters.
+                      maxLength: 32
+                      pattern: ^\PC*$
+                      type: string
+                  type: object
+                nodeSelector:
+                  description: |-
+                    NodeSelector selects all nodes which should be subject to this rule.
+                    EndpointSelector and NodeSelector cannot be both empty and are mutually
+                    exclusive. Can only be used in CiliumClusterwideNetworkPolicies.
+                  properties:
+                    matchExpressions:
+                      description: matchExpressions is a list of label selector requirements.
+                        The requirements are ANDed.
+                      items:
+                        description: |-
+                          A label selector requirement is a selector that contains values, a key, and an operator that
+                          relates the key and values.
+                        properties:
+                          key:
+                            description: key is the label key that the selector applies
+                              to.
+                            type: string
+                          operator:
+                            description: |-
+                              operator represents a key's relationship to a set of values.
+                              Valid operators are In, NotIn, Exists and DoesNotExist.
+                            enum:
+                            - In
+                            - NotIn
+                            - Exists
+                            - DoesNotExist
+                            type: string
+                          values:
+                            description: |-
+                              values is an array of string values. If the operator is In or NotIn,
+                              the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                              the values array must be empty. This array is replaced during a strategic
+                              merge patch.
+                            items:
+                              type: string
+                            type: array
+                            x-kubernetes-list-type: atomic
+                        required:
+                        - key
+                        - operator
+                        type: object
+                      type: array
+                      x-kubernetes-list-type: atomic
+                    matchLabels:
+                      additionalProperties:
+                        description: MatchLabelsValue represents the value from the
+                          MatchLabels {key,value} pair.
+                        maxLength: 63
+                        pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
+                        type: string
+                      description: |-
+                        matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                        map is equivalent to an element of matchExpressions, whose key field is "key", the
+                        operator is "In", and the values array contains only "value". The requirements are ANDed.
+                      type: object
+                  type: object
+                  x-kubernetes-map-type: atomic
+              type: object
+            type: array
+          status:
+            description: Status is the status of the Cilium policy rule
+            properties:
+              conditions:
+                items:
+                  properties:
+                    lastTransitionTime:
+                      description: The last time the condition transitioned from one
+                        status to another.
+                      format: date-time
+                      type: string
+                    message:
+                      description: A human readable message indicating details about
+                        the transition.
+                      type: string
+                    reason:
+                      description: The reason for the condition's last transition.
+                      type: string
+                    status:
+                      description: The status of the condition, one of True, False,
+                        or Unknown
+                      type: string
+                    type:
+                      description: The type of the policy condition
+                      type: string
+                  required:
+                  - status
+                  - type
+                  type: object
+                type: array
+                x-kubernetes-list-map-keys:
+                - type
+                x-kubernetes-list-type: map
+              derivativePolicies:
+                additionalProperties:
+                  description: |-
+                    CiliumNetworkPolicyNodeStatus is the status of a Cilium policy rule for a
+                    specific node.
+                  properties:
+                    annotations:
+                      additionalProperties:
+                        type: string
+                      description: |-
+                        Annotations corresponds to the Annotations in the ObjectMeta of the CNP
+                        that have been realized on the node for CNP. That is, if a CNP has been
+                        imported and has been assigned annotation X=Y by the user,
+                        Annotations in CiliumNetworkPolicyNodeStatus will be X=Y once the
+                        CNP that was imported corresponding to Annotation X=Y has been realized on
+                        the node.
+                      type: object
+                    enforcing:
+                      description: |-
+                        Enforcing is set to true once all endpoints present at the time the
+                        policy has been imported are enforcing this policy.
+                      type: boolean
+                    error:
+                      description: |-
+                        Error describes any error that occurred when parsing or importing the
+                        policy, or realizing the policy for the endpoints to which it applies
+                        on the node.
+                      type: string
+                    lastUpdated:
+                      description: LastUpdated contains the last time this status
+                        was updated
+                      format: date-time
+                      type: string
+                    localPolicyRevision:
+                      description: |-
+                        Revision is the policy revision of the repository which first implemented
+                        this policy.
+                      format: int64
+                      type: integer
+                    ok:
+                      description: |-
+                        OK is true when the policy has been parsed and imported successfully
+                        into the in-memory policy repository on the node.
+                      type: boolean
+                  type: object
+                description: |-
+                  DerivativePolicies is the status of all policies derived from the Cilium
+                  policy
+                type: object
+            type: object
+        required:
+        - metadata
+        type: object
+        x-kubernetes-validations:
+        - message: spec or specs must be provided
+          rule: has(self.spec) || has(self.specs)
+    served: true
+    storage: true
+    subresources:
+      status: {}
diff --git a/hack/cilium-api-probe/go.mod b/hack/cilium-api-probe/go.mod
new file mode 100644
index 0000000..c496d37
--- /dev/null
+++ b/hack/cilium-api-probe/go.mod
@@ -0,0 +1,82 @@
+module github.com/hubble-policy-gen/hack/cilium-api-probe
+
+go 1.27.1
+
+require (
+	github.com/cilium/cilium v1.20.1
+	k8s.io/apimachinery v0.36.3
+	sigs.k8s.io/yaml v1.6.0
+)
+
+require (
+	github.com/blang/semver/v4 v4.0.0 // indirect
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
+	github.com/cilium/ebpf v0.22.0 // indirect
+	github.com/cilium/hive v1.0.4 // indirect
+	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
+	github.com/fsnotify/fsnotify v1.10.1 // indirect
+	github.com/fxamacker/cbor/v2 v2.9.1 // indirect
+	github.com/go-logr/logr v1.4.3 // indirect
+	github.com/go-openapi/analysis v0.25.2 // indirect
+	github.com/go-openapi/errors v0.22.8 // indirect
+	github.com/go-openapi/jsonpointer v0.23.1 // indirect
+	github.com/go-openapi/jsonreference v0.21.6 // indirect
+	github.com/go-openapi/loads v0.24.0 // indirect
+	github.com/go-openapi/spec v0.22.6 // indirect
+	github.com/go-openapi/strfmt v0.26.3 // indirect
+	github.com/go-openapi/swag/conv v0.26.1 // indirect
+	github.com/go-openapi/swag/fileutils v0.26.1 // indirect
+	github.com/go-openapi/swag/jsonname v0.26.1 // indirect
+	github.com/go-openapi/swag/jsonutils v0.26.1 // indirect
+	github.com/go-openapi/swag/loading v0.26.1 // indirect
+	github.com/go-openapi/swag/mangling v0.26.1 // indirect
+	github.com/go-openapi/swag/stringutils v0.26.1 // indirect
+	github.com/go-openapi/swag/typeutils v0.26.1 // indirect
+	github.com/go-openapi/swag/yamlutils v0.26.1 // indirect
+	github.com/go-openapi/validate v0.26.0 // indirect
+	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
+	github.com/google/go-cmp v0.7.0 // indirect
+	github.com/google/uuid v1.6.0 // indirect
+	github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
+	github.com/inconshreveable/mousetrap v1.1.0 // indirect
+	github.com/json-iterator/go v1.1.12 // indirect
+	github.com/mackerelio/go-osstat v0.2.7 // indirect
+	github.com/mitchellh/mapstructure v1.5.0 // indirect
+	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
+	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
+	github.com/oklog/ulid/v2 v2.1.1 // indirect
+	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
+	github.com/petermattis/goid v0.0.0-20250813065127-a731cc31b4fe // indirect
+	github.com/sagikazarmark/locafero v0.11.0 // indirect
+	github.com/sasha-s/go-deadlock v0.3.9 // indirect
+	github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8 // indirect
+	github.com/spf13/afero v1.15.0 // indirect
+	github.com/spf13/cast v1.10.0 // indirect
+	github.com/spf13/cobra v1.10.2 // indirect
+	github.com/spf13/pflag v1.0.10 // indirect
+	github.com/spf13/viper v1.21.0 // indirect
+	github.com/subosito/gotenv v1.6.0 // indirect
+	github.com/vishvananda/netlink v1.3.2-0.20260624190457-bab08b3566fc // indirect
+	github.com/vishvananda/netns v0.0.5 // indirect
+	github.com/x448/float16 v0.8.4 // indirect
+	go.uber.org/dig v1.17.1 // indirect
+	go.yaml.in/yaml/v2 v2.4.4 // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
+	go4.org/netipx v0.0.0-20231129151722-fdeea329fbba // indirect
+	golang.org/x/net v0.56.0 // indirect
+	golang.org/x/sync v0.21.0 // indirect
+	golang.org/x/sys v0.46.0 // indirect
+	golang.org/x/term v0.44.0 // indirect
+	golang.org/x/text v0.38.0 // indirect
+	golang.org/x/time v0.15.0 // indirect
+	golang.org/x/tools v0.46.0 // indirect
+	gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c // indirect
+	gopkg.in/inf.v0 v0.9.1 // indirect
+	k8s.io/client-go v0.36.3 // indirect
+	k8s.io/klog/v2 v2.140.0 // indirect
+	k8s.io/kube-openapi v0.0.0-20260501160325-927ab1f70cd6 // indirect
+	k8s.io/utils v0.0.0-20260707023825-cf1189d6abe3 // indirect
+	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
+	sigs.k8s.io/randfill v1.0.0 // indirect
+	sigs.k8s.io/structured-merge-diff/v6 v6.4.0 // indirect
+)
diff --git a/hack/cilium-api-probe/go.sum b/hack/cilium-api-probe/go.sum
new file mode 100644
index 0000000..b687be5
--- /dev/null
+++ b/hack/cilium-api-probe/go.sum
@@ -0,0 +1,185 @@
+github.com/blang/semver/v4 v4.0.0 h1:1PFHFE6yCCTv8C1TeyNNarDzntLi7wMI5i/pzqYIsAM=
+github.com/blang/semver/v4 v4.0.0/go.mod h1:IbckMUScFkM3pff0VJDNKRiT6TG/YpiHIM2yvyW5YoQ=
+github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
+github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/cilium/cilium v1.20.1 h1:omXYGsC9nvDEdTXZpOVa3VlpB1QTok9OHDPSQbnPoJg=
+github.com/cilium/cilium v1.20.1/go.mod h1:b3q9uyjW+L8rGh0KlCSdNyiyE2kpSE2fa2A5cWqXhCo=
+github.com/cilium/ebpf v0.22.0 h1:v2ktp0roffpMOj2MMf3idtCQZOsAoC4BJbAJN+ke2bY=
+github.com/cilium/ebpf v0.22.0/go.mod h1:CDzZbe2hC5JjlDC+CY3KFCzlYwN4gbxppYM+Z10bQt4=
+github.com/cilium/hive v1.0.4 h1:Sw4loPv25qMnnYSA65+ybpvZMJHQuUMjQ9jcwoPmP7U=
+github.com/cilium/hive v1.0.4/go.mod h1:NY1wD3TQ4sya7zkhkB4QX6eIZ4FjwZPG+lnUB2IH5Xs=
+github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
+github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
+github.com/fsnotify/fsnotify v1.10.1 h1:b0/UzAf9yR5rhf3RPm9gf3ehBPpf0oZKIjtpKrx59Ho=
+github.com/fsnotify/fsnotify v1.10.1/go.mod h1:TLheqan6HD6GBK6PrDWyDPBaEV8LspOxvPSjC+bVfgo=
+github.com/fxamacker/cbor/v2 v2.9.1 h1:2rWm8B193Ll4VdjsJY28jxs70IdDsHRWgQYAI80+rMQ=
+github.com/fxamacker/cbor/v2 v2.9.1/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
+github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
+github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-openapi/analysis v0.25.2 h1:I0vy4n3alz+DHTiN1PRhCb7QZxkK6g5YmswZKv2TKuw=
+github.com/go-openapi/analysis v0.25.2/go.mod h1:Uhs1t/2XR10EnwONYILGEzw8gcfGIG5Xk5K2AxnhqDo=
+github.com/go-openapi/errors v0.22.8 h1:oP7sW7TWc3wFFjrzzj0nI83H2qMBkNjNfSd+XRejk/I=
+github.com/go-openapi/errors v0.22.8/go.mod h1:BuUoHcYrU6E7V9gfj1I5wLQqgtIHnup/alXZ8KdgQ0w=
+github.com/go-openapi/jsonpointer v0.23.1 h1:1HBACs7XIwR2RcmItfdSFlALhGbe6S92p0ry4d1GWg4=
+github.com/go-openapi/jsonpointer v0.23.1/go.mod h1:iWRmZTrGn7XwYhtPt/fvdSFj1OfNBngqRT2UG3BxSqY=
+github.com/go-openapi/jsonreference v0.21.6 h1:NZ5nGfnaM1n4I43Xjm1e5/M2GjOwQwndQz22uhxwD+Y=
+github.com/go-openapi/jsonreference v0.21.6/go.mod h1:xzbgtQ3ZbWxvET3AxdzCJlJt6vkovbf+IfSPJjD0tUY=
+github.com/go-openapi/loads v0.24.0 h1:4LLorXRPTzIN9V6ngMUZbAscsBOUBk3Oa8cClu/bFrQ=
+github.com/go-openapi/loads v0.24.0/go.mod h1:xQMgX+hw5xRAhGrcDXxeMw78IFqUpIzhleu3HqPhyF4=
+github.com/go-openapi/spec v0.22.6 h1:Tyy1pLaNCM8GBCFLoGYLonjJi6zykqyLCjXLc19ZPic=
+github.com/go-openapi/spec v0.22.6/go.mod h1:HZvTHat+iH0PALQRWhrqIHtU/PEqxqd89fu0MxGlMeM=
+github.com/go-openapi/strfmt v0.26.3 h1:rzmslHarJgBbf2qfGge+X3htclQfmXqBZMm0Too0HhU=
+github.com/go-openapi/strfmt v0.26.3/go.mod h1:a5nsUw0oRpQzZeOwx8bi6cKbzFZslpbCKt1LEot+KnQ=
+github.com/go-openapi/swag v0.26.1 h1:l5sVEyVpwj+DDYeZyo7wQI/Ebn/mKYIyGB/pFwAfGoQ=
+github.com/go-openapi/swag/conv v0.26.1 h1:slr5FVkg9Wc3Y5zcwenD8Sd/PQ94b2I/QJI7N7KTBpg=
+github.com/go-openapi/swag/conv v0.26.1/go.mod h1:mvQXgPptZk9GTrFgGwWvT4q+dN+zQej9JfmGwnipz1A=
+github.com/go-openapi/swag/fileutils v0.26.1 h1:K1XCM2CGhfNsc6YDt6v7Q5+1e59rftYWdcu/isZhvFw=
+github.com/go-openapi/swag/fileutils v0.26.1/go.mod h1:mYUgxQAKX4ShS3qvvySx+/9yrlUnDhjiD1CalaQl8lQ=
+github.com/go-openapi/swag/jsonname v0.26.1 h1:VReupaV6WxlAsCn0e4DUfgV6bPmINnPpyJDLqSfNPcE=
+github.com/go-openapi/swag/jsonname v0.26.1/go.mod h1:OvdW6BoWoj33pTfi7x9vFrgmT+fk7aw0BRwvCE0YOuc=
+github.com/go-openapi/swag/jsonutils v0.26.1 h1:2hdBfFkHg+7Wrz2VsCbeyR6hzkRDs7AztnMR2u84yOY=
+github.com/go-openapi/swag/jsonutils v0.26.1/go.mod h1:U+RMJH3wa+6BRiphuRtIyI8fW9HPFqFQ4sHk2oRx0UQ=
+github.com/go-openapi/swag/jsonutils/fixtures_test v0.26.1 h1:1CD7NiLLb/TXl3tOnFYU4b+mNfb5rtgHkaA+q7RMYYQ=
+github.com/go-openapi/swag/jsonutils/fixtures_test v0.26.1/go.mod h1:ZWafc8nMdYzTE3uYY6W86f0n46+IF0g4uUyRhJw/kXc=
+github.com/go-openapi/swag/loading v0.26.1 h1:E9K4wqXeROlhjFQ13K9zMz6ojFGXIggGe+ad1odrK9w=
+github.com/go-openapi/swag/loading v0.26.1/go.mod h1:3qvRIlWzWdq1HvmldwmuJ2ohpcAryN6xVt2OTKd0/7E=
+github.com/go-openapi/swag/mangling v0.26.1 h1:gpYI4WuPKFJJVjV5cDLGlDVJhFIxYjQc7yN5eEb4CqM=
+github.com/go-openapi/swag/mangling v0.26.1/go.mod h1:POETDH01hqAdASXfw7ISEd9bCOE6xBHOt8NHmGZRmYM=
+github.com/go-openapi/swag/stringutils v0.26.1 h1:f88uYyTso7TnHrKM/bUBsQ5e2wKf37cpgo6pvbzd9yU=
+github.com/go-openapi/swag/stringutils v0.26.1/go.mod h1:Sc6d3bU8fgk5AyZR8/8jEQ+Is/Ald+TD/IIggPN8UJk=
+github.com/go-openapi/swag/typeutils v0.26.1 h1:yg42FgMzRR6PVQ3M3qHz1s+Y6/P4HoJ3cBarXa3OVnU=
+github.com/go-openapi/swag/typeutils v0.26.1/go.mod h1:VfnV+oUtSP2vCSCn2aJgnr8OevUYemyIzzS1VOzS10o=
+github.com/go-openapi/swag/yamlutils v0.26.1 h1:0TSLK+lXs9vfIhAWzBeI/lOzEnIoot6WTCO1aAeWFTk=
+github.com/go-openapi/swag/yamlutils v0.26.1/go.mod h1:7W5b7PRX9MxwL7TjeG7H8HkyBGRsIDRObhyMWFgBI2M=
+github.com/go-openapi/testify/enable/yaml/v2 v2.5.1 h1:q9NtHwK4qHF7yZziBPvZyv7zWAIk8ok88Gh2mR6Jpc8=
+github.com/go-openapi/testify/enable/yaml/v2 v2.5.1/go.mod h1:JW0MXIotCYps/XsgJnG3a8Q7rE5xAiBwoOD5OfaIQBk=
+github.com/go-openapi/testify/v2 v2.5.1 h1:TMdhCaw8fUNraVSf3Omoob1dO/AzBfhtFAPW0an6sBo=
+github.com/go-openapi/testify/v2 v2.5.1/go.mod h1:SgsVHtfooshd0tublTtJ50FPKhujf47YRqauXXOUxfw=
+github.com/go-openapi/validate v0.26.0 h1:dxWzQ3F+vb1SajqUxHjwb5T4mTpSHmdrtv5Bi7+ZNhw=
+github.com/go-openapi/validate v0.26.0/go.mod h1:b4o00uq7fJeJA+wWhVFCJpKTctzeFwzZImGGmHsl2JA=
+github.com/go-quicktest/qt v1.101.1-0.20240301121107-c6c8733fa1e6 h1:teYtXy9B7y5lHTp8V9KPxpYRAVA7dozigQcMiBust1s=
+github.com/go-quicktest/qt v1.101.1-0.20240301121107-c6c8733fa1e6/go.mod h1:p4lGIVX+8Wa6ZPNDvqcxq36XpUDLh42FLetFU7odllI=
+github.com/go-viper/mapstructure/v2 v2.5.0 h1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPEgAXnvj1Ro=
+github.com/go-viper/mapstructure/v2 v2.5.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
+github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
+github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
+github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
+github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
+github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
+github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
+github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/mackerelio/go-osstat v0.2.7 h1:TCavZi10wF49bT6iQZ9eT2keGZQpC69MTDfdJej5e94=
+github.com/mackerelio/go-osstat v0.2.7/go.mod h1:dwpYh5pIPmvk+IEwBKNIWRFMB92mrC08CmXOhDC7nQk=
+github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
+github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
+github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee h1:W5t00kpgFdJifH4BDsTlE89Zl93FEloxaWZfGcifgq8=
+github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/oklog/ulid/v2 v2.1.1 h1:suPZ4ARWLOJLegGFiZZ1dFAkqzhMjL3J1TzI+5wHz8s=
+github.com/oklog/ulid/v2 v2.1.1/go.mod h1:rcEKHmBBKfef9DhnvX7y1HZBYxjXb0cP5ExxNsTT1QQ=
+github.com/pborman/getopt v0.0.0-20170112200414-7148bc3a4c30/go.mod h1:85jBQOZwpVEaDAr341tbn15RS4fCAsIst0qp7i8ex1o=
+github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=
+github.com/pelletier/go-toml/v2 v2.2.4/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
+github.com/petermattis/goid v0.0.0-20250813065127-a731cc31b4fe h1:vHpqOnPlnkba8iSxU4j/CvDSS9J4+F4473esQsYLGoE=
+github.com/petermattis/goid v0.0.0-20250813065127-a731cc31b4fe/go.mod h1:pxMtw7cyUw6B2bRH0ZBANSPg+AoSud1I1iyJHI69jH4=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
+github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
+github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
+github.com/sagikazarmark/locafero v0.11.0 h1:1iurJgmM9G3PA/I+wWYIOw/5SyBtxapeHDcg+AAIFXc=
+github.com/sagikazarmark/locafero v0.11.0/go.mod h1:nVIGvgyzw595SUSUE6tvCp3YYTeHs15MvlmU87WwIik=
+github.com/sasha-s/go-deadlock v0.3.9 h1:fiaT9rB7g5sr5ddNZvlwheclN9IP86eFW9WgqlEQV+w=
+github.com/sasha-s/go-deadlock v0.3.9/go.mod h1:KuZj51ZFmx42q/mPaYbRk0P1xcwe697zsJKE03vD4/Y=
+github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8 h1:+jumHNA0Wrelhe64i8F6HNlS8pkoyMv5sreGx2Ry5Rw=
+github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8/go.mod h1:3n1Cwaq1E1/1lhQhtRK2ts/ZwZEhjcQeJQ1RuC6Q/8U=
+github.com/spf13/afero v1.15.0 h1:b/YBCLWAJdFWJTN9cLhiXXcD7mzKn9Dm86dNnfyQw1I=
+github.com/spf13/afero v1.15.0/go.mod h1:NC2ByUVxtQs4b3sIUphxK0NioZnmxgyCrfzeuq8lxMg=
+github.com/spf13/cast v1.10.0 h1:h2x0u2shc1QuLHfxi+cTJvs30+ZAHOGRic8uyGTDWxY=
+github.com/spf13/cast v1.10.0/go.mod h1:jNfB8QC9IA6ZuY2ZjDp0KtFO2LZZlg4S/7bzP6qqeHo=
+github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
+github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4=
+github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
+github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/viper v1.21.0 h1:x5S+0EU27Lbphp4UKm1C+1oQO+rKx36vfCoaVebLFSU=
+github.com/spf13/viper v1.21.0/go.mod h1:P0lhsswPGWD/1lZJ9ny3fYnVqxiegrlNrEmgLjbTCAY=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8=
+github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU=
+github.com/vishvananda/netlink v1.3.2-0.20260624190457-bab08b3566fc h1:rz8YwESFhYgF7sjsKskrWDAve2WC8wA1cWcLLEdojks=
+github.com/vishvananda/netlink v1.3.2-0.20260624190457-bab08b3566fc/go.mod h1:lEui7SPMd9fgxzHVGRAvTxsBGCF6PRH81o2kLWLWHgw=
+github.com/vishvananda/netns v0.0.5 h1:DfiHV+j8bA32MFM7bfEunvT8IAqQ/NzSJHtcmW5zdEY=
+github.com/vishvananda/netns v0.0.5/go.mod h1:SpkAiCQRtJ6TvvxPnOSyH3BMl6unz3xZlaprSwhNNJM=
+github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
+github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
+go.uber.org/dig v1.17.1 h1:Tga8Lz8PcYNsWsyHMZ1Vm0OQOUaJNDyvPImgbAu9YSc=
+go.uber.org/dig v1.17.1/go.mod h1:Us0rSJiThwCv2GteUN0Q7OKvU7n5J4dxZ9JKUXozFdE=
+go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
+go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
+go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
+go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
+go4.org/netipx v0.0.0-20231129151722-fdeea329fbba h1:0b9z3AuHCjxk0x/opv64kcgZLBseWJUpBw5I82+2U4M=
+go4.org/netipx v0.0.0-20231129151722-fdeea329fbba/go.mod h1:PLyyIXexvUFg3Owu6p/WfdlivPbZJsZdgWZlrGope/Y=
+golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=
+golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec=
+golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM=
+golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw=
+golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/term v0.44.0 h1:0rLvDRCtNj0gZkyIXhCyOb2OAzEhLVqc4B+hrsBhrmc=
+golang.org/x/term v0.44.0/go.mod h1:7ze4MdzUzLXpSAoFP1H0bOI9aXDqveSvatT5vKcFh2Y=
+golang.org/x/text v0.38.0 h1:sXmwo9DwP3OK9EZ7PqAdaooSGozfl/3a6/xJcbzPRhE=
+golang.org/x/text v0.38.0/go.mod h1:YXZt3QhHUKYT53r2lLKFIVi6Ao1jdzrTR/KQ09qyxF4=
+golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
+golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
+golang.org/x/tools v0.46.0 h1:7jTurBkPZu4moS/Uy4OQT1M+QBlsj3wejyZwsT8Z7rk=
+golang.org/x/tools v0.46.0/go.mod h1:FrD85F8l+NWL+9XWBSyVSHO6Ne4jutsfIFba7AWQ5Ys=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
+gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
+gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+k8s.io/apimachinery v0.36.3 h1:PkzMRBRG8joFD8EhCuQAtNPvJlxb82FwplP26HIzvAM=
+k8s.io/apimachinery v0.36.3/go.mod h1:cTSjBWgPe/6CQyBKzY/hDIRWCQQQeK0mfLbml0UYFHE=
+k8s.io/client-go v0.36.3 h1:M4JdVzXxYcZk4fGpfDdYnxSwhLKWCFoQsHW6t+z8Hfg=
+k8s.io/client-go v0.36.3/go.mod h1:gcPwr0c87vjjG6HB6pWEqOeuYVoXSsREjzux2j6GF30=
+k8s.io/klog/v2 v2.140.0 h1:Tf+J3AH7xnUzZyVVXhTgGhEKnFqye14aadWv7bzXdzc=
+k8s.io/klog/v2 v2.140.0/go.mod h1:o+/RWfJ6PwpnFn7OyAG3QnO47BFsymfEfrz6XyYSSp0=
+k8s.io/kube-openapi v0.0.0-20260501160325-927ab1f70cd6 h1:ngxu1nL4SbFuXwu1EY7cSKcVqSjTQPVbYQT6WNjTXaU=
+k8s.io/kube-openapi v0.0.0-20260501160325-927ab1f70cd6/go.mod h1:uGBT7iTA6c6MvqUvSXIaYZo9ukscABYi2btjhvgKGZ0=
+k8s.io/utils v0.0.0-20260707023825-cf1189d6abe3 h1:jVkFFVfXdXP74B/zbO3hM3hpSFD0xvhQ5U686DPurkE=
+k8s.io/utils v0.0.0-20260707023825-cf1189d6abe3/go.mod h1:M2s5JB1lIYP3jzZdorPLHXIPJzt9vv2muW5a6L9DtNM=
+sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5EXP7sU1kvOlxwZh5txg=
+sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
+sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
+sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
+sigs.k8s.io/structured-merge-diff/v6 v6.4.0 h1:qmp2e3ZfFi1/jJbDGpD4mt3wyp6PE1NfKHCYLqgNQJo=
+sigs.k8s.io/structured-merge-diff/v6 v6.4.0/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
+sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
+sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=
diff --git a/hack/cilium-api-probe/main.go b/hack/cilium-api-probe/main.go
new file mode 100644
index 0000000..5976c92
--- /dev/null
+++ b/hack/cilium-api-probe/main.go
@@ -0,0 +1,64 @@
+package main
+
+import (
+	_ "embed"
+	"fmt"
+	"os"
+	"runtime/debug"
+	"strings"
+
+	"github.com/cilium/cilium/pkg/policy/api"
+	slimv1 "github.com/cilium/cilium/pkg/k8s/slim/k8s/apis/meta/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"sigs.k8s.io/yaml"
+)
+
+//go:embed crd/ciliumnetworkpolicies.yaml
+var cnpCRD string
+
+// the envelope cf2cnp would render: no Status, ObjectMeta from apimachinery (already a dependency of policy/api)
+type Policy struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata"`
+	Spec              *api.Rule `json:"spec"`
+}
+
+func selector(labels map[string]string) api.EndpointSelector {
+	return api.EndpointSelector{LabelSelector: &slimv1.LabelSelector{MatchLabels: labels}}
+}
+
+func main() {
+	rule := &api.Rule{
+		EndpointSelector: selector(map[string]string{"app.kubernetes.io/name": "receiver"}),
+		Ingress: []api.IngressRule{{
+			IngressCommonRule: api.IngressCommonRule{
+				FromEndpoints: []api.EndpointSelector{selector(map[string]string{"app.kubernetes.io/name": "ns1-caller", "io.kubernetes.pod.namespace": "ns1", "io.cilium.k8s.policy.cluster": "poc2"})},
+				FromCIDR:      api.CIDRSlice{"172.18.255.170/32"},
+			},
+			ToPorts: api.PortRules{{Ports: []api.PortProtocol{{Port: "80", Protocol: "tcp"}}}},
+		}},
+		Description: "probe 3",
+	}
+	// validate a COPY with Cilium's own checks; render the original
+	check := rule.DeepCopy()
+	fmt.Println("sanitize (copy):", check.Sanitize(), "| protocol fixed on the copy:", check.Ingress[0].ToPorts[0].Ports[0].Protocol, "| selector key on the copy:", firstKey(check.EndpointSelector))
+	p := Policy{TypeMeta: metav1.TypeMeta{APIVersion: "cilium.io/v2", Kind: "CiliumNetworkPolicy"},
+		ObjectMeta: metav1.ObjectMeta{Name: "receiver", Namespace: "ns-recv", Labels: map[string]string{"app.kubernetes.io/managed-by": "cf2cnp"}}, Spec: rule}
+	b, _ := yaml.Marshal(p)
+	os.Stdout.Write(b)
+	fmt.Println("embedded CRD bytes:", len(cnpCRD), "| names the v2 version:", strings.Contains(cnpCRD, "name: v2"))
+	if bi, ok := debug.ReadBuildInfo(); ok {
+		for _, d := range bi.Deps {
+			if d.Path == "github.com/cilium/cilium" {
+				fmt.Println("supported spec: cilium.io/v2 CiliumNetworkPolicy as of cilium", d.Version)
+			}
+		}
+	}
+}
+
+func firstKey(es api.EndpointSelector) string {
+	for k := range es.LabelSelector.MatchLabels {
+		return k
+	}
+	return ""
+}
diff --git a/hack/copy-crd.sh b/hack/copy-crd.sh
new file mode 100755
index 0000000..41e4fc1
--- /dev/null
+++ b/hack/copy-crd.sh
@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+# copy-crd.sh — copy the CiliumNetworkPolicy CRD of the Cilium module pinned in go.mod into internal/crd/, where it is
+# embedded into the binary (`cf2cnp version` names it; CI validates every golden output against it). Copying the FILE
+# costs 0.4 MB; importing the package that embeds it upstream drags the Kubernetes client machinery in (measured:
+# 18 MB → 94 MB, docs/CRD-SPEC-FORENSICS.md §3). Run by `go generate ./internal/crd`; CI asserts the copy is identical.
+set -euo pipefail; cd "$(dirname "$0")/.."
+DIR=$(go list -m -f '{{.Dir}}' github.com/cilium/cilium)
+VERSION=$(go list -m -f '{{.Version}}' github.com/cilium/cilium)
+cp "$DIR/pkg/k8s/apis/cilium.io/client/crds/v2/ciliumnetworkpolicies.yaml" internal/crd/ciliumnetworkpolicies.yaml
+chmod u+w internal/crd/ciliumnetworkpolicies.yaml
+printf '%s\n' "$VERSION" > internal/crd/VERSION
+echo "internal/crd/ciliumnetworkpolicies.yaml <- cilium $VERSION"
diff --git a/hack/golden/regenerate.sh b/hack/golden/regenerate.sh
new file mode 100755
index 0000000..8986041
--- /dev/null
+++ b/hack/golden/regenerate.sh
@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+# regenerate.sh <cf2cnp binary> — rewrite every golden expected.yaml with the given binary's /generate answer.
+# Use only for a deliberate output change; commit the regenerated files with the change that caused them.
+set -euo pipefail; cd "$(dirname "$0")/../.."; BIN="${1:?cf2cnp binary}"; PORT=28096
+"$BIN" serve --port $PORT >/dev/null 2>&1 & PID=$!; trap 'kill $PID 2>/dev/null' EXIT; sleep 2
+for d in internal/testdata/golden/*/; do
+  q=$(python3 -c "import json,urllib.parse; print(urllib.parse.urlencode(json.load(open('$d/options.json'))))")
+  curl -s --fail-with-body -X POST "http://127.0.0.1:$PORT/generate${q:+?$q}" --data-binary @"$d/flows.ndjson" -o "$d/expected.yaml"
+  echo "$(basename "$d"): $(grep -c '^kind: CiliumNetworkPolicy' "$d/expected.yaml") policies"
+done
diff --git a/helm/cf2cnp/Chart.yaml b/helm/cf2cnp/Chart.yaml
index d5e718d..5338457 100644
--- a/helm/cf2cnp/Chart.yaml
+++ b/helm/cf2cnp/Chart.yaml
@@ -2,8 +2,8 @@ apiVersion: v2
 name: cf2cnp
 description: A Helm chart for CF2CNP - Cilium Flow to CiliumNetworkPolicy converter
 type: application
-version: 0.4.0
-appVersion: "0.3.1"
+version: 0.7.0
+appVersion: "0.7.0"
 keywords:
   - cilium
   - network-policy
diff --git a/helm/cf2cnp/README.md b/helm/cf2cnp/README.md
index 3fa4aa1..c83903a 100644
--- a/helm/cf2cnp/README.md
+++ b/helm/cf2cnp/README.md
@@ -32,6 +32,12 @@ The following table lists the configurable parameters of the CF2CNP chart and th
 | `service.type` | Service type | `ClusterIP` |
 | `service.port` | Service port | `80` |
 | `containerPort` | Container port | `8080` |
+| `externalURL` | Base URL clients reach cf2cnp at, for `download_url` (empty = derived from the request and its `Forwarded` / `X-Forwarded-Proto` / `X-Forwarded-Host` headers) | `""` |
+| `cors.allowedOrigins` | Origins allowed by CORS (Grafana's, for the dashboard action); empty = any | `[]` |
+| `auth.token`, `auth.existingSecret` | A bearer token required on `/generate` and `/download` (a Secret with key `token` preferred) | `""`, `""` |
+| `networkPolicy.enabled`, `networkPolicy.fromEndpoints` | A CiliumNetworkPolicy for the pod: ingress from the Gateway (`reserved:ingress`), the kubelet (`reserved:host`) and the listed endpoints (add `io.kubernetes.pod.namespace` for another namespace), egress to kube-dns | `false`, `[]` |
+| `extraArgs` | Extra arguments appended to `cf2cnp serve --port <containerPort>` | `[]` |
+| `extraEnv` | Extra environment variables (`CF2CNP_EXTERNAL_URL` is an alternative to `externalURL`) | `[]` |
 | `ingress.enabled` | Enable ingress | `false` |
 | `ingress.className` | Ingress class name | `""` |
 | `ingress.annotations` | Ingress annotations | `{}` |
diff --git a/helm/cf2cnp/templates/ciliumnetworkpolicy.yaml b/helm/cf2cnp/templates/ciliumnetworkpolicy.yaml
new file mode 100644
index 0000000..7e35c2e
--- /dev/null
+++ b/helm/cf2cnp/templates/ciliumnetworkpolicy.yaml
@@ -0,0 +1,55 @@
+{{- if .Values.networkPolicy.enabled }}
+{{- if and .Values.dns.resolver (not .Values.networkPolicy.dnsEgress) }}
+{{- fail "networkPolicy.dnsEgress must be set when dns.resolver is set: this policy would otherwise allow kube-system/kube-dns:53, not the resolver the server names (review ENH-003)" }}
+{{- end }}
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: {{ include "cf2cnp.fullname" . }}
+  labels:
+    {{- include "cf2cnp.labels" . | nindent 4 }}
+spec:
+  description: cf2cnp — reachable from the Gateway (reserved:ingress), the kubelet's probes (reserved:host) and the listed endpoints only; egress to the cluster's DNS only
+  endpointSelector:
+    matchLabels:
+      {{- include "cf2cnp.selectorLabels" . | nindent 6 }}
+  ingress:
+    # measured on Cilium 1.20.1 with Gateway API: a request through the Gateway reaches the pod as reserved:ingress;
+    # the kubelet's liveness/readiness probes reach it as reserved:host — without host, the pod fails its probes
+    - fromEntities: [ingress, host]
+      toPorts:
+        - ports:
+            - port: {{ .Values.containerPort | quote }}
+              protocol: TCP
+    {{- with .Values.networkPolicy.fromEndpoints }}
+    - fromEndpoints:
+        {{- toYaml . | nindent 8 }}
+      toPorts:
+        - ports:
+            - port: {{ $.Values.containerPort | quote }}
+              protocol: TCP
+    {{- end }}
+  egress:
+    # the resolver the dns.profile names (Cilium's DNS guide: OpenShift's DNS operator runs in openshift-dns on 5353
+    # without the k8s-app label). A custom dns.resolver names pods this rule does not know: set networkPolicy.dnsEgress.
+    {{- if .Values.networkPolicy.dnsEgress }}
+    {{- toYaml (list .Values.networkPolicy.dnsEgress) | nindent 4 }}
+    {{- else if eq .Values.dns.profile "openshift" }}
+    - toEndpoints:
+        - matchLabels:
+            io.kubernetes.pod.namespace: openshift-dns
+      toPorts:
+        - ports:
+            - port: "5353"
+              protocol: ANY
+    {{- else }}
+    - toEndpoints:
+        - matchLabels:
+            io.kubernetes.pod.namespace: kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: ANY
+    {{- end }}
+{{- end }}
diff --git a/helm/cf2cnp/templates/deployment.yaml b/helm/cf2cnp/templates/deployment.yaml
index d85889c..155fce0 100644
--- a/helm/cf2cnp/templates/deployment.yaml
+++ b/helm/cf2cnp/templates/deployment.yaml
@@ -31,6 +31,48 @@ spec:
             {{- toYaml .Values.securityContext | nindent 12 }}
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
           imagePullPolicy: {{ .Values.image.pullPolicy }}
+          args:
+            - serve
+            - --port
+            - {{ .Values.containerPort | quote }}
+            {{- if .Values.externalURL }}
+            - --external-url
+            - {{ .Values.externalURL | quote }}
+            {{- end }}
+            {{- with .Values.cors.allowedOrigins }}
+            - --allowed-origins
+            - {{ join "," . | quote }}
+            {{- end }}
+            {{- if and .Values.dns.profile (ne .Values.dns.profile "auto") }}
+            - --dns-profile
+            - {{ .Values.dns.profile | quote }}
+            {{- end }}
+            {{- with .Values.dns.resolver }}
+            - --dns-resolver
+            - {{ . | quote }}
+            {{- end }}
+            {{- with .Values.extraArgs }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
+          {{- if or .Values.extraEnv .Values.auth.token .Values.auth.existingSecret }}
+          env:
+            {{- if .Values.auth.existingSecret }}
+            - name: CF2CNP_AUTH_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.auth.existingSecret }}
+                  key: token
+            {{- else if .Values.auth.token }}
+            - name: CF2CNP_AUTH_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "cf2cnp.fullname" . }}-auth
+                  key: token
+            {{- end }}
+            {{- with .Values.extraEnv }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
+          {{- end }}
           ports:
             - name: http
               containerPort: {{ .Values.containerPort }}
diff --git a/helm/cf2cnp/templates/secret.yaml b/helm/cf2cnp/templates/secret.yaml
new file mode 100644
index 0000000..133f8b0
--- /dev/null
+++ b/helm/cf2cnp/templates/secret.yaml
@@ -0,0 +1,11 @@
+{{- if and .Values.auth.token (not .Values.auth.existingSecret) }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "cf2cnp.fullname" . }}-auth
+  labels:
+    {{- include "cf2cnp.labels" . | nindent 4 }}
+type: Opaque
+stringData:
+  token: {{ .Values.auth.token | quote }}
+{{- end }}
diff --git a/helm/cf2cnp/values.yaml b/helm/cf2cnp/values.yaml
index b2877a0..d4396be 100644
--- a/helm/cf2cnp/values.yaml
+++ b/helm/cf2cnp/values.yaml
@@ -43,6 +43,55 @@ service:
 
 containerPort: 8080
 
+# Base URL clients reach cf2cnp at (scheme://host[:port][/prefix]), used for the download_url in JSON
+# answers (the Grafana action). Leave empty to derive it from each request and the Forwarded /
+# X-Forwarded-Proto / X-Forwarded-Host headers a TLS-terminating ingress or gateway sets. Set it when
+# the proxy strips those headers or the public URL differs from the Host the pod sees.
+externalURL: ""
+
+# CORS (E6): origins allowed to call /generate from a browser (Grafana's origin for the dashboard action).
+# Empty = any origin, the historical default.
+cors:
+  allowedOrigins: []
+  # - https://grafana.example.com
+
+# Authentication (E6): a bearer token required on /generate and /download (never on /health or the page).
+# Prefer existingSecret (a Secret with the key `token`); `token` is for labs.
+auth:
+  token: ""
+  existingSecret: ""
+
+# A CiliumNetworkPolicy for the cf2cnp pod (E6): ingress from the Gateway (reserved:ingress), the kubelet's probes
+# (reserved:host) and the endpoints listed, on the container port; egress to kube-dns only.
+networkPolicy:
+  enabled: false
+  # Extra callers besides the Gateway and the kubelet. The Grafana ACTION is a browser call that arrives through
+  # the Gateway (reserved:ingress), so nothing is needed for it. A pod in ANOTHER namespace needs the namespace
+  # label in its selector (review finding — a bare label matches the release namespace only), e.g.
+  #   - matchLabels: {app.kubernetes.io/name: grafana, io.kubernetes.pod.namespace: monitoring}
+  fromEndpoints: []
+  # The egress rule to the cluster's DNS follows dns.profile (kube-dns 53/ANY, or openshift-dns 5353/ANY). When
+  # dns.resolver names other pods, write the rule for them here (one CiliumNetworkPolicy egress rule; the chart
+  # refuses to render a policy that would cut the pod off from a named resolver), e.g.
+  #   toEndpoints: [{matchLabels: {io.kubernetes.pod.namespace: dns-system, app: coredns}}]
+  #   toPorts: [{ports: [{port: "5353", protocol: ANY}]}]
+  dnsEgress: {}
+
+# Extra arguments appended to `cf2cnp serve --port <containerPort>` (e.g. a flag this chart has no value for)
+# The DNS resolver rule (0.7.0) a request gets when it does not name one (?dnsProfile= / ?dnsResolver=): the rule
+# toFQDNs and DNS visibility write. auto = derived from the observed DNS flows, else kubernetes (kube-system,
+# k8s-app=kube-dns, 53/ANY). On OpenShift set profile: openshift (openshift-dns, 5353/ANY, no k8s-app label —
+# Cilium's DNS guide), or name any resolver: resolver: "dns-system/app=coredns:5353/ANY". The chart's own
+# CiliumNetworkPolicy (networkPolicy.enabled) lets the pod reach the resolver the profile names.
+dns:
+  profile: auto
+  resolver: ""
+
+extraArgs: []
+
+# Extra environment variables for the container (list of EnvVar; CF2CNP_EXTERNAL_URL is an alternative to externalURL)
+extraEnv: []
+
 ingress:
   enabled: false
   className: ""
diff --git a/internal/aggregator/aggregator.go b/internal/aggregator/aggregator.go
index c006ddd..a565442 100644
--- a/internal/aggregator/aggregator.go
+++ b/internal/aggregator/aggregator.go
@@ -10,26 +10,38 @@ import (
 
 // AggregatedFlow represents flows grouped by source/destination
 type AggregatedFlow struct {
-	Direction          string            // INGRESS or EGRESS
-	SourceNamespace    string            // Source pod namespace
-	SourceLabels       map[string]string // Filtered source labels
-	SourceEntity       string            // Reserved entity for source (remote-node, host, etc.)
-	IsSourceEntity     bool              // True if source is a reserved entity
-	DestNamespace      string            // Destination pod namespace
-	DestLabels         map[string]string // Filtered destination labels
-	DestFQDNs          []string          // Destination FQDNs for world traffic
-	DestIPs            []string          // Destination IPs for CIDR-based rules
-	DestEntity         string            // Reserved entity (kube-apiserver, host, world, etc.)
-	Ports              []PortInfo        // Aggregated ports
-	IsWorldTraffic     bool              // True if destination is "world"
-	IsDestEntityTraffic bool             // True if destination is a reserved entity
-	IsReply            bool              // True if this is a reply packet
+	Direction           string            // INGRESS or EGRESS
+	SourceNamespace     string            // Source pod namespace
+	SourceLabels        map[string]string // Filtered source labels
+	SourceCluster       string            // ClusterMesh: the source's cluster (E1)
+	SourceEntity        string            // Reserved entity for source (remote-node, host, etc.)
+	IsSourceEntity      bool              // True if source is a reserved entity
+	DestNamespace       string            // Destination pod namespace
+	DestLabels          map[string]string // Filtered destination labels
+	DestCluster         string            // ClusterMesh: the destination's cluster (E1)
+	DestFQDNs           []string          // Destination FQDNs for world traffic
+	DestIPs             []string          // Destination IPs for CIDR-based rules
+	SourceIPs           []string          // Source addresses of a reserved:world source (fromCIDR, 0.7.0)
+	DestEntity          string            // Reserved entity (kube-apiserver, host, world, etc.)
+	Ports               []PortInfo        // Aggregated ports
+	IsWorldTraffic      bool              // True if destination is "world"
+	IsDestEntityTraffic bool              // True if destination is a reserved entity
+	IsReply             bool              // True if this is a reply packet
 }
 
-// PortInfo represents a port and protocol combination
+// HTTPRequest is one distinct method + path seen on a peer pair (E2)
+type HTTPRequest struct {
+	Method string
+	Path   string
+}
+
+// PortInfo represents a port and protocol combination, with the layer-7 records seen on it (E2). L7 is
+// per port: a rules: block on one port must not restrict another port of the same peer pair (review finding).
 type PortInfo struct {
-	Port     int
-	Protocol string
+	Port         int
+	Protocol     string
+	HTTPRequests []HTTPRequest // distinct method+path seen on this port
+	DNSQueries   []string      // distinct names queried on this port
 }
 
 // AggregateFlows groups flows by source/destination and aggregates ports
@@ -56,28 +68,39 @@ func AggregateFlows(flows []*flow.ParsedFlow) []*AggregatedFlow {
 			if f.DestIP != "" && !containsString(existing.DestIPs, f.DestIP) {
 				existing.DestIPs = append(existing.DestIPs, f.DestIP)
 			}
+			if f.SourceIP != "" && !containsString(existing.SourceIPs, f.SourceIP) {
+				existing.SourceIPs = append(existing.SourceIPs, f.SourceIP)
+			}
+			addL7(existing, f)
 		} else {
 			// Create new aggregated flow
-			var destIPs []string
+			var destIPs, sourceIPs []string
 			if f.DestIP != "" {
 				destIPs = []string{f.DestIP}
 			}
+			if f.SourceIP != "" {
+				sourceIPs = []string{f.SourceIP}
+			}
 			aggregated := &AggregatedFlow{
-				Direction:          f.Direction,
-				SourceNamespace:    f.SourceNamespace,
-				SourceLabels:       copyLabels(f.SourceLabels),
-				SourceEntity:       f.SourceEntity,
-				IsSourceEntity:     f.IsSourceEntity,
-				DestNamespace:      f.DestNamespace,
-				DestLabels:         copyLabels(f.DestLabels),
-				DestFQDNs:          append([]string{}, f.DestFQDNs...),
-				DestIPs:            destIPs,
-				DestEntity:         f.DestEntity,
-				Ports:              []PortInfo{{Port: f.Port, Protocol: f.Protocol}},
-				IsWorldTraffic:     f.IsWorldTraffic,
+				Direction:           f.Direction,
+				SourceNamespace:     f.SourceNamespace,
+				SourceLabels:        copyLabels(f.SourceLabels),
+				SourceCluster:       f.SourceCluster,
+				SourceEntity:        f.SourceEntity,
+				IsSourceEntity:      f.IsSourceEntity,
+				DestNamespace:       f.DestNamespace,
+				DestLabels:          copyLabels(f.DestLabels),
+				DestCluster:         f.DestCluster,
+				DestFQDNs:           append([]string{}, f.DestFQDNs...),
+				DestIPs:             destIPs,
+				SourceIPs:           sourceIPs,
+				DestEntity:          f.DestEntity,
+				Ports:               []PortInfo{{Port: f.Port, Protocol: f.Protocol}},
+				IsWorldTraffic:      f.IsWorldTraffic,
 				IsDestEntityTraffic: f.IsDestEntityTraffic,
-				IsReply:            f.IsReply,
+				IsReply:             f.IsReply,
 			}
+			addL7(aggregated, f)
 			aggregationMap[key] = aggregated
 		}
 	}
@@ -106,26 +129,60 @@ func AggregateFlows(flows []*flow.ParsedFlow) []*AggregatedFlow {
 	return result
 }
 
+// addL7 records the flow's layer-7 records on ITS port of the aggregated flow (E2)
+func addL7(agg *AggregatedFlow, f *flow.ParsedFlow) {
+	if f.HTTPMethod == "" && f.HTTPPath == "" && f.DNSQuery == "" {
+		return
+	}
+	for i := range agg.Ports {
+		p := &agg.Ports[i]
+		if p.Port != f.Port || p.Protocol != f.Protocol {
+			continue
+		}
+		if f.HTTPMethod != "" || f.HTTPPath != "" {
+			r := HTTPRequest{Method: f.HTTPMethod, Path: f.HTTPPath}
+			if !containsRequest(p.HTTPRequests, r) {
+				p.HTTPRequests = append(p.HTTPRequests, r)
+			}
+		}
+		if f.DNSQuery != "" && !containsString(p.DNSQueries, f.DNSQuery) {
+			p.DNSQueries = append(p.DNSQueries, f.DNSQuery)
+		}
+		return
+	}
+}
+
+func containsRequest(reqs []HTTPRequest, r HTTPRequest) bool {
+	for _, have := range reqs {
+		if have == r {
+			return true
+		}
+	}
+	return false
+}
+
 // generateAggregationKey creates a unique key for grouping flows
 func generateAggregationKey(f *flow.ParsedFlow) string {
 	var parts []string
 	parts = append(parts, f.Direction)
 	parts = append(parts, f.SourceNamespace)
 	parts = append(parts, labelsToString(f.SourceLabels))
-	
+	parts = append(parts, f.SourceCluster) // a peer in another cluster is another peer (E1)
+
 	// Include source entity in key for entity-based traffic
 	if f.IsSourceEntity {
 		parts = append(parts, f.SourceEntity)
 	}
-	
+
 	parts = append(parts, f.DestNamespace)
 	parts = append(parts, labelsToString(f.DestLabels))
-	
+	parts = append(parts, f.DestCluster)
+
 	// Include destination entity in key for entity-based traffic
 	if f.IsDestEntityTraffic {
 		parts = append(parts, f.DestEntity)
 	}
-	
+
 	if f.IsWorldTraffic {
 		// For world traffic, include FQDNs in the key
 		fqdns := append([]string{}, f.DestFQDNs...)
@@ -187,18 +244,19 @@ func containsString(slice []string, s string) bool {
 // parsedFlowFromAggregated creates a minimal ParsedFlow for key generation
 func parsedFlowFromAggregated(agg *AggregatedFlow) *flow.ParsedFlow {
 	return &flow.ParsedFlow{
-		Direction:          agg.Direction,
-		SourceNamespace:    agg.SourceNamespace,
-		SourceLabels:       agg.SourceLabels,
-		SourceEntity:       agg.SourceEntity,
-		IsSourceEntity:     agg.IsSourceEntity,
-		DestNamespace:      agg.DestNamespace,
-		DestLabels:         agg.DestLabels,
-		DestFQDNs:          agg.DestFQDNs,
-		DestEntity:         agg.DestEntity,
-		IsWorldTraffic:     agg.IsWorldTraffic,
+		Direction:           agg.Direction,
+		SourceNamespace:     agg.SourceNamespace,
+		SourceLabels:        agg.SourceLabels,
+		SourceCluster:       agg.SourceCluster,
+		SourceEntity:        agg.SourceEntity,
+		IsSourceEntity:      agg.IsSourceEntity,
+		DestNamespace:       agg.DestNamespace,
+		DestLabels:          agg.DestLabels,
+		DestCluster:         agg.DestCluster,
+		DestFQDNs:           agg.DestFQDNs,
+		DestEntity:          agg.DestEntity,
+		IsWorldTraffic:      agg.IsWorldTraffic,
 		IsDestEntityTraffic: agg.IsDestEntityTraffic,
-		IsReply:            agg.IsReply,
+		IsReply:             agg.IsReply,
 	}
 }
-
diff --git a/internal/crd/VERSION b/internal/crd/VERSION
new file mode 100644
index 0000000..9c01bd7
--- /dev/null
+++ b/internal/crd/VERSION
@@ -0,0 +1 @@
+v1.20.1
diff --git a/internal/crd/ciliumnetworkpolicies.yaml b/internal/crd/ciliumnetworkpolicies.yaml
new file mode 100644
index 0000000..071ae6c
--- /dev/null
+++ b/internal/crd/ciliumnetworkpolicies.yaml
@@ -0,0 +1,6552 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.20.1
+  name: ciliumnetworkpolicies.cilium.io
+spec:
+  group: cilium.io
+  names:
+    categories:
+    - cilium
+    - ciliumpolicy
+    kind: CiliumNetworkPolicy
+    listKind: CiliumNetworkPolicyList
+    plural: ciliumnetworkpolicies
+    shortNames:
+    - cnp
+    - ciliumnp
+    singular: ciliumnetworkpolicy
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    - jsonPath: .status.conditions[?(@.type=='Valid')].status
+      name: Valid
+      type: string
+    name: v2
+    schema:
+      openAPIV3Schema:
+        description: |-
+          CiliumNetworkPolicy is a Kubernetes third-party resource with an extended
+          version of NetworkPolicy.
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            anyOf:
+            - properties:
+                ingress: {}
+              required:
+              - ingress
+            - properties:
+                ingressDeny: {}
+              required:
+              - ingressDeny
+            - properties:
+                egress: {}
+              required:
+              - egress
+            - properties:
+                egressDeny: {}
+              required:
+              - egressDeny
+            description: Spec is the desired Cilium specific rule specification.
+            oneOf:
+            - properties:
+                endpointSelector: {}
+              required:
+              - endpointSelector
+            - properties:
+                nodeSelector: {}
+              required:
+              - nodeSelector
+            properties:
+              description:
+                description: |-
+                  Description is a free form string, it can be used by the creator of
+                  the rule to store human readable explanation of the purpose of this
+                  rule. Rules cannot be identified by comment.
+                type: string
+              egress:
+                description: |-
+                  Egress is a list of EgressRule which are enforced at egress.
+                  If omitted or empty, this rule does not apply at egress.
+                items:
+                  description: |-
+                    EgressRule contains all rule types which can be applied at egress, i.e.
+                    network traffic that originates inside the endpoint and exits the endpoint
+                    selected by the endpointSelector.
+
+                      - All members of this structure are optional. If omitted or empty, the
+                        member will have no effect on the rule.
+
+                      - If multiple members of the structure are specified, then all members
+                        must match in order for the rule to take effect.
+
+                      - ToEndpoints, ToCIDR, ToCIDRSet, ToEntities, ToServices and ToGroups are
+                        mutually exclusive. Only one of these members may be present within an
+                        individual rule.
+                  properties:
+                    authentication:
+                      description: Authentication is the required authentication type
+                        for the allowed traffic, if any.
+                      properties:
+                        mode:
+                          description: Mode is the required authentication mode for
+                            the allowed traffic, if any.
+                          enum:
+                          - disabled
+                          - required
+                          - test-always-fail
+                          type: string
+                      required:
+                      - mode
+                      type: object
+                    icmps:
+                      description: |-
+                        ICMPs is a list of ICMP rule identified by type number
+                        which the endpoint subject to the rule is allowed to connect to.
+
+                        Example:
+                        Any endpoint with the label "app=httpd" is allowed to initiate
+                        type 8 ICMP connections.
+                      items:
+                        description: ICMPRule is a list of ICMP fields.
+                        properties:
+                          fields:
+                            description: Fields is a list of ICMP fields.
+                            items:
+                              description: ICMPField is a ICMP field.
+                              properties:
+                                family:
+                                  default: IPv4
+                                  description: |-
+                                    Family is a IP address version.
+                                    Currently, we support `IPv4` and `IPv6`.
+                                    `IPv4` is set as default.
+                                  enum:
+                                  - IPv4
+                                  - IPv6
+                                  type: string
+                                type:
+                                  anyOf:
+                                  - type: integer
+                                  - type: string
+                                  description: "Type is a ICMP-type.\nIt should be
+                                    an 8bit code (0-255), or it's CamelCase name (for
+                                    example, \"EchoReply\").\nAllowed ICMP types are:\n
+                                    \   Ipv4: EchoReply | DestinationUnreachable |
+                                    Redirect | Echo | EchoRequest |\n\t\t     RouterAdvertisement
+                                    | RouterSelection | TimeExceeded | ParameterProblem
+                                    |\n\t\t\t Timestamp | TimestampReply | Photuris
+                                    | ExtendedEcho Request | ExtendedEcho Reply\n
+                                    \   Ipv6: DestinationUnreachable | PacketTooBig
+                                    | TimeExceeded | ParameterProblem |\n\t\t\t EchoRequest
+                                    | EchoReply | MulticastListenerQuery| MulticastListenerReport
+                                    |\n\t\t\t MulticastListenerDone | RouterSolicitation
+                                    | RouterAdvertisement | NeighborSolicitation |\n\t\t\t
+                                    NeighborAdvertisement | RedirectMessage | RouterRenumbering
+                                    | ICMPNodeInformationQuery |\n\t\t\t ICMPNodeInformationResponse
+                                    | InverseNeighborDiscoverySolicitation | InverseNeighborDiscoveryAdvertisement
+                                    |\n\t\t\t HomeAgentAddressDiscoveryRequest | HomeAgentAddressDiscoveryReply
+                                    | MobilePrefixSolicitation |\n\t\t\t MobilePrefixAdvertisement
+                                    | DuplicateAddressRequestCodeSuffix | DuplicateAddressConfirmationCodeSuffix
+                                    |\n\t\t\t ExtendedEchoRequest | ExtendedEchoReply"
+                                  pattern: ^([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]|EchoReply|DestinationUnreachable|Redirect|Echo|RouterAdvertisement|RouterSelection|TimeExceeded|ParameterProblem|Timestamp|TimestampReply|Photuris|ExtendedEchoRequest|ExtendedEcho
+                                    Reply|PacketTooBig|ParameterProblem|EchoRequest|MulticastListenerQuery|MulticastListenerReport|MulticastListenerDone|RouterSolicitation|RouterAdvertisement|NeighborSolicitation|NeighborAdvertisement|RedirectMessage|RouterRenumbering|ICMPNodeInformationQuery|ICMPNodeInformationResponse|InverseNeighborDiscoverySolicitation|InverseNeighborDiscoveryAdvertisement|HomeAgentAddressDiscoveryRequest|HomeAgentAddressDiscoveryReply|MobilePrefixSolicitation|MobilePrefixAdvertisement|DuplicateAddressRequestCodeSuffix|DuplicateAddressConfirmationCodeSuffix)$
+                                  x-kubernetes-int-or-string: true
+                              required:
+                              - type
+                              type: object
+                            maxItems: 40
+                            type: array
+                        type: object
+                      type: array
+                    toCIDR:
+                      description: |-
+                        ToCIDR is a list of IP blocks which the endpoint subject to the rule
+                        is allowed to initiate connections. Only connections destined for
+                        outside of the cluster and not targeting the host will be subject
+                        to CIDR rules.  This will match on the destination IP address of
+                        outgoing connections. Adding a prefix into ToCIDR or into ToCIDRSet
+                        with no ExcludeCIDRs is equivalent. Overlaps are allowed between
+                        ToCIDR and ToCIDRSet.
+
+                        Example:
+                        Any endpoint with the label "app=database-proxy" is allowed to
+                        initiate connections to 10.2.3.0/24
+                      items:
+                        description: |-
+                          CIDR specifies a block of IP addresses.
+                          Example: 192.0.2.1/32
+                        format: cidr
+                        type: string
+                      type: array
+                    toCIDRSet:
+                      description: |-
+                        ToCIDRSet is a list of IP blocks which the endpoint subject to the rule
+                        is allowed to initiate connections to in addition to connections
+                        which are allowed via ToEndpoints, along with a list of subnets contained
+                        within their corresponding IP block to which traffic should not be
+                        allowed. This will match on the destination IP address of outgoing
+                        connections. Adding a prefix into ToCIDR or into ToCIDRSet with no
+                        ExcludeCIDRs is equivalent. Overlaps are allowed between ToCIDR and
+                        ToCIDRSet.
+
+                        Example:
+                        Any endpoint with the label "app=database-proxy" is allowed to
+                        initiate connections to 10.2.3.0/24 except from IPs in subnet 10.2.3.0/28.
+                      items:
+                        description: |-
+                          CIDRRule is a rule that specifies a CIDR prefix to/from which outside
+                          communication  is allowed, along with an optional list of subnets within that
+                          CIDR prefix to/from which outside communication is not allowed.
+                        oneOf:
+                        - properties:
+                            cidr: {}
+                          required:
+                          - cidr
+                        - properties:
+                            cidrGroupRef: {}
+                          required:
+                          - cidrGroupRef
+                        - properties:
+                            cidrGroupSelector: {}
+                          required:
+                          - cidrGroupSelector
+                        properties:
+                          cidr:
+                            description: CIDR is a CIDR prefix / IP Block.
+                            format: cidr
+                            type: string
+                          cidrGroupRef:
+                            description: |-
+                              CIDRGroupRef is a reference to a CiliumCIDRGroup object.
+                              A CiliumCIDRGroup contains a list of CIDRs that the endpoint, subject to
+                              the rule, can (Ingress/Egress) or cannot (IngressDeny/EgressDeny) receive
+                              connections from.
+                            maxLength: 253
+                            pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                            type: string
+                          cidrGroupSelector:
+                            description: |-
+                              CIDRGroupSelector selects CiliumCIDRGroups by their labels,
+                              rather than by name.
+                            properties:
+                              matchExpressions:
+                                description: matchExpressions is a list of label selector
+                                  requirements. The requirements are ANDed.
+                                items:
+                                  description: |-
+                                    A label selector requirement is a selector that contains values, a key, and an operator that
+                                    relates the key and values.
+                                  properties:
+                                    key:
+                                      description: key is the label key that the selector
+                                        applies to.
+                                      type: string
+                                    operator:
+                                      description: |-
+                                        operator represents a key's relationship to a set of values.
+                                        Valid operators are In, NotIn, Exists and DoesNotExist.
+                                      enum:
+                                      - In
+                                      - NotIn
+                                      - Exists
+                                      - DoesNotExist
+                                      type: string
+                                    values:
+                                      description: |-
+                                        values is an array of string values. If the operator is In or NotIn,
+                                        the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                        the values array must be empty. This array is replaced during a strategic
+                                        merge patch.
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                  required:
+                                  - key
+                                  - operator
+                                  type: object
+                                type: array
+                                x-kubernetes-list-type: atomic
+                              matchLabels:
+                                additionalProperties:
+                                  description: MatchLabelsValue represents the value
+                                    from the MatchLabels {key,value} pair.
+                                  maxLength: 63
+                                  pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
+                                  type: string
+                                description: |-
+                                  matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                  map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                  operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                type: object
+                            type: object
+                            x-kubernetes-map-type: atomic
+                          except:
+                            description: |-
+                              ExceptCIDRs is a list of IP blocks which the endpoint subject to the rule
+                              is not allowed to initiate connections to. These CIDR prefixes should be
+                              contained within Cidr, using ExceptCIDRs together with CIDRGroupRef is not
+                              supported yet.
+                              These exceptions are only applied to the Cidr in this CIDRRule, and do not
+                              apply to any other CIDR prefixes in any other CIDRRules.
+                            items:
+                              description: |-
+                                CIDR specifies a block of IP addresses.
+                                Example: 192.0.2.1/32
+                              format: cidr
+                              type: string
+                            type: array
+                        type: object
+                      type: array
+                    toEndpoints:
+                      description: |-
+                        ToEndpoints is a list of endpoints identified by an EndpointSelector to
+                        which the endpoints subject to the rule are allowed to communicate.
+
+                        Example:
+                        Any endpoint with the label "role=frontend" can communicate with any
+                        endpoint carrying the label "role=backend".
+
+                        Note that while an empty non-nil ToEndpoints does not select anything,
+                        nil ToEndpoints is implicitly treated as a wildcard selector if ToPorts
+                        are also specified.
+                        To select everything, use one EndpointSelector without any match requirements.
+                      items:
+                        description: EndpointSelector is a wrapper for k8s LabelSelector.
+                        properties:
+                          matchExpressions:
+                            description: matchExpressions is a list of label selector
+                              requirements. The requirements are ANDed.
+                            items:
+                              description: |-
+                                A label selector requirement is a selector that contains values, a key, and an operator that
+                                relates the key and values.
+                              properties:
+                                key:
+                                  description: key is the label key that the selector
+                                    applies to.
+                                  type: string
+                                operator:
+                                  description: |-
+                                    operator represents a key's relationship to a set of values.
+                                    Valid operators are In, NotIn, Exists and DoesNotExist.
+                                  enum:
+                                  - In
+                                  - NotIn
+                                  - Exists
+                                  - DoesNotExist
+                                  type: string
+                                values:
+                                  description: |-
+                                    values is an array of string values. If the operator is In or NotIn,
+                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                    the values array must be empty. This array is replaced during a strategic
+                                    merge patch.
+                                  items:
+                                    type: string
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                              required:
+                              - key
+                              - operator
+                              type: object
+                            type: array
+                            x-kubernetes-list-type: atomic
+                          matchLabels:
+                            additionalProperties:
+                              description: MatchLabelsValue represents the value from
+                                the MatchLabels {key,value} pair.
+                              maxLength: 63
+                              pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
+                              type: string
+                            description: |-
+                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                              map is equivalent to an element of matchExpressions, whose key field is "key", the
+                              operator is "In", and the values array contains only "value". The requirements are ANDed.
+                            type: object
+                        type: object
+                        x-kubernetes-map-type: atomic
+                      type: array
+                    toEntities:
+                      description: |-
+                        ToEntities is a list of special entities to which the endpoint subject
+                        to the rule is allowed to initiate connections. Supported entities are
+                        `world`, `cluster`, `cluster-mesh`, `host`, `remote-node`, `kube-apiserver`, `ingress`, `init`,
+                        `health`, `unmanaged`, `none` and `all`.
+                      items:
+                        description: |-
+                          Entity specifies the class of receiver/sender endpoints that do not have
+                          individual identities.  Entities are used to describe "outside of cluster",
+                          "host", etc.
+                        enum:
+                        - all
+                        - world
+                        - cluster
+                        - cluster-mesh
+                        - host
+                        - init
+                        - ingress
+                        - unmanaged
+                        - remote-node
+                        - health
+                        - none
+                        - kube-apiserver
+                        type: string
+                      type: array
+                    toFQDNs:
+                      description: |-
+                        ToFQDN allows whitelisting DNS names in place of IPs. The IPs that result
+                        from DNS resolution of `ToFQDN.MatchName`s are added to the same
+                        EgressRule object as ToCIDRSet entries, and behave accordingly. Any L4 and
+                        L7 rules within this EgressRule will also apply to these IPs.
+                        The DNS -> IP mapping is re-resolved periodically from within the
+                        cilium-agent, and the IPs in the DNS response are effected in the policy
+                        for selected pods as-is (i.e. the list of IPs is not modified in any way).
+                        Note: An explicit rule to allow for DNS traffic is needed for the pods, as
+                        ToFQDN counts as an egress rule and will enforce egress policy when
+                        PolicyEnforcment=default.
+                        Note: If the resolved IPs are IPs within the kubernetes cluster, the
+                        ToFQDN rule will not apply to that IP.
+                        Note: ToFQDN cannot occur in the same policy as other To* rules.
+                      items:
+                        oneOf:
+                        - properties:
+                            matchName: {}
+                          required:
+                          - matchName
+                        - properties:
+                            matchPattern: {}
+                          required:
+                          - matchPattern
+                        properties:
+                          matchName:
+                            description: |-
+                              MatchName matches literal DNS names. A trailing "." is automatically added
+                              when missing.
+                            maxLength: 255
+                            pattern: ^([-a-zA-Z0-9_]+[.]?)+$
+                            type: string
+                          matchPattern:
+                            description: |-
+                              MatchPattern allows using wildcards to match DNS names. All wildcards are
+                              case insensitive. The wildcards are:
+                              - "*" matches 0 or more DNS valid characters, and may occur anywhere in
+                              the pattern. As a special case a "*" as the leftmost character, without a
+                              following "." matches all subdomains as well as the name to the right.
+                              A trailing "." is automatically added when missing.
+                              - "**." is a special prefix which matches all multilevel subdomains in the prefix.
+
+                              Examples:
+                              1. `*.cilium.io` matches subdomains of cilium at that level
+                                www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
+                              2. `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
+                                except those containing "." separator, subcilium.io and sub-cilium.io match,
+                                www.cilium.io and blog.cilium.io does not
+                              3. `sub*.cilium.io` matches subdomains of cilium where the subdomain component
+                                begins with "sub". sub.cilium.io and subdomain.cilium.io match while www.cilium.io,
+                                blog.cilium.io, cilium.io and google.com do not
+                              4. `**.cilium.io` matches all multilevel subdomains of cilium.io.
+                                "app.cilium.io" and "test.app.cilium.io" match but not "cilium.io"
+                            maxLength: 255
+                            pattern: ^([-a-zA-Z0-9_*]+[.]?)+$
+                            type: string
+                        type: object
+                      type: array
+                    toGroups:
+                      description: |-
+                        ToGroups allows policies to reference CIDRs provided by external integrations.
+                        Currently, only AWS is supported, and the rule can select by multiple sub directives.
+                        ToGroups entries are functionally equivalent to toCIDR, and have the same
+                        limitiations. They cannot select traffic originating from within the cluster.
+
+                        Example:
+                        toGroups:
+                        - aws:
+                            securityGroupsIds:
+                            - 'sg-XXXXXXXXXXXXX'
+                      items:
+                        description: Groups allows referencing CIDRs that are resolved
+                          from an external integration.
+                        properties:
+                          aws:
+                            description: AWSGroup is an structure that can be used
+                              to whitelisting information from AWS integration
+                            properties:
+                              labels:
+                                additionalProperties:
+                                  type: string
+                                description: |-
+                                  Labels selects AWS ENIs by labels.
+                                  Multiple labels are AND-ed together.
+                                type: object
+                              region:
+                                description: 'Deprecated: Region is unused.'
+                                type: string
+                              securityGroupsIds:
+                                description: |-
+                                  SecurityGroupsIds selects VPC SecurityGroups by IDs.
+                                  If multiple IDs are specified, they are OR-ed together.
+
+                                  Note that this may be AND-ed with any Names specified. Specifying both
+                                  IDs and Names is not recommended.
+                                items:
+                                  type: string
+                                type: array
+                              securityGroupsNames:
+                                description: |-
+                                  SecurityGroupsNames selects VPC SecurityGroups by name.
+                                  If multiple names are specified, they are OR-ed together.
+
+                                  Note that this may be AND-ed with any IDs specified. Specifying both
+                                  IDs and Names is not recommended.
+                                items:
+                                  type: string
+                                type: array
+                            type: object
+                        type: object
+                      type: array
+                    toNodes:
+                      description: |-
+                        ToNodes is a list of nodes identified by an
+                        EndpointSelector to which endpoints subject to the rule is allowed to communicate.
+                      items:
+                        description: EndpointSelector is a wrapper for k8s LabelSelector.
+                        properties:
+                          matchExpressions:
+                            description: matchExpressions is a list of label selector
+                              requirements. The requirements are ANDed.
+                            items:
+                              description: |-
+                                A label selector requirement is a selector that contains values, a key, and an operator that
+                                relates the key and values.
+                              properties:
+                                key:
+                                  description: key is the label key that the selector
+                                    applies to.
+                                  type: string
+                                operator:
+                                  description: |-
+                                    operator represents a key's relationship to a set of values.
+                                    Valid operators are In, NotIn, Exists and DoesNotExist.
+                                  enum:
+                                  - In
+                                  - NotIn
+                                  - Exists
+                                  - DoesNotExist
+                                  type: string
+                                values:
+                                  description: |-
+                                    values is an array of string values. If the operator is In or NotIn,
+                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                    the values array must be empty. This array is replaced during a strategic
+                                    merge patch.
+                                  items:
+                                    type: string
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                              required:
+                              - key
+                              - operator
+                              type: object
+                            type: array
+                            x-kubernetes-list-type: atomic
+                          matchLabels:
+                            additionalProperties:
+                              description: MatchLabelsValue represents the value from
+                                the MatchLabels {key,value} pair.
+                              maxLength: 63
+                              pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
+                              type: string
+                            description: |-
+                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                              map is equivalent to an element of matchExpressions, whose key field is "key", the
+                              operator is "In", and the values array contains only "value". The requirements are ANDed.
+                            type: object
+                        type: object
+                        x-kubernetes-map-type: atomic
+                      type: array
+                    toPorts:
+                      description: |-
+                        ToPorts is a list of destination ports identified by port number and
+                        protocol which the endpoint subject to the rule is allowed to
+                        connect to.
+
+                        Example:
+                        Any endpoint with the label "role=frontend" is allowed to initiate
+                        connections to destination port 8080/tcp
+                      items:
+                        description: |-
+                          PortRule is a list of ports/protocol combinations with optional Layer 7
+                          rules which must be met.
+                        properties:
+                          listener:
+                            description: |-
+                              listener specifies the name of a custom Envoy listener to which this traffic should be
+                              redirected to.
+                            properties:
+                              envoyConfig:
+                                description: |-
+                                  EnvoyConfig is a reference to the CEC or CCEC resource in which
+                                  the listener is defined.
+                                properties:
+                                  kind:
+                                    description: |-
+                                      Kind is the resource type being referred to. Defaults to CiliumEnvoyConfig or
+                                      CiliumClusterwideEnvoyConfig for CiliumNetworkPolicy and CiliumClusterwideNetworkPolicy,
+                                      respectively. The only case this is currently explicitly needed is when referring to a
+                                      CiliumClusterwideEnvoyConfig from CiliumNetworkPolicy, as using a namespaced listener
+                                      from a cluster scoped policy is not allowed.
+                                    enum:
+                                    - CiliumEnvoyConfig
+                                    - CiliumClusterwideEnvoyConfig
+                                    type: string
+                                  name:
+                                    description: |-
+                                      Name is the resource name of the CiliumEnvoyConfig or CiliumClusterwideEnvoyConfig where
+                                      the listener is defined in.
+                                    minLength: 1
+                                    type: string
+                                required:
+                                - name
+                                type: object
+                              name:
+                                description: Name is the name of the listener.
+                                minLength: 1
+                                type: string
+                              priority:
+                                description: |-
+                                  Priority for this Listener that is used when multiple rules would apply different
+                                  listeners to a policy map entry. Behavior of this is implementation dependent.
+                                maximum: 100
+                                minimum: 1
+                                type: integer
+                            required:
+                            - envoyConfig
+                            - name
+                            type: object
+                          originatingTLS:
+                            description: |-
+                              OriginatingTLS is the TLS context for the connections originated by
+                              the L7 proxy.  For egress policy this specifies the client-side TLS
+                              parameters for the upstream connection originating from the L7 proxy
+                              to the remote destination. For ingress policy this specifies the
+                              client-side TLS parameters for the connection from the L7 proxy to
+                              the local endpoint.
+                            properties:
+                              certificate:
+                                description: |-
+                                  Certificate is the file name or k8s secret item name for the certificate
+                                  chain. If omitted, 'tls.crt' is assumed, if it exists. If given, the
+                                  item must exist.
+                                type: string
+                              privateKey:
+                                description: |-
+                                  PrivateKey is the file name or k8s secret item name for the private key
+                                  matching the certificate chain. If omitted, 'tls.key' is assumed, if it
+                                  exists. If given, the item must exist.
+                                type: string
+                              secret:
+                                description: |-
+                                  Secret is the secret that contains the certificates and private key for
+                                  the TLS context.
+                                  By default, Cilium will search in this secret for the following items:
+                                   - 'ca.crt'  - Which represents the trusted CA to verify remote source.
+                                   - 'tls.crt' - Which represents the public key certificate.
+                                   - 'tls.key' - Which represents the private key matching the public key
+                                                 certificate.
+                                properties:
+                                  name:
+                                    description: Name is the name of the secret.
+                                    type: string
+                                  namespace:
+                                    description: |-
+                                      Namespace is the namespace in which the secret exists. Context of use
+                                      determines the default value if left out (e.g., "default").
+                                    type: string
+                                required:
+                                - name
+                                type: object
+                              trustedCA:
+                                description: |-
+                                  TrustedCA is the file name or k8s secret item name for the trusted CA.
+                                  If omitted, 'ca.crt' is assumed, if it exists. If given, the item must
+                                  exist.
+                                type: string
+                            required:
+                            - secret
+                            type: object
+                          ports:
+                            description: Ports is a list of L4 port/protocol
+                            items:
+                              description: PortProtocol specifies an L4 port with
+                                an optional transport protocol
+                              properties:
+                                endPort:
+                                  description: EndPort can only be an L4 port number.
+                                  format: int32
+                                  maximum: 65535
+                                  minimum: 0
+                                  type: integer
+                                port:
+                                  description: |-
+                                    Port can be an L4 port number, or a name in the form of "http"
+                                    or "http-8080".
+                                  pattern: ^(6553[0-5]|655[0-2][0-9]|65[0-4][0-9]{2}|6[0-4][0-9]{3}|[1-5][0-9]{4}|[0-9]{1,4})|([a-zA-Z0-9]-?)*[a-zA-Z](-?[a-zA-Z0-9])*$
+                                  type: string
+                                protocol:
+                                  description: |-
+                                    Protocol is the L4 protocol. If "ANY", omitted or empty, any protocols
+                                    with transport ports (TCP, UDP, SCTP) match.
+
+                                    Accepted values: "TCP", "UDP", "SCTP", "VRRP", "IGMP", "GRE", "IPIP",
+                                    "IPV6", "ESP", "AH", "ANY"
+
+                                    Tunnel/encapsulation protocols (GRE, IPIP, IPV6, ESP, AH) and other
+                                    extended IP protocols (VRRP, IGMP) require the --enable-extended-ip-protocols
+                                    flag to be set. These protocols do not use transport-layer ports.
+
+                                    Matching on ICMP is not supported.
+
+                                    Named port specified for a container may narrow this down, but may not
+                                    contradict this.
+                                  enum:
+                                  - TCP
+                                  - UDP
+                                  - SCTP
+                                  - VRRP
+                                  - IGMP
+                                  - GRE
+                                  - IPIP
+                                  - IPV6
+                                  - ESP
+                                  - AH
+                                  - ANY
+                                  type: string
+                              type: object
+                            maxItems: 40
+                            type: array
+                          rules:
+                            description: |-
+                              Rules is a list of additional port level rules which must be met in
+                              order for the PortRule to allow the traffic. If omitted or empty,
+                              no layer 7 rules are enforced.
+                            oneOf:
+                            - properties:
+                                http: {}
+                              required:
+                              - http
+                            - properties:
+                                dns: {}
+                              required:
+                              - dns
+                            properties:
+                              dns:
+                                description: DNS-specific rules.
+                                items:
+                                  description: PortRuleDNS is a list of allowed DNS
+                                    lookups.
+                                  oneOf:
+                                  - properties:
+                                      matchName: {}
+                                    required:
+                                    - matchName
+                                  - properties:
+                                      matchPattern: {}
+                                    required:
+                                    - matchPattern
+                                  properties:
+                                    matchName:
+                                      description: |-
+                                        MatchName matches literal DNS names. A trailing "." is automatically added
+                                        when missing.
+                                      maxLength: 255
+                                      pattern: ^([-a-zA-Z0-9_]+[.]?)+$
+                                      type: string
+                                    matchPattern:
+                                      description: |-
+                                        MatchPattern allows using wildcards to match DNS names. All wildcards are
+                                        case insensitive. The wildcards are:
+                                        - "*" matches 0 or more DNS valid characters, and may occur anywhere in
+                                        the pattern. As a special case a "*" as the leftmost character, without a
+                                        following "." matches all subdomains as well as the name to the right.
+                                        A trailing "." is automatically added when missing.
+                                        - "**." is a special prefix which matches all multilevel subdomains in the prefix.
+
+                                        Examples:
+                                        1. `*.cilium.io` matches subdomains of cilium at that level
+                                          www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
+                                        2. `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
+                                          except those containing "." separator, subcilium.io and sub-cilium.io match,
+                                          www.cilium.io and blog.cilium.io does not
+                                        3. `sub*.cilium.io` matches subdomains of cilium where the subdomain component
+                                          begins with "sub". sub.cilium.io and subdomain.cilium.io match while www.cilium.io,
+                                          blog.cilium.io, cilium.io and google.com do not
+                                        4. `**.cilium.io` matches all multilevel subdomains of cilium.io.
+                                          "app.cilium.io" and "test.app.cilium.io" match but not "cilium.io"
+                                      maxLength: 255
+                                      pattern: ^([-a-zA-Z0-9_*]+[.]?)+$
+                                      type: string
+                                  type: object
+                                type: array
+                              http:
+                                description: HTTP specific rules.
+                                items:
+                                  description: |-
+                                    PortRuleHTTP is a list of HTTP protocol constraints. All fields are
+                                    optional, if all fields are empty or missing, the rule does not have any
+                                    effect.
+
+                                    All fields of this type are extended POSIX regex as defined by IEEE Std
+                                    1003.1, (i.e this follows the egrep/unix syntax, not the perl syntax)
+                                    matched against the path of an incoming request. Currently it can contain
+                                    characters disallowed from the conventional "path" part of a URL as defined
+                                    by RFC 3986.
+                                  properties:
+                                    headerMatches:
+                                      description: |-
+                                        HeaderMatches is a list of HTTP headers which must be
+                                        present and match against the given values. Mismatch field can be used
+                                        to specify what to do when there is no match.
+                                      items:
+                                        description: |-
+                                          HeaderMatch extends the HeaderValue for matching requirement of a
+                                          named header field against an immediate string or a secret value.
+                                          If none of the optional fields is present, then the
+                                          header value is not matched, only presence of the header is enough.
+                                        properties:
+                                          mismatch:
+                                            description: |-
+                                              Mismatch identifies what to do in case there is no match. The default is
+                                              to drop the request. Otherwise the overall rule is still considered as
+                                              matching, but the mismatches are logged in the access log.
+                                            enum:
+                                            - LOG
+                                            - ADD
+                                            - DELETE
+                                            - REPLACE
+                                            type: string
+                                          name:
+                                            description: Name identifies the header.
+                                            minLength: 1
+                                            type: string
+                                          secret:
+                                            description: |-
+                                              Secret refers to a secret that contains the value to be matched against.
+                                              The secret must only contain one entry. If the referred secret does not
+                                              exist, and there is no "Value" specified, the match will fail.
+                                            properties:
+                                              name:
+                                                description: Name is the name of the
+                                                  secret.
+                                                type: string
+                                              namespace:
+                                                description: |-
+                                                  Namespace is the namespace in which the secret exists. Context of use
+                                                  determines the default value if left out (e.g., "default").
+                                                type: string
+                                            required:
+                                            - name
+                                            type: object
+                                          value:
+                                            description: |-
+                                              Value matches the exact value of the header. Can be specified either
+                                              alone or together with "Secret"; will be used as the header value if the
+                                              secret can not be found in the latter case.
+                                            type: string
+                                        required:
+                                        - name
+                                        type: object
+                                      type: array
+                                    headers:
+                                      description: |-
+                                        Headers is a list of HTTP headers which must be present in the
+                                        request. If omitted or empty, requests are allowed regardless of
+                                        headers present.
+                                      items:
+                                        type: string
+                                      type: array
+                                    host:
+                                      description: |-
+                                        Host is an extended POSIX regex matched against the host header of a
+                                        request. Examples:
+
+                                        - foo.bar.com will match the host fooXbar.com or foo-bar.com
+                                        - foo\.bar\.com will only match the host foo.bar.com
+
+                                        If omitted or empty, the value of the host header is ignored.
+                                      format: idn-hostname
+                                      type: string
+                                    method:
+                                      description: |-
+                                        Method is an extended POSIX regex matched against the method of a
+                                        request, e.g. "GET", "POST", "PUT", "PATCH", "DELETE", ...
+
+                                        If omitted or empty, all methods are allowed.
+                                      type: string
+                                    path:
+                                      description: |-
+                                        Path is an extended POSIX regex matched against the path of a
+                                        request. Currently it can contain characters disallowed from the
+                                        conventional "path" part of a URL as defined by RFC 3986.
+
+                                        If omitted or empty, all paths are all allowed.
+                                      type: string
+                                  type: object
+                                type: array
+                            type: object
+                          serverNames:
+                            description: |-
+                              ServerNames is a list of allowed TLS SNI values. If not empty, then
+                              TLS must be present and one of the provided SNIs must be indicated in the
+                              TLS handshake.
+                            items:
+                              description: |-
+                                ServerName allows using '*' wildcard specifier for matching server names with
+                                the below semantics.
+
+                                - `*` matches 0 or more DNS valid characters, and may occur anywhere in the pattern.
+                                - `**.` is a special prefix which matches all multilevel subdomains in the prefix.
+
+                                As a special case the name "*" matches all valid DNS names.
+
+                                Examples:
+                                 1. `*.cilium.io` matches subdomains of cilium at that level
+                                    www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
+                                 2. `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
+                                    except those containing "." separator, subcilium.io and sub-cilium.io match,
+                                    www.cilium.io and blog.cilium.io does not
+                                 3. `sub*.cilium.io` matches subdomains of cilium where the subdomain component
+                                    begins with "sub". sub.cilium.io and subdomain.cilium.io match while www.cilium.io,
+                                    blog.cilium.io, cilium.io and google.com do not
+                                 4. `**.cilium.io` matches all multilevel subdomains of cilium.io.
+                                    "app.cilium.io" and "test.app.cilium.io" match but not "cilium.io"
+                              maxLength: 255
+                              pattern: ^([-a-zA-Z0-9_*]+[.]?)+$
+                              type: string
+                            minItems: 1
+                            type: array
+                            x-kubernetes-list-type: set
+                          terminatingTLS:
+                            description: |-
+                              TerminatingTLS is the TLS context for the connection terminated by
+                              the L7 proxy.  For egress policy this specifies the server-side TLS
+                              parameters to be applied on the connections originated from the local
+                              endpoint and terminated by the L7 proxy. For ingress policy this specifies
+                              the server-side TLS parameters to be applied on the connections
+                              originated from a remote source and terminated by the L7 proxy.
+                            properties:
+                              certificate:
+                                description: |-
+                                  Certificate is the file name or k8s secret item name for the certificate
+                                  chain. If omitted, 'tls.crt' is assumed, if it exists. If given, the
+                                  item must exist.
+                                type: string
+                              privateKey:
+                                description: |-
+                                  PrivateKey is the file name or k8s secret item name for the private key
+                                  matching the certificate chain. If omitted, 'tls.key' is assumed, if it
+                                  exists. If given, the item must exist.
+                                type: string
+                              secret:
+                                description: |-
+                                  Secret is the secret that contains the certificates and private key for
+                                  the TLS context.
+                                  By default, Cilium will search in this secret for the following items:
+                                   - 'ca.crt'  - Which represents the trusted CA to verify remote source.
+                                   - 'tls.crt' - Which represents the public key certificate.
+                                   - 'tls.key' - Which represents the private key matching the public key
+                                                 certificate.
+                                properties:
+                                  name:
+                                    description: Name is the name of the secret.
+                                    type: string
+                                  namespace:
+                                    description: |-
+                                      Namespace is the namespace in which the secret exists. Context of use
+                                      determines the default value if left out (e.g., "default").
+                                    type: string
+                                required:
+                                - name
+                                type: object
+                              trustedCA:
+                                description: |-
+                                  TrustedCA is the file name or k8s secret item name for the trusted CA.
+                                  If omitted, 'ca.crt' is assumed, if it exists. If given, the item must
+                                  exist.
+                                type: string
+                            required:
+                            - secret
+                            type: object
+                        type: object
+                      type: array
+                    toRequires:
+                      description: Deprecated.
+                      items:
+                        type: string
+                      maxItems: 0
+                      type: array
+                    toServices:
+                      description: |-
+                        ToServices is a list of services to which the endpoint subject
+                        to the rule is allowed to initiate connections.
+                        Currently Cilium only supports toServices for K8s services.
+                      items:
+                        description: |-
+                          Service selects policy targets that are bundled as part of a
+                          logical load-balanced service.
+
+                          Currently only Kubernetes-based Services are supported.
+                        properties:
+                          k8sService:
+                            description: K8sService selects service by name and namespace
+                              pair
+                            properties:
+                              namespace:
+                                type: string
+                              serviceName:
+                                type: string
+                            type: object
+                          k8sServiceSelector:
+                            description: K8sServiceSelector selects services by k8s
+                              labels and namespace
+                            properties:
+                              namespace:
+                                type: string
+                              selector:
+                                description: ServiceSelector is a label selector for
+                                  k8s services
+                                properties:
+                                  matchExpressions:
+                                    description: matchExpressions is a list of label
+                                      selector requirements. The requirements are
+                                      ANDed.
+                                    items:
+                                      description: |-
+                                        A label selector requirement is a selector that contains values, a key, and an operator that
+                                        relates the key and values.
+                                      properties:
+                                        key:
+                                          description: key is the label key that the
+                                            selector applies to.
+                                          type: string
+                                        operator:
+                                          description: |-
+                                            operator represents a key's relationship to a set of values.
+                                            Valid operators are In, NotIn, Exists and DoesNotExist.
+                                          enum:
+                                          - In
+                                          - NotIn
+                                          - Exists
+                                          - DoesNotExist
+                                          type: string
+                                        values:
+                                          description: |-
+                                            values is an array of string values. If the operator is In or NotIn,
+                                            the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                            the values array must be empty. This array is replaced during a strategic
+                                            merge patch.
+                                          items:
+                                            type: string
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                      required:
+                                      - key
+                                      - operator
+                                      type: object
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                  matchLabels:
+                                    additionalProperties:
+                                      description: MatchLabelsValue represents the
+                                        value from the MatchLabels {key,value} pair.
+                                      maxLength: 63
+                                      pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
+                                      type: string
+                                    description: |-
+                                      matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                      map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                      operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                    type: object
+                                type: object
+                                x-kubernetes-map-type: atomic
+                            required:
+                            - selector
+                            type: object
+                        type: object
+                      type: array
+                  type: object
+                type: array
+              egressDeny:
+                description: |-
+                  EgressDeny is a list of EgressDenyRule which are enforced at egress.
+                  Any rule inserted here will be denied regardless of the allowed egress
+                  rules in the 'egress' field.
+                  If omitted or empty, this rule does not apply at egress.
+                items:
+                  description: |-
+                    EgressDenyRule contains all rule types which can be applied at egress, i.e.
+                    network traffic that originates inside the endpoint and exits the endpoint
+                    selected by the endpointSelector.
+
+                      - All members of this structure are optional. If omitted or empty, the
+                        member will have no effect on the rule.
+
+                      - If multiple members of the structure are specified, then all members
+                        must match in order for the rule to take effect.
+
+                      - ToEndpoints, ToCIDR, ToCIDRSet, ToEntities, ToServices and ToGroups are
+                        mutually exclusive. Only one of these members may be present within an
+                        individual rule.
+                  properties:
+                    icmps:
+                      description: |-
+                        ICMPs is a list of ICMP rule identified by type number
+                        which the endpoint subject to the rule is not allowed to connect to.
+
+                        Example:
+                        Any endpoint with the label "app=httpd" is not allowed to initiate
+                        type 8 ICMP connections.
+                      items:
+                        description: ICMPRule is a list of ICMP fields.
+                        properties:
+                          fields:
+                            description: Fields is a list of ICMP fields.
+                            items:
+                              description: ICMPField is a ICMP field.
+                              properties:
+                                family:
+                                  default: IPv4
+                                  description: |-
+                                    Family is a IP address version.
+                                    Currently, we support `IPv4` and `IPv6`.
+                                    `IPv4` is set as default.
+                                  enum:
+                                  - IPv4
+                                  - IPv6
+                                  type: string
+                                type:
+                                  anyOf:
+                                  - type: integer
+                                  - type: string
+                                  description: "Type is a ICMP-type.\nIt should be
+                                    an 8bit code (0-255), or it's CamelCase name (for
+                                    example, \"EchoReply\").\nAllowed ICMP types are:\n
+                                    \   Ipv4: EchoReply | DestinationUnreachable |
+                                    Redirect | Echo | EchoRequest |\n\t\t     RouterAdvertisement
+                                    | RouterSelection | TimeExceeded | ParameterProblem
+                                    |\n\t\t\t Timestamp | TimestampReply | Photuris
+                                    | ExtendedEcho Request | ExtendedEcho Reply\n
+                                    \   Ipv6: DestinationUnreachable | PacketTooBig
+                                    | TimeExceeded | ParameterProblem |\n\t\t\t EchoRequest
+                                    | EchoReply | MulticastListenerQuery| MulticastListenerReport
+                                    |\n\t\t\t MulticastListenerDone | RouterSolicitation
+                                    | RouterAdvertisement | NeighborSolicitation |\n\t\t\t
+                                    NeighborAdvertisement | RedirectMessage | RouterRenumbering
+                                    | ICMPNodeInformationQuery |\n\t\t\t ICMPNodeInformationResponse
+                                    | InverseNeighborDiscoverySolicitation | InverseNeighborDiscoveryAdvertisement
+                                    |\n\t\t\t HomeAgentAddressDiscoveryRequest | HomeAgentAddressDiscoveryReply
+                                    | MobilePrefixSolicitation |\n\t\t\t MobilePrefixAdvertisement
+                                    | DuplicateAddressRequestCodeSuffix | DuplicateAddressConfirmationCodeSuffix
+                                    |\n\t\t\t ExtendedEchoRequest | ExtendedEchoReply"
+                                  pattern: ^([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]|EchoReply|DestinationUnreachable|Redirect|Echo|RouterAdvertisement|RouterSelection|TimeExceeded|ParameterProblem|Timestamp|TimestampReply|Photuris|ExtendedEchoRequest|ExtendedEcho
+                                    Reply|PacketTooBig|ParameterProblem|EchoRequest|MulticastListenerQuery|MulticastListenerReport|MulticastListenerDone|RouterSolicitation|RouterAdvertisement|NeighborSolicitation|NeighborAdvertisement|RedirectMessage|RouterRenumbering|ICMPNodeInformationQuery|ICMPNodeInformationResponse|InverseNeighborDiscoverySolicitation|InverseNeighborDiscoveryAdvertisement|HomeAgentAddressDiscoveryRequest|HomeAgentAddressDiscoveryReply|MobilePrefixSolicitation|MobilePrefixAdvertisement|DuplicateAddressRequestCodeSuffix|DuplicateAddressConfirmationCodeSuffix)$
+                                  x-kubernetes-int-or-string: true
+                              required:
+                              - type
+                              type: object
+                            maxItems: 40
+                            type: array
+                        type: object
+                      type: array
+                    toCIDR:
+                      description: |-
+                        ToCIDR is a list of IP blocks which the endpoint subject to the rule
+                        is allowed to initiate connections. Only connections destined for
+                        outside of the cluster and not targeting the host will be subject
+                        to CIDR rules.  This will match on the destination IP address of
+                        outgoing connections. Adding a prefix into ToCIDR or into ToCIDRSet
+                        with no ExcludeCIDRs is equivalent. Overlaps are allowed between
+                        ToCIDR and ToCIDRSet.
+
+                        Example:
+                        Any endpoint with the label "app=database-proxy" is allowed to
+                        initiate connections to 10.2.3.0/24
+                      items:
+                        description: |-
+                          CIDR specifies a block of IP addresses.
+                          Example: 192.0.2.1/32
+                        format: cidr
+                        type: string
+                      type: array
+                    toCIDRSet:
+                      description: |-
+                        ToCIDRSet is a list of IP blocks which the endpoint subject to the rule
+                        is allowed to initiate connections to in addition to connections
+                        which are allowed via ToEndpoints, along with a list of subnets contained
+                        within their corresponding IP block to which traffic should not be
+                        allowed. This will match on the destination IP address of outgoing
+                        connections. Adding a prefix into ToCIDR or into ToCIDRSet with no
+                        ExcludeCIDRs is equivalent. Overlaps are allowed between ToCIDR and
+                        ToCIDRSet.
+
+                        Example:
+                        Any endpoint with the label "app=database-proxy" is allowed to
+                        initiate connections to 10.2.3.0/24 except from IPs in subnet 10.2.3.0/28.
+                      items:
+                        description: |-
+                          CIDRRule is a rule that specifies a CIDR prefix to/from which outside
+                          communication  is allowed, along with an optional list of subnets within that
+                          CIDR prefix to/from which outside communication is not allowed.
+                        oneOf:
+                        - properties:
+                            cidr: {}
+                          required:
+                          - cidr
+                        - properties:
+                            cidrGroupRef: {}
+                          required:
+                          - cidrGroupRef
+                        - properties:
+                            cidrGroupSelector: {}
+                          required:
+                          - cidrGroupSelector
+                        properties:
+                          cidr:
+                            description: CIDR is a CIDR prefix / IP Block.
+                            format: cidr
+                            type: string
+                          cidrGroupRef:
+                            description: |-
+                              CIDRGroupRef is a reference to a CiliumCIDRGroup object.
+                              A CiliumCIDRGroup contains a list of CIDRs that the endpoint, subject to
+                              the rule, can (Ingress/Egress) or cannot (IngressDeny/EgressDeny) receive
+                              connections from.
+                            maxLength: 253
+                            pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                            type: string
+                          cidrGroupSelector:
+                            description: |-
+                              CIDRGroupSelector selects CiliumCIDRGroups by their labels,
+                              rather than by name.
+                            properties:
+                              matchExpressions:
+                                description: matchExpressions is a list of label selector
+                                  requirements. The requirements are ANDed.
+                                items:
+                                  description: |-
+                                    A label selector requirement is a selector that contains values, a key, and an operator that
+                                    relates the key and values.
+                                  properties:
+                                    key:
+                                      description: key is the label key that the selector
+                                        applies to.
+                                      type: string
+                                    operator:
+                                      description: |-
+                                        operator represents a key's relationship to a set of values.
+                                        Valid operators are In, NotIn, Exists and DoesNotExist.
+                                      enum:
+                                      - In
+                                      - NotIn
+                                      - Exists
+                                      - DoesNotExist
+                                      type: string
+                                    values:
+                                      description: |-
+                                        values is an array of string values. If the operator is In or NotIn,
+                                        the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                        the values array must be empty. This array is replaced during a strategic
+                                        merge patch.
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                  required:
+                                  - key
+                                  - operator
+                                  type: object
+                                type: array
+                                x-kubernetes-list-type: atomic
+                              matchLabels:
+                                additionalProperties:
+                                  description: MatchLabelsValue represents the value
+                                    from the MatchLabels {key,value} pair.
+                                  maxLength: 63
+                                  pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
+                                  type: string
+                                description: |-
+                                  matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                  map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                  operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                type: object
+                            type: object
+                            x-kubernetes-map-type: atomic
+                          except:
+                            description: |-
+                              ExceptCIDRs is a list of IP blocks which the endpoint subject to the rule
+                              is not allowed to initiate connections to. These CIDR prefixes should be
+                              contained within Cidr, using ExceptCIDRs together with CIDRGroupRef is not
+                              supported yet.
+                              These exceptions are only applied to the Cidr in this CIDRRule, and do not
+                              apply to any other CIDR prefixes in any other CIDRRules.
+                            items:
+                              description: |-
+                                CIDR specifies a block of IP addresses.
+                                Example: 192.0.2.1/32
+                              format: cidr
+                              type: string
+                            type: array
+                        type: object
+                      type: array
+                    toEndpoints:
+                      description: |-
+                        ToEndpoints is a list of endpoints identified by an EndpointSelector to
+                        which the endpoints subject to the rule are allowed to communicate.
+
+                        Example:
+                        Any endpoint with the label "role=frontend" can communicate with any
+                        endpoint carrying the label "role=backend".
+
+                        Note that while an empty non-nil ToEndpoints does not select anything,
+                        nil ToEndpoints is implicitly treated as a wildcard selector if ToPorts
+                        are also specified.
+                        To select everything, use one EndpointSelector without any match requirements.
+                      items:
+                        description: EndpointSelector is a wrapper for k8s LabelSelector.
+                        properties:
+                          matchExpressions:
+                            description: matchExpressions is a list of label selector
+                              requirements. The requirements are ANDed.
+                            items:
+                              description: |-
+                                A label selector requirement is a selector that contains values, a key, and an operator that
+                                relates the key and values.
+                              properties:
+                                key:
+                                  description: key is the label key that the selector
+                                    applies to.
+                                  type: string
+                                operator:
+                                  description: |-
+                                    operator represents a key's relationship to a set of values.
+                                    Valid operators are In, NotIn, Exists and DoesNotExist.
+                                  enum:
+                                  - In
+                                  - NotIn
+                                  - Exists
+                                  - DoesNotExist
+                                  type: string
+                                values:
+                                  description: |-
+                                    values is an array of string values. If the operator is In or NotIn,
+                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                    the values array must be empty. This array is replaced during a strategic
+                                    merge patch.
+                                  items:
+                                    type: string
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                              required:
+                              - key
+                              - operator
+                              type: object
+                            type: array
+                            x-kubernetes-list-type: atomic
+                          matchLabels:
+                            additionalProperties:
+                              description: MatchLabelsValue represents the value from
+                                the MatchLabels {key,value} pair.
+                              maxLength: 63
+                              pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
+                              type: string
+                            description: |-
+                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                              map is equivalent to an element of matchExpressions, whose key field is "key", the
+                              operator is "In", and the values array contains only "value". The requirements are ANDed.
+                            type: object
+                        type: object
+                        x-kubernetes-map-type: atomic
+                      type: array
+                    toEntities:
+                      description: |-
+                        ToEntities is a list of special entities to which the endpoint subject
+                        to the rule is allowed to initiate connections. Supported entities are
+                        `world`, `cluster`, `cluster-mesh`, `host`, `remote-node`, `kube-apiserver`, `ingress`, `init`,
+                        `health`, `unmanaged`, `none` and `all`.
+                      items:
+                        description: |-
+                          Entity specifies the class of receiver/sender endpoints that do not have
+                          individual identities.  Entities are used to describe "outside of cluster",
+                          "host", etc.
+                        enum:
+                        - all
+                        - world
+                        - cluster
+                        - cluster-mesh
+                        - host
+                        - init
+                        - ingress
+                        - unmanaged
+                        - remote-node
+                        - health
+                        - none
+                        - kube-apiserver
+                        type: string
+                      type: array
+                    toGroups:
+                      description: |-
+                        ToGroups allows policies to reference CIDRs provided by external integrations.
+                        Currently, only AWS is supported, and the rule can select by multiple sub directives.
+                        ToGroups entries are functionally equivalent to toCIDR, and have the same
+                        limitiations. They cannot select traffic originating from within the cluster.
+
+                        Example:
+                        toGroups:
+                        - aws:
+                            securityGroupsIds:
+                            - 'sg-XXXXXXXXXXXXX'
+                      items:
+                        description: Groups allows referencing CIDRs that are resolved
+                          from an external integration.
+                        properties:
+                          aws:
+                            description: AWSGroup is an structure that can be used
+                              to whitelisting information from AWS integration
+                            properties:
+                              labels:
+                                additionalProperties:
+                                  type: string
+                                description: |-
+                                  Labels selects AWS ENIs by labels.
+                                  Multiple labels are AND-ed together.
+                                type: object
+                              region:
+                                description: 'Deprecated: Region is unused.'
+                                type: string
+                              securityGroupsIds:
+                                description: |-
+                                  SecurityGroupsIds selects VPC SecurityGroups by IDs.
+                                  If multiple IDs are specified, they are OR-ed together.
+
+                                  Note that this may be AND-ed with any Names specified. Specifying both
+                                  IDs and Names is not recommended.
+                                items:
+                                  type: string
+                                type: array
+                              securityGroupsNames:
+                                description: |-
+                                  SecurityGroupsNames selects VPC SecurityGroups by name.
+                                  If multiple names are specified, they are OR-ed together.
+
+                                  Note that this may be AND-ed with any IDs specified. Specifying both
+                                  IDs and Names is not recommended.
+                                items:
+                                  type: string
+                                type: array
+                            type: object
+                        type: object
+                      type: array
+                    toNodes:
+                      description: |-
+                        ToNodes is a list of nodes identified by an
+                        EndpointSelector to which endpoints subject to the rule is allowed to communicate.
+                      items:
+                        description: EndpointSelector is a wrapper for k8s LabelSelector.
+                        properties:
+                          matchExpressions:
+                            description: matchExpressions is a list of label selector
+                              requirements. The requirements are ANDed.
+                            items:
+                              description: |-
+                                A label selector requirement is a selector that contains values, a key, and an operator that
+                                relates the key and values.
+                              properties:
+                                key:
+                                  description: key is the label key that the selector
+                                    applies to.
+                                  type: string
+                                operator:
+                                  description: |-
+                                    operator represents a key's relationship to a set of values.
+                                    Valid operators are In, NotIn, Exists and DoesNotExist.
+                                  enum:
+                                  - In
+                                  - NotIn
+                                  - Exists
+                                  - DoesNotExist
+                                  type: string
+                                values:
+                                  description: |-
+                                    values is an array of string values. If the operator is In or NotIn,
+                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                    the values array must be empty. This array is replaced during a strategic
+                                    merge patch.
+                                  items:
+                                    type: string
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                              required:
+                              - key
+                              - operator
+                              type: object
+                            type: array
+                            x-kubernetes-list-type: atomic
+                          matchLabels:
+                            additionalProperties:
+                              description: MatchLabelsValue represents the value from
+                                the MatchLabels {key,value} pair.
+                              maxLength: 63
+                              pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
+                              type: string
+                            description: |-
+                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                              map is equivalent to an element of matchExpressions, whose key field is "key", the
+                              operator is "In", and the values array contains only "value". The requirements are ANDed.
+                            type: object
+                        type: object
+                        x-kubernetes-map-type: atomic
+                      type: array
+                    toPorts:
+                      description: |-
+                        ToPorts is a list of destination ports identified by port number and
+                        protocol which the endpoint subject to the rule is not allowed to connect
+                        to.
+
+                        Example:
+                        Any endpoint with the label "role=frontend" is not allowed to initiate
+                        connections to destination port 8080/tcp
+                      items:
+                        description: |-
+                          PortDenyRule is a list of ports/protocol that should be used for deny
+                          policies. This structure lacks the L7Rules since it's not supported in deny
+                          policies.
+                        properties:
+                          ports:
+                            description: Ports is a list of L4 port/protocol
+                            items:
+                              description: PortProtocol specifies an L4 port with
+                                an optional transport protocol
+                              properties:
+                                endPort:
+                                  description: EndPort can only be an L4 port number.
+                                  format: int32
+                                  maximum: 65535
+                                  minimum: 0
+                                  type: integer
+                                port:
+                                  description: |-
+                                    Port can be an L4 port number, or a name in the form of "http"
+                                    or "http-8080".
+                                  pattern: ^(6553[0-5]|655[0-2][0-9]|65[0-4][0-9]{2}|6[0-4][0-9]{3}|[1-5][0-9]{4}|[0-9]{1,4})|([a-zA-Z0-9]-?)*[a-zA-Z](-?[a-zA-Z0-9])*$
+                                  type: string
+                                protocol:
+                                  description: |-
+                                    Protocol is the L4 protocol. If "ANY", omitted or empty, any protocols
+                                    with transport ports (TCP, UDP, SCTP) match.
+
+                                    Accepted values: "TCP", "UDP", "SCTP", "VRRP", "IGMP", "GRE", "IPIP",
+                                    "IPV6", "ESP", "AH", "ANY"
+
+                                    Tunnel/encapsulation protocols (GRE, IPIP, IPV6, ESP, AH) and other
+                                    extended IP protocols (VRRP, IGMP) require the --enable-extended-ip-protocols
+                                    flag to be set. These protocols do not use transport-layer ports.
+
+                                    Matching on ICMP is not supported.
+
+                                    Named port specified for a container may narrow this down, but may not
+                                    contradict this.
+                                  enum:
+                                  - TCP
+                                  - UDP
+                                  - SCTP
+                                  - VRRP
+                                  - IGMP
+                                  - GRE
+                                  - IPIP
+                                  - IPV6
+                                  - ESP
+                                  - AH
+                                  - ANY
+                                  type: string
+                              type: object
+                            type: array
+                        type: object
+                      type: array
+                    toRequires:
+                      description: Deprecated.
+                      items:
+                        type: string
+                      maxItems: 0
+                      type: array
+                    toServices:
+                      description: |-
+                        ToServices is a list of services to which the endpoint subject
+                        to the rule is allowed to initiate connections.
+                        Currently Cilium only supports toServices for K8s services.
+                      items:
+                        description: |-
+                          Service selects policy targets that are bundled as part of a
+                          logical load-balanced service.
+
+                          Currently only Kubernetes-based Services are supported.
+                        properties:
+                          k8sService:
+                            description: K8sService selects service by name and namespace
+                              pair
+                            properties:
+                              namespace:
+                                type: string
+                              serviceName:
+                                type: string
+                            type: object
+                          k8sServiceSelector:
+                            description: K8sServiceSelector selects services by k8s
+                              labels and namespace
+                            properties:
+                              namespace:
+                                type: string
+                              selector:
+                                description: ServiceSelector is a label selector for
+                                  k8s services
+                                properties:
+                                  matchExpressions:
+                                    description: matchExpressions is a list of label
+                                      selector requirements. The requirements are
+                                      ANDed.
+                                    items:
+                                      description: |-
+                                        A label selector requirement is a selector that contains values, a key, and an operator that
+                                        relates the key and values.
+                                      properties:
+                                        key:
+                                          description: key is the label key that the
+                                            selector applies to.
+                                          type: string
+                                        operator:
+                                          description: |-
+                                            operator represents a key's relationship to a set of values.
+                                            Valid operators are In, NotIn, Exists and DoesNotExist.
+                                          enum:
+                                          - In
+                                          - NotIn
+                                          - Exists
+                                          - DoesNotExist
+                                          type: string
+                                        values:
+                                          description: |-
+                                            values is an array of string values. If the operator is In or NotIn,
+                                            the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                            the values array must be empty. This array is replaced during a strategic
+                                            merge patch.
+                                          items:
+                                            type: string
+                                          type: array
+                                          x-kubernetes-list-type: atomic
+                                      required:
+                                      - key
+                                      - operator
+                                      type: object
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                  matchLabels:
+                                    additionalProperties:
+                                      description: MatchLabelsValue represents the
+                                        value from the MatchLabels {key,value} pair.
+                                      maxLength: 63
+                                      pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
+                                      type: string
+                                    description: |-
+                                      matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                      map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                      operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                    type: object
+                                type: object
+                                x-kubernetes-map-type: atomic
+                            required:
+                            - selector
+                            type: object
+                        type: object
+                      type: array
+                  type: object
+                type: array
+              enableDefaultDeny:
+                description: |-
+                  EnableDefaultDeny determines whether this policy configures the
+                  subject endpoint(s) to have a default deny mode. If enabled,
+                  this causes all traffic not explicitly allowed by a network policy
+                  to be dropped.
+
+                  If not specified, the default is true for each traffic direction
+                  that has rules, and false otherwise. For example, if a policy
+                  only has Ingress or IngressDeny rules, then the default for
+                  ingress is true and egress is false.
+
+                  If multiple policies apply to an endpoint, that endpoint's default deny
+                  will be enabled if any policy requests it.
+
+                  This is useful for creating broad-based network policies that will not
+                  cause endpoints to enter default-deny mode.
+                properties:
+                  egress:
+                    description: |-
+                      Whether or not the endpoint should have a default-deny rule applied
+                      to egress traffic.
+                    type: boolean
+                  ingress:
+                    description: |-
+                      Whether or not the endpoint should have a default-deny rule applied
+                      to ingress traffic.
+                    type: boolean
+                type: object
+              endpointSelector:
+                description: |-
+                  EndpointSelector selects all endpoints which should be subject to
+                  this rule. EndpointSelector and NodeSelector cannot be both empty and
+                  are mutually exclusive.
+                properties:
+                  matchExpressions:
+                    description: matchExpressions is a list of label selector requirements.
+                      The requirements are ANDed.
+                    items:
+                      description: |-
+                        A label selector requirement is a selector that contains values, a key, and an operator that
+                        relates the key and values.
+                      properties:
+                        key:
+                          description: key is the label key that the selector applies
+                            to.
+                          type: string
+                        operator:
+                          description: |-
+                            operator represents a key's relationship to a set of values.
+                            Valid operators are In, NotIn, Exists and DoesNotExist.
+                          enum:
+                          - In
+                          - NotIn
+                          - Exists
+                          - DoesNotExist
+                          type: string
+                        values:
+                          description: |-
+                            values is an array of string values. If the operator is In or NotIn,
+                            the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                            the values array must be empty. This array is replaced during a strategic
+                            merge patch.
+                          items:
+                            type: string
+                          type: array
+                          x-kubernetes-list-type: atomic
+                      required:
+                      - key
+                      - operator
+                      type: object
+                    type: array
+                    x-kubernetes-list-type: atomic
+                  matchLabels:
+                    additionalProperties:
+                      description: MatchLabelsValue represents the value from the
+                        MatchLabels {key,value} pair.
+                      maxLength: 63
+                      pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
+                      type: string
+                    description: |-
+                      matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                      map is equivalent to an element of matchExpressions, whose key field is "key", the
+                      operator is "In", and the values array contains only "value". The requirements are ANDed.
+                    type: object
+                type: object
+                x-kubernetes-map-type: atomic
+              ingress:
+                description: |-
+                  Ingress is a list of IngressRule which are enforced at ingress.
+                  If omitted or empty, this rule does not apply at ingress.
+                items:
+                  description: |-
+                    IngressRule contains all rule types which can be applied at ingress,
+                    i.e. network traffic that originates outside of the endpoint and
+                    is entering the endpoint selected by the endpointSelector.
+
+                      - All members of this structure are optional. If omitted or empty, the
+                        member will have no effect on the rule.
+
+                      - If multiple members are set, all of them need to match in order for
+                        the rule to take effect.
+
+                      - FromEndpoints, FromCIDR, FromCIDRSet and FromEntities are mutually
+                        exclusive. Only one of these members may be present within an individual
+                        rule.
+                  properties:
+                    authentication:
+                      description: Authentication is the required authentication type
+                        for the allowed traffic, if any.
+                      properties:
+                        mode:
+                          description: Mode is the required authentication mode for
+                            the allowed traffic, if any.
+                          enum:
+                          - disabled
+                          - required
+                          - test-always-fail
+                          type: string
+                      required:
+                      - mode
+                      type: object
+                    fromCIDR:
+                      description: |-
+                        FromCIDR is a list of IP blocks which the endpoint subject to the
+                        rule is allowed to receive connections from. Only connections which
+                        do *not* originate from the cluster or from the local host are subject
+                        to CIDR rules. In order to allow in-cluster connectivity, use the
+                        FromEndpoints field.  This will match on the source IP address of
+                        incoming connections. Adding  a prefix into FromCIDR or into
+                        FromCIDRSet with no ExcludeCIDRs is  equivalent.  Overlaps are
+                        allowed between FromCIDR and FromCIDRSet.
+
+                        Example:
+                        Any endpoint with the label "app=my-legacy-pet" is allowed to receive
+                        connections from 10.3.9.1
+                      items:
+                        description: |-
+                          CIDR specifies a block of IP addresses.
+                          Example: 192.0.2.1/32
+                        format: cidr
+                        type: string
+                      type: array
+                    fromCIDRSet:
+                      description: |-
+                        FromCIDRSet is a list of IP blocks which the endpoint subject to the
+                        rule is allowed to receive connections from in addition to FromEndpoints,
+                        along with a list of subnets contained within their corresponding IP block
+                        from which traffic should not be allowed.
+                        This will match on the source IP address of incoming connections. Adding
+                        a prefix into FromCIDR or into FromCIDRSet with no ExcludeCIDRs is
+                        equivalent. Overlaps are allowed between FromCIDR and FromCIDRSet.
+
+                        Example:
+                        Any endpoint with the label "app=my-legacy-pet" is allowed to receive
+                        connections from 10.0.0.0/8 except from IPs in subnet 10.96.0.0/12.
+                      items:
+                        description: |-
+                          CIDRRule is a rule that specifies a CIDR prefix to/from which outside
+                          communication  is allowed, along with an optional list of subnets within that
+                          CIDR prefix to/from which outside communication is not allowed.
+                        oneOf:
+                        - properties:
+                            cidr: {}
+                          required:
+                          - cidr
+                        - properties:
+                            cidrGroupRef: {}
+                          required:
+                          - cidrGroupRef
+                        - properties:
+                            cidrGroupSelector: {}
+                          required:
+                          - cidrGroupSelector
+                        properties:
+                          cidr:
+                            description: CIDR is a CIDR prefix / IP Block.
+                            format: cidr
+                            type: string
+                          cidrGroupRef:
+                            description: |-
+                              CIDRGroupRef is a reference to a CiliumCIDRGroup object.
+                              A CiliumCIDRGroup contains a list of CIDRs that the endpoint, subject to
+                              the rule, can (Ingress/Egress) or cannot (IngressDeny/EgressDeny) receive
+                              connections from.
+                            maxLength: 253
+                            pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                            type: string
+                          cidrGroupSelector:
+                            description: |-
+                              CIDRGroupSelector selects CiliumCIDRGroups by their labels,
+                              rather than by name.
+                            properties:
+                              matchExpressions:
+                                description: matchExpressions is a list of label selector
+                                  requirements. The requirements are ANDed.
+                                items:
+                                  description: |-
+                                    A label selector requirement is a selector that contains values, a key, and an operator that
+                                    relates the key and values.
+                                  properties:
+                                    key:
+                                      description: key is the label key that the selector
+                                        applies to.
+                                      type: string
+                                    operator:
+                                      description: |-
+                                        operator represents a key's relationship to a set of values.
+                                        Valid operators are In, NotIn, Exists and DoesNotExist.
+                                      enum:
+                                      - In
+                                      - NotIn
+                                      - Exists
+                                      - DoesNotExist
+                                      type: string
+                                    values:
+                                      description: |-
+                                        values is an array of string values. If the operator is In or NotIn,
+                                        the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                        the values array must be empty. This array is replaced during a strategic
+                                        merge patch.
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                  required:
+                                  - key
+                                  - operator
+                                  type: object
+                                type: array
+                                x-kubernetes-list-type: atomic
+                              matchLabels:
+                                additionalProperties:
+                                  description: MatchLabelsValue represents the value
+                                    from the MatchLabels {key,value} pair.
+                                  maxLength: 63
+                                  pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
+                                  type: string
+                                description: |-
+                                  matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                  map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                  operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                type: object
+                            type: object
+                            x-kubernetes-map-type: atomic
+                          except:
+                            description: |-
+                              ExceptCIDRs is a list of IP blocks which the endpoint subject to the rule
+                              is not allowed to initiate connections to. These CIDR prefixes should be
+                              contained within Cidr, using ExceptCIDRs together with CIDRGroupRef is not
+                              supported yet.
+                              These exceptions are only applied to the Cidr in this CIDRRule, and do not
+                              apply to any other CIDR prefixes in any other CIDRRules.
+                            items:
+                              description: |-
+                                CIDR specifies a block of IP addresses.
+                                Example: 192.0.2.1/32
+                              format: cidr
+                              type: string
+                            type: array
+                        type: object
+                      type: array
+                    fromEndpoints:
+                      description: |-
+                        FromEndpoints is a list of endpoints identified by an
+                        EndpointSelector which are allowed to communicate with the endpoint
+                        subject to the rule.
+
+                        Example:
+                        Any endpoint with the label "role=backend" can be consumed by any
+                        endpoint carrying the label "role=frontend".
+
+                        Note that while an empty non-nil FromEndpoints does not select anything,
+                        nil FromEndpoints is implicitly treated as a wildcard selector if ToPorts
+                        are also specified.
+                        To select everything, use one EndpointSelector without any match requirements.
+                      items:
+                        description: EndpointSelector is a wrapper for k8s LabelSelector.
+                        properties:
+                          matchExpressions:
+                            description: matchExpressions is a list of label selector
+                              requirements. The requirements are ANDed.
+                            items:
+                              description: |-
+                                A label selector requirement is a selector that contains values, a key, and an operator that
+                                relates the key and values.
+                              properties:
+                                key:
+                                  description: key is the label key that the selector
+                                    applies to.
+                                  type: string
+                                operator:
+                                  description: |-
+                                    operator represents a key's relationship to a set of values.
+                                    Valid operators are In, NotIn, Exists and DoesNotExist.
+                                  enum:
+                                  - In
+                                  - NotIn
+                                  - Exists
+                                  - DoesNotExist
+                                  type: string
+                                values:
+                                  description: |-
+                                    values is an array of string values. If the operator is In or NotIn,
+                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                    the values array must be empty. This array is replaced during a strategic
+                                    merge patch.
+                                  items:
+                                    type: string
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                              required:
+                              - key
+                              - operator
+                              type: object
+                            type: array
+                            x-kubernetes-list-type: atomic
+                          matchLabels:
+                            additionalProperties:
+                              description: MatchLabelsValue represents the value from
+                                the MatchLabels {key,value} pair.
+                              maxLength: 63
+                              pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
+                              type: string
+                            description: |-
+                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                              map is equivalent to an element of matchExpressions, whose key field is "key", the
+                              operator is "In", and the values array contains only "value". The requirements are ANDed.
+                            type: object
+                        type: object
+                        x-kubernetes-map-type: atomic
+                      type: array
+                    fromEntities:
+                      description: |-
+                        FromEntities is a list of special entities which the endpoint subject
+                        to the rule is allowed to receive connections from. Supported entities are
+                        `world`, `cluster`, `cluster-mesh`, `host`, `remote-node`, `kube-apiserver`, `ingress`, `init`,
+                        `health`, `unmanaged`, `none` and `all`.
+                      items:
+                        description: |-
+                          Entity specifies the class of receiver/sender endpoints that do not have
+                          individual identities.  Entities are used to describe "outside of cluster",
+                          "host", etc.
+                        enum:
+                        - all
+                        - world
+                        - cluster
+                        - cluster-mesh
+                        - host
+                        - init
+                        - ingress
+                        - unmanaged
+                        - remote-node
+                        - health
+                        - none
+                        - kube-apiserver
+                        type: string
+                      type: array
+                    fromGroups:
+                      description: |-
+                        FromGroups allows policies to reference CIDRs provided by external integrations.
+                        Currently, only AWS is supported, and the rule can select by multiple sub directives.
+                        FromGroups entries are functionally equivalent to FromCIDR, and have the same
+                        limitiations. They cannot select traffic originating from within the cluster.
+
+                        Example:
+                        fromGroups:
+                        - aws:
+                            securityGroupsIds:
+                            - 'sg-XXXXXXXXXXXXX'
+                      items:
+                        description: Groups allows referencing CIDRs that are resolved
+                          from an external integration.
+                        properties:
+                          aws:
+                            description: AWSGroup is an structure that can be used
+                              to whitelisting information from AWS integration
+                            properties:
+                              labels:
+                                additionalProperties:
+                                  type: string
+                                description: |-
+                                  Labels selects AWS ENIs by labels.
+                                  Multiple labels are AND-ed together.
+                                type: object
+                              region:
+                                description: 'Deprecated: Region is unused.'
+                                type: string
+                              securityGroupsIds:
+                                description: |-
+                                  SecurityGroupsIds selects VPC SecurityGroups by IDs.
+                                  If multiple IDs are specified, they are OR-ed together.
+
+                                  Note that this may be AND-ed with any Names specified. Specifying both
+                                  IDs and Names is not recommended.
+                                items:
+                                  type: string
+                                type: array
+                              securityGroupsNames:
+                                description: |-
+                                  SecurityGroupsNames selects VPC SecurityGroups by name.
+                                  If multiple names are specified, they are OR-ed together.
+
+                                  Note that this may be AND-ed with any IDs specified. Specifying both
+                                  IDs and Names is not recommended.
+                                items:
+                                  type: string
+                                type: array
+                            type: object
+                        type: object
+                      type: array
+                    fromNodes:
+                      description: |-
+                        FromNodes is a list of nodes identified by an
+                        EndpointSelector which are allowed to communicate with the endpoint
+                        subject to the rule.
+                      items:
+                        description: EndpointSelector is a wrapper for k8s LabelSelector.
+                        properties:
+                          matchExpressions:
+                            description: matchExpressions is a list of label selector
+                              requirements. The requirements are ANDed.
+                            items:
+                              description: |-
+                                A label selector requirement is a selector that contains values, a key, and an operator that
+                                relates the key and values.
+                              properties:
+                                key:
+                                  description: key is the label key that the selector
+                                    applies to.
+                                  type: string
+                                operator:
+                                  description: |-
+                                    operator represents a key's relationship to a set of values.
+                                    Valid operators are In, NotIn, Exists and DoesNotExist.
+                                  enum:
+                                  - In
+                                  - NotIn
+                                  - Exists
+                                  - DoesNotExist
+                                  type: string
+                                values:
+                                  description: |-
+                                    values is an array of string values. If the operator is In or NotIn,
+                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                    the values array must be empty. This array is replaced during a strategic
+                                    merge patch.
+                                  items:
+                                    type: string
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                              required:
+                              - key
+                              - operator
+                              type: object
+                            type: array
+                            x-kubernetes-list-type: atomic
+                          matchLabels:
+                            additionalProperties:
+                              description: MatchLabelsValue represents the value from
+                                the MatchLabels {key,value} pair.
+                              maxLength: 63
+                              pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
+                              type: string
+                            description: |-
+                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                              map is equivalent to an element of matchExpressions, whose key field is "key", the
+                              operator is "In", and the values array contains only "value". The requirements are ANDed.
+                            type: object
+                        type: object
+                        x-kubernetes-map-type: atomic
+                      type: array
+                    fromRequires:
+                      description: Deprecated.
+                      items:
+                        type: string
+                      maxItems: 0
+                      type: array
+                    icmps:
+                      description: |-
+                        ICMPs is a list of ICMP rule identified by type number
+                        which the endpoint subject to the rule is allowed to
+                        receive connections on.
+
+                        Example:
+                        Any endpoint with the label "app=httpd" can only accept incoming
+                        type 8 ICMP connections.
+                      items:
+                        description: ICMPRule is a list of ICMP fields.
+                        properties:
+                          fields:
+                            description: Fields is a list of ICMP fields.
+                            items:
+                              description: ICMPField is a ICMP field.
+                              properties:
+                                family:
+                                  default: IPv4
+                                  description: |-
+                                    Family is a IP address version.
+                                    Currently, we support `IPv4` and `IPv6`.
+                                    `IPv4` is set as default.
+                                  enum:
+                                  - IPv4
+                                  - IPv6
+                                  type: string
+                                type:
+                                  anyOf:
+                                  - type: integer
+                                  - type: string
+                                  description: "Type is a ICMP-type.\nIt should be
+                                    an 8bit code (0-255), or it's CamelCase name (for
+                                    example, \"EchoReply\").\nAllowed ICMP types are:\n
+                                    \   Ipv4: EchoReply | DestinationUnreachable |
+                                    Redirect | Echo | EchoRequest |\n\t\t     RouterAdvertisement
+                                    | RouterSelection | TimeExceeded | ParameterProblem
+                                    |\n\t\t\t Timestamp | TimestampReply | Photuris
+                                    | ExtendedEcho Request | ExtendedEcho Reply\n
+                                    \   Ipv6: DestinationUnreachable | PacketTooBig
+                                    | TimeExceeded | ParameterProblem |\n\t\t\t EchoRequest
+                                    | EchoReply | MulticastListenerQuery| MulticastListenerReport
+                                    |\n\t\t\t MulticastListenerDone | RouterSolicitation
+                                    | RouterAdvertisement | NeighborSolicitation |\n\t\t\t
+                                    NeighborAdvertisement | RedirectMessage | RouterRenumbering
+                                    | ICMPNodeInformationQuery |\n\t\t\t ICMPNodeInformationResponse
+                                    | InverseNeighborDiscoverySolicitation | InverseNeighborDiscoveryAdvertisement
+                                    |\n\t\t\t HomeAgentAddressDiscoveryRequest | HomeAgentAddressDiscoveryReply
+                                    | MobilePrefixSolicitation |\n\t\t\t MobilePrefixAdvertisement
+                                    | DuplicateAddressRequestCodeSuffix | DuplicateAddressConfirmationCodeSuffix
+                                    |\n\t\t\t ExtendedEchoRequest | ExtendedEchoReply"
+                                  pattern: ^([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]|EchoReply|DestinationUnreachable|Redirect|Echo|RouterAdvertisement|RouterSelection|TimeExceeded|ParameterProblem|Timestamp|TimestampReply|Photuris|ExtendedEchoRequest|ExtendedEcho
+                                    Reply|PacketTooBig|ParameterProblem|EchoRequest|MulticastListenerQuery|MulticastListenerReport|MulticastListenerDone|RouterSolicitation|RouterAdvertisement|NeighborSolicitation|NeighborAdvertisement|RedirectMessage|RouterRenumbering|ICMPNodeInformationQuery|ICMPNodeInformationResponse|InverseNeighborDiscoverySolicitation|InverseNeighborDiscoveryAdvertisement|HomeAgentAddressDiscoveryRequest|HomeAgentAddressDiscoveryReply|MobilePrefixSolicitation|MobilePrefixAdvertisement|DuplicateAddressRequestCodeSuffix|DuplicateAddressConfirmationCodeSuffix)$
+                                  x-kubernetes-int-or-string: true
+                              required:
+                              - type
+                              type: object
+                            maxItems: 40
+                            type: array
+                        type: object
+                      type: array
+                    toPorts:
+                      description: |-
+                        ToPorts is a list of destination ports identified by port number and
+                        protocol which the endpoint subject to the rule is allowed to
+                        receive connections on.
+
+                        Example:
+                        Any endpoint with the label "app=httpd" can only accept incoming
+                        connections on port 80/tcp.
+                      items:
+                        description: |-
+                          PortRule is a list of ports/protocol combinations with optional Layer 7
+                          rules which must be met.
+                        properties:
+                          listener:
+                            description: |-
+                              listener specifies the name of a custom Envoy listener to which this traffic should be
+                              redirected to.
+                            properties:
+                              envoyConfig:
+                                description: |-
+                                  EnvoyConfig is a reference to the CEC or CCEC resource in which
+                                  the listener is defined.
+                                properties:
+                                  kind:
+                                    description: |-
+                                      Kind is the resource type being referred to. Defaults to CiliumEnvoyConfig or
+                                      CiliumClusterwideEnvoyConfig for CiliumNetworkPolicy and CiliumClusterwideNetworkPolicy,
+                                      respectively. The only case this is currently explicitly needed is when referring to a
+                                      CiliumClusterwideEnvoyConfig from CiliumNetworkPolicy, as using a namespaced listener
+                                      from a cluster scoped policy is not allowed.
+                                    enum:
+                                    - CiliumEnvoyConfig
+                                    - CiliumClusterwideEnvoyConfig
+                                    type: string
+                                  name:
+                                    description: |-
+                                      Name is the resource name of the CiliumEnvoyConfig or CiliumClusterwideEnvoyConfig where
+                                      the listener is defined in.
+                                    minLength: 1
+                                    type: string
+                                required:
+                                - name
+                                type: object
+                              name:
+                                description: Name is the name of the listener.
+                                minLength: 1
+                                type: string
+                              priority:
+                                description: |-
+                                  Priority for this Listener that is used when multiple rules would apply different
+                                  listeners to a policy map entry. Behavior of this is implementation dependent.
+                                maximum: 100
+                                minimum: 1
+                                type: integer
+                            required:
+                            - envoyConfig
+                            - name
+                            type: object
+                          originatingTLS:
+                            description: |-
+                              OriginatingTLS is the TLS context for the connections originated by
+                              the L7 proxy.  For egress policy this specifies the client-side TLS
+                              parameters for the upstream connection originating from the L7 proxy
+                              to the remote destination. For ingress policy this specifies the
+                              client-side TLS parameters for the connection from the L7 proxy to
+                              the local endpoint.
+                            properties:
+                              certificate:
+                                description: |-
+                                  Certificate is the file name or k8s secret item name for the certificate
+                                  chain. If omitted, 'tls.crt' is assumed, if it exists. If given, the
+                                  item must exist.
+                                type: string
+                              privateKey:
+                                description: |-
+                                  PrivateKey is the file name or k8s secret item name for the private key
+                                  matching the certificate chain. If omitted, 'tls.key' is assumed, if it
+                                  exists. If given, the item must exist.
+                                type: string
+                              secret:
+                                description: |-
+                                  Secret is the secret that contains the certificates and private key for
+                                  the TLS context.
+                                  By default, Cilium will search in this secret for the following items:
+                                   - 'ca.crt'  - Which represents the trusted CA to verify remote source.
+                                   - 'tls.crt' - Which represents the public key certificate.
+                                   - 'tls.key' - Which represents the private key matching the public key
+                                                 certificate.
+                                properties:
+                                  name:
+                                    description: Name is the name of the secret.
+                                    type: string
+                                  namespace:
+                                    description: |-
+                                      Namespace is the namespace in which the secret exists. Context of use
+                                      determines the default value if left out (e.g., "default").
+                                    type: string
+                                required:
+                                - name
+                                type: object
+                              trustedCA:
+                                description: |-
+                                  TrustedCA is the file name or k8s secret item name for the trusted CA.
+                                  If omitted, 'ca.crt' is assumed, if it exists. If given, the item must
+                                  exist.
+                                type: string
+                            required:
+                            - secret
+                            type: object
+                          ports:
+                            description: Ports is a list of L4 port/protocol
+                            items:
+                              description: PortProtocol specifies an L4 port with
+                                an optional transport protocol
+                              properties:
+                                endPort:
+                                  description: EndPort can only be an L4 port number.
+                                  format: int32
+                                  maximum: 65535
+                                  minimum: 0
+                                  type: integer
+                                port:
+                                  description: |-
+                                    Port can be an L4 port number, or a name in the form of "http"
+                                    or "http-8080".
+                                  pattern: ^(6553[0-5]|655[0-2][0-9]|65[0-4][0-9]{2}|6[0-4][0-9]{3}|[1-5][0-9]{4}|[0-9]{1,4})|([a-zA-Z0-9]-?)*[a-zA-Z](-?[a-zA-Z0-9])*$
+                                  type: string
+                                protocol:
+                                  description: |-
+                                    Protocol is the L4 protocol. If "ANY", omitted or empty, any protocols
+                                    with transport ports (TCP, UDP, SCTP) match.
+
+                                    Accepted values: "TCP", "UDP", "SCTP", "VRRP", "IGMP", "GRE", "IPIP",
+                                    "IPV6", "ESP", "AH", "ANY"
+
+                                    Tunnel/encapsulation protocols (GRE, IPIP, IPV6, ESP, AH) and other
+                                    extended IP protocols (VRRP, IGMP) require the --enable-extended-ip-protocols
+                                    flag to be set. These protocols do not use transport-layer ports.
+
+                                    Matching on ICMP is not supported.
+
+                                    Named port specified for a container may narrow this down, but may not
+                                    contradict this.
+                                  enum:
+                                  - TCP
+                                  - UDP
+                                  - SCTP
+                                  - VRRP
+                                  - IGMP
+                                  - GRE
+                                  - IPIP
+                                  - IPV6
+                                  - ESP
+                                  - AH
+                                  - ANY
+                                  type: string
+                              type: object
+                            maxItems: 40
+                            type: array
+                          rules:
+                            description: |-
+                              Rules is a list of additional port level rules which must be met in
+                              order for the PortRule to allow the traffic. If omitted or empty,
+                              no layer 7 rules are enforced.
+                            oneOf:
+                            - properties:
+                                http: {}
+                              required:
+                              - http
+                            - properties:
+                                dns: {}
+                              required:
+                              - dns
+                            properties:
+                              dns:
+                                description: DNS-specific rules.
+                                items:
+                                  description: PortRuleDNS is a list of allowed DNS
+                                    lookups.
+                                  oneOf:
+                                  - properties:
+                                      matchName: {}
+                                    required:
+                                    - matchName
+                                  - properties:
+                                      matchPattern: {}
+                                    required:
+                                    - matchPattern
+                                  properties:
+                                    matchName:
+                                      description: |-
+                                        MatchName matches literal DNS names. A trailing "." is automatically added
+                                        when missing.
+                                      maxLength: 255
+                                      pattern: ^([-a-zA-Z0-9_]+[.]?)+$
+                                      type: string
+                                    matchPattern:
+                                      description: |-
+                                        MatchPattern allows using wildcards to match DNS names. All wildcards are
+                                        case insensitive. The wildcards are:
+                                        - "*" matches 0 or more DNS valid characters, and may occur anywhere in
+                                        the pattern. As a special case a "*" as the leftmost character, without a
+                                        following "." matches all subdomains as well as the name to the right.
+                                        A trailing "." is automatically added when missing.
+                                        - "**." is a special prefix which matches all multilevel subdomains in the prefix.
+
+                                        Examples:
+                                        1. `*.cilium.io` matches subdomains of cilium at that level
+                                          www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
+                                        2. `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
+                                          except those containing "." separator, subcilium.io and sub-cilium.io match,
+                                          www.cilium.io and blog.cilium.io does not
+                                        3. `sub*.cilium.io` matches subdomains of cilium where the subdomain component
+                                          begins with "sub". sub.cilium.io and subdomain.cilium.io match while www.cilium.io,
+                                          blog.cilium.io, cilium.io and google.com do not
+                                        4. `**.cilium.io` matches all multilevel subdomains of cilium.io.
+                                          "app.cilium.io" and "test.app.cilium.io" match but not "cilium.io"
+                                      maxLength: 255
+                                      pattern: ^([-a-zA-Z0-9_*]+[.]?)+$
+                                      type: string
+                                  type: object
+                                type: array
+                              http:
+                                description: HTTP specific rules.
+                                items:
+                                  description: |-
+                                    PortRuleHTTP is a list of HTTP protocol constraints. All fields are
+                                    optional, if all fields are empty or missing, the rule does not have any
+                                    effect.
+
+                                    All fields of this type are extended POSIX regex as defined by IEEE Std
+                                    1003.1, (i.e this follows the egrep/unix syntax, not the perl syntax)
+                                    matched against the path of an incoming request. Currently it can contain
+                                    characters disallowed from the conventional "path" part of a URL as defined
+                                    by RFC 3986.
+                                  properties:
+                                    headerMatches:
+                                      description: |-
+                                        HeaderMatches is a list of HTTP headers which must be
+                                        present and match against the given values. Mismatch field can be used
+                                        to specify what to do when there is no match.
+                                      items:
+                                        description: |-
+                                          HeaderMatch extends the HeaderValue for matching requirement of a
+                                          named header field against an immediate string or a secret value.
+                                          If none of the optional fields is present, then the
+                                          header value is not matched, only presence of the header is enough.
+                                        properties:
+                                          mismatch:
+                                            description: |-
+                                              Mismatch identifies what to do in case there is no match. The default is
+                                              to drop the request. Otherwise the overall rule is still considered as
+                                              matching, but the mismatches are logged in the access log.
+                                            enum:
+                                            - LOG
+                                            - ADD
+                                            - DELETE
+                                            - REPLACE
+                                            type: string
+                                          name:
+                                            description: Name identifies the header.
+                                            minLength: 1
+                                            type: string
+                                          secret:
+                                            description: |-
+                                              Secret refers to a secret that contains the value to be matched against.
+                                              The secret must only contain one entry. If the referred secret does not
+                                              exist, and there is no "Value" specified, the match will fail.
+                                            properties:
+                                              name:
+                                                description: Name is the name of the
+                                                  secret.
+                                                type: string
+                                              namespace:
+                                                description: |-
+                                                  Namespace is the namespace in which the secret exists. Context of use
+                                                  determines the default value if left out (e.g., "default").
+                                                type: string
+                                            required:
+                                            - name
+                                            type: object
+                                          value:
+                                            description: |-
+                                              Value matches the exact value of the header. Can be specified either
+                                              alone or together with "Secret"; will be used as the header value if the
+                                              secret can not be found in the latter case.
+                                            type: string
+                                        required:
+                                        - name
+                                        type: object
+                                      type: array
+                                    headers:
+                                      description: |-
+                                        Headers is a list of HTTP headers which must be present in the
+                                        request. If omitted or empty, requests are allowed regardless of
+                                        headers present.
+                                      items:
+                                        type: string
+                                      type: array
+                                    host:
+                                      description: |-
+                                        Host is an extended POSIX regex matched against the host header of a
+                                        request. Examples:
+
+                                        - foo.bar.com will match the host fooXbar.com or foo-bar.com
+                                        - foo\.bar\.com will only match the host foo.bar.com
+
+                                        If omitted or empty, the value of the host header is ignored.
+                                      format: idn-hostname
+                                      type: string
+                                    method:
+                                      description: |-
+                                        Method is an extended POSIX regex matched against the method of a
+                                        request, e.g. "GET", "POST", "PUT", "PATCH", "DELETE", ...
+
+                                        If omitted or empty, all methods are allowed.
+                                      type: string
+                                    path:
+                                      description: |-
+                                        Path is an extended POSIX regex matched against the path of a
+                                        request. Currently it can contain characters disallowed from the
+                                        conventional "path" part of a URL as defined by RFC 3986.
+
+                                        If omitted or empty, all paths are all allowed.
+                                      type: string
+                                  type: object
+                                type: array
+                            type: object
+                          serverNames:
+                            description: |-
+                              ServerNames is a list of allowed TLS SNI values. If not empty, then
+                              TLS must be present and one of the provided SNIs must be indicated in the
+                              TLS handshake.
+                            items:
+                              description: |-
+                                ServerName allows using '*' wildcard specifier for matching server names with
+                                the below semantics.
+
+                                - `*` matches 0 or more DNS valid characters, and may occur anywhere in the pattern.
+                                - `**.` is a special prefix which matches all multilevel subdomains in the prefix.
+
+                                As a special case the name "*" matches all valid DNS names.
+
+                                Examples:
+                                 1. `*.cilium.io` matches subdomains of cilium at that level
+                                    www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
+                                 2. `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
+                                    except those containing "." separator, subcilium.io and sub-cilium.io match,
+                                    www.cilium.io and blog.cilium.io does not
+                                 3. `sub*.cilium.io` matches subdomains of cilium where the subdomain component
+                                    begins with "sub". sub.cilium.io and subdomain.cilium.io match while www.cilium.io,
+                                    blog.cilium.io, cilium.io and google.com do not
+                                 4. `**.cilium.io` matches all multilevel subdomains of cilium.io.
+                                    "app.cilium.io" and "test.app.cilium.io" match but not "cilium.io"
+                              maxLength: 255
+                              pattern: ^([-a-zA-Z0-9_*]+[.]?)+$
+                              type: string
+                            minItems: 1
+                            type: array
+                            x-kubernetes-list-type: set
+                          terminatingTLS:
+                            description: |-
+                              TerminatingTLS is the TLS context for the connection terminated by
+                              the L7 proxy.  For egress policy this specifies the server-side TLS
+                              parameters to be applied on the connections originated from the local
+                              endpoint and terminated by the L7 proxy. For ingress policy this specifies
+                              the server-side TLS parameters to be applied on the connections
+                              originated from a remote source and terminated by the L7 proxy.
+                            properties:
+                              certificate:
+                                description: |-
+                                  Certificate is the file name or k8s secret item name for the certificate
+                                  chain. If omitted, 'tls.crt' is assumed, if it exists. If given, the
+                                  item must exist.
+                                type: string
+                              privateKey:
+                                description: |-
+                                  PrivateKey is the file name or k8s secret item name for the private key
+                                  matching the certificate chain. If omitted, 'tls.key' is assumed, if it
+                                  exists. If given, the item must exist.
+                                type: string
+                              secret:
+                                description: |-
+                                  Secret is the secret that contains the certificates and private key for
+                                  the TLS context.
+                                  By default, Cilium will search in this secret for the following items:
+                                   - 'ca.crt'  - Which represents the trusted CA to verify remote source.
+                                   - 'tls.crt' - Which represents the public key certificate.
+                                   - 'tls.key' - Which represents the private key matching the public key
+                                                 certificate.
+                                properties:
+                                  name:
+                                    description: Name is the name of the secret.
+                                    type: string
+                                  namespace:
+                                    description: |-
+                                      Namespace is the namespace in which the secret exists. Context of use
+                                      determines the default value if left out (e.g., "default").
+                                    type: string
+                                required:
+                                - name
+                                type: object
+                              trustedCA:
+                                description: |-
+                                  TrustedCA is the file name or k8s secret item name for the trusted CA.
+                                  If omitted, 'ca.crt' is assumed, if it exists. If given, the item must
+                                  exist.
+                                type: string
+                            required:
+                            - secret
+                            type: object
+                        type: object
+                      type: array
+                  type: object
+                type: array
+              ingressDeny:
+                description: |-
+                  IngressDeny is a list of IngressDenyRule which are enforced at ingress.
+                  Any rule inserted here will be denied regardless of the allowed ingress
+                  rules in the 'ingress' field.
+                  If omitted or empty, this rule does not apply at ingress.
+                items:
+                  description: |-
+                    IngressDenyRule contains all rule types which can be applied at ingress,
+                    i.e. network traffic that originates outside of the endpoint and
+                    is entering the endpoint selected by the endpointSelector.
+
+                      - All members of this structure are optional. If omitted or empty, the
+                        member will have no effect on the rule.
+
+                      - If multiple members are set, all of them need to match in order for
+                        the rule to take effect.
+
+                      - FromEndpoints, FromCIDR, FromCIDRSet, FromGroups and FromEntities are mutually
+                        exclusive. Only one of these members may be present within an individual
+                        rule.
+                  properties:
+                    fromCIDR:
+                      description: |-
+                        FromCIDR is a list of IP blocks which the endpoint subject to the
+                        rule is allowed to receive connections from. Only connections which
+                        do *not* originate from the cluster or from the local host are subject
+                        to CIDR rules. In order to allow in-cluster connectivity, use the
+                        FromEndpoints field.  This will match on the source IP address of
+                        incoming connections. Adding  a prefix into FromCIDR or into
+                        FromCIDRSet with no ExcludeCIDRs is  equivalent.  Overlaps are
+                        allowed between FromCIDR and FromCIDRSet.
+
+                        Example:
+                        Any endpoint with the label "app=my-legacy-pet" is allowed to receive
+                        connections from 10.3.9.1
+                      items:
+                        description: |-
+                          CIDR specifies a block of IP addresses.
+                          Example: 192.0.2.1/32
+                        format: cidr
+                        type: string
+                      type: array
+                    fromCIDRSet:
+                      description: |-
+                        FromCIDRSet is a list of IP blocks which the endpoint subject to the
+                        rule is allowed to receive connections from in addition to FromEndpoints,
+                        along with a list of subnets contained within their corresponding IP block
+                        from which traffic should not be allowed.
+                        This will match on the source IP address of incoming connections. Adding
+                        a prefix into FromCIDR or into FromCIDRSet with no ExcludeCIDRs is
+                        equivalent. Overlaps are allowed between FromCIDR and FromCIDRSet.
+
+                        Example:
+                        Any endpoint with the label "app=my-legacy-pet" is allowed to receive
+                        connections from 10.0.0.0/8 except from IPs in subnet 10.96.0.0/12.
+                      items:
+                        description: |-
+                          CIDRRule is a rule that specifies a CIDR prefix to/from which outside
+                          communication  is allowed, along with an optional list of subnets within that
+                          CIDR prefix to/from which outside communication is not allowed.
+                        oneOf:
+                        - properties:
+                            cidr: {}
+                          required:
+                          - cidr
+                        - properties:
+                            cidrGroupRef: {}
+                          required:
+                          - cidrGroupRef
+                        - properties:
+                            cidrGroupSelector: {}
+                          required:
+                          - cidrGroupSelector
+                        properties:
+                          cidr:
+                            description: CIDR is a CIDR prefix / IP Block.
+                            format: cidr
+                            type: string
+                          cidrGroupRef:
+                            description: |-
+                              CIDRGroupRef is a reference to a CiliumCIDRGroup object.
+                              A CiliumCIDRGroup contains a list of CIDRs that the endpoint, subject to
+                              the rule, can (Ingress/Egress) or cannot (IngressDeny/EgressDeny) receive
+                              connections from.
+                            maxLength: 253
+                            pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                            type: string
+                          cidrGroupSelector:
+                            description: |-
+                              CIDRGroupSelector selects CiliumCIDRGroups by their labels,
+                              rather than by name.
+                            properties:
+                              matchExpressions:
+                                description: matchExpressions is a list of label selector
+                                  requirements. The requirements are ANDed.
+                                items:
+                                  description: |-
+                                    A label selector requirement is a selector that contains values, a key, and an operator that
+                                    relates the key and values.
+                                  properties:
+                                    key:
+                                      description: key is the label key that the selector
+                                        applies to.
+                                      type: string
+                                    operator:
+                                      description: |-
+                                        operator represents a key's relationship to a set of values.
+                                        Valid operators are In, NotIn, Exists and DoesNotExist.
+                                      enum:
+                                      - In
+                                      - NotIn
+                                      - Exists
+                                      - DoesNotExist
+                                      type: string
+                                    values:
+                                      description: |-
+                                        values is an array of string values. If the operator is In or NotIn,
+                                        the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                        the values array must be empty. This array is replaced during a strategic
+                                        merge patch.
+                                      items:
+                                        type: string
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                  required:
+                                  - key
+                                  - operator
+                                  type: object
+                                type: array
+                                x-kubernetes-list-type: atomic
+                              matchLabels:
+                                additionalProperties:
+                                  description: MatchLabelsValue represents the value
+                                    from the MatchLabels {key,value} pair.
+                                  maxLength: 63
+                                  pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
+                                  type: string
+                                description: |-
+                                  matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                  map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                  operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                type: object
+                            type: object
+                            x-kubernetes-map-type: atomic
+                          except:
+                            description: |-
+                              ExceptCIDRs is a list of IP blocks which the endpoint subject to the rule
+                              is not allowed to initiate connections to. These CIDR prefixes should be
+                              contained within Cidr, using ExceptCIDRs together with CIDRGroupRef is not
+                              supported yet.
+                              These exceptions are only applied to the Cidr in this CIDRRule, and do not
+                              apply to any other CIDR prefixes in any other CIDRRules.
+                            items:
+                              description: |-
+                                CIDR specifies a block of IP addresses.
+                                Example: 192.0.2.1/32
+                              format: cidr
+                              type: string
+                            type: array
+                        type: object
+                      type: array
+                    fromEndpoints:
+                      description: |-
+                        FromEndpoints is a list of endpoints identified by an
+                        EndpointSelector which are allowed to communicate with the endpoint
+                        subject to the rule.
+
+                        Example:
+                        Any endpoint with the label "role=backend" can be consumed by any
+                        endpoint carrying the label "role=frontend".
+
+                        Note that while an empty non-nil FromEndpoints does not select anything,
+                        nil FromEndpoints is implicitly treated as a wildcard selector if ToPorts
+                        are also specified.
+                        To select everything, use one EndpointSelector without any match requirements.
+                      items:
+                        description: EndpointSelector is a wrapper for k8s LabelSelector.
+                        properties:
+                          matchExpressions:
+                            description: matchExpressions is a list of label selector
+                              requirements. The requirements are ANDed.
+                            items:
+                              description: |-
+                                A label selector requirement is a selector that contains values, a key, and an operator that
+                                relates the key and values.
+                              properties:
+                                key:
+                                  description: key is the label key that the selector
+                                    applies to.
+                                  type: string
+                                operator:
+                                  description: |-
+                                    operator represents a key's relationship to a set of values.
+                                    Valid operators are In, NotIn, Exists and DoesNotExist.
+                                  enum:
+                                  - In
+                                  - NotIn
+                                  - Exists
+                                  - DoesNotExist
+                                  type: string
+                                values:
+                                  description: |-
+                                    values is an array of string values. If the operator is In or NotIn,
+                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                    the values array must be empty. This array is replaced during a strategic
+                                    merge patch.
+                                  items:
+                                    type: string
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                              required:
+                              - key
+                              - operator
+                              type: object
+                            type: array
+                            x-kubernetes-list-type: atomic
+                          matchLabels:
+                            additionalProperties:
+                              description: MatchLabelsValue represents the value from
+                                the MatchLabels {key,value} pair.
+                              maxLength: 63
+                              pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
+                              type: string
+                            description: |-
+                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                              map is equivalent to an element of matchExpressions, whose key field is "key", the
+                              operator is "In", and the values array contains only "value". The requirements are ANDed.
+                            type: object
+                        type: object
+                        x-kubernetes-map-type: atomic
+                      type: array
+                    fromEntities:
+                      description: |-
+                        FromEntities is a list of special entities which the endpoint subject
+                        to the rule is allowed to receive connections from. Supported entities are
+                        `world`, `cluster`, `cluster-mesh`, `host`, `remote-node`, `kube-apiserver`, `ingress`, `init`,
+                        `health`, `unmanaged`, `none` and `all`.
+                      items:
+                        description: |-
+                          Entity specifies the class of receiver/sender endpoints that do not have
+                          individual identities.  Entities are used to describe "outside of cluster",
+                          "host", etc.
+                        enum:
+                        - all
+                        - world
+                        - cluster
+                        - cluster-mesh
+                        - host
+                        - init
+                        - ingress
+                        - unmanaged
+                        - remote-node
+                        - health
+                        - none
+                        - kube-apiserver
+                        type: string
+                      type: array
+                    fromGroups:
+                      description: |-
+                        FromGroups allows policies to reference CIDRs provided by external integrations.
+                        Currently, only AWS is supported, and the rule can select by multiple sub directives.
+                        FromGroups entries are functionally equivalent to FromCIDR, and have the same
+                        limitiations. They cannot select traffic originating from within the cluster.
+
+                        Example:
+                        fromGroups:
+                        - aws:
+                            securityGroupsIds:
+                            - 'sg-XXXXXXXXXXXXX'
+                      items:
+                        description: Groups allows referencing CIDRs that are resolved
+                          from an external integration.
+                        properties:
+                          aws:
+                            description: AWSGroup is an structure that can be used
+                              to whitelisting information from AWS integration
+                            properties:
+                              labels:
+                                additionalProperties:
+                                  type: string
+                                description: |-
+                                  Labels selects AWS ENIs by labels.
+                                  Multiple labels are AND-ed together.
+                                type: object
+                              region:
+                                description: 'Deprecated: Region is unused.'
+                                type: string
+                              securityGroupsIds:
+                                description: |-
+                                  SecurityGroupsIds selects VPC SecurityGroups by IDs.
+                                  If multiple IDs are specified, they are OR-ed together.
+
+                                  Note that this may be AND-ed with any Names specified. Specifying both
+                                  IDs and Names is not recommended.
+                                items:
+                                  type: string
+                                type: array
+                              securityGroupsNames:
+                                description: |-
+                                  SecurityGroupsNames selects VPC SecurityGroups by name.
+                                  If multiple names are specified, they are OR-ed together.
+
+                                  Note that this may be AND-ed with any IDs specified. Specifying both
+                                  IDs and Names is not recommended.
+                                items:
+                                  type: string
+                                type: array
+                            type: object
+                        type: object
+                      type: array
+                    fromNodes:
+                      description: |-
+                        FromNodes is a list of nodes identified by an
+                        EndpointSelector which are allowed to communicate with the endpoint
+                        subject to the rule.
+                      items:
+                        description: EndpointSelector is a wrapper for k8s LabelSelector.
+                        properties:
+                          matchExpressions:
+                            description: matchExpressions is a list of label selector
+                              requirements. The requirements are ANDed.
+                            items:
+                              description: |-
+                                A label selector requirement is a selector that contains values, a key, and an operator that
+                                relates the key and values.
+                              properties:
+                                key:
+                                  description: key is the label key that the selector
+                                    applies to.
+                                  type: string
+                                operator:
+                                  description: |-
+                                    operator represents a key's relationship to a set of values.
+                                    Valid operators are In, NotIn, Exists and DoesNotExist.
+                                  enum:
+                                  - In
+                                  - NotIn
+                                  - Exists
+                                  - DoesNotExist
+                                  type: string
+                                values:
+                                  description: |-
+                                    values is an array of string values. If the operator is In or NotIn,
+                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                    the values array must be empty. This array is replaced during a strategic
+                                    merge patch.
+                                  items:
+                                    type: string
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                              required:
+                              - key
+                              - operator
+                              type: object
+                            type: array
+                            x-kubernetes-list-type: atomic
+                          matchLabels:
+                            additionalProperties:
+                              description: MatchLabelsValue represents the value from
+                                the MatchLabels {key,value} pair.
+                              maxLength: 63
+                              pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
+                              type: string
+                            description: |-
+                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                              map is equivalent to an element of matchExpressions, whose key field is "key", the
+                              operator is "In", and the values array contains only "value". The requirements are ANDed.
+                            type: object
+                        type: object
+                        x-kubernetes-map-type: atomic
+                      type: array
+                    fromRequires:
+                      description: Deprecated.
+                      items:
+                        type: string
+                      maxItems: 0
+                      type: array
+                    icmps:
+                      description: |-
+                        ICMPs is a list of ICMP rule identified by type number
+                        which the endpoint subject to the rule is not allowed to
+                        receive connections on.
+
+                        Example:
+                        Any endpoint with the label "app=httpd" can not accept incoming
+                        type 8 ICMP connections.
+                      items:
+                        description: ICMPRule is a list of ICMP fields.
+                        properties:
+                          fields:
+                            description: Fields is a list of ICMP fields.
+                            items:
+                              description: ICMPField is a ICMP field.
+                              properties:
+                                family:
+                                  default: IPv4
+                                  description: |-
+                                    Family is a IP address version.
+                                    Currently, we support `IPv4` and `IPv6`.
+                                    `IPv4` is set as default.
+                                  enum:
+                                  - IPv4
+                                  - IPv6
+                                  type: string
+                                type:
+                                  anyOf:
+                                  - type: integer
+                                  - type: string
+                                  description: "Type is a ICMP-type.\nIt should be
+                                    an 8bit code (0-255), or it's CamelCase name (for
+                                    example, \"EchoReply\").\nAllowed ICMP types are:\n
+                                    \   Ipv4: EchoReply | DestinationUnreachable |
+                                    Redirect | Echo | EchoRequest |\n\t\t     RouterAdvertisement
+                                    | RouterSelection | TimeExceeded | ParameterProblem
+                                    |\n\t\t\t Timestamp | TimestampReply | Photuris
+                                    | ExtendedEcho Request | ExtendedEcho Reply\n
+                                    \   Ipv6: DestinationUnreachable | PacketTooBig
+                                    | TimeExceeded | ParameterProblem |\n\t\t\t EchoRequest
+                                    | EchoReply | MulticastListenerQuery| MulticastListenerReport
+                                    |\n\t\t\t MulticastListenerDone | RouterSolicitation
+                                    | RouterAdvertisement | NeighborSolicitation |\n\t\t\t
+                                    NeighborAdvertisement | RedirectMessage | RouterRenumbering
+                                    | ICMPNodeInformationQuery |\n\t\t\t ICMPNodeInformationResponse
+                                    | InverseNeighborDiscoverySolicitation | InverseNeighborDiscoveryAdvertisement
+                                    |\n\t\t\t HomeAgentAddressDiscoveryRequest | HomeAgentAddressDiscoveryReply
+                                    | MobilePrefixSolicitation |\n\t\t\t MobilePrefixAdvertisement
+                                    | DuplicateAddressRequestCodeSuffix | DuplicateAddressConfirmationCodeSuffix
+                                    |\n\t\t\t ExtendedEchoRequest | ExtendedEchoReply"
+                                  pattern: ^([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]|EchoReply|DestinationUnreachable|Redirect|Echo|RouterAdvertisement|RouterSelection|TimeExceeded|ParameterProblem|Timestamp|TimestampReply|Photuris|ExtendedEchoRequest|ExtendedEcho
+                                    Reply|PacketTooBig|ParameterProblem|EchoRequest|MulticastListenerQuery|MulticastListenerReport|MulticastListenerDone|RouterSolicitation|RouterAdvertisement|NeighborSolicitation|NeighborAdvertisement|RedirectMessage|RouterRenumbering|ICMPNodeInformationQuery|ICMPNodeInformationResponse|InverseNeighborDiscoverySolicitation|InverseNeighborDiscoveryAdvertisement|HomeAgentAddressDiscoveryRequest|HomeAgentAddressDiscoveryReply|MobilePrefixSolicitation|MobilePrefixAdvertisement|DuplicateAddressRequestCodeSuffix|DuplicateAddressConfirmationCodeSuffix)$
+                                  x-kubernetes-int-or-string: true
+                              required:
+                              - type
+                              type: object
+                            maxItems: 40
+                            type: array
+                        type: object
+                      type: array
+                    toPorts:
+                      description: |-
+                        ToPorts is a list of destination ports identified by port number and
+                        protocol which the endpoint subject to the rule is not allowed to
+                        receive connections on.
+
+                        Example:
+                        Any endpoint with the label "app=httpd" can not accept incoming
+                        connections on port 80/tcp.
+                      items:
+                        description: |-
+                          PortDenyRule is a list of ports/protocol that should be used for deny
+                          policies. This structure lacks the L7Rules since it's not supported in deny
+                          policies.
+                        properties:
+                          ports:
+                            description: Ports is a list of L4 port/protocol
+                            items:
+                              description: PortProtocol specifies an L4 port with
+                                an optional transport protocol
+                              properties:
+                                endPort:
+                                  description: EndPort can only be an L4 port number.
+                                  format: int32
+                                  maximum: 65535
+                                  minimum: 0
+                                  type: integer
+                                port:
+                                  description: |-
+                                    Port can be an L4 port number, or a name in the form of "http"
+                                    or "http-8080".
+                                  pattern: ^(6553[0-5]|655[0-2][0-9]|65[0-4][0-9]{2}|6[0-4][0-9]{3}|[1-5][0-9]{4}|[0-9]{1,4})|([a-zA-Z0-9]-?)*[a-zA-Z](-?[a-zA-Z0-9])*$
+                                  type: string
+                                protocol:
+                                  description: |-
+                                    Protocol is the L4 protocol. If "ANY", omitted or empty, any protocols
+                                    with transport ports (TCP, UDP, SCTP) match.
+
+                                    Accepted values: "TCP", "UDP", "SCTP", "VRRP", "IGMP", "GRE", "IPIP",
+                                    "IPV6", "ESP", "AH", "ANY"
+
+                                    Tunnel/encapsulation protocols (GRE, IPIP, IPV6, ESP, AH) and other
+                                    extended IP protocols (VRRP, IGMP) require the --enable-extended-ip-protocols
+                                    flag to be set. These protocols do not use transport-layer ports.
+
+                                    Matching on ICMP is not supported.
+
+                                    Named port specified for a container may narrow this down, but may not
+                                    contradict this.
+                                  enum:
+                                  - TCP
+                                  - UDP
+                                  - SCTP
+                                  - VRRP
+                                  - IGMP
+                                  - GRE
+                                  - IPIP
+                                  - IPV6
+                                  - ESP
+                                  - AH
+                                  - ANY
+                                  type: string
+                              type: object
+                            type: array
+                        type: object
+                      type: array
+                  type: object
+                type: array
+              labels:
+                description: |-
+                  Labels is a list of optional strings which can be used to
+                  re-identify the rule or to store metadata. It is possible to lookup
+                  or delete strings based on labels. Labels are not required to be
+                  unique, multiple rules can have overlapping or identical labels.
+                items:
+                  description: Label is Cilium's representation of a label.
+                  properties:
+                    key:
+                      type: string
+                    source:
+                      description: 'Source can be one of the above values (e.g.: LabelSourceK8s).'
+                      type: string
+                    value:
+                      type: string
+                  required:
+                  - key
+                  type: object
+                type: array
+              log:
+                description: Log specifies custom policy-specific Hubble logging configuration.
+                properties:
+                  value:
+                    description: |-
+                      Value is a free-form string that is included in Hubble flows
+                      that match this policy. The string is limited to 32 printable characters.
+                    maxLength: 32
+                    pattern: ^\PC*$
+                    type: string
+                type: object
+              nodeSelector:
+                description: |-
+                  NodeSelector selects all nodes which should be subject to this rule.
+                  EndpointSelector and NodeSelector cannot be both empty and are mutually
+                  exclusive. Can only be used in CiliumClusterwideNetworkPolicies.
+                properties:
+                  matchExpressions:
+                    description: matchExpressions is a list of label selector requirements.
+                      The requirements are ANDed.
+                    items:
+                      description: |-
+                        A label selector requirement is a selector that contains values, a key, and an operator that
+                        relates the key and values.
+                      properties:
+                        key:
+                          description: key is the label key that the selector applies
+                            to.
+                          type: string
+                        operator:
+                          description: |-
+                            operator represents a key's relationship to a set of values.
+                            Valid operators are In, NotIn, Exists and DoesNotExist.
+                          enum:
+                          - In
+                          - NotIn
+                          - Exists
+                          - DoesNotExist
+                          type: string
+                        values:
+                          description: |-
+                            values is an array of string values. If the operator is In or NotIn,
+                            the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                            the values array must be empty. This array is replaced during a strategic
+                            merge patch.
+                          items:
+                            type: string
+                          type: array
+                          x-kubernetes-list-type: atomic
+                      required:
+                      - key
+                      - operator
+                      type: object
+                    type: array
+                    x-kubernetes-list-type: atomic
+                  matchLabels:
+                    additionalProperties:
+                      description: MatchLabelsValue represents the value from the
+                        MatchLabels {key,value} pair.
+                      maxLength: 63
+                      pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
+                      type: string
+                    description: |-
+                      matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                      map is equivalent to an element of matchExpressions, whose key field is "key", the
+                      operator is "In", and the values array contains only "value". The requirements are ANDed.
+                    type: object
+                type: object
+                x-kubernetes-map-type: atomic
+            type: object
+          specs:
+            description: Specs is a list of desired Cilium specific rule specification.
+            items:
+              anyOf:
+              - properties:
+                  ingress: {}
+                required:
+                - ingress
+              - properties:
+                  ingressDeny: {}
+                required:
+                - ingressDeny
+              - properties:
+                  egress: {}
+                required:
+                - egress
+              - properties:
+                  egressDeny: {}
+                required:
+                - egressDeny
+              description: |-
+                Rule is a policy rule which must be applied to all endpoints which match the
+                labels contained in the endpointSelector
+
+                Each rule is split into an ingress section which contains all rules
+                applicable at ingress, and an egress section applicable at egress. For rule
+                types such as `L4Rule` and `CIDR` which can be applied at both ingress and
+                egress, both ingress and egress side have to either specifically allow the
+                connection or one side has to be omitted.
+
+                Either ingress, egress, or both can be provided. If both ingress and egress
+                are omitted, the rule has no effect.
+              oneOf:
+              - properties:
+                  endpointSelector: {}
+                required:
+                - endpointSelector
+              - properties:
+                  nodeSelector: {}
+                required:
+                - nodeSelector
+              properties:
+                description:
+                  description: |-
+                    Description is a free form string, it can be used by the creator of
+                    the rule to store human readable explanation of the purpose of this
+                    rule. Rules cannot be identified by comment.
+                  type: string
+                egress:
+                  description: |-
+                    Egress is a list of EgressRule which are enforced at egress.
+                    If omitted or empty, this rule does not apply at egress.
+                  items:
+                    description: |-
+                      EgressRule contains all rule types which can be applied at egress, i.e.
+                      network traffic that originates inside the endpoint and exits the endpoint
+                      selected by the endpointSelector.
+
+                        - All members of this structure are optional. If omitted or empty, the
+                          member will have no effect on the rule.
+
+                        - If multiple members of the structure are specified, then all members
+                          must match in order for the rule to take effect.
+
+                        - ToEndpoints, ToCIDR, ToCIDRSet, ToEntities, ToServices and ToGroups are
+                          mutually exclusive. Only one of these members may be present within an
+                          individual rule.
+                    properties:
+                      authentication:
+                        description: Authentication is the required authentication
+                          type for the allowed traffic, if any.
+                        properties:
+                          mode:
+                            description: Mode is the required authentication mode
+                              for the allowed traffic, if any.
+                            enum:
+                            - disabled
+                            - required
+                            - test-always-fail
+                            type: string
+                        required:
+                        - mode
+                        type: object
+                      icmps:
+                        description: |-
+                          ICMPs is a list of ICMP rule identified by type number
+                          which the endpoint subject to the rule is allowed to connect to.
+
+                          Example:
+                          Any endpoint with the label "app=httpd" is allowed to initiate
+                          type 8 ICMP connections.
+                        items:
+                          description: ICMPRule is a list of ICMP fields.
+                          properties:
+                            fields:
+                              description: Fields is a list of ICMP fields.
+                              items:
+                                description: ICMPField is a ICMP field.
+                                properties:
+                                  family:
+                                    default: IPv4
+                                    description: |-
+                                      Family is a IP address version.
+                                      Currently, we support `IPv4` and `IPv6`.
+                                      `IPv4` is set as default.
+                                    enum:
+                                    - IPv4
+                                    - IPv6
+                                    type: string
+                                  type:
+                                    anyOf:
+                                    - type: integer
+                                    - type: string
+                                    description: "Type is a ICMP-type.\nIt should
+                                      be an 8bit code (0-255), or it's CamelCase name
+                                      (for example, \"EchoReply\").\nAllowed ICMP
+                                      types are:\n    Ipv4: EchoReply | DestinationUnreachable
+                                      | Redirect | Echo | EchoRequest |\n\t\t     RouterAdvertisement
+                                      | RouterSelection | TimeExceeded | ParameterProblem
+                                      |\n\t\t\t Timestamp | TimestampReply | Photuris
+                                      | ExtendedEcho Request | ExtendedEcho Reply\n
+                                      \   Ipv6: DestinationUnreachable | PacketTooBig
+                                      | TimeExceeded | ParameterProblem |\n\t\t\t
+                                      EchoRequest | EchoReply | MulticastListenerQuery|
+                                      MulticastListenerReport |\n\t\t\t MulticastListenerDone
+                                      | RouterSolicitation | RouterAdvertisement |
+                                      NeighborSolicitation |\n\t\t\t NeighborAdvertisement
+                                      | RedirectMessage | RouterRenumbering | ICMPNodeInformationQuery
+                                      |\n\t\t\t ICMPNodeInformationResponse | InverseNeighborDiscoverySolicitation
+                                      | InverseNeighborDiscoveryAdvertisement |\n\t\t\t
+                                      HomeAgentAddressDiscoveryRequest | HomeAgentAddressDiscoveryReply
+                                      | MobilePrefixSolicitation |\n\t\t\t MobilePrefixAdvertisement
+                                      | DuplicateAddressRequestCodeSuffix | DuplicateAddressConfirmationCodeSuffix
+                                      |\n\t\t\t ExtendedEchoRequest | ExtendedEchoReply"
+                                    pattern: ^([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]|EchoReply|DestinationUnreachable|Redirect|Echo|RouterAdvertisement|RouterSelection|TimeExceeded|ParameterProblem|Timestamp|TimestampReply|Photuris|ExtendedEchoRequest|ExtendedEcho
+                                      Reply|PacketTooBig|ParameterProblem|EchoRequest|MulticastListenerQuery|MulticastListenerReport|MulticastListenerDone|RouterSolicitation|RouterAdvertisement|NeighborSolicitation|NeighborAdvertisement|RedirectMessage|RouterRenumbering|ICMPNodeInformationQuery|ICMPNodeInformationResponse|InverseNeighborDiscoverySolicitation|InverseNeighborDiscoveryAdvertisement|HomeAgentAddressDiscoveryRequest|HomeAgentAddressDiscoveryReply|MobilePrefixSolicitation|MobilePrefixAdvertisement|DuplicateAddressRequestCodeSuffix|DuplicateAddressConfirmationCodeSuffix)$
+                                    x-kubernetes-int-or-string: true
+                                required:
+                                - type
+                                type: object
+                              maxItems: 40
+                              type: array
+                          type: object
+                        type: array
+                      toCIDR:
+                        description: |-
+                          ToCIDR is a list of IP blocks which the endpoint subject to the rule
+                          is allowed to initiate connections. Only connections destined for
+                          outside of the cluster and not targeting the host will be subject
+                          to CIDR rules.  This will match on the destination IP address of
+                          outgoing connections. Adding a prefix into ToCIDR or into ToCIDRSet
+                          with no ExcludeCIDRs is equivalent. Overlaps are allowed between
+                          ToCIDR and ToCIDRSet.
+
+                          Example:
+                          Any endpoint with the label "app=database-proxy" is allowed to
+                          initiate connections to 10.2.3.0/24
+                        items:
+                          description: |-
+                            CIDR specifies a block of IP addresses.
+                            Example: 192.0.2.1/32
+                          format: cidr
+                          type: string
+                        type: array
+                      toCIDRSet:
+                        description: |-
+                          ToCIDRSet is a list of IP blocks which the endpoint subject to the rule
+                          is allowed to initiate connections to in addition to connections
+                          which are allowed via ToEndpoints, along with a list of subnets contained
+                          within their corresponding IP block to which traffic should not be
+                          allowed. This will match on the destination IP address of outgoing
+                          connections. Adding a prefix into ToCIDR or into ToCIDRSet with no
+                          ExcludeCIDRs is equivalent. Overlaps are allowed between ToCIDR and
+                          ToCIDRSet.
+
+                          Example:
+                          Any endpoint with the label "app=database-proxy" is allowed to
+                          initiate connections to 10.2.3.0/24 except from IPs in subnet 10.2.3.0/28.
+                        items:
+                          description: |-
+                            CIDRRule is a rule that specifies a CIDR prefix to/from which outside
+                            communication  is allowed, along with an optional list of subnets within that
+                            CIDR prefix to/from which outside communication is not allowed.
+                          oneOf:
+                          - properties:
+                              cidr: {}
+                            required:
+                            - cidr
+                          - properties:
+                              cidrGroupRef: {}
+                            required:
+                            - cidrGroupRef
+                          - properties:
+                              cidrGroupSelector: {}
+                            required:
+                            - cidrGroupSelector
+                          properties:
+                            cidr:
+                              description: CIDR is a CIDR prefix / IP Block.
+                              format: cidr
+                              type: string
+                            cidrGroupRef:
+                              description: |-
+                                CIDRGroupRef is a reference to a CiliumCIDRGroup object.
+                                A CiliumCIDRGroup contains a list of CIDRs that the endpoint, subject to
+                                the rule, can (Ingress/Egress) or cannot (IngressDeny/EgressDeny) receive
+                                connections from.
+                              maxLength: 253
+                              pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                              type: string
+                            cidrGroupSelector:
+                              description: |-
+                                CIDRGroupSelector selects CiliumCIDRGroups by their labels,
+                                rather than by name.
+                              properties:
+                                matchExpressions:
+                                  description: matchExpressions is a list of label
+                                    selector requirements. The requirements are ANDed.
+                                  items:
+                                    description: |-
+                                      A label selector requirement is a selector that contains values, a key, and an operator that
+                                      relates the key and values.
+                                    properties:
+                                      key:
+                                        description: key is the label key that the
+                                          selector applies to.
+                                        type: string
+                                      operator:
+                                        description: |-
+                                          operator represents a key's relationship to a set of values.
+                                          Valid operators are In, NotIn, Exists and DoesNotExist.
+                                        enum:
+                                        - In
+                                        - NotIn
+                                        - Exists
+                                        - DoesNotExist
+                                        type: string
+                                      values:
+                                        description: |-
+                                          values is an array of string values. If the operator is In or NotIn,
+                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                          the values array must be empty. This array is replaced during a strategic
+                                          merge patch.
+                                        items:
+                                          type: string
+                                        type: array
+                                        x-kubernetes-list-type: atomic
+                                    required:
+                                    - key
+                                    - operator
+                                    type: object
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                matchLabels:
+                                  additionalProperties:
+                                    description: MatchLabelsValue represents the value
+                                      from the MatchLabels {key,value} pair.
+                                    maxLength: 63
+                                    pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
+                                    type: string
+                                  description: |-
+                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                  type: object
+                              type: object
+                              x-kubernetes-map-type: atomic
+                            except:
+                              description: |-
+                                ExceptCIDRs is a list of IP blocks which the endpoint subject to the rule
+                                is not allowed to initiate connections to. These CIDR prefixes should be
+                                contained within Cidr, using ExceptCIDRs together with CIDRGroupRef is not
+                                supported yet.
+                                These exceptions are only applied to the Cidr in this CIDRRule, and do not
+                                apply to any other CIDR prefixes in any other CIDRRules.
+                              items:
+                                description: |-
+                                  CIDR specifies a block of IP addresses.
+                                  Example: 192.0.2.1/32
+                                format: cidr
+                                type: string
+                              type: array
+                          type: object
+                        type: array
+                      toEndpoints:
+                        description: |-
+                          ToEndpoints is a list of endpoints identified by an EndpointSelector to
+                          which the endpoints subject to the rule are allowed to communicate.
+
+                          Example:
+                          Any endpoint with the label "role=frontend" can communicate with any
+                          endpoint carrying the label "role=backend".
+
+                          Note that while an empty non-nil ToEndpoints does not select anything,
+                          nil ToEndpoints is implicitly treated as a wildcard selector if ToPorts
+                          are also specified.
+                          To select everything, use one EndpointSelector without any match requirements.
+                        items:
+                          description: EndpointSelector is a wrapper for k8s LabelSelector.
+                          properties:
+                            matchExpressions:
+                              description: matchExpressions is a list of label selector
+                                requirements. The requirements are ANDed.
+                              items:
+                                description: |-
+                                  A label selector requirement is a selector that contains values, a key, and an operator that
+                                  relates the key and values.
+                                properties:
+                                  key:
+                                    description: key is the label key that the selector
+                                      applies to.
+                                    type: string
+                                  operator:
+                                    description: |-
+                                      operator represents a key's relationship to a set of values.
+                                      Valid operators are In, NotIn, Exists and DoesNotExist.
+                                    enum:
+                                    - In
+                                    - NotIn
+                                    - Exists
+                                    - DoesNotExist
+                                    type: string
+                                  values:
+                                    description: |-
+                                      values is an array of string values. If the operator is In or NotIn,
+                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                      the values array must be empty. This array is replaced during a strategic
+                                      merge patch.
+                                    items:
+                                      type: string
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                required:
+                                - key
+                                - operator
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
+                            matchLabels:
+                              additionalProperties:
+                                description: MatchLabelsValue represents the value
+                                  from the MatchLabels {key,value} pair.
+                                maxLength: 63
+                                pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
+                                type: string
+                              description: |-
+                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                operator is "In", and the values array contains only "value". The requirements are ANDed.
+                              type: object
+                          type: object
+                          x-kubernetes-map-type: atomic
+                        type: array
+                      toEntities:
+                        description: |-
+                          ToEntities is a list of special entities to which the endpoint subject
+                          to the rule is allowed to initiate connections. Supported entities are
+                          `world`, `cluster`, `cluster-mesh`, `host`, `remote-node`, `kube-apiserver`, `ingress`, `init`,
+                          `health`, `unmanaged`, `none` and `all`.
+                        items:
+                          description: |-
+                            Entity specifies the class of receiver/sender endpoints that do not have
+                            individual identities.  Entities are used to describe "outside of cluster",
+                            "host", etc.
+                          enum:
+                          - all
+                          - world
+                          - cluster
+                          - cluster-mesh
+                          - host
+                          - init
+                          - ingress
+                          - unmanaged
+                          - remote-node
+                          - health
+                          - none
+                          - kube-apiserver
+                          type: string
+                        type: array
+                      toFQDNs:
+                        description: |-
+                          ToFQDN allows whitelisting DNS names in place of IPs. The IPs that result
+                          from DNS resolution of `ToFQDN.MatchName`s are added to the same
+                          EgressRule object as ToCIDRSet entries, and behave accordingly. Any L4 and
+                          L7 rules within this EgressRule will also apply to these IPs.
+                          The DNS -> IP mapping is re-resolved periodically from within the
+                          cilium-agent, and the IPs in the DNS response are effected in the policy
+                          for selected pods as-is (i.e. the list of IPs is not modified in any way).
+                          Note: An explicit rule to allow for DNS traffic is needed for the pods, as
+                          ToFQDN counts as an egress rule and will enforce egress policy when
+                          PolicyEnforcment=default.
+                          Note: If the resolved IPs are IPs within the kubernetes cluster, the
+                          ToFQDN rule will not apply to that IP.
+                          Note: ToFQDN cannot occur in the same policy as other To* rules.
+                        items:
+                          oneOf:
+                          - properties:
+                              matchName: {}
+                            required:
+                            - matchName
+                          - properties:
+                              matchPattern: {}
+                            required:
+                            - matchPattern
+                          properties:
+                            matchName:
+                              description: |-
+                                MatchName matches literal DNS names. A trailing "." is automatically added
+                                when missing.
+                              maxLength: 255
+                              pattern: ^([-a-zA-Z0-9_]+[.]?)+$
+                              type: string
+                            matchPattern:
+                              description: |-
+                                MatchPattern allows using wildcards to match DNS names. All wildcards are
+                                case insensitive. The wildcards are:
+                                - "*" matches 0 or more DNS valid characters, and may occur anywhere in
+                                the pattern. As a special case a "*" as the leftmost character, without a
+                                following "." matches all subdomains as well as the name to the right.
+                                A trailing "." is automatically added when missing.
+                                - "**." is a special prefix which matches all multilevel subdomains in the prefix.
+
+                                Examples:
+                                1. `*.cilium.io` matches subdomains of cilium at that level
+                                  www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
+                                2. `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
+                                  except those containing "." separator, subcilium.io and sub-cilium.io match,
+                                  www.cilium.io and blog.cilium.io does not
+                                3. `sub*.cilium.io` matches subdomains of cilium where the subdomain component
+                                  begins with "sub". sub.cilium.io and subdomain.cilium.io match while www.cilium.io,
+                                  blog.cilium.io, cilium.io and google.com do not
+                                4. `**.cilium.io` matches all multilevel subdomains of cilium.io.
+                                  "app.cilium.io" and "test.app.cilium.io" match but not "cilium.io"
+                              maxLength: 255
+                              pattern: ^([-a-zA-Z0-9_*]+[.]?)+$
+                              type: string
+                          type: object
+                        type: array
+                      toGroups:
+                        description: |-
+                          ToGroups allows policies to reference CIDRs provided by external integrations.
+                          Currently, only AWS is supported, and the rule can select by multiple sub directives.
+                          ToGroups entries are functionally equivalent to toCIDR, and have the same
+                          limitiations. They cannot select traffic originating from within the cluster.
+
+                          Example:
+                          toGroups:
+                          - aws:
+                              securityGroupsIds:
+                              - 'sg-XXXXXXXXXXXXX'
+                        items:
+                          description: Groups allows referencing CIDRs that are resolved
+                            from an external integration.
+                          properties:
+                            aws:
+                              description: AWSGroup is an structure that can be used
+                                to whitelisting information from AWS integration
+                              properties:
+                                labels:
+                                  additionalProperties:
+                                    type: string
+                                  description: |-
+                                    Labels selects AWS ENIs by labels.
+                                    Multiple labels are AND-ed together.
+                                  type: object
+                                region:
+                                  description: 'Deprecated: Region is unused.'
+                                  type: string
+                                securityGroupsIds:
+                                  description: |-
+                                    SecurityGroupsIds selects VPC SecurityGroups by IDs.
+                                    If multiple IDs are specified, they are OR-ed together.
+
+                                    Note that this may be AND-ed with any Names specified. Specifying both
+                                    IDs and Names is not recommended.
+                                  items:
+                                    type: string
+                                  type: array
+                                securityGroupsNames:
+                                  description: |-
+                                    SecurityGroupsNames selects VPC SecurityGroups by name.
+                                    If multiple names are specified, they are OR-ed together.
+
+                                    Note that this may be AND-ed with any IDs specified. Specifying both
+                                    IDs and Names is not recommended.
+                                  items:
+                                    type: string
+                                  type: array
+                              type: object
+                          type: object
+                        type: array
+                      toNodes:
+                        description: |-
+                          ToNodes is a list of nodes identified by an
+                          EndpointSelector to which endpoints subject to the rule is allowed to communicate.
+                        items:
+                          description: EndpointSelector is a wrapper for k8s LabelSelector.
+                          properties:
+                            matchExpressions:
+                              description: matchExpressions is a list of label selector
+                                requirements. The requirements are ANDed.
+                              items:
+                                description: |-
+                                  A label selector requirement is a selector that contains values, a key, and an operator that
+                                  relates the key and values.
+                                properties:
+                                  key:
+                                    description: key is the label key that the selector
+                                      applies to.
+                                    type: string
+                                  operator:
+                                    description: |-
+                                      operator represents a key's relationship to a set of values.
+                                      Valid operators are In, NotIn, Exists and DoesNotExist.
+                                    enum:
+                                    - In
+                                    - NotIn
+                                    - Exists
+                                    - DoesNotExist
+                                    type: string
+                                  values:
+                                    description: |-
+                                      values is an array of string values. If the operator is In or NotIn,
+                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                      the values array must be empty. This array is replaced during a strategic
+                                      merge patch.
+                                    items:
+                                      type: string
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                required:
+                                - key
+                                - operator
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
+                            matchLabels:
+                              additionalProperties:
+                                description: MatchLabelsValue represents the value
+                                  from the MatchLabels {key,value} pair.
+                                maxLength: 63
+                                pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
+                                type: string
+                              description: |-
+                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                operator is "In", and the values array contains only "value". The requirements are ANDed.
+                              type: object
+                          type: object
+                          x-kubernetes-map-type: atomic
+                        type: array
+                      toPorts:
+                        description: |-
+                          ToPorts is a list of destination ports identified by port number and
+                          protocol which the endpoint subject to the rule is allowed to
+                          connect to.
+
+                          Example:
+                          Any endpoint with the label "role=frontend" is allowed to initiate
+                          connections to destination port 8080/tcp
+                        items:
+                          description: |-
+                            PortRule is a list of ports/protocol combinations with optional Layer 7
+                            rules which must be met.
+                          properties:
+                            listener:
+                              description: |-
+                                listener specifies the name of a custom Envoy listener to which this traffic should be
+                                redirected to.
+                              properties:
+                                envoyConfig:
+                                  description: |-
+                                    EnvoyConfig is a reference to the CEC or CCEC resource in which
+                                    the listener is defined.
+                                  properties:
+                                    kind:
+                                      description: |-
+                                        Kind is the resource type being referred to. Defaults to CiliumEnvoyConfig or
+                                        CiliumClusterwideEnvoyConfig for CiliumNetworkPolicy and CiliumClusterwideNetworkPolicy,
+                                        respectively. The only case this is currently explicitly needed is when referring to a
+                                        CiliumClusterwideEnvoyConfig from CiliumNetworkPolicy, as using a namespaced listener
+                                        from a cluster scoped policy is not allowed.
+                                      enum:
+                                      - CiliumEnvoyConfig
+                                      - CiliumClusterwideEnvoyConfig
+                                      type: string
+                                    name:
+                                      description: |-
+                                        Name is the resource name of the CiliumEnvoyConfig or CiliumClusterwideEnvoyConfig where
+                                        the listener is defined in.
+                                      minLength: 1
+                                      type: string
+                                  required:
+                                  - name
+                                  type: object
+                                name:
+                                  description: Name is the name of the listener.
+                                  minLength: 1
+                                  type: string
+                                priority:
+                                  description: |-
+                                    Priority for this Listener that is used when multiple rules would apply different
+                                    listeners to a policy map entry. Behavior of this is implementation dependent.
+                                  maximum: 100
+                                  minimum: 1
+                                  type: integer
+                              required:
+                              - envoyConfig
+                              - name
+                              type: object
+                            originatingTLS:
+                              description: |-
+                                OriginatingTLS is the TLS context for the connections originated by
+                                the L7 proxy.  For egress policy this specifies the client-side TLS
+                                parameters for the upstream connection originating from the L7 proxy
+                                to the remote destination. For ingress policy this specifies the
+                                client-side TLS parameters for the connection from the L7 proxy to
+                                the local endpoint.
+                              properties:
+                                certificate:
+                                  description: |-
+                                    Certificate is the file name or k8s secret item name for the certificate
+                                    chain. If omitted, 'tls.crt' is assumed, if it exists. If given, the
+                                    item must exist.
+                                  type: string
+                                privateKey:
+                                  description: |-
+                                    PrivateKey is the file name or k8s secret item name for the private key
+                                    matching the certificate chain. If omitted, 'tls.key' is assumed, if it
+                                    exists. If given, the item must exist.
+                                  type: string
+                                secret:
+                                  description: |-
+                                    Secret is the secret that contains the certificates and private key for
+                                    the TLS context.
+                                    By default, Cilium will search in this secret for the following items:
+                                     - 'ca.crt'  - Which represents the trusted CA to verify remote source.
+                                     - 'tls.crt' - Which represents the public key certificate.
+                                     - 'tls.key' - Which represents the private key matching the public key
+                                                   certificate.
+                                  properties:
+                                    name:
+                                      description: Name is the name of the secret.
+                                      type: string
+                                    namespace:
+                                      description: |-
+                                        Namespace is the namespace in which the secret exists. Context of use
+                                        determines the default value if left out (e.g., "default").
+                                      type: string
+                                  required:
+                                  - name
+                                  type: object
+                                trustedCA:
+                                  description: |-
+                                    TrustedCA is the file name or k8s secret item name for the trusted CA.
+                                    If omitted, 'ca.crt' is assumed, if it exists. If given, the item must
+                                    exist.
+                                  type: string
+                              required:
+                              - secret
+                              type: object
+                            ports:
+                              description: Ports is a list of L4 port/protocol
+                              items:
+                                description: PortProtocol specifies an L4 port with
+                                  an optional transport protocol
+                                properties:
+                                  endPort:
+                                    description: EndPort can only be an L4 port number.
+                                    format: int32
+                                    maximum: 65535
+                                    minimum: 0
+                                    type: integer
+                                  port:
+                                    description: |-
+                                      Port can be an L4 port number, or a name in the form of "http"
+                                      or "http-8080".
+                                    pattern: ^(6553[0-5]|655[0-2][0-9]|65[0-4][0-9]{2}|6[0-4][0-9]{3}|[1-5][0-9]{4}|[0-9]{1,4})|([a-zA-Z0-9]-?)*[a-zA-Z](-?[a-zA-Z0-9])*$
+                                    type: string
+                                  protocol:
+                                    description: |-
+                                      Protocol is the L4 protocol. If "ANY", omitted or empty, any protocols
+                                      with transport ports (TCP, UDP, SCTP) match.
+
+                                      Accepted values: "TCP", "UDP", "SCTP", "VRRP", "IGMP", "GRE", "IPIP",
+                                      "IPV6", "ESP", "AH", "ANY"
+
+                                      Tunnel/encapsulation protocols (GRE, IPIP, IPV6, ESP, AH) and other
+                                      extended IP protocols (VRRP, IGMP) require the --enable-extended-ip-protocols
+                                      flag to be set. These protocols do not use transport-layer ports.
+
+                                      Matching on ICMP is not supported.
+
+                                      Named port specified for a container may narrow this down, but may not
+                                      contradict this.
+                                    enum:
+                                    - TCP
+                                    - UDP
+                                    - SCTP
+                                    - VRRP
+                                    - IGMP
+                                    - GRE
+                                    - IPIP
+                                    - IPV6
+                                    - ESP
+                                    - AH
+                                    - ANY
+                                    type: string
+                                type: object
+                              maxItems: 40
+                              type: array
+                            rules:
+                              description: |-
+                                Rules is a list of additional port level rules which must be met in
+                                order for the PortRule to allow the traffic. If omitted or empty,
+                                no layer 7 rules are enforced.
+                              oneOf:
+                              - properties:
+                                  http: {}
+                                required:
+                                - http
+                              - properties:
+                                  dns: {}
+                                required:
+                                - dns
+                              properties:
+                                dns:
+                                  description: DNS-specific rules.
+                                  items:
+                                    description: PortRuleDNS is a list of allowed
+                                      DNS lookups.
+                                    oneOf:
+                                    - properties:
+                                        matchName: {}
+                                      required:
+                                      - matchName
+                                    - properties:
+                                        matchPattern: {}
+                                      required:
+                                      - matchPattern
+                                    properties:
+                                      matchName:
+                                        description: |-
+                                          MatchName matches literal DNS names. A trailing "." is automatically added
+                                          when missing.
+                                        maxLength: 255
+                                        pattern: ^([-a-zA-Z0-9_]+[.]?)+$
+                                        type: string
+                                      matchPattern:
+                                        description: |-
+                                          MatchPattern allows using wildcards to match DNS names. All wildcards are
+                                          case insensitive. The wildcards are:
+                                          - "*" matches 0 or more DNS valid characters, and may occur anywhere in
+                                          the pattern. As a special case a "*" as the leftmost character, without a
+                                          following "." matches all subdomains as well as the name to the right.
+                                          A trailing "." is automatically added when missing.
+                                          - "**." is a special prefix which matches all multilevel subdomains in the prefix.
+
+                                          Examples:
+                                          1. `*.cilium.io` matches subdomains of cilium at that level
+                                            www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
+                                          2. `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
+                                            except those containing "." separator, subcilium.io and sub-cilium.io match,
+                                            www.cilium.io and blog.cilium.io does not
+                                          3. `sub*.cilium.io` matches subdomains of cilium where the subdomain component
+                                            begins with "sub". sub.cilium.io and subdomain.cilium.io match while www.cilium.io,
+                                            blog.cilium.io, cilium.io and google.com do not
+                                          4. `**.cilium.io` matches all multilevel subdomains of cilium.io.
+                                            "app.cilium.io" and "test.app.cilium.io" match but not "cilium.io"
+                                        maxLength: 255
+                                        pattern: ^([-a-zA-Z0-9_*]+[.]?)+$
+                                        type: string
+                                    type: object
+                                  type: array
+                                http:
+                                  description: HTTP specific rules.
+                                  items:
+                                    description: |-
+                                      PortRuleHTTP is a list of HTTP protocol constraints. All fields are
+                                      optional, if all fields are empty or missing, the rule does not have any
+                                      effect.
+
+                                      All fields of this type are extended POSIX regex as defined by IEEE Std
+                                      1003.1, (i.e this follows the egrep/unix syntax, not the perl syntax)
+                                      matched against the path of an incoming request. Currently it can contain
+                                      characters disallowed from the conventional "path" part of a URL as defined
+                                      by RFC 3986.
+                                    properties:
+                                      headerMatches:
+                                        description: |-
+                                          HeaderMatches is a list of HTTP headers which must be
+                                          present and match against the given values. Mismatch field can be used
+                                          to specify what to do when there is no match.
+                                        items:
+                                          description: |-
+                                            HeaderMatch extends the HeaderValue for matching requirement of a
+                                            named header field against an immediate string or a secret value.
+                                            If none of the optional fields is present, then the
+                                            header value is not matched, only presence of the header is enough.
+                                          properties:
+                                            mismatch:
+                                              description: |-
+                                                Mismatch identifies what to do in case there is no match. The default is
+                                                to drop the request. Otherwise the overall rule is still considered as
+                                                matching, but the mismatches are logged in the access log.
+                                              enum:
+                                              - LOG
+                                              - ADD
+                                              - DELETE
+                                              - REPLACE
+                                              type: string
+                                            name:
+                                              description: Name identifies the header.
+                                              minLength: 1
+                                              type: string
+                                            secret:
+                                              description: |-
+                                                Secret refers to a secret that contains the value to be matched against.
+                                                The secret must only contain one entry. If the referred secret does not
+                                                exist, and there is no "Value" specified, the match will fail.
+                                              properties:
+                                                name:
+                                                  description: Name is the name of
+                                                    the secret.
+                                                  type: string
+                                                namespace:
+                                                  description: |-
+                                                    Namespace is the namespace in which the secret exists. Context of use
+                                                    determines the default value if left out (e.g., "default").
+                                                  type: string
+                                              required:
+                                              - name
+                                              type: object
+                                            value:
+                                              description: |-
+                                                Value matches the exact value of the header. Can be specified either
+                                                alone or together with "Secret"; will be used as the header value if the
+                                                secret can not be found in the latter case.
+                                              type: string
+                                          required:
+                                          - name
+                                          type: object
+                                        type: array
+                                      headers:
+                                        description: |-
+                                          Headers is a list of HTTP headers which must be present in the
+                                          request. If omitted or empty, requests are allowed regardless of
+                                          headers present.
+                                        items:
+                                          type: string
+                                        type: array
+                                      host:
+                                        description: |-
+                                          Host is an extended POSIX regex matched against the host header of a
+                                          request. Examples:
+
+                                          - foo.bar.com will match the host fooXbar.com or foo-bar.com
+                                          - foo\.bar\.com will only match the host foo.bar.com
+
+                                          If omitted or empty, the value of the host header is ignored.
+                                        format: idn-hostname
+                                        type: string
+                                      method:
+                                        description: |-
+                                          Method is an extended POSIX regex matched against the method of a
+                                          request, e.g. "GET", "POST", "PUT", "PATCH", "DELETE", ...
+
+                                          If omitted or empty, all methods are allowed.
+                                        type: string
+                                      path:
+                                        description: |-
+                                          Path is an extended POSIX regex matched against the path of a
+                                          request. Currently it can contain characters disallowed from the
+                                          conventional "path" part of a URL as defined by RFC 3986.
+
+                                          If omitted or empty, all paths are all allowed.
+                                        type: string
+                                    type: object
+                                  type: array
+                              type: object
+                            serverNames:
+                              description: |-
+                                ServerNames is a list of allowed TLS SNI values. If not empty, then
+                                TLS must be present and one of the provided SNIs must be indicated in the
+                                TLS handshake.
+                              items:
+                                description: |-
+                                  ServerName allows using '*' wildcard specifier for matching server names with
+                                  the below semantics.
+
+                                  - `*` matches 0 or more DNS valid characters, and may occur anywhere in the pattern.
+                                  - `**.` is a special prefix which matches all multilevel subdomains in the prefix.
+
+                                  As a special case the name "*" matches all valid DNS names.
+
+                                  Examples:
+                                   1. `*.cilium.io` matches subdomains of cilium at that level
+                                      www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
+                                   2. `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
+                                      except those containing "." separator, subcilium.io and sub-cilium.io match,
+                                      www.cilium.io and blog.cilium.io does not
+                                   3. `sub*.cilium.io` matches subdomains of cilium where the subdomain component
+                                      begins with "sub". sub.cilium.io and subdomain.cilium.io match while www.cilium.io,
+                                      blog.cilium.io, cilium.io and google.com do not
+                                   4. `**.cilium.io` matches all multilevel subdomains of cilium.io.
+                                      "app.cilium.io" and "test.app.cilium.io" match but not "cilium.io"
+                                maxLength: 255
+                                pattern: ^([-a-zA-Z0-9_*]+[.]?)+$
+                                type: string
+                              minItems: 1
+                              type: array
+                              x-kubernetes-list-type: set
+                            terminatingTLS:
+                              description: |-
+                                TerminatingTLS is the TLS context for the connection terminated by
+                                the L7 proxy.  For egress policy this specifies the server-side TLS
+                                parameters to be applied on the connections originated from the local
+                                endpoint and terminated by the L7 proxy. For ingress policy this specifies
+                                the server-side TLS parameters to be applied on the connections
+                                originated from a remote source and terminated by the L7 proxy.
+                              properties:
+                                certificate:
+                                  description: |-
+                                    Certificate is the file name or k8s secret item name for the certificate
+                                    chain. If omitted, 'tls.crt' is assumed, if it exists. If given, the
+                                    item must exist.
+                                  type: string
+                                privateKey:
+                                  description: |-
+                                    PrivateKey is the file name or k8s secret item name for the private key
+                                    matching the certificate chain. If omitted, 'tls.key' is assumed, if it
+                                    exists. If given, the item must exist.
+                                  type: string
+                                secret:
+                                  description: |-
+                                    Secret is the secret that contains the certificates and private key for
+                                    the TLS context.
+                                    By default, Cilium will search in this secret for the following items:
+                                     - 'ca.crt'  - Which represents the trusted CA to verify remote source.
+                                     - 'tls.crt' - Which represents the public key certificate.
+                                     - 'tls.key' - Which represents the private key matching the public key
+                                                   certificate.
+                                  properties:
+                                    name:
+                                      description: Name is the name of the secret.
+                                      type: string
+                                    namespace:
+                                      description: |-
+                                        Namespace is the namespace in which the secret exists. Context of use
+                                        determines the default value if left out (e.g., "default").
+                                      type: string
+                                  required:
+                                  - name
+                                  type: object
+                                trustedCA:
+                                  description: |-
+                                    TrustedCA is the file name or k8s secret item name for the trusted CA.
+                                    If omitted, 'ca.crt' is assumed, if it exists. If given, the item must
+                                    exist.
+                                  type: string
+                              required:
+                              - secret
+                              type: object
+                          type: object
+                        type: array
+                      toRequires:
+                        description: Deprecated.
+                        items:
+                          type: string
+                        maxItems: 0
+                        type: array
+                      toServices:
+                        description: |-
+                          ToServices is a list of services to which the endpoint subject
+                          to the rule is allowed to initiate connections.
+                          Currently Cilium only supports toServices for K8s services.
+                        items:
+                          description: |-
+                            Service selects policy targets that are bundled as part of a
+                            logical load-balanced service.
+
+                            Currently only Kubernetes-based Services are supported.
+                          properties:
+                            k8sService:
+                              description: K8sService selects service by name and
+                                namespace pair
+                              properties:
+                                namespace:
+                                  type: string
+                                serviceName:
+                                  type: string
+                              type: object
+                            k8sServiceSelector:
+                              description: K8sServiceSelector selects services by
+                                k8s labels and namespace
+                              properties:
+                                namespace:
+                                  type: string
+                                selector:
+                                  description: ServiceSelector is a label selector
+                                    for k8s services
+                                  properties:
+                                    matchExpressions:
+                                      description: matchExpressions is a list of label
+                                        selector requirements. The requirements are
+                                        ANDed.
+                                      items:
+                                        description: |-
+                                          A label selector requirement is a selector that contains values, a key, and an operator that
+                                          relates the key and values.
+                                        properties:
+                                          key:
+                                            description: key is the label key that
+                                              the selector applies to.
+                                            type: string
+                                          operator:
+                                            description: |-
+                                              operator represents a key's relationship to a set of values.
+                                              Valid operators are In, NotIn, Exists and DoesNotExist.
+                                            enum:
+                                            - In
+                                            - NotIn
+                                            - Exists
+                                            - DoesNotExist
+                                            type: string
+                                          values:
+                                            description: |-
+                                              values is an array of string values. If the operator is In or NotIn,
+                                              the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                              the values array must be empty. This array is replaced during a strategic
+                                              merge patch.
+                                            items:
+                                              type: string
+                                            type: array
+                                            x-kubernetes-list-type: atomic
+                                        required:
+                                        - key
+                                        - operator
+                                        type: object
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    matchLabels:
+                                      additionalProperties:
+                                        description: MatchLabelsValue represents the
+                                          value from the MatchLabels {key,value} pair.
+                                        maxLength: 63
+                                        pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
+                                        type: string
+                                      description: |-
+                                        matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                        map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                        operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                      type: object
+                                  type: object
+                                  x-kubernetes-map-type: atomic
+                              required:
+                              - selector
+                              type: object
+                          type: object
+                        type: array
+                    type: object
+                  type: array
+                egressDeny:
+                  description: |-
+                    EgressDeny is a list of EgressDenyRule which are enforced at egress.
+                    Any rule inserted here will be denied regardless of the allowed egress
+                    rules in the 'egress' field.
+                    If omitted or empty, this rule does not apply at egress.
+                  items:
+                    description: |-
+                      EgressDenyRule contains all rule types which can be applied at egress, i.e.
+                      network traffic that originates inside the endpoint and exits the endpoint
+                      selected by the endpointSelector.
+
+                        - All members of this structure are optional. If omitted or empty, the
+                          member will have no effect on the rule.
+
+                        - If multiple members of the structure are specified, then all members
+                          must match in order for the rule to take effect.
+
+                        - ToEndpoints, ToCIDR, ToCIDRSet, ToEntities, ToServices and ToGroups are
+                          mutually exclusive. Only one of these members may be present within an
+                          individual rule.
+                    properties:
+                      icmps:
+                        description: |-
+                          ICMPs is a list of ICMP rule identified by type number
+                          which the endpoint subject to the rule is not allowed to connect to.
+
+                          Example:
+                          Any endpoint with the label "app=httpd" is not allowed to initiate
+                          type 8 ICMP connections.
+                        items:
+                          description: ICMPRule is a list of ICMP fields.
+                          properties:
+                            fields:
+                              description: Fields is a list of ICMP fields.
+                              items:
+                                description: ICMPField is a ICMP field.
+                                properties:
+                                  family:
+                                    default: IPv4
+                                    description: |-
+                                      Family is a IP address version.
+                                      Currently, we support `IPv4` and `IPv6`.
+                                      `IPv4` is set as default.
+                                    enum:
+                                    - IPv4
+                                    - IPv6
+                                    type: string
+                                  type:
+                                    anyOf:
+                                    - type: integer
+                                    - type: string
+                                    description: "Type is a ICMP-type.\nIt should
+                                      be an 8bit code (0-255), or it's CamelCase name
+                                      (for example, \"EchoReply\").\nAllowed ICMP
+                                      types are:\n    Ipv4: EchoReply | DestinationUnreachable
+                                      | Redirect | Echo | EchoRequest |\n\t\t     RouterAdvertisement
+                                      | RouterSelection | TimeExceeded | ParameterProblem
+                                      |\n\t\t\t Timestamp | TimestampReply | Photuris
+                                      | ExtendedEcho Request | ExtendedEcho Reply\n
+                                      \   Ipv6: DestinationUnreachable | PacketTooBig
+                                      | TimeExceeded | ParameterProblem |\n\t\t\t
+                                      EchoRequest | EchoReply | MulticastListenerQuery|
+                                      MulticastListenerReport |\n\t\t\t MulticastListenerDone
+                                      | RouterSolicitation | RouterAdvertisement |
+                                      NeighborSolicitation |\n\t\t\t NeighborAdvertisement
+                                      | RedirectMessage | RouterRenumbering | ICMPNodeInformationQuery
+                                      |\n\t\t\t ICMPNodeInformationResponse | InverseNeighborDiscoverySolicitation
+                                      | InverseNeighborDiscoveryAdvertisement |\n\t\t\t
+                                      HomeAgentAddressDiscoveryRequest | HomeAgentAddressDiscoveryReply
+                                      | MobilePrefixSolicitation |\n\t\t\t MobilePrefixAdvertisement
+                                      | DuplicateAddressRequestCodeSuffix | DuplicateAddressConfirmationCodeSuffix
+                                      |\n\t\t\t ExtendedEchoRequest | ExtendedEchoReply"
+                                    pattern: ^([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]|EchoReply|DestinationUnreachable|Redirect|Echo|RouterAdvertisement|RouterSelection|TimeExceeded|ParameterProblem|Timestamp|TimestampReply|Photuris|ExtendedEchoRequest|ExtendedEcho
+                                      Reply|PacketTooBig|ParameterProblem|EchoRequest|MulticastListenerQuery|MulticastListenerReport|MulticastListenerDone|RouterSolicitation|RouterAdvertisement|NeighborSolicitation|NeighborAdvertisement|RedirectMessage|RouterRenumbering|ICMPNodeInformationQuery|ICMPNodeInformationResponse|InverseNeighborDiscoverySolicitation|InverseNeighborDiscoveryAdvertisement|HomeAgentAddressDiscoveryRequest|HomeAgentAddressDiscoveryReply|MobilePrefixSolicitation|MobilePrefixAdvertisement|DuplicateAddressRequestCodeSuffix|DuplicateAddressConfirmationCodeSuffix)$
+                                    x-kubernetes-int-or-string: true
+                                required:
+                                - type
+                                type: object
+                              maxItems: 40
+                              type: array
+                          type: object
+                        type: array
+                      toCIDR:
+                        description: |-
+                          ToCIDR is a list of IP blocks which the endpoint subject to the rule
+                          is allowed to initiate connections. Only connections destined for
+                          outside of the cluster and not targeting the host will be subject
+                          to CIDR rules.  This will match on the destination IP address of
+                          outgoing connections. Adding a prefix into ToCIDR or into ToCIDRSet
+                          with no ExcludeCIDRs is equivalent. Overlaps are allowed between
+                          ToCIDR and ToCIDRSet.
+
+                          Example:
+                          Any endpoint with the label "app=database-proxy" is allowed to
+                          initiate connections to 10.2.3.0/24
+                        items:
+                          description: |-
+                            CIDR specifies a block of IP addresses.
+                            Example: 192.0.2.1/32
+                          format: cidr
+                          type: string
+                        type: array
+                      toCIDRSet:
+                        description: |-
+                          ToCIDRSet is a list of IP blocks which the endpoint subject to the rule
+                          is allowed to initiate connections to in addition to connections
+                          which are allowed via ToEndpoints, along with a list of subnets contained
+                          within their corresponding IP block to which traffic should not be
+                          allowed. This will match on the destination IP address of outgoing
+                          connections. Adding a prefix into ToCIDR or into ToCIDRSet with no
+                          ExcludeCIDRs is equivalent. Overlaps are allowed between ToCIDR and
+                          ToCIDRSet.
+
+                          Example:
+                          Any endpoint with the label "app=database-proxy" is allowed to
+                          initiate connections to 10.2.3.0/24 except from IPs in subnet 10.2.3.0/28.
+                        items:
+                          description: |-
+                            CIDRRule is a rule that specifies a CIDR prefix to/from which outside
+                            communication  is allowed, along with an optional list of subnets within that
+                            CIDR prefix to/from which outside communication is not allowed.
+                          oneOf:
+                          - properties:
+                              cidr: {}
+                            required:
+                            - cidr
+                          - properties:
+                              cidrGroupRef: {}
+                            required:
+                            - cidrGroupRef
+                          - properties:
+                              cidrGroupSelector: {}
+                            required:
+                            - cidrGroupSelector
+                          properties:
+                            cidr:
+                              description: CIDR is a CIDR prefix / IP Block.
+                              format: cidr
+                              type: string
+                            cidrGroupRef:
+                              description: |-
+                                CIDRGroupRef is a reference to a CiliumCIDRGroup object.
+                                A CiliumCIDRGroup contains a list of CIDRs that the endpoint, subject to
+                                the rule, can (Ingress/Egress) or cannot (IngressDeny/EgressDeny) receive
+                                connections from.
+                              maxLength: 253
+                              pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                              type: string
+                            cidrGroupSelector:
+                              description: |-
+                                CIDRGroupSelector selects CiliumCIDRGroups by their labels,
+                                rather than by name.
+                              properties:
+                                matchExpressions:
+                                  description: matchExpressions is a list of label
+                                    selector requirements. The requirements are ANDed.
+                                  items:
+                                    description: |-
+                                      A label selector requirement is a selector that contains values, a key, and an operator that
+                                      relates the key and values.
+                                    properties:
+                                      key:
+                                        description: key is the label key that the
+                                          selector applies to.
+                                        type: string
+                                      operator:
+                                        description: |-
+                                          operator represents a key's relationship to a set of values.
+                                          Valid operators are In, NotIn, Exists and DoesNotExist.
+                                        enum:
+                                        - In
+                                        - NotIn
+                                        - Exists
+                                        - DoesNotExist
+                                        type: string
+                                      values:
+                                        description: |-
+                                          values is an array of string values. If the operator is In or NotIn,
+                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                          the values array must be empty. This array is replaced during a strategic
+                                          merge patch.
+                                        items:
+                                          type: string
+                                        type: array
+                                        x-kubernetes-list-type: atomic
+                                    required:
+                                    - key
+                                    - operator
+                                    type: object
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                matchLabels:
+                                  additionalProperties:
+                                    description: MatchLabelsValue represents the value
+                                      from the MatchLabels {key,value} pair.
+                                    maxLength: 63
+                                    pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
+                                    type: string
+                                  description: |-
+                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                  type: object
+                              type: object
+                              x-kubernetes-map-type: atomic
+                            except:
+                              description: |-
+                                ExceptCIDRs is a list of IP blocks which the endpoint subject to the rule
+                                is not allowed to initiate connections to. These CIDR prefixes should be
+                                contained within Cidr, using ExceptCIDRs together with CIDRGroupRef is not
+                                supported yet.
+                                These exceptions are only applied to the Cidr in this CIDRRule, and do not
+                                apply to any other CIDR prefixes in any other CIDRRules.
+                              items:
+                                description: |-
+                                  CIDR specifies a block of IP addresses.
+                                  Example: 192.0.2.1/32
+                                format: cidr
+                                type: string
+                              type: array
+                          type: object
+                        type: array
+                      toEndpoints:
+                        description: |-
+                          ToEndpoints is a list of endpoints identified by an EndpointSelector to
+                          which the endpoints subject to the rule are allowed to communicate.
+
+                          Example:
+                          Any endpoint with the label "role=frontend" can communicate with any
+                          endpoint carrying the label "role=backend".
+
+                          Note that while an empty non-nil ToEndpoints does not select anything,
+                          nil ToEndpoints is implicitly treated as a wildcard selector if ToPorts
+                          are also specified.
+                          To select everything, use one EndpointSelector without any match requirements.
+                        items:
+                          description: EndpointSelector is a wrapper for k8s LabelSelector.
+                          properties:
+                            matchExpressions:
+                              description: matchExpressions is a list of label selector
+                                requirements. The requirements are ANDed.
+                              items:
+                                description: |-
+                                  A label selector requirement is a selector that contains values, a key, and an operator that
+                                  relates the key and values.
+                                properties:
+                                  key:
+                                    description: key is the label key that the selector
+                                      applies to.
+                                    type: string
+                                  operator:
+                                    description: |-
+                                      operator represents a key's relationship to a set of values.
+                                      Valid operators are In, NotIn, Exists and DoesNotExist.
+                                    enum:
+                                    - In
+                                    - NotIn
+                                    - Exists
+                                    - DoesNotExist
+                                    type: string
+                                  values:
+                                    description: |-
+                                      values is an array of string values. If the operator is In or NotIn,
+                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                      the values array must be empty. This array is replaced during a strategic
+                                      merge patch.
+                                    items:
+                                      type: string
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                required:
+                                - key
+                                - operator
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
+                            matchLabels:
+                              additionalProperties:
+                                description: MatchLabelsValue represents the value
+                                  from the MatchLabels {key,value} pair.
+                                maxLength: 63
+                                pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
+                                type: string
+                              description: |-
+                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                operator is "In", and the values array contains only "value". The requirements are ANDed.
+                              type: object
+                          type: object
+                          x-kubernetes-map-type: atomic
+                        type: array
+                      toEntities:
+                        description: |-
+                          ToEntities is a list of special entities to which the endpoint subject
+                          to the rule is allowed to initiate connections. Supported entities are
+                          `world`, `cluster`, `cluster-mesh`, `host`, `remote-node`, `kube-apiserver`, `ingress`, `init`,
+                          `health`, `unmanaged`, `none` and `all`.
+                        items:
+                          description: |-
+                            Entity specifies the class of receiver/sender endpoints that do not have
+                            individual identities.  Entities are used to describe "outside of cluster",
+                            "host", etc.
+                          enum:
+                          - all
+                          - world
+                          - cluster
+                          - cluster-mesh
+                          - host
+                          - init
+                          - ingress
+                          - unmanaged
+                          - remote-node
+                          - health
+                          - none
+                          - kube-apiserver
+                          type: string
+                        type: array
+                      toGroups:
+                        description: |-
+                          ToGroups allows policies to reference CIDRs provided by external integrations.
+                          Currently, only AWS is supported, and the rule can select by multiple sub directives.
+                          ToGroups entries are functionally equivalent to toCIDR, and have the same
+                          limitiations. They cannot select traffic originating from within the cluster.
+
+                          Example:
+                          toGroups:
+                          - aws:
+                              securityGroupsIds:
+                              - 'sg-XXXXXXXXXXXXX'
+                        items:
+                          description: Groups allows referencing CIDRs that are resolved
+                            from an external integration.
+                          properties:
+                            aws:
+                              description: AWSGroup is an structure that can be used
+                                to whitelisting information from AWS integration
+                              properties:
+                                labels:
+                                  additionalProperties:
+                                    type: string
+                                  description: |-
+                                    Labels selects AWS ENIs by labels.
+                                    Multiple labels are AND-ed together.
+                                  type: object
+                                region:
+                                  description: 'Deprecated: Region is unused.'
+                                  type: string
+                                securityGroupsIds:
+                                  description: |-
+                                    SecurityGroupsIds selects VPC SecurityGroups by IDs.
+                                    If multiple IDs are specified, they are OR-ed together.
+
+                                    Note that this may be AND-ed with any Names specified. Specifying both
+                                    IDs and Names is not recommended.
+                                  items:
+                                    type: string
+                                  type: array
+                                securityGroupsNames:
+                                  description: |-
+                                    SecurityGroupsNames selects VPC SecurityGroups by name.
+                                    If multiple names are specified, they are OR-ed together.
+
+                                    Note that this may be AND-ed with any IDs specified. Specifying both
+                                    IDs and Names is not recommended.
+                                  items:
+                                    type: string
+                                  type: array
+                              type: object
+                          type: object
+                        type: array
+                      toNodes:
+                        description: |-
+                          ToNodes is a list of nodes identified by an
+                          EndpointSelector to which endpoints subject to the rule is allowed to communicate.
+                        items:
+                          description: EndpointSelector is a wrapper for k8s LabelSelector.
+                          properties:
+                            matchExpressions:
+                              description: matchExpressions is a list of label selector
+                                requirements. The requirements are ANDed.
+                              items:
+                                description: |-
+                                  A label selector requirement is a selector that contains values, a key, and an operator that
+                                  relates the key and values.
+                                properties:
+                                  key:
+                                    description: key is the label key that the selector
+                                      applies to.
+                                    type: string
+                                  operator:
+                                    description: |-
+                                      operator represents a key's relationship to a set of values.
+                                      Valid operators are In, NotIn, Exists and DoesNotExist.
+                                    enum:
+                                    - In
+                                    - NotIn
+                                    - Exists
+                                    - DoesNotExist
+                                    type: string
+                                  values:
+                                    description: |-
+                                      values is an array of string values. If the operator is In or NotIn,
+                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                      the values array must be empty. This array is replaced during a strategic
+                                      merge patch.
+                                    items:
+                                      type: string
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                required:
+                                - key
+                                - operator
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
+                            matchLabels:
+                              additionalProperties:
+                                description: MatchLabelsValue represents the value
+                                  from the MatchLabels {key,value} pair.
+                                maxLength: 63
+                                pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
+                                type: string
+                              description: |-
+                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                operator is "In", and the values array contains only "value". The requirements are ANDed.
+                              type: object
+                          type: object
+                          x-kubernetes-map-type: atomic
+                        type: array
+                      toPorts:
+                        description: |-
+                          ToPorts is a list of destination ports identified by port number and
+                          protocol which the endpoint subject to the rule is not allowed to connect
+                          to.
+
+                          Example:
+                          Any endpoint with the label "role=frontend" is not allowed to initiate
+                          connections to destination port 8080/tcp
+                        items:
+                          description: |-
+                            PortDenyRule is a list of ports/protocol that should be used for deny
+                            policies. This structure lacks the L7Rules since it's not supported in deny
+                            policies.
+                          properties:
+                            ports:
+                              description: Ports is a list of L4 port/protocol
+                              items:
+                                description: PortProtocol specifies an L4 port with
+                                  an optional transport protocol
+                                properties:
+                                  endPort:
+                                    description: EndPort can only be an L4 port number.
+                                    format: int32
+                                    maximum: 65535
+                                    minimum: 0
+                                    type: integer
+                                  port:
+                                    description: |-
+                                      Port can be an L4 port number, or a name in the form of "http"
+                                      or "http-8080".
+                                    pattern: ^(6553[0-5]|655[0-2][0-9]|65[0-4][0-9]{2}|6[0-4][0-9]{3}|[1-5][0-9]{4}|[0-9]{1,4})|([a-zA-Z0-9]-?)*[a-zA-Z](-?[a-zA-Z0-9])*$
+                                    type: string
+                                  protocol:
+                                    description: |-
+                                      Protocol is the L4 protocol. If "ANY", omitted or empty, any protocols
+                                      with transport ports (TCP, UDP, SCTP) match.
+
+                                      Accepted values: "TCP", "UDP", "SCTP", "VRRP", "IGMP", "GRE", "IPIP",
+                                      "IPV6", "ESP", "AH", "ANY"
+
+                                      Tunnel/encapsulation protocols (GRE, IPIP, IPV6, ESP, AH) and other
+                                      extended IP protocols (VRRP, IGMP) require the --enable-extended-ip-protocols
+                                      flag to be set. These protocols do not use transport-layer ports.
+
+                                      Matching on ICMP is not supported.
+
+                                      Named port specified for a container may narrow this down, but may not
+                                      contradict this.
+                                    enum:
+                                    - TCP
+                                    - UDP
+                                    - SCTP
+                                    - VRRP
+                                    - IGMP
+                                    - GRE
+                                    - IPIP
+                                    - IPV6
+                                    - ESP
+                                    - AH
+                                    - ANY
+                                    type: string
+                                type: object
+                              type: array
+                          type: object
+                        type: array
+                      toRequires:
+                        description: Deprecated.
+                        items:
+                          type: string
+                        maxItems: 0
+                        type: array
+                      toServices:
+                        description: |-
+                          ToServices is a list of services to which the endpoint subject
+                          to the rule is allowed to initiate connections.
+                          Currently Cilium only supports toServices for K8s services.
+                        items:
+                          description: |-
+                            Service selects policy targets that are bundled as part of a
+                            logical load-balanced service.
+
+                            Currently only Kubernetes-based Services are supported.
+                          properties:
+                            k8sService:
+                              description: K8sService selects service by name and
+                                namespace pair
+                              properties:
+                                namespace:
+                                  type: string
+                                serviceName:
+                                  type: string
+                              type: object
+                            k8sServiceSelector:
+                              description: K8sServiceSelector selects services by
+                                k8s labels and namespace
+                              properties:
+                                namespace:
+                                  type: string
+                                selector:
+                                  description: ServiceSelector is a label selector
+                                    for k8s services
+                                  properties:
+                                    matchExpressions:
+                                      description: matchExpressions is a list of label
+                                        selector requirements. The requirements are
+                                        ANDed.
+                                      items:
+                                        description: |-
+                                          A label selector requirement is a selector that contains values, a key, and an operator that
+                                          relates the key and values.
+                                        properties:
+                                          key:
+                                            description: key is the label key that
+                                              the selector applies to.
+                                            type: string
+                                          operator:
+                                            description: |-
+                                              operator represents a key's relationship to a set of values.
+                                              Valid operators are In, NotIn, Exists and DoesNotExist.
+                                            enum:
+                                            - In
+                                            - NotIn
+                                            - Exists
+                                            - DoesNotExist
+                                            type: string
+                                          values:
+                                            description: |-
+                                              values is an array of string values. If the operator is In or NotIn,
+                                              the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                              the values array must be empty. This array is replaced during a strategic
+                                              merge patch.
+                                            items:
+                                              type: string
+                                            type: array
+                                            x-kubernetes-list-type: atomic
+                                        required:
+                                        - key
+                                        - operator
+                                        type: object
+                                      type: array
+                                      x-kubernetes-list-type: atomic
+                                    matchLabels:
+                                      additionalProperties:
+                                        description: MatchLabelsValue represents the
+                                          value from the MatchLabels {key,value} pair.
+                                        maxLength: 63
+                                        pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
+                                        type: string
+                                      description: |-
+                                        matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                        map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                        operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                      type: object
+                                  type: object
+                                  x-kubernetes-map-type: atomic
+                              required:
+                              - selector
+                              type: object
+                          type: object
+                        type: array
+                    type: object
+                  type: array
+                enableDefaultDeny:
+                  description: |-
+                    EnableDefaultDeny determines whether this policy configures the
+                    subject endpoint(s) to have a default deny mode. If enabled,
+                    this causes all traffic not explicitly allowed by a network policy
+                    to be dropped.
+
+                    If not specified, the default is true for each traffic direction
+                    that has rules, and false otherwise. For example, if a policy
+                    only has Ingress or IngressDeny rules, then the default for
+                    ingress is true and egress is false.
+
+                    If multiple policies apply to an endpoint, that endpoint's default deny
+                    will be enabled if any policy requests it.
+
+                    This is useful for creating broad-based network policies that will not
+                    cause endpoints to enter default-deny mode.
+                  properties:
+                    egress:
+                      description: |-
+                        Whether or not the endpoint should have a default-deny rule applied
+                        to egress traffic.
+                      type: boolean
+                    ingress:
+                      description: |-
+                        Whether or not the endpoint should have a default-deny rule applied
+                        to ingress traffic.
+                      type: boolean
+                  type: object
+                endpointSelector:
+                  description: |-
+                    EndpointSelector selects all endpoints which should be subject to
+                    this rule. EndpointSelector and NodeSelector cannot be both empty and
+                    are mutually exclusive.
+                  properties:
+                    matchExpressions:
+                      description: matchExpressions is a list of label selector requirements.
+                        The requirements are ANDed.
+                      items:
+                        description: |-
+                          A label selector requirement is a selector that contains values, a key, and an operator that
+                          relates the key and values.
+                        properties:
+                          key:
+                            description: key is the label key that the selector applies
+                              to.
+                            type: string
+                          operator:
+                            description: |-
+                              operator represents a key's relationship to a set of values.
+                              Valid operators are In, NotIn, Exists and DoesNotExist.
+                            enum:
+                            - In
+                            - NotIn
+                            - Exists
+                            - DoesNotExist
+                            type: string
+                          values:
+                            description: |-
+                              values is an array of string values. If the operator is In or NotIn,
+                              the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                              the values array must be empty. This array is replaced during a strategic
+                              merge patch.
+                            items:
+                              type: string
+                            type: array
+                            x-kubernetes-list-type: atomic
+                        required:
+                        - key
+                        - operator
+                        type: object
+                      type: array
+                      x-kubernetes-list-type: atomic
+                    matchLabels:
+                      additionalProperties:
+                        description: MatchLabelsValue represents the value from the
+                          MatchLabels {key,value} pair.
+                        maxLength: 63
+                        pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
+                        type: string
+                      description: |-
+                        matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                        map is equivalent to an element of matchExpressions, whose key field is "key", the
+                        operator is "In", and the values array contains only "value". The requirements are ANDed.
+                      type: object
+                  type: object
+                  x-kubernetes-map-type: atomic
+                ingress:
+                  description: |-
+                    Ingress is a list of IngressRule which are enforced at ingress.
+                    If omitted or empty, this rule does not apply at ingress.
+                  items:
+                    description: |-
+                      IngressRule contains all rule types which can be applied at ingress,
+                      i.e. network traffic that originates outside of the endpoint and
+                      is entering the endpoint selected by the endpointSelector.
+
+                        - All members of this structure are optional. If omitted or empty, the
+                          member will have no effect on the rule.
+
+                        - If multiple members are set, all of them need to match in order for
+                          the rule to take effect.
+
+                        - FromEndpoints, FromCIDR, FromCIDRSet and FromEntities are mutually
+                          exclusive. Only one of these members may be present within an individual
+                          rule.
+                    properties:
+                      authentication:
+                        description: Authentication is the required authentication
+                          type for the allowed traffic, if any.
+                        properties:
+                          mode:
+                            description: Mode is the required authentication mode
+                              for the allowed traffic, if any.
+                            enum:
+                            - disabled
+                            - required
+                            - test-always-fail
+                            type: string
+                        required:
+                        - mode
+                        type: object
+                      fromCIDR:
+                        description: |-
+                          FromCIDR is a list of IP blocks which the endpoint subject to the
+                          rule is allowed to receive connections from. Only connections which
+                          do *not* originate from the cluster or from the local host are subject
+                          to CIDR rules. In order to allow in-cluster connectivity, use the
+                          FromEndpoints field.  This will match on the source IP address of
+                          incoming connections. Adding  a prefix into FromCIDR or into
+                          FromCIDRSet with no ExcludeCIDRs is  equivalent.  Overlaps are
+                          allowed between FromCIDR and FromCIDRSet.
+
+                          Example:
+                          Any endpoint with the label "app=my-legacy-pet" is allowed to receive
+                          connections from 10.3.9.1
+                        items:
+                          description: |-
+                            CIDR specifies a block of IP addresses.
+                            Example: 192.0.2.1/32
+                          format: cidr
+                          type: string
+                        type: array
+                      fromCIDRSet:
+                        description: |-
+                          FromCIDRSet is a list of IP blocks which the endpoint subject to the
+                          rule is allowed to receive connections from in addition to FromEndpoints,
+                          along with a list of subnets contained within their corresponding IP block
+                          from which traffic should not be allowed.
+                          This will match on the source IP address of incoming connections. Adding
+                          a prefix into FromCIDR or into FromCIDRSet with no ExcludeCIDRs is
+                          equivalent. Overlaps are allowed between FromCIDR and FromCIDRSet.
+
+                          Example:
+                          Any endpoint with the label "app=my-legacy-pet" is allowed to receive
+                          connections from 10.0.0.0/8 except from IPs in subnet 10.96.0.0/12.
+                        items:
+                          description: |-
+                            CIDRRule is a rule that specifies a CIDR prefix to/from which outside
+                            communication  is allowed, along with an optional list of subnets within that
+                            CIDR prefix to/from which outside communication is not allowed.
+                          oneOf:
+                          - properties:
+                              cidr: {}
+                            required:
+                            - cidr
+                          - properties:
+                              cidrGroupRef: {}
+                            required:
+                            - cidrGroupRef
+                          - properties:
+                              cidrGroupSelector: {}
+                            required:
+                            - cidrGroupSelector
+                          properties:
+                            cidr:
+                              description: CIDR is a CIDR prefix / IP Block.
+                              format: cidr
+                              type: string
+                            cidrGroupRef:
+                              description: |-
+                                CIDRGroupRef is a reference to a CiliumCIDRGroup object.
+                                A CiliumCIDRGroup contains a list of CIDRs that the endpoint, subject to
+                                the rule, can (Ingress/Egress) or cannot (IngressDeny/EgressDeny) receive
+                                connections from.
+                              maxLength: 253
+                              pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                              type: string
+                            cidrGroupSelector:
+                              description: |-
+                                CIDRGroupSelector selects CiliumCIDRGroups by their labels,
+                                rather than by name.
+                              properties:
+                                matchExpressions:
+                                  description: matchExpressions is a list of label
+                                    selector requirements. The requirements are ANDed.
+                                  items:
+                                    description: |-
+                                      A label selector requirement is a selector that contains values, a key, and an operator that
+                                      relates the key and values.
+                                    properties:
+                                      key:
+                                        description: key is the label key that the
+                                          selector applies to.
+                                        type: string
+                                      operator:
+                                        description: |-
+                                          operator represents a key's relationship to a set of values.
+                                          Valid operators are In, NotIn, Exists and DoesNotExist.
+                                        enum:
+                                        - In
+                                        - NotIn
+                                        - Exists
+                                        - DoesNotExist
+                                        type: string
+                                      values:
+                                        description: |-
+                                          values is an array of string values. If the operator is In or NotIn,
+                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                          the values array must be empty. This array is replaced during a strategic
+                                          merge patch.
+                                        items:
+                                          type: string
+                                        type: array
+                                        x-kubernetes-list-type: atomic
+                                    required:
+                                    - key
+                                    - operator
+                                    type: object
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                matchLabels:
+                                  additionalProperties:
+                                    description: MatchLabelsValue represents the value
+                                      from the MatchLabels {key,value} pair.
+                                    maxLength: 63
+                                    pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
+                                    type: string
+                                  description: |-
+                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                  type: object
+                              type: object
+                              x-kubernetes-map-type: atomic
+                            except:
+                              description: |-
+                                ExceptCIDRs is a list of IP blocks which the endpoint subject to the rule
+                                is not allowed to initiate connections to. These CIDR prefixes should be
+                                contained within Cidr, using ExceptCIDRs together with CIDRGroupRef is not
+                                supported yet.
+                                These exceptions are only applied to the Cidr in this CIDRRule, and do not
+                                apply to any other CIDR prefixes in any other CIDRRules.
+                              items:
+                                description: |-
+                                  CIDR specifies a block of IP addresses.
+                                  Example: 192.0.2.1/32
+                                format: cidr
+                                type: string
+                              type: array
+                          type: object
+                        type: array
+                      fromEndpoints:
+                        description: |-
+                          FromEndpoints is a list of endpoints identified by an
+                          EndpointSelector which are allowed to communicate with the endpoint
+                          subject to the rule.
+
+                          Example:
+                          Any endpoint with the label "role=backend" can be consumed by any
+                          endpoint carrying the label "role=frontend".
+
+                          Note that while an empty non-nil FromEndpoints does not select anything,
+                          nil FromEndpoints is implicitly treated as a wildcard selector if ToPorts
+                          are also specified.
+                          To select everything, use one EndpointSelector without any match requirements.
+                        items:
+                          description: EndpointSelector is a wrapper for k8s LabelSelector.
+                          properties:
+                            matchExpressions:
+                              description: matchExpressions is a list of label selector
+                                requirements. The requirements are ANDed.
+                              items:
+                                description: |-
+                                  A label selector requirement is a selector that contains values, a key, and an operator that
+                                  relates the key and values.
+                                properties:
+                                  key:
+                                    description: key is the label key that the selector
+                                      applies to.
+                                    type: string
+                                  operator:
+                                    description: |-
+                                      operator represents a key's relationship to a set of values.
+                                      Valid operators are In, NotIn, Exists and DoesNotExist.
+                                    enum:
+                                    - In
+                                    - NotIn
+                                    - Exists
+                                    - DoesNotExist
+                                    type: string
+                                  values:
+                                    description: |-
+                                      values is an array of string values. If the operator is In or NotIn,
+                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                      the values array must be empty. This array is replaced during a strategic
+                                      merge patch.
+                                    items:
+                                      type: string
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                required:
+                                - key
+                                - operator
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
+                            matchLabels:
+                              additionalProperties:
+                                description: MatchLabelsValue represents the value
+                                  from the MatchLabels {key,value} pair.
+                                maxLength: 63
+                                pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
+                                type: string
+                              description: |-
+                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                operator is "In", and the values array contains only "value". The requirements are ANDed.
+                              type: object
+                          type: object
+                          x-kubernetes-map-type: atomic
+                        type: array
+                      fromEntities:
+                        description: |-
+                          FromEntities is a list of special entities which the endpoint subject
+                          to the rule is allowed to receive connections from. Supported entities are
+                          `world`, `cluster`, `cluster-mesh`, `host`, `remote-node`, `kube-apiserver`, `ingress`, `init`,
+                          `health`, `unmanaged`, `none` and `all`.
+                        items:
+                          description: |-
+                            Entity specifies the class of receiver/sender endpoints that do not have
+                            individual identities.  Entities are used to describe "outside of cluster",
+                            "host", etc.
+                          enum:
+                          - all
+                          - world
+                          - cluster
+                          - cluster-mesh
+                          - host
+                          - init
+                          - ingress
+                          - unmanaged
+                          - remote-node
+                          - health
+                          - none
+                          - kube-apiserver
+                          type: string
+                        type: array
+                      fromGroups:
+                        description: |-
+                          FromGroups allows policies to reference CIDRs provided by external integrations.
+                          Currently, only AWS is supported, and the rule can select by multiple sub directives.
+                          FromGroups entries are functionally equivalent to FromCIDR, and have the same
+                          limitiations. They cannot select traffic originating from within the cluster.
+
+                          Example:
+                          fromGroups:
+                          - aws:
+                              securityGroupsIds:
+                              - 'sg-XXXXXXXXXXXXX'
+                        items:
+                          description: Groups allows referencing CIDRs that are resolved
+                            from an external integration.
+                          properties:
+                            aws:
+                              description: AWSGroup is an structure that can be used
+                                to whitelisting information from AWS integration
+                              properties:
+                                labels:
+                                  additionalProperties:
+                                    type: string
+                                  description: |-
+                                    Labels selects AWS ENIs by labels.
+                                    Multiple labels are AND-ed together.
+                                  type: object
+                                region:
+                                  description: 'Deprecated: Region is unused.'
+                                  type: string
+                                securityGroupsIds:
+                                  description: |-
+                                    SecurityGroupsIds selects VPC SecurityGroups by IDs.
+                                    If multiple IDs are specified, they are OR-ed together.
+
+                                    Note that this may be AND-ed with any Names specified. Specifying both
+                                    IDs and Names is not recommended.
+                                  items:
+                                    type: string
+                                  type: array
+                                securityGroupsNames:
+                                  description: |-
+                                    SecurityGroupsNames selects VPC SecurityGroups by name.
+                                    If multiple names are specified, they are OR-ed together.
+
+                                    Note that this may be AND-ed with any IDs specified. Specifying both
+                                    IDs and Names is not recommended.
+                                  items:
+                                    type: string
+                                  type: array
+                              type: object
+                          type: object
+                        type: array
+                      fromNodes:
+                        description: |-
+                          FromNodes is a list of nodes identified by an
+                          EndpointSelector which are allowed to communicate with the endpoint
+                          subject to the rule.
+                        items:
+                          description: EndpointSelector is a wrapper for k8s LabelSelector.
+                          properties:
+                            matchExpressions:
+                              description: matchExpressions is a list of label selector
+                                requirements. The requirements are ANDed.
+                              items:
+                                description: |-
+                                  A label selector requirement is a selector that contains values, a key, and an operator that
+                                  relates the key and values.
+                                properties:
+                                  key:
+                                    description: key is the label key that the selector
+                                      applies to.
+                                    type: string
+                                  operator:
+                                    description: |-
+                                      operator represents a key's relationship to a set of values.
+                                      Valid operators are In, NotIn, Exists and DoesNotExist.
+                                    enum:
+                                    - In
+                                    - NotIn
+                                    - Exists
+                                    - DoesNotExist
+                                    type: string
+                                  values:
+                                    description: |-
+                                      values is an array of string values. If the operator is In or NotIn,
+                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                      the values array must be empty. This array is replaced during a strategic
+                                      merge patch.
+                                    items:
+                                      type: string
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                required:
+                                - key
+                                - operator
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
+                            matchLabels:
+                              additionalProperties:
+                                description: MatchLabelsValue represents the value
+                                  from the MatchLabels {key,value} pair.
+                                maxLength: 63
+                                pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
+                                type: string
+                              description: |-
+                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                operator is "In", and the values array contains only "value". The requirements are ANDed.
+                              type: object
+                          type: object
+                          x-kubernetes-map-type: atomic
+                        type: array
+                      fromRequires:
+                        description: Deprecated.
+                        items:
+                          type: string
+                        maxItems: 0
+                        type: array
+                      icmps:
+                        description: |-
+                          ICMPs is a list of ICMP rule identified by type number
+                          which the endpoint subject to the rule is allowed to
+                          receive connections on.
+
+                          Example:
+                          Any endpoint with the label "app=httpd" can only accept incoming
+                          type 8 ICMP connections.
+                        items:
+                          description: ICMPRule is a list of ICMP fields.
+                          properties:
+                            fields:
+                              description: Fields is a list of ICMP fields.
+                              items:
+                                description: ICMPField is a ICMP field.
+                                properties:
+                                  family:
+                                    default: IPv4
+                                    description: |-
+                                      Family is a IP address version.
+                                      Currently, we support `IPv4` and `IPv6`.
+                                      `IPv4` is set as default.
+                                    enum:
+                                    - IPv4
+                                    - IPv6
+                                    type: string
+                                  type:
+                                    anyOf:
+                                    - type: integer
+                                    - type: string
+                                    description: "Type is a ICMP-type.\nIt should
+                                      be an 8bit code (0-255), or it's CamelCase name
+                                      (for example, \"EchoReply\").\nAllowed ICMP
+                                      types are:\n    Ipv4: EchoReply | DestinationUnreachable
+                                      | Redirect | Echo | EchoRequest |\n\t\t     RouterAdvertisement
+                                      | RouterSelection | TimeExceeded | ParameterProblem
+                                      |\n\t\t\t Timestamp | TimestampReply | Photuris
+                                      | ExtendedEcho Request | ExtendedEcho Reply\n
+                                      \   Ipv6: DestinationUnreachable | PacketTooBig
+                                      | TimeExceeded | ParameterProblem |\n\t\t\t
+                                      EchoRequest | EchoReply | MulticastListenerQuery|
+                                      MulticastListenerReport |\n\t\t\t MulticastListenerDone
+                                      | RouterSolicitation | RouterAdvertisement |
+                                      NeighborSolicitation |\n\t\t\t NeighborAdvertisement
+                                      | RedirectMessage | RouterRenumbering | ICMPNodeInformationQuery
+                                      |\n\t\t\t ICMPNodeInformationResponse | InverseNeighborDiscoverySolicitation
+                                      | InverseNeighborDiscoveryAdvertisement |\n\t\t\t
+                                      HomeAgentAddressDiscoveryRequest | HomeAgentAddressDiscoveryReply
+                                      | MobilePrefixSolicitation |\n\t\t\t MobilePrefixAdvertisement
+                                      | DuplicateAddressRequestCodeSuffix | DuplicateAddressConfirmationCodeSuffix
+                                      |\n\t\t\t ExtendedEchoRequest | ExtendedEchoReply"
+                                    pattern: ^([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]|EchoReply|DestinationUnreachable|Redirect|Echo|RouterAdvertisement|RouterSelection|TimeExceeded|ParameterProblem|Timestamp|TimestampReply|Photuris|ExtendedEchoRequest|ExtendedEcho
+                                      Reply|PacketTooBig|ParameterProblem|EchoRequest|MulticastListenerQuery|MulticastListenerReport|MulticastListenerDone|RouterSolicitation|RouterAdvertisement|NeighborSolicitation|NeighborAdvertisement|RedirectMessage|RouterRenumbering|ICMPNodeInformationQuery|ICMPNodeInformationResponse|InverseNeighborDiscoverySolicitation|InverseNeighborDiscoveryAdvertisement|HomeAgentAddressDiscoveryRequest|HomeAgentAddressDiscoveryReply|MobilePrefixSolicitation|MobilePrefixAdvertisement|DuplicateAddressRequestCodeSuffix|DuplicateAddressConfirmationCodeSuffix)$
+                                    x-kubernetes-int-or-string: true
+                                required:
+                                - type
+                                type: object
+                              maxItems: 40
+                              type: array
+                          type: object
+                        type: array
+                      toPorts:
+                        description: |-
+                          ToPorts is a list of destination ports identified by port number and
+                          protocol which the endpoint subject to the rule is allowed to
+                          receive connections on.
+
+                          Example:
+                          Any endpoint with the label "app=httpd" can only accept incoming
+                          connections on port 80/tcp.
+                        items:
+                          description: |-
+                            PortRule is a list of ports/protocol combinations with optional Layer 7
+                            rules which must be met.
+                          properties:
+                            listener:
+                              description: |-
+                                listener specifies the name of a custom Envoy listener to which this traffic should be
+                                redirected to.
+                              properties:
+                                envoyConfig:
+                                  description: |-
+                                    EnvoyConfig is a reference to the CEC or CCEC resource in which
+                                    the listener is defined.
+                                  properties:
+                                    kind:
+                                      description: |-
+                                        Kind is the resource type being referred to. Defaults to CiliumEnvoyConfig or
+                                        CiliumClusterwideEnvoyConfig for CiliumNetworkPolicy and CiliumClusterwideNetworkPolicy,
+                                        respectively. The only case this is currently explicitly needed is when referring to a
+                                        CiliumClusterwideEnvoyConfig from CiliumNetworkPolicy, as using a namespaced listener
+                                        from a cluster scoped policy is not allowed.
+                                      enum:
+                                      - CiliumEnvoyConfig
+                                      - CiliumClusterwideEnvoyConfig
+                                      type: string
+                                    name:
+                                      description: |-
+                                        Name is the resource name of the CiliumEnvoyConfig or CiliumClusterwideEnvoyConfig where
+                                        the listener is defined in.
+                                      minLength: 1
+                                      type: string
+                                  required:
+                                  - name
+                                  type: object
+                                name:
+                                  description: Name is the name of the listener.
+                                  minLength: 1
+                                  type: string
+                                priority:
+                                  description: |-
+                                    Priority for this Listener that is used when multiple rules would apply different
+                                    listeners to a policy map entry. Behavior of this is implementation dependent.
+                                  maximum: 100
+                                  minimum: 1
+                                  type: integer
+                              required:
+                              - envoyConfig
+                              - name
+                              type: object
+                            originatingTLS:
+                              description: |-
+                                OriginatingTLS is the TLS context for the connections originated by
+                                the L7 proxy.  For egress policy this specifies the client-side TLS
+                                parameters for the upstream connection originating from the L7 proxy
+                                to the remote destination. For ingress policy this specifies the
+                                client-side TLS parameters for the connection from the L7 proxy to
+                                the local endpoint.
+                              properties:
+                                certificate:
+                                  description: |-
+                                    Certificate is the file name or k8s secret item name for the certificate
+                                    chain. If omitted, 'tls.crt' is assumed, if it exists. If given, the
+                                    item must exist.
+                                  type: string
+                                privateKey:
+                                  description: |-
+                                    PrivateKey is the file name or k8s secret item name for the private key
+                                    matching the certificate chain. If omitted, 'tls.key' is assumed, if it
+                                    exists. If given, the item must exist.
+                                  type: string
+                                secret:
+                                  description: |-
+                                    Secret is the secret that contains the certificates and private key for
+                                    the TLS context.
+                                    By default, Cilium will search in this secret for the following items:
+                                     - 'ca.crt'  - Which represents the trusted CA to verify remote source.
+                                     - 'tls.crt' - Which represents the public key certificate.
+                                     - 'tls.key' - Which represents the private key matching the public key
+                                                   certificate.
+                                  properties:
+                                    name:
+                                      description: Name is the name of the secret.
+                                      type: string
+                                    namespace:
+                                      description: |-
+                                        Namespace is the namespace in which the secret exists. Context of use
+                                        determines the default value if left out (e.g., "default").
+                                      type: string
+                                  required:
+                                  - name
+                                  type: object
+                                trustedCA:
+                                  description: |-
+                                    TrustedCA is the file name or k8s secret item name for the trusted CA.
+                                    If omitted, 'ca.crt' is assumed, if it exists. If given, the item must
+                                    exist.
+                                  type: string
+                              required:
+                              - secret
+                              type: object
+                            ports:
+                              description: Ports is a list of L4 port/protocol
+                              items:
+                                description: PortProtocol specifies an L4 port with
+                                  an optional transport protocol
+                                properties:
+                                  endPort:
+                                    description: EndPort can only be an L4 port number.
+                                    format: int32
+                                    maximum: 65535
+                                    minimum: 0
+                                    type: integer
+                                  port:
+                                    description: |-
+                                      Port can be an L4 port number, or a name in the form of "http"
+                                      or "http-8080".
+                                    pattern: ^(6553[0-5]|655[0-2][0-9]|65[0-4][0-9]{2}|6[0-4][0-9]{3}|[1-5][0-9]{4}|[0-9]{1,4})|([a-zA-Z0-9]-?)*[a-zA-Z](-?[a-zA-Z0-9])*$
+                                    type: string
+                                  protocol:
+                                    description: |-
+                                      Protocol is the L4 protocol. If "ANY", omitted or empty, any protocols
+                                      with transport ports (TCP, UDP, SCTP) match.
+
+                                      Accepted values: "TCP", "UDP", "SCTP", "VRRP", "IGMP", "GRE", "IPIP",
+                                      "IPV6", "ESP", "AH", "ANY"
+
+                                      Tunnel/encapsulation protocols (GRE, IPIP, IPV6, ESP, AH) and other
+                                      extended IP protocols (VRRP, IGMP) require the --enable-extended-ip-protocols
+                                      flag to be set. These protocols do not use transport-layer ports.
+
+                                      Matching on ICMP is not supported.
+
+                                      Named port specified for a container may narrow this down, but may not
+                                      contradict this.
+                                    enum:
+                                    - TCP
+                                    - UDP
+                                    - SCTP
+                                    - VRRP
+                                    - IGMP
+                                    - GRE
+                                    - IPIP
+                                    - IPV6
+                                    - ESP
+                                    - AH
+                                    - ANY
+                                    type: string
+                                type: object
+                              maxItems: 40
+                              type: array
+                            rules:
+                              description: |-
+                                Rules is a list of additional port level rules which must be met in
+                                order for the PortRule to allow the traffic. If omitted or empty,
+                                no layer 7 rules are enforced.
+                              oneOf:
+                              - properties:
+                                  http: {}
+                                required:
+                                - http
+                              - properties:
+                                  dns: {}
+                                required:
+                                - dns
+                              properties:
+                                dns:
+                                  description: DNS-specific rules.
+                                  items:
+                                    description: PortRuleDNS is a list of allowed
+                                      DNS lookups.
+                                    oneOf:
+                                    - properties:
+                                        matchName: {}
+                                      required:
+                                      - matchName
+                                    - properties:
+                                        matchPattern: {}
+                                      required:
+                                      - matchPattern
+                                    properties:
+                                      matchName:
+                                        description: |-
+                                          MatchName matches literal DNS names. A trailing "." is automatically added
+                                          when missing.
+                                        maxLength: 255
+                                        pattern: ^([-a-zA-Z0-9_]+[.]?)+$
+                                        type: string
+                                      matchPattern:
+                                        description: |-
+                                          MatchPattern allows using wildcards to match DNS names. All wildcards are
+                                          case insensitive. The wildcards are:
+                                          - "*" matches 0 or more DNS valid characters, and may occur anywhere in
+                                          the pattern. As a special case a "*" as the leftmost character, without a
+                                          following "." matches all subdomains as well as the name to the right.
+                                          A trailing "." is automatically added when missing.
+                                          - "**." is a special prefix which matches all multilevel subdomains in the prefix.
+
+                                          Examples:
+                                          1. `*.cilium.io` matches subdomains of cilium at that level
+                                            www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
+                                          2. `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
+                                            except those containing "." separator, subcilium.io and sub-cilium.io match,
+                                            www.cilium.io and blog.cilium.io does not
+                                          3. `sub*.cilium.io` matches subdomains of cilium where the subdomain component
+                                            begins with "sub". sub.cilium.io and subdomain.cilium.io match while www.cilium.io,
+                                            blog.cilium.io, cilium.io and google.com do not
+                                          4. `**.cilium.io` matches all multilevel subdomains of cilium.io.
+                                            "app.cilium.io" and "test.app.cilium.io" match but not "cilium.io"
+                                        maxLength: 255
+                                        pattern: ^([-a-zA-Z0-9_*]+[.]?)+$
+                                        type: string
+                                    type: object
+                                  type: array
+                                http:
+                                  description: HTTP specific rules.
+                                  items:
+                                    description: |-
+                                      PortRuleHTTP is a list of HTTP protocol constraints. All fields are
+                                      optional, if all fields are empty or missing, the rule does not have any
+                                      effect.
+
+                                      All fields of this type are extended POSIX regex as defined by IEEE Std
+                                      1003.1, (i.e this follows the egrep/unix syntax, not the perl syntax)
+                                      matched against the path of an incoming request. Currently it can contain
+                                      characters disallowed from the conventional "path" part of a URL as defined
+                                      by RFC 3986.
+                                    properties:
+                                      headerMatches:
+                                        description: |-
+                                          HeaderMatches is a list of HTTP headers which must be
+                                          present and match against the given values. Mismatch field can be used
+                                          to specify what to do when there is no match.
+                                        items:
+                                          description: |-
+                                            HeaderMatch extends the HeaderValue for matching requirement of a
+                                            named header field against an immediate string or a secret value.
+                                            If none of the optional fields is present, then the
+                                            header value is not matched, only presence of the header is enough.
+                                          properties:
+                                            mismatch:
+                                              description: |-
+                                                Mismatch identifies what to do in case there is no match. The default is
+                                                to drop the request. Otherwise the overall rule is still considered as
+                                                matching, but the mismatches are logged in the access log.
+                                              enum:
+                                              - LOG
+                                              - ADD
+                                              - DELETE
+                                              - REPLACE
+                                              type: string
+                                            name:
+                                              description: Name identifies the header.
+                                              minLength: 1
+                                              type: string
+                                            secret:
+                                              description: |-
+                                                Secret refers to a secret that contains the value to be matched against.
+                                                The secret must only contain one entry. If the referred secret does not
+                                                exist, and there is no "Value" specified, the match will fail.
+                                              properties:
+                                                name:
+                                                  description: Name is the name of
+                                                    the secret.
+                                                  type: string
+                                                namespace:
+                                                  description: |-
+                                                    Namespace is the namespace in which the secret exists. Context of use
+                                                    determines the default value if left out (e.g., "default").
+                                                  type: string
+                                              required:
+                                              - name
+                                              type: object
+                                            value:
+                                              description: |-
+                                                Value matches the exact value of the header. Can be specified either
+                                                alone or together with "Secret"; will be used as the header value if the
+                                                secret can not be found in the latter case.
+                                              type: string
+                                          required:
+                                          - name
+                                          type: object
+                                        type: array
+                                      headers:
+                                        description: |-
+                                          Headers is a list of HTTP headers which must be present in the
+                                          request. If omitted or empty, requests are allowed regardless of
+                                          headers present.
+                                        items:
+                                          type: string
+                                        type: array
+                                      host:
+                                        description: |-
+                                          Host is an extended POSIX regex matched against the host header of a
+                                          request. Examples:
+
+                                          - foo.bar.com will match the host fooXbar.com or foo-bar.com
+                                          - foo\.bar\.com will only match the host foo.bar.com
+
+                                          If omitted or empty, the value of the host header is ignored.
+                                        format: idn-hostname
+                                        type: string
+                                      method:
+                                        description: |-
+                                          Method is an extended POSIX regex matched against the method of a
+                                          request, e.g. "GET", "POST", "PUT", "PATCH", "DELETE", ...
+
+                                          If omitted or empty, all methods are allowed.
+                                        type: string
+                                      path:
+                                        description: |-
+                                          Path is an extended POSIX regex matched against the path of a
+                                          request. Currently it can contain characters disallowed from the
+                                          conventional "path" part of a URL as defined by RFC 3986.
+
+                                          If omitted or empty, all paths are all allowed.
+                                        type: string
+                                    type: object
+                                  type: array
+                              type: object
+                            serverNames:
+                              description: |-
+                                ServerNames is a list of allowed TLS SNI values. If not empty, then
+                                TLS must be present and one of the provided SNIs must be indicated in the
+                                TLS handshake.
+                              items:
+                                description: |-
+                                  ServerName allows using '*' wildcard specifier for matching server names with
+                                  the below semantics.
+
+                                  - `*` matches 0 or more DNS valid characters, and may occur anywhere in the pattern.
+                                  - `**.` is a special prefix which matches all multilevel subdomains in the prefix.
+
+                                  As a special case the name "*" matches all valid DNS names.
+
+                                  Examples:
+                                   1. `*.cilium.io` matches subdomains of cilium at that level
+                                      www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
+                                   2. `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
+                                      except those containing "." separator, subcilium.io and sub-cilium.io match,
+                                      www.cilium.io and blog.cilium.io does not
+                                   3. `sub*.cilium.io` matches subdomains of cilium where the subdomain component
+                                      begins with "sub". sub.cilium.io and subdomain.cilium.io match while www.cilium.io,
+                                      blog.cilium.io, cilium.io and google.com do not
+                                   4. `**.cilium.io` matches all multilevel subdomains of cilium.io.
+                                      "app.cilium.io" and "test.app.cilium.io" match but not "cilium.io"
+                                maxLength: 255
+                                pattern: ^([-a-zA-Z0-9_*]+[.]?)+$
+                                type: string
+                              minItems: 1
+                              type: array
+                              x-kubernetes-list-type: set
+                            terminatingTLS:
+                              description: |-
+                                TerminatingTLS is the TLS context for the connection terminated by
+                                the L7 proxy.  For egress policy this specifies the server-side TLS
+                                parameters to be applied on the connections originated from the local
+                                endpoint and terminated by the L7 proxy. For ingress policy this specifies
+                                the server-side TLS parameters to be applied on the connections
+                                originated from a remote source and terminated by the L7 proxy.
+                              properties:
+                                certificate:
+                                  description: |-
+                                    Certificate is the file name or k8s secret item name for the certificate
+                                    chain. If omitted, 'tls.crt' is assumed, if it exists. If given, the
+                                    item must exist.
+                                  type: string
+                                privateKey:
+                                  description: |-
+                                    PrivateKey is the file name or k8s secret item name for the private key
+                                    matching the certificate chain. If omitted, 'tls.key' is assumed, if it
+                                    exists. If given, the item must exist.
+                                  type: string
+                                secret:
+                                  description: |-
+                                    Secret is the secret that contains the certificates and private key for
+                                    the TLS context.
+                                    By default, Cilium will search in this secret for the following items:
+                                     - 'ca.crt'  - Which represents the trusted CA to verify remote source.
+                                     - 'tls.crt' - Which represents the public key certificate.
+                                     - 'tls.key' - Which represents the private key matching the public key
+                                                   certificate.
+                                  properties:
+                                    name:
+                                      description: Name is the name of the secret.
+                                      type: string
+                                    namespace:
+                                      description: |-
+                                        Namespace is the namespace in which the secret exists. Context of use
+                                        determines the default value if left out (e.g., "default").
+                                      type: string
+                                  required:
+                                  - name
+                                  type: object
+                                trustedCA:
+                                  description: |-
+                                    TrustedCA is the file name or k8s secret item name for the trusted CA.
+                                    If omitted, 'ca.crt' is assumed, if it exists. If given, the item must
+                                    exist.
+                                  type: string
+                              required:
+                              - secret
+                              type: object
+                          type: object
+                        type: array
+                    type: object
+                  type: array
+                ingressDeny:
+                  description: |-
+                    IngressDeny is a list of IngressDenyRule which are enforced at ingress.
+                    Any rule inserted here will be denied regardless of the allowed ingress
+                    rules in the 'ingress' field.
+                    If omitted or empty, this rule does not apply at ingress.
+                  items:
+                    description: |-
+                      IngressDenyRule contains all rule types which can be applied at ingress,
+                      i.e. network traffic that originates outside of the endpoint and
+                      is entering the endpoint selected by the endpointSelector.
+
+                        - All members of this structure are optional. If omitted or empty, the
+                          member will have no effect on the rule.
+
+                        - If multiple members are set, all of them need to match in order for
+                          the rule to take effect.
+
+                        - FromEndpoints, FromCIDR, FromCIDRSet, FromGroups and FromEntities are mutually
+                          exclusive. Only one of these members may be present within an individual
+                          rule.
+                    properties:
+                      fromCIDR:
+                        description: |-
+                          FromCIDR is a list of IP blocks which the endpoint subject to the
+                          rule is allowed to receive connections from. Only connections which
+                          do *not* originate from the cluster or from the local host are subject
+                          to CIDR rules. In order to allow in-cluster connectivity, use the
+                          FromEndpoints field.  This will match on the source IP address of
+                          incoming connections. Adding  a prefix into FromCIDR or into
+                          FromCIDRSet with no ExcludeCIDRs is  equivalent.  Overlaps are
+                          allowed between FromCIDR and FromCIDRSet.
+
+                          Example:
+                          Any endpoint with the label "app=my-legacy-pet" is allowed to receive
+                          connections from 10.3.9.1
+                        items:
+                          description: |-
+                            CIDR specifies a block of IP addresses.
+                            Example: 192.0.2.1/32
+                          format: cidr
+                          type: string
+                        type: array
+                      fromCIDRSet:
+                        description: |-
+                          FromCIDRSet is a list of IP blocks which the endpoint subject to the
+                          rule is allowed to receive connections from in addition to FromEndpoints,
+                          along with a list of subnets contained within their corresponding IP block
+                          from which traffic should not be allowed.
+                          This will match on the source IP address of incoming connections. Adding
+                          a prefix into FromCIDR or into FromCIDRSet with no ExcludeCIDRs is
+                          equivalent. Overlaps are allowed between FromCIDR and FromCIDRSet.
+
+                          Example:
+                          Any endpoint with the label "app=my-legacy-pet" is allowed to receive
+                          connections from 10.0.0.0/8 except from IPs in subnet 10.96.0.0/12.
+                        items:
+                          description: |-
+                            CIDRRule is a rule that specifies a CIDR prefix to/from which outside
+                            communication  is allowed, along with an optional list of subnets within that
+                            CIDR prefix to/from which outside communication is not allowed.
+                          oneOf:
+                          - properties:
+                              cidr: {}
+                            required:
+                            - cidr
+                          - properties:
+                              cidrGroupRef: {}
+                            required:
+                            - cidrGroupRef
+                          - properties:
+                              cidrGroupSelector: {}
+                            required:
+                            - cidrGroupSelector
+                          properties:
+                            cidr:
+                              description: CIDR is a CIDR prefix / IP Block.
+                              format: cidr
+                              type: string
+                            cidrGroupRef:
+                              description: |-
+                                CIDRGroupRef is a reference to a CiliumCIDRGroup object.
+                                A CiliumCIDRGroup contains a list of CIDRs that the endpoint, subject to
+                                the rule, can (Ingress/Egress) or cannot (IngressDeny/EgressDeny) receive
+                                connections from.
+                              maxLength: 253
+                              pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                              type: string
+                            cidrGroupSelector:
+                              description: |-
+                                CIDRGroupSelector selects CiliumCIDRGroups by their labels,
+                                rather than by name.
+                              properties:
+                                matchExpressions:
+                                  description: matchExpressions is a list of label
+                                    selector requirements. The requirements are ANDed.
+                                  items:
+                                    description: |-
+                                      A label selector requirement is a selector that contains values, a key, and an operator that
+                                      relates the key and values.
+                                    properties:
+                                      key:
+                                        description: key is the label key that the
+                                          selector applies to.
+                                        type: string
+                                      operator:
+                                        description: |-
+                                          operator represents a key's relationship to a set of values.
+                                          Valid operators are In, NotIn, Exists and DoesNotExist.
+                                        enum:
+                                        - In
+                                        - NotIn
+                                        - Exists
+                                        - DoesNotExist
+                                        type: string
+                                      values:
+                                        description: |-
+                                          values is an array of string values. If the operator is In or NotIn,
+                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                          the values array must be empty. This array is replaced during a strategic
+                                          merge patch.
+                                        items:
+                                          type: string
+                                        type: array
+                                        x-kubernetes-list-type: atomic
+                                    required:
+                                    - key
+                                    - operator
+                                    type: object
+                                  type: array
+                                  x-kubernetes-list-type: atomic
+                                matchLabels:
+                                  additionalProperties:
+                                    description: MatchLabelsValue represents the value
+                                      from the MatchLabels {key,value} pair.
+                                    maxLength: 63
+                                    pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
+                                    type: string
+                                  description: |-
+                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
+                                  type: object
+                              type: object
+                              x-kubernetes-map-type: atomic
+                            except:
+                              description: |-
+                                ExceptCIDRs is a list of IP blocks which the endpoint subject to the rule
+                                is not allowed to initiate connections to. These CIDR prefixes should be
+                                contained within Cidr, using ExceptCIDRs together with CIDRGroupRef is not
+                                supported yet.
+                                These exceptions are only applied to the Cidr in this CIDRRule, and do not
+                                apply to any other CIDR prefixes in any other CIDRRules.
+                              items:
+                                description: |-
+                                  CIDR specifies a block of IP addresses.
+                                  Example: 192.0.2.1/32
+                                format: cidr
+                                type: string
+                              type: array
+                          type: object
+                        type: array
+                      fromEndpoints:
+                        description: |-
+                          FromEndpoints is a list of endpoints identified by an
+                          EndpointSelector which are allowed to communicate with the endpoint
+                          subject to the rule.
+
+                          Example:
+                          Any endpoint with the label "role=backend" can be consumed by any
+                          endpoint carrying the label "role=frontend".
+
+                          Note that while an empty non-nil FromEndpoints does not select anything,
+                          nil FromEndpoints is implicitly treated as a wildcard selector if ToPorts
+                          are also specified.
+                          To select everything, use one EndpointSelector without any match requirements.
+                        items:
+                          description: EndpointSelector is a wrapper for k8s LabelSelector.
+                          properties:
+                            matchExpressions:
+                              description: matchExpressions is a list of label selector
+                                requirements. The requirements are ANDed.
+                              items:
+                                description: |-
+                                  A label selector requirement is a selector that contains values, a key, and an operator that
+                                  relates the key and values.
+                                properties:
+                                  key:
+                                    description: key is the label key that the selector
+                                      applies to.
+                                    type: string
+                                  operator:
+                                    description: |-
+                                      operator represents a key's relationship to a set of values.
+                                      Valid operators are In, NotIn, Exists and DoesNotExist.
+                                    enum:
+                                    - In
+                                    - NotIn
+                                    - Exists
+                                    - DoesNotExist
+                                    type: string
+                                  values:
+                                    description: |-
+                                      values is an array of string values. If the operator is In or NotIn,
+                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                      the values array must be empty. This array is replaced during a strategic
+                                      merge patch.
+                                    items:
+                                      type: string
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                required:
+                                - key
+                                - operator
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
+                            matchLabels:
+                              additionalProperties:
+                                description: MatchLabelsValue represents the value
+                                  from the MatchLabels {key,value} pair.
+                                maxLength: 63
+                                pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
+                                type: string
+                              description: |-
+                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                operator is "In", and the values array contains only "value". The requirements are ANDed.
+                              type: object
+                          type: object
+                          x-kubernetes-map-type: atomic
+                        type: array
+                      fromEntities:
+                        description: |-
+                          FromEntities is a list of special entities which the endpoint subject
+                          to the rule is allowed to receive connections from. Supported entities are
+                          `world`, `cluster`, `cluster-mesh`, `host`, `remote-node`, `kube-apiserver`, `ingress`, `init`,
+                          `health`, `unmanaged`, `none` and `all`.
+                        items:
+                          description: |-
+                            Entity specifies the class of receiver/sender endpoints that do not have
+                            individual identities.  Entities are used to describe "outside of cluster",
+                            "host", etc.
+                          enum:
+                          - all
+                          - world
+                          - cluster
+                          - cluster-mesh
+                          - host
+                          - init
+                          - ingress
+                          - unmanaged
+                          - remote-node
+                          - health
+                          - none
+                          - kube-apiserver
+                          type: string
+                        type: array
+                      fromGroups:
+                        description: |-
+                          FromGroups allows policies to reference CIDRs provided by external integrations.
+                          Currently, only AWS is supported, and the rule can select by multiple sub directives.
+                          FromGroups entries are functionally equivalent to FromCIDR, and have the same
+                          limitiations. They cannot select traffic originating from within the cluster.
+
+                          Example:
+                          fromGroups:
+                          - aws:
+                              securityGroupsIds:
+                              - 'sg-XXXXXXXXXXXXX'
+                        items:
+                          description: Groups allows referencing CIDRs that are resolved
+                            from an external integration.
+                          properties:
+                            aws:
+                              description: AWSGroup is an structure that can be used
+                                to whitelisting information from AWS integration
+                              properties:
+                                labels:
+                                  additionalProperties:
+                                    type: string
+                                  description: |-
+                                    Labels selects AWS ENIs by labels.
+                                    Multiple labels are AND-ed together.
+                                  type: object
+                                region:
+                                  description: 'Deprecated: Region is unused.'
+                                  type: string
+                                securityGroupsIds:
+                                  description: |-
+                                    SecurityGroupsIds selects VPC SecurityGroups by IDs.
+                                    If multiple IDs are specified, they are OR-ed together.
+
+                                    Note that this may be AND-ed with any Names specified. Specifying both
+                                    IDs and Names is not recommended.
+                                  items:
+                                    type: string
+                                  type: array
+                                securityGroupsNames:
+                                  description: |-
+                                    SecurityGroupsNames selects VPC SecurityGroups by name.
+                                    If multiple names are specified, they are OR-ed together.
+
+                                    Note that this may be AND-ed with any IDs specified. Specifying both
+                                    IDs and Names is not recommended.
+                                  items:
+                                    type: string
+                                  type: array
+                              type: object
+                          type: object
+                        type: array
+                      fromNodes:
+                        description: |-
+                          FromNodes is a list of nodes identified by an
+                          EndpointSelector which are allowed to communicate with the endpoint
+                          subject to the rule.
+                        items:
+                          description: EndpointSelector is a wrapper for k8s LabelSelector.
+                          properties:
+                            matchExpressions:
+                              description: matchExpressions is a list of label selector
+                                requirements. The requirements are ANDed.
+                              items:
+                                description: |-
+                                  A label selector requirement is a selector that contains values, a key, and an operator that
+                                  relates the key and values.
+                                properties:
+                                  key:
+                                    description: key is the label key that the selector
+                                      applies to.
+                                    type: string
+                                  operator:
+                                    description: |-
+                                      operator represents a key's relationship to a set of values.
+                                      Valid operators are In, NotIn, Exists and DoesNotExist.
+                                    enum:
+                                    - In
+                                    - NotIn
+                                    - Exists
+                                    - DoesNotExist
+                                    type: string
+                                  values:
+                                    description: |-
+                                      values is an array of string values. If the operator is In or NotIn,
+                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                                      the values array must be empty. This array is replaced during a strategic
+                                      merge patch.
+                                    items:
+                                      type: string
+                                    type: array
+                                    x-kubernetes-list-type: atomic
+                                required:
+                                - key
+                                - operator
+                                type: object
+                              type: array
+                              x-kubernetes-list-type: atomic
+                            matchLabels:
+                              additionalProperties:
+                                description: MatchLabelsValue represents the value
+                                  from the MatchLabels {key,value} pair.
+                                maxLength: 63
+                                pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
+                                type: string
+                              description: |-
+                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                                map is equivalent to an element of matchExpressions, whose key field is "key", the
+                                operator is "In", and the values array contains only "value". The requirements are ANDed.
+                              type: object
+                          type: object
+                          x-kubernetes-map-type: atomic
+                        type: array
+                      fromRequires:
+                        description: Deprecated.
+                        items:
+                          type: string
+                        maxItems: 0
+                        type: array
+                      icmps:
+                        description: |-
+                          ICMPs is a list of ICMP rule identified by type number
+                          which the endpoint subject to the rule is not allowed to
+                          receive connections on.
+
+                          Example:
+                          Any endpoint with the label "app=httpd" can not accept incoming
+                          type 8 ICMP connections.
+                        items:
+                          description: ICMPRule is a list of ICMP fields.
+                          properties:
+                            fields:
+                              description: Fields is a list of ICMP fields.
+                              items:
+                                description: ICMPField is a ICMP field.
+                                properties:
+                                  family:
+                                    default: IPv4
+                                    description: |-
+                                      Family is a IP address version.
+                                      Currently, we support `IPv4` and `IPv6`.
+                                      `IPv4` is set as default.
+                                    enum:
+                                    - IPv4
+                                    - IPv6
+                                    type: string
+                                  type:
+                                    anyOf:
+                                    - type: integer
+                                    - type: string
+                                    description: "Type is a ICMP-type.\nIt should
+                                      be an 8bit code (0-255), or it's CamelCase name
+                                      (for example, \"EchoReply\").\nAllowed ICMP
+                                      types are:\n    Ipv4: EchoReply | DestinationUnreachable
+                                      | Redirect | Echo | EchoRequest |\n\t\t     RouterAdvertisement
+                                      | RouterSelection | TimeExceeded | ParameterProblem
+                                      |\n\t\t\t Timestamp | TimestampReply | Photuris
+                                      | ExtendedEcho Request | ExtendedEcho Reply\n
+                                      \   Ipv6: DestinationUnreachable | PacketTooBig
+                                      | TimeExceeded | ParameterProblem |\n\t\t\t
+                                      EchoRequest | EchoReply | MulticastListenerQuery|
+                                      MulticastListenerReport |\n\t\t\t MulticastListenerDone
+                                      | RouterSolicitation | RouterAdvertisement |
+                                      NeighborSolicitation |\n\t\t\t NeighborAdvertisement
+                                      | RedirectMessage | RouterRenumbering | ICMPNodeInformationQuery
+                                      |\n\t\t\t ICMPNodeInformationResponse | InverseNeighborDiscoverySolicitation
+                                      | InverseNeighborDiscoveryAdvertisement |\n\t\t\t
+                                      HomeAgentAddressDiscoveryRequest | HomeAgentAddressDiscoveryReply
+                                      | MobilePrefixSolicitation |\n\t\t\t MobilePrefixAdvertisement
+                                      | DuplicateAddressRequestCodeSuffix | DuplicateAddressConfirmationCodeSuffix
+                                      |\n\t\t\t ExtendedEchoRequest | ExtendedEchoReply"
+                                    pattern: ^([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]|EchoReply|DestinationUnreachable|Redirect|Echo|RouterAdvertisement|RouterSelection|TimeExceeded|ParameterProblem|Timestamp|TimestampReply|Photuris|ExtendedEchoRequest|ExtendedEcho
+                                      Reply|PacketTooBig|ParameterProblem|EchoRequest|MulticastListenerQuery|MulticastListenerReport|MulticastListenerDone|RouterSolicitation|RouterAdvertisement|NeighborSolicitation|NeighborAdvertisement|RedirectMessage|RouterRenumbering|ICMPNodeInformationQuery|ICMPNodeInformationResponse|InverseNeighborDiscoverySolicitation|InverseNeighborDiscoveryAdvertisement|HomeAgentAddressDiscoveryRequest|HomeAgentAddressDiscoveryReply|MobilePrefixSolicitation|MobilePrefixAdvertisement|DuplicateAddressRequestCodeSuffix|DuplicateAddressConfirmationCodeSuffix)$
+                                    x-kubernetes-int-or-string: true
+                                required:
+                                - type
+                                type: object
+                              maxItems: 40
+                              type: array
+                          type: object
+                        type: array
+                      toPorts:
+                        description: |-
+                          ToPorts is a list of destination ports identified by port number and
+                          protocol which the endpoint subject to the rule is not allowed to
+                          receive connections on.
+
+                          Example:
+                          Any endpoint with the label "app=httpd" can not accept incoming
+                          connections on port 80/tcp.
+                        items:
+                          description: |-
+                            PortDenyRule is a list of ports/protocol that should be used for deny
+                            policies. This structure lacks the L7Rules since it's not supported in deny
+                            policies.
+                          properties:
+                            ports:
+                              description: Ports is a list of L4 port/protocol
+                              items:
+                                description: PortProtocol specifies an L4 port with
+                                  an optional transport protocol
+                                properties:
+                                  endPort:
+                                    description: EndPort can only be an L4 port number.
+                                    format: int32
+                                    maximum: 65535
+                                    minimum: 0
+                                    type: integer
+                                  port:
+                                    description: |-
+                                      Port can be an L4 port number, or a name in the form of "http"
+                                      or "http-8080".
+                                    pattern: ^(6553[0-5]|655[0-2][0-9]|65[0-4][0-9]{2}|6[0-4][0-9]{3}|[1-5][0-9]{4}|[0-9]{1,4})|([a-zA-Z0-9]-?)*[a-zA-Z](-?[a-zA-Z0-9])*$
+                                    type: string
+                                  protocol:
+                                    description: |-
+                                      Protocol is the L4 protocol. If "ANY", omitted or empty, any protocols
+                                      with transport ports (TCP, UDP, SCTP) match.
+
+                                      Accepted values: "TCP", "UDP", "SCTP", "VRRP", "IGMP", "GRE", "IPIP",
+                                      "IPV6", "ESP", "AH", "ANY"
+
+                                      Tunnel/encapsulation protocols (GRE, IPIP, IPV6, ESP, AH) and other
+                                      extended IP protocols (VRRP, IGMP) require the --enable-extended-ip-protocols
+                                      flag to be set. These protocols do not use transport-layer ports.
+
+                                      Matching on ICMP is not supported.
+
+                                      Named port specified for a container may narrow this down, but may not
+                                      contradict this.
+                                    enum:
+                                    - TCP
+                                    - UDP
+                                    - SCTP
+                                    - VRRP
+                                    - IGMP
+                                    - GRE
+                                    - IPIP
+                                    - IPV6
+                                    - ESP
+                                    - AH
+                                    - ANY
+                                    type: string
+                                type: object
+                              type: array
+                          type: object
+                        type: array
+                    type: object
+                  type: array
+                labels:
+                  description: |-
+                    Labels is a list of optional strings which can be used to
+                    re-identify the rule or to store metadata. It is possible to lookup
+                    or delete strings based on labels. Labels are not required to be
+                    unique, multiple rules can have overlapping or identical labels.
+                  items:
+                    description: Label is Cilium's representation of a label.
+                    properties:
+                      key:
+                        type: string
+                      source:
+                        description: 'Source can be one of the above values (e.g.:
+                          LabelSourceK8s).'
+                        type: string
+                      value:
+                        type: string
+                    required:
+                    - key
+                    type: object
+                  type: array
+                log:
+                  description: Log specifies custom policy-specific Hubble logging
+                    configuration.
+                  properties:
+                    value:
+                      description: |-
+                        Value is a free-form string that is included in Hubble flows
+                        that match this policy. The string is limited to 32 printable characters.
+                      maxLength: 32
+                      pattern: ^\PC*$
+                      type: string
+                  type: object
+                nodeSelector:
+                  description: |-
+                    NodeSelector selects all nodes which should be subject to this rule.
+                    EndpointSelector and NodeSelector cannot be both empty and are mutually
+                    exclusive. Can only be used in CiliumClusterwideNetworkPolicies.
+                  properties:
+                    matchExpressions:
+                      description: matchExpressions is a list of label selector requirements.
+                        The requirements are ANDed.
+                      items:
+                        description: |-
+                          A label selector requirement is a selector that contains values, a key, and an operator that
+                          relates the key and values.
+                        properties:
+                          key:
+                            description: key is the label key that the selector applies
+                              to.
+                            type: string
+                          operator:
+                            description: |-
+                              operator represents a key's relationship to a set of values.
+                              Valid operators are In, NotIn, Exists and DoesNotExist.
+                            enum:
+                            - In
+                            - NotIn
+                            - Exists
+                            - DoesNotExist
+                            type: string
+                          values:
+                            description: |-
+                              values is an array of string values. If the operator is In or NotIn,
+                              the values array must be non-empty. If the operator is Exists or DoesNotExist,
+                              the values array must be empty. This array is replaced during a strategic
+                              merge patch.
+                            items:
+                              type: string
+                            type: array
+                            x-kubernetes-list-type: atomic
+                        required:
+                        - key
+                        - operator
+                        type: object
+                      type: array
+                      x-kubernetes-list-type: atomic
+                    matchLabels:
+                      additionalProperties:
+                        description: MatchLabelsValue represents the value from the
+                          MatchLabels {key,value} pair.
+                        maxLength: 63
+                        pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
+                        type: string
+                      description: |-
+                        matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+                        map is equivalent to an element of matchExpressions, whose key field is "key", the
+                        operator is "In", and the values array contains only "value". The requirements are ANDed.
+                      type: object
+                  type: object
+                  x-kubernetes-map-type: atomic
+              type: object
+            type: array
+          status:
+            description: Status is the status of the Cilium policy rule
+            properties:
+              conditions:
+                items:
+                  properties:
+                    lastTransitionTime:
+                      description: The last time the condition transitioned from one
+                        status to another.
+                      format: date-time
+                      type: string
+                    message:
+                      description: A human readable message indicating details about
+                        the transition.
+                      type: string
+                    reason:
+                      description: The reason for the condition's last transition.
+                      type: string
+                    status:
+                      description: The status of the condition, one of True, False,
+                        or Unknown
+                      type: string
+                    type:
+                      description: The type of the policy condition
+                      type: string
+                  required:
+                  - status
+                  - type
+                  type: object
+                type: array
+                x-kubernetes-list-map-keys:
+                - type
+                x-kubernetes-list-type: map
+              derivativePolicies:
+                additionalProperties:
+                  description: |-
+                    CiliumNetworkPolicyNodeStatus is the status of a Cilium policy rule for a
+                    specific node.
+                  properties:
+                    annotations:
+                      additionalProperties:
+                        type: string
+                      description: |-
+                        Annotations corresponds to the Annotations in the ObjectMeta of the CNP
+                        that have been realized on the node for CNP. That is, if a CNP has been
+                        imported and has been assigned annotation X=Y by the user,
+                        Annotations in CiliumNetworkPolicyNodeStatus will be X=Y once the
+                        CNP that was imported corresponding to Annotation X=Y has been realized on
+                        the node.
+                      type: object
+                    enforcing:
+                      description: |-
+                        Enforcing is set to true once all endpoints present at the time the
+                        policy has been imported are enforcing this policy.
+                      type: boolean
+                    error:
+                      description: |-
+                        Error describes any error that occurred when parsing or importing the
+                        policy, or realizing the policy for the endpoints to which it applies
+                        on the node.
+                      type: string
+                    lastUpdated:
+                      description: LastUpdated contains the last time this status
+                        was updated
+                      format: date-time
+                      type: string
+                    localPolicyRevision:
+                      description: |-
+                        Revision is the policy revision of the repository which first implemented
+                        this policy.
+                      format: int64
+                      type: integer
+                    ok:
+                      description: |-
+                        OK is true when the policy has been parsed and imported successfully
+                        into the in-memory policy repository on the node.
+                      type: boolean
+                  type: object
+                description: |-
+                  DerivativePolicies is the status of all policies derived from the Cilium
+                  policy
+                type: object
+            type: object
+        required:
+        - metadata
+        type: object
+        x-kubernetes-validations:
+        - message: spec or specs must be provided
+          rule: has(self.spec) || has(self.specs)
+    served: true
+    storage: true
+    subresources:
+      status: {}
diff --git a/internal/crd/crd.go b/internal/crd/crd.go
new file mode 100644
index 0000000..1a0cc63
--- /dev/null
+++ b/internal/crd/crd.go
@@ -0,0 +1,24 @@
+// Package crd carries the CiliumNetworkPolicy CustomResourceDefinition of the Cilium version cf2cnp is built
+// against — the schema its output must satisfy. The file is copied from the module cache by `go generate`
+// (hack/copy-crd.sh), not imported: the upstream package that embeds it pulls the Kubernetes client machinery
+// in (docs/CRD-SPEC-FORENSICS.md §3). CI checks the copy is byte-identical to the module's.
+package crd
+
+import (
+	_ "embed"
+	"strings"
+)
+
+//go:generate sh ../../hack/copy-crd.sh
+
+//go:embed ciliumnetworkpolicies.yaml
+var cnp string
+
+//go:embed VERSION
+var version string
+
+// CiliumNetworkPolicy is the CRD YAML (apiextensions.k8s.io/v1) as shipped by Cilium at Version
+func CiliumNetworkPolicy() string { return cnp }
+
+// Version is the Cilium module version the CRD was copied from — the spec version this build supports
+func Version() string { return strings.TrimSpace(version) }
diff --git a/internal/flow/parser.go b/internal/flow/parser.go
index a9c834e..2dafd70 100644
--- a/internal/flow/parser.go
+++ b/internal/flow/parser.go
@@ -1,8 +1,12 @@
 package flow
 
 import (
+	"bytes"
 	"encoding/json"
+	"errors"
 	"fmt"
+	"io"
+	"net/url"
 	"os"
 	"path/filepath"
 	"strings"
@@ -44,6 +48,49 @@ func ParseFlowFromBytes(data []byte) (*ParsedFlow, error) {
 	return parseFlow(&flowData.Flow)
 }
 
+// ParseFlowsFromBytes parses one or many Hubble flows from JSON bytes. Three shapes are accepted, because that is what
+// the tools produce: a single flow object (a saved file, the Grafana action's log line), a JSON array of flow objects,
+// and newline-delimited objects — the output of `hubble observe -o json`, one flow per line. Blank lines are skipped;
+// the first object that does not parse names its position in the error.
+func ParseFlowsFromBytes(data []byte) ([]*ParsedFlow, error) {
+	trimmed := bytes.TrimSpace(data)
+	if len(trimmed) == 0 {
+		return nil, errors.New("no flow data")
+	}
+
+	var raw []HubbleFlowData
+	if trimmed[0] == '[' {
+		if err := json.Unmarshal(trimmed, &raw); err != nil {
+			return nil, fmt.Errorf("failed to parse JSON array of flows: %w", err)
+		}
+	} else {
+		dec := json.NewDecoder(bytes.NewReader(trimmed))
+		for i := 1; ; i++ {
+			var fd HubbleFlowData
+			if err := dec.Decode(&fd); err != nil {
+				if errors.Is(err, io.EOF) {
+					break
+				}
+				return nil, fmt.Errorf("failed to parse flow #%d: %w", i, err)
+			}
+			raw = append(raw, fd)
+		}
+	}
+	if len(raw) == 0 {
+		return nil, errors.New("no flow objects found")
+	}
+
+	flows := make([]*ParsedFlow, 0, len(raw))
+	for i := range raw {
+		parsed, err := parseFlow(&raw[i].Flow)
+		if err != nil {
+			return nil, fmt.Errorf("flow #%d: %w", i+1, err)
+		}
+		flows = append(flows, parsed)
+	}
+	return flows, nil
+}
+
 // ParseFlowsFromDirectory parses all JSON flow files from a directory
 func ParseFlowsFromDirectory(dirPath string) ([]*ParsedFlow, error) {
 	entries, err := os.ReadDir(dirPath)
@@ -61,11 +108,15 @@ func ParseFlowsFromDirectory(dirPath string) ([]*ParsedFlow, error) {
 		}
 
 		filePath := filepath.Join(dirPath, entry.Name())
-		flow, err := ParseFlowFile(filePath)
+		data, err := os.ReadFile(filePath)
 		if err != nil {
-			return nil, err
+			return nil, fmt.Errorf("failed to read file %s: %w", filePath, err)
 		}
-		flows = append(flows, flow)
+		parsed, err := ParseFlowsFromBytes(data)
+		if err != nil {
+			return nil, fmt.Errorf("%s: %w", filePath, err)
+		}
+		flows = append(flows, parsed...)
 	}
 
 	return flows, nil
@@ -73,6 +124,11 @@ func ParseFlowsFromDirectory(dirPath string) ([]*ParsedFlow, error) {
 
 // parseFlow converts a Flow struct to a ParsedFlow with extracted information
 func parseFlow(flow *Flow) (*ParsedFlow, error) {
+	// A zero Flow decodes from `{}`, `null` or an object without a "flow" key without error; it would
+	// become a policy with empty selectors. Refuse anything that names neither an endpoint nor a direction.
+	if flow == nil || (flow.UUID == "" && flow.TrafficDirection == "" && len(flow.Source.Labels) == 0 && len(flow.Destination.Labels) == 0) {
+		return nil, errors.New("not a Hubble flow (no flow.source/destination labels, no traffic_direction, no uuid)")
+	}
 	parsed := &ParsedFlow{
 		UUID:         flow.UUID,
 		SourceLabels: make(map[string]string),
@@ -88,6 +144,12 @@ func parseFlow(flow *Flow) (*ParsedFlow, error) {
 	parsed.DestNamespace = flow.Destination.Namespace
 	parsed.DestLabels = extractLabels(flow.Destination.Labels)
 
+	// ClusterMesh: which cluster each side is in. Since Cilium 1.19 a selector without
+	// io.cilium.k8s.policy.cluster matches the LOCAL cluster only, so a policy generated from a
+	// cross-cluster flow must name the peer's cluster or it excludes that very peer.
+	parsed.SourceCluster = clusterOf(flow.Source)
+	parsed.DestCluster = clusterOf(flow.Destination)
+
 	// Check if source is a reserved entity (remote-node, host, etc.)
 	parsed.SourceEntity = getReservedEntity(flow.Source.Labels)
 	parsed.IsSourceEntity = parsed.SourceEntity != ""
@@ -95,7 +157,13 @@ func parseFlow(flow *Flow) (*ParsedFlow, error) {
 	// Check if destination is a reserved entity (kube-apiserver, host, world, etc.)
 	parsed.DestEntity = getReservedEntity(flow.Destination.Labels)
 	parsed.IsDestEntityTraffic = parsed.DestEntity != ""
-	
+
+	// A world SOURCE is an address too (an egress-gateway IP, a load balancer's client, an office range): keep it, so
+	// the ingress rule can be a fromCIDR instead of the whole world (0.7.0; the 0.6.x rule was fromEntities: [world])
+	if isWorldTraffic(flow.Source.Labels) {
+		parsed.SourceIP = flow.IP.Source
+	}
+
 	// Check if destination is "world" (external traffic)
 	parsed.IsWorldTraffic = isWorldTraffic(flow.Destination.Labels)
 	if parsed.IsWorldTraffic {
@@ -123,9 +191,49 @@ func parseFlow(flow *Flow) (*ParsedFlow, error) {
 		parsed.Port = flow.L4.UDP.DestinationPort
 	}
 
+	// Layer 7 (E2): only REQUEST records describe what the client asked for; a RESPONSE is the reply
+	// side, skipped like is_reply. A request carries either http or dns.
+	if flow.L7 != nil && flow.L7.Type == "REQUEST" {
+		if flow.L7.HTTP != nil && flow.L7.HTTP.URL != "" {
+			parsed.HTTPMethod = flow.L7.HTTP.Method
+			if u, err := url.Parse(flow.L7.HTTP.URL); err == nil {
+				parsed.HTTPPath = u.Path
+			}
+		}
+		if flow.L7.DNS != nil {
+			// The query exactly as the resolver sent it, trailing dot removed. A search-list expansion
+			// (accounts.bank.svc.cluster.local.bank.svc.cluster.local — ndots:5) is kept on purpose: an L7 DNS
+			// policy allows ONLY the names it lists ("No other DNS queries will be allowed", layer7.rst), and
+			// the resolver tries the expansions before the real name — deny them and lookups fail.
+			parsed.DNSQuery = strings.TrimSuffix(flow.L7.DNS.Query, ".")
+		}
+	}
+
 	return parsed, nil
 }
 
+// clusterOf is the endpoint's cluster: cluster_name when Hubble set it, else the io.cilium.k8s.policy.cluster
+// label the endpoint carries anyway (review finding: a flow with an empty cluster_name still names the cluster
+// in its labels, and dropping it there reintroduced the local-only bug E1 exists to fix)
+func clusterOf(ep Endpoint) string {
+	if ep.ClusterName != "" {
+		return ep.ClusterName
+	}
+	return labelValue(ep.Labels, "io.cilium.k8s.policy.cluster")
+}
+
+// labelValue returns the value of key in Hubble's "k8s:key=value" (or "key=value") label list, or ""
+func labelValue(labels []string, key string) string {
+	for _, l := range labels {
+		for _, prefix := range []string{"k8s:" + key + "=", key + "="} {
+			if strings.HasPrefix(l, prefix) {
+				return strings.TrimPrefix(l, prefix)
+			}
+		}
+	}
+	return ""
+}
+
 // extractLabels extracts and filters labels from Hubble label format
 // Labels are in format "k8s:labelKey=labelValue"
 func extractLabels(labels []string) map[string]string {
@@ -136,7 +244,7 @@ func extractLabels(labels []string) map[string]string {
 	for _, label := range labels {
 		// Remove "k8s:" prefix if present
 		labelStr := strings.TrimPrefix(label, "k8s:")
-		
+
 		// Split by "=" to get key and value
 		parts := strings.SplitN(labelStr, "=", 2)
 		if len(parts) != 2 {
@@ -166,10 +274,15 @@ func extractLabels(labels []string) map[string]string {
 	return result
 }
 
+// worldLabels are the labels Cilium gives an address outside the cluster: reserved:world on a single-stack cluster,
+// reserved:world-ipv4 / reserved:world-ipv6 when both address families are enabled (pkg/labels/cidr.go getWorldLabel,
+// identities 2, 9 and 10). All three are the `world` entity of a policy (NumericIdentity.IsWorld).
+var worldLabels = map[string]bool{"reserved:world": true, "reserved:world-ipv4": true, "reserved:world-ipv6": true}
+
 // isWorldTraffic checks if the endpoint is external "world" traffic
 func isWorldTraffic(labels []string) bool {
 	for _, label := range labels {
-		if label == "reserved:world" {
+		if worldLabels[label] {
 			return true
 		}
 	}
@@ -182,6 +295,8 @@ var reservedEntities = map[string]string{
 	"reserved:host":           "host",
 	"reserved:remote-node":    "remote-node",
 	"reserved:world":          "world",
+	"reserved:world-ipv4":     "world", // dual-stack (see worldLabels)
+	"reserved:world-ipv6":     "world",
 	"reserved:health":         "health",
 	"reserved:init":           "init",
 	"reserved:ingress":        "ingress",
@@ -190,7 +305,7 @@ var reservedEntities = map[string]string{
 // getReservedEntity checks if the endpoint is a reserved entity and returns the entity name
 func getReservedEntity(labels []string) string {
 	var foundEntity string
-	
+
 	for _, label := range labels {
 		if entity, ok := reservedEntities[label]; ok {
 			// Prefer kube-apiserver over other entities if present
@@ -245,4 +360,3 @@ func inferTrafficDirection(parsed *ParsedFlow) string {
 	// Fallback
 	return "EGRESS"
 }
-
diff --git a/internal/flow/parser_test.go b/internal/flow/parser_test.go
new file mode 100644
index 0000000..357fb6e
--- /dev/null
+++ b/internal/flow/parser_test.go
@@ -0,0 +1,97 @@
+package flow
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+// The three fixtures are real Hubble 1.20 flows captured on a kind cluster: two INGRESS audit verdicts
+// into the same workload from two peers, and one EGRESS flow to the world without destination_names.
+func fixture(t *testing.T, name string) []byte {
+	t.Helper()
+	b, err := os.ReadFile(filepath.Join("..", "testdata", name))
+	if err != nil {
+		t.Fatal(err)
+	}
+	return b
+}
+
+func TestParseFlowsFromBytes_Single(t *testing.T) {
+	flows, err := ParseFlowsFromBytes(fixture(t, "ingress-pos-to-shop.json"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(flows) != 1 || flows[0].Direction != "INGRESS" || flows[0].Port != 80 || flows[0].DestLabels["app.kubernetes.io/name"] != "shop" {
+		t.Fatalf("unexpected parse: %+v", flows[0])
+	}
+}
+
+func TestParseFlowsFromBytes_NDJSON(t *testing.T) {
+	// `hubble observe -o json` output: one object per line, blank lines and trailing newline included
+	body := string(fixture(t, "ingress-pos-to-shop.json")) + "\n\n" + string(fixture(t, "ingress-stranger-to-shop.json")) + "\n"
+	flows, err := ParseFlowsFromBytes([]byte(body))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(flows) != 2 || flows[0].SourceLabels["app.kubernetes.io/name"] != "pos" || flows[1].SourceLabels["app.kubernetes.io/name"] != "stranger" {
+		t.Fatalf("expected pos then stranger, got %d flows: %+v", len(flows), flows)
+	}
+}
+
+func TestParseFlowsFromBytes_Array(t *testing.T) {
+	body := "[" + string(fixture(t, "ingress-pos-to-shop.json")) + "," + string(fixture(t, "egress-pos-to-world.json")) + "]"
+	flows, err := ParseFlowsFromBytes([]byte(body))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(flows) != 2 || flows[1].Direction != "EGRESS" || !flows[1].IsWorldTraffic || flows[1].DestIP != "104.20.23.154" {
+		t.Fatalf("unexpected: %+v", flows)
+	}
+}
+
+func TestParseFlowsFromBytes_Errors(t *testing.T) {
+	if _, err := ParseFlowsFromBytes([]byte("  \n")); err == nil {
+		t.Fatal("empty input must error")
+	}
+	bad := string(fixture(t, "ingress-pos-to-shop.json")) + "\n{not json}\n"
+	_, err := ParseFlowsFromBytes([]byte(bad))
+	if err == nil || !strings.Contains(err.Error(), "flow #2") {
+		t.Fatalf("the bad line must be named by position, got %v", err)
+	}
+}
+
+func TestParseFlowsFromDirectory_ManyPerFile(t *testing.T) {
+	dir := t.TempDir()
+	ndjson := string(fixture(t, "ingress-pos-to-shop.json")) + "\n" + string(fixture(t, "ingress-stranger-to-shop.json")) + "\n"
+	if err := os.WriteFile(filepath.Join(dir, "observe.json"), []byte(ndjson), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(dir, "world.json"), fixture(t, "egress-pos-to-world.json"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	flows, err := ParseFlowsFromDirectory(dir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(flows) != 3 {
+		t.Fatalf("expected 3 flows from 2 files, got %d", len(flows))
+	}
+}
+
+// Review finding: json.Decoder turns `{}`, `null` and objects without "flow" into a zero flow without error
+func TestParseFlowsFromBytes_RejectsNonFlows(t *testing.T) {
+	good := string(fixture(t, "ingress-pos-to-shop.json"))
+	for _, in := range []string{`[{}]`, `[{"foo":1}]`, `{}`, good + "\n{}", good + "\nnull", `{"flow":{}}`} {
+		if _, err := ParseFlowsFromBytes([]byte(in)); err == nil {
+			t.Fatalf("must reject %q", in)
+		} else if !strings.Contains(err.Error(), "not a Hubble flow") && !strings.Contains(err.Error(), "parse") {
+			t.Fatalf("error must say why: %v", err)
+		}
+	}
+	two := good + string(fixture(t, "ingress-stranger-to-shop.json")) // two objects, no separator
+	if fs, err := ParseFlowsFromBytes([]byte(two)); err != nil || len(fs) != 2 {
+		t.Fatalf("two concatenated flows: %d %v", len(fs), err)
+	}
+}
diff --git a/internal/flow/review_test.go b/internal/flow/review_test.go
new file mode 100644
index 0000000..71b212b
--- /dev/null
+++ b/internal/flow/review_test.go
@@ -0,0 +1,30 @@
+package flow
+
+import "testing"
+
+// Review ENH-003 (Cursor): on a dual-stack Cilium (both address families enabled) the world identity is not 2
+// (reserved:world) but 9 (reserved:world-ipv4) or 10 (reserved:world-ipv6) — pkg/labels/cidr.go getWorldLabel,
+// pkg/identity/numericidentity.go GetWorldIdentityFromIP at v1.20.1. Both are "world" to a policy (the world entity
+// covers all three, NumericIdentity.IsWorld), so both are world to the parser: an egress to them is world traffic
+// with an address, an ingress from them carries the source address for fromCIDR.
+func TestParse_DualStackWorldLabels(t *testing.T) {
+	egress, err := ParseFlowsFromBytes(fixture(t, "egress-pos-to-world-ipv4.json"))
+	if err != nil || len(egress) != 1 {
+		t.Fatalf("parse: %d %v", len(egress), err)
+	}
+	if e := egress[0]; !e.IsWorldTraffic || e.DestEntity != "world" || e.DestIP != "104.20.23.154" || e.Direction != "EGRESS" {
+		t.Fatalf("reserved:world-ipv4 must be world traffic with its address: %+v", e)
+	}
+	ingress, err := ParseFlowsFromBytes(fixture(t, "ingress-world-ipv4-cidr-to-receiver.json"))
+	if err != nil || len(ingress) != 1 {
+		t.Fatalf("parse: %d %v", len(ingress), err)
+	}
+	if i := ingress[0]; i.SourceIP != "172.18.255.170" || i.SourceEntity != "world" {
+		t.Fatalf("a reserved:world-ipv4 source must keep its address and be the world entity: %+v", i)
+	}
+	for _, l := range []string{"reserved:world", "reserved:world-ipv4", "reserved:world-ipv6"} {
+		if !isWorldTraffic([]string{l}) || getReservedEntity([]string{l}) != "world" {
+			t.Fatalf("%s is world", l)
+		}
+	}
+}
diff --git a/internal/flow/types.go b/internal/flow/types.go
index 727d615..c8e3fcb 100644
--- a/internal/flow/types.go
+++ b/internal/flow/types.go
@@ -25,6 +25,28 @@ type Flow struct {
 	TrafficDirection string    `json:"traffic_direction"`
 	IsReply          bool      `json:"is_reply"`
 	Summary          string    `json:"Summary"`
+	L7               *L7       `json:"l7,omitempty"`
+}
+
+// L7 is Hubble's layer-7 record on a flow, present once a visibility or L7 policy put the port on the proxy
+type L7 struct {
+	Type string  `json:"type"` // REQUEST or RESPONSE
+	HTTP *L7HTTP `json:"http,omitempty"`
+	DNS  *L7DNS  `json:"dns,omitempty"`
+}
+
+// L7HTTP is the http part of an L7 record (url is a full URL; code is set on responses)
+type L7HTTP struct {
+	Method   string `json:"method"`
+	URL      string `json:"url"`
+	Protocol string `json:"protocol"`
+	Code     int    `json:"code,omitempty"`
+}
+
+// L7DNS is the dns part of an L7 record (query carries a trailing dot)
+type L7DNS struct {
+	Query  string   `json:"query"`
+	Qtypes []string `json:"qtypes,omitempty"`
 }
 
 // Ethernet contains MAC address information
@@ -93,21 +115,26 @@ type EventType struct {
 
 // ParsedFlow represents a parsed and processed flow with extracted information
 type ParsedFlow struct {
-	UUID               string            // Flow UUID from Hubble
-	Direction          string            // INGRESS or EGRESS
-	SourceNamespace    string            // Source pod namespace
-	SourceLabels       map[string]string // Filtered source labels
-	SourceEntity       string            // Reserved entity for source (remote-node, host, etc.)
-	IsSourceEntity     bool              // True if source is a reserved entity
-	DestNamespace      string            // Destination pod namespace
-	DestLabels         map[string]string // Filtered destination labels
-	DestFQDNs          []string          // Destination FQDNs for world traffic
-	DestIP             string            // Destination IP for CIDR-based rules
-	DestEntity         string            // Reserved entity (kube-apiserver, host, world, etc.)
-	Protocol           string            // TCP or UDP
-	Port               int               // Destination port
-	IsWorldTraffic     bool              // True if destination is "world"
-	IsDestEntityTraffic bool             // True if destination is a reserved entity
-	IsReply            bool              // True if this is a reply packet
+	UUID                string            // Flow UUID from Hubble
+	Direction           string            // INGRESS or EGRESS
+	SourceNamespace     string            // Source pod namespace
+	SourceLabels        map[string]string // Filtered source labels
+	SourceCluster       string            // flow.source.cluster_name — empty when Hubble did not set it (E1)
+	SourceEntity        string            // Reserved entity for source (remote-node, host, etc.)
+	IsSourceEntity      bool              // True if source is a reserved entity
+	DestNamespace       string            // Destination pod namespace
+	DestLabels          map[string]string // Filtered destination labels
+	DestCluster         string            // flow.destination.cluster_name (E1)
+	DestFQDNs           []string          // Destination FQDNs for world traffic
+	DestIP              string            // Destination IP for CIDR-based rules
+	SourceIP            string            // 0.7.0: the source's address when the source is reserved:world (fromCIDR)
+	DestEntity          string            // Reserved entity (kube-apiserver, host, world, etc.)
+	Protocol            string            // TCP or UDP
+	Port                int               // Destination port
+	IsWorldTraffic      bool              // True if destination is "world"
+	IsDestEntityTraffic bool              // True if destination is a reserved entity
+	IsReply             bool              // True if this is a reply packet
+	HTTPMethod          string            // E2: l7.http.method of a REQUEST record
+	HTTPPath            string            // E2: the path of l7.http.url of a REQUEST record
+	DNSQuery            string            // E2: l7.dns.query of a REQUEST record, without the trailing dot
 }
-
diff --git a/internal/policy/describe.go b/internal/policy/describe.go
new file mode 100644
index 0000000..6f3d883
--- /dev/null
+++ b/internal/policy/describe.go
@@ -0,0 +1,184 @@
+package policy
+
+import (
+	"fmt"
+	"regexp"
+	"sort"
+	"strings"
+
+	"github.com/hubble-policy-gen/internal/flow"
+)
+
+// Describe writes the policy's description from its own spec, so that it says what the rules say — who the
+// subject is, which peers it may talk to, on which ports, with which L7 rules — instead of a generic sentence
+// about namespaces. It runs once the rules are final (after the merge across flows), on every policy:
+//
+//	Allow ingress to shop/frontend in cf2cnp-lab27: from pos on TCP/80 (HTTP GET /, GET /checkout); from kiosk on TCP/80
+//	Allow egress from pos in cf2cnp-lab: to shop on TCP/80; to kube-dns in kube-system on UDP/53 (DNS *); to example.com on TCP/443
+//	Allow ingress to cache/server in mesh-lab: from worker/batch in cluster poc2 on TCP/6379
+//
+// Peers are named the way the selector names them (name, then component and instance), a peer in another namespace
+// or cluster says so, entities and CIDRs are listed as written. A long policy is cut after maxDescribedRules peers
+// with "and N more", so the description stays a sentence, not a second copy of the spec.
+func Describe(p *CiliumNetworkPolicy) string {
+	// the subject is named the way the peers are (name/component/instance from the selector), so the sentence reads
+	// "shop/frontend … from shop/backend"; a policy without a selector falls back to its object name
+	subject := describeSelector(MatchLabelsOf(p.Spec.EndpointSelector))
+	if len(MatchLabelsOf(p.Spec.EndpointSelector)) == 0 {
+		subject = p.Metadata.Name
+	}
+	subject += " in " + p.Metadata.Namespace
+	var parts []string
+	if n := len(p.Spec.Ingress); n > 0 {
+		items := make([]string, 0, n)
+		for _, r := range p.Spec.Ingress {
+			items = append(items, "from "+peerList(r.FromEndpoints, r.FromEntities, r.FromCIDR, nil)+portList(r.ToPorts))
+		}
+		parts = append(parts, "ingress to "+subject+": "+joinRules(items))
+	}
+	if n := len(p.Spec.Egress); n > 0 {
+		items := make([]string, 0, n)
+		for _, r := range p.Spec.Egress {
+			items = append(items, "to "+peerList(r.ToEndpoints, r.ToEntities, r.ToCIDR, r.ToFQDNs)+portList(r.ToPorts))
+		}
+		parts = append(parts, "egress from "+subject+": "+joinRules(items))
+	}
+	if len(parts) == 0 {
+		return "Allow nothing for " + subject
+	}
+	return "Allow " + strings.Join(parts, "; ")
+}
+
+const maxDescribedRules = 6
+
+func joinRules(items []string) string {
+	if len(items) > maxDescribedRules {
+		return strings.Join(items[:maxDescribedRules], "; ") + fmt.Sprintf("; and %d more", len(items)-maxDescribedRules)
+	}
+	return strings.Join(items, "; ")
+}
+
+// peerList names every peer of one rule: endpoints by their selector, entities, CIDRs and FQDNs as written
+func peerList(endpoints []EndpointSelector, entities EntitySlice, cidrs CIDRSlice, fqdns []FQDNSelector) string {
+	var peers []string
+	for _, e := range endpoints {
+		peers = append(peers, describeSelector(MatchLabelsOf(e)))
+	}
+	if len(entities) > 0 {
+		names := make([]string, len(entities))
+		for i, e := range entities {
+			names[i] = string(e)
+		}
+		peers = append(peers, "entities "+strings.Join(names, ", "))
+	}
+	for _, c := range cidrs {
+		peers = append(peers, string(c))
+	}
+	for _, f := range fqdns {
+		if f.MatchName != "" {
+			peers = append(peers, f.MatchName)
+		} else if f.MatchPattern != "" {
+			peers = append(peers, f.MatchPattern)
+		}
+	}
+	if len(peers) == 0 {
+		return "anyone"
+	}
+	return strings.Join(peers, ", ")
+}
+
+// describeSelector turns a peer's matchLabels into "name/component/instance", then "in <namespace>" when the
+// selector names one (a peer in the policy's own namespace carries no namespace label), then "in cluster <c>"
+// for a ClusterMesh peer. Labels the naming does not use are listed as key=value so nothing is hidden.
+func describeSelector(labels map[string]string) string {
+	if len(labels) == 0 {
+		return "any endpoint"
+	}
+	used := map[string]bool{}
+	var who []string
+	for _, k := range []string{"app.kubernetes.io/name", "app", "k8s-app", "name"} {
+		if v, ok := labels[k]; ok {
+			who = append(who, v)
+			used[k] = true
+			break
+		}
+	}
+	for _, k := range []string{"app.kubernetes.io/component", "app.kubernetes.io/instance"} {
+		if v, ok := labels[k]; ok {
+			who = append(who, v)
+			used[k] = true
+		}
+	}
+	out := strings.Join(who, "/")
+	if ns, ok := labels[flow.GetNamespaceLabel()]; ok {
+		if out == "" {
+			out = "endpoints"
+		}
+		out += " in " + ns
+		used[flow.GetNamespaceLabel()] = true
+	}
+	if c, ok := labels[ClusterLabel]; ok {
+		out += " in cluster " + c
+		used[ClusterLabel] = true
+	}
+	var rest []string
+	for k, v := range labels {
+		if !used[k] {
+			rest = append(rest, k+"="+v)
+		}
+	}
+	sort.Strings(rest)
+	if len(rest) > 0 {
+		if out != "" {
+			out += " "
+		}
+		out += "(" + strings.Join(rest, ", ") + ")"
+	}
+	return out
+}
+
+// portList renders " on TCP/80, UDP/53" and the L7 rules a port carries: HTTP as "GET /path" (the anchors and the
+// optional-query suffix the generator adds are stripped for reading), DNS as the names or patterns
+func portList(rules PortRules) string {
+	var ports []string
+	for _, pr := range rules {
+		for _, p := range pr.Ports {
+			s := string(p.Protocol) + "/" + p.Port
+			if p.Protocol == "" {
+				s = p.Port
+			}
+			ports = append(ports, s)
+		}
+		if pr.Rules != nil {
+			var l7 []string
+			for _, h := range pr.Rules.HTTP {
+				l7 = append(l7, strings.TrimSpace(h.Method+" "+readablePath(h.Path)))
+			}
+			for _, d := range pr.Rules.DNS {
+				if d.MatchName != "" {
+					l7 = append(l7, d.MatchName)
+				} else if d.MatchPattern != "" {
+					l7 = append(l7, d.MatchPattern)
+				}
+			}
+			if len(l7) > 0 && len(ports) > 0 {
+				kind := "HTTP"
+				if len(pr.Rules.HTTP) == 0 {
+					kind = "DNS"
+				}
+				ports[len(ports)-1] += " (" + kind + " " + strings.Join(l7, ", ") + ")"
+			}
+		}
+	}
+	if len(ports) == 0 {
+		return ""
+	}
+	return " on " + strings.Join(ports, ", ")
+}
+
+var pathAnchors = regexp.MustCompile(`^\^|\(\\\?\.\*\)\?\$$|\$$`)
+
+// readablePath strips what the generator adds around an observed path (^ … (\?.*)?$) and leaves a hand-written regex alone
+func readablePath(p string) string {
+	return pathAnchors.ReplaceAllString(p, "")
+}
diff --git a/internal/policy/describe_test.go b/internal/policy/describe_test.go
new file mode 100644
index 0000000..e2ba8ef
--- /dev/null
+++ b/internal/policy/describe_test.go
@@ -0,0 +1,73 @@
+package policy
+
+import (
+	"testing"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// 0.6.2: the description is written from the final spec — subject, peers, ports, L7 — not a generic sentence
+func TestDescribe(t *testing.T) {
+	cases := []struct {
+		name string
+		p    CiliumNetworkPolicy
+		want string
+	}{
+		{"ingress with L7 and a second peer",
+			CiliumNetworkPolicy{Metadata: metav1.ObjectMeta{Name: "shop-frontend", Namespace: "cf2cnp-lab27"}, Spec: Rule{EndpointSelector: Selector(map[string]string{"app.kubernetes.io/name": "shop", "app.kubernetes.io/component": "frontend"}), Ingress: []IngressRule{
+				{IngressCommonRule: IngressCommonRule{FromEndpoints: []EndpointSelector{Selector(map[string]string{"app.kubernetes.io/name": "pos"})}},
+					ToPorts: PortRules{{Ports: []Port{{Port: "80", Protocol: "TCP"}}, Rules: &L7Rules{HTTP: []HTTPRule{{Method: "GET", Path: `^/(\?.*)?$`}, {Method: "GET", Path: `^/checkout(\?.*)?$`}}}}}},
+				{IngressCommonRule: IngressCommonRule{FromEndpoints: []EndpointSelector{Selector(map[string]string{"app.kubernetes.io/name": "kiosk"})}}, ToPorts: PortRules{{Ports: []Port{{Port: "80", Protocol: "TCP"}}}}},
+			}}},
+			"Allow ingress to shop/frontend in cf2cnp-lab27: from pos on TCP/80 (HTTP GET /, GET /checkout); from kiosk on TCP/80"},
+		{"egress: another namespace, DNS rule, FQDN, CIDR",
+			CiliumNetworkPolicy{Metadata: metav1.ObjectMeta{Name: "pos", Namespace: "cf2cnp-lab"}, Spec: Rule{Egress: []EgressRule{
+				{EgressCommonRule: EgressCommonRule{ToEndpoints: []EndpointSelector{Selector(map[string]string{"app.kubernetes.io/name": "shop"})}}, ToPorts: PortRules{{Ports: []Port{{Port: "80", Protocol: "TCP"}}}}},
+				{EgressCommonRule: EgressCommonRule{ToEndpoints: []EndpointSelector{Selector(map[string]string{"io.kubernetes.pod.namespace": "kube-system", "k8s-app": "kube-dns"})}}, ToPorts: PortRules{{Ports: []Port{{Port: "53", Protocol: "UDP"}}, Rules: &L7Rules{DNS: []DNSRule{{MatchPattern: "*"}}}}}},
+				{ToFQDNs: []FQDNSelector{{MatchName: "example.com"}}, ToPorts: PortRules{{Ports: []Port{{Port: "443", Protocol: "TCP"}}}}},
+				{EgressCommonRule: EgressCommonRule{ToCIDR: CIDRSlice{"104.20.23.154/32"}}, ToPorts: PortRules{{Ports: []Port{{Port: "443", Protocol: "TCP"}}}}},
+			}}},
+			"Allow egress from pos in cf2cnp-lab: to shop on TCP/80; to kube-dns in kube-system on UDP/53 (DNS *); to example.com on TCP/443; to 104.20.23.154/32 on TCP/443"},
+		{"a ClusterMesh peer with a component, and entities",
+			CiliumNetworkPolicy{Metadata: metav1.ObjectMeta{Name: "cache-server", Namespace: "mesh-lab"}, Spec: Rule{EndpointSelector: Selector(map[string]string{"app.kubernetes.io/name": "cache", "app.kubernetes.io/component": "server"}), Ingress: []IngressRule{
+				{IngressCommonRule: IngressCommonRule{FromEndpoints: []EndpointSelector{Selector(map[string]string{"app.kubernetes.io/name": "worker", "app.kubernetes.io/component": "batch", ClusterLabel: "poc2"})}}, ToPorts: PortRules{{Ports: []Port{{Port: "6379", Protocol: "TCP"}}}}},
+				{IngressCommonRule: IngressCommonRule{FromEntities: EntitySlice{"ingress", "host"}}, ToPorts: PortRules{{Ports: []Port{{Port: "8080", Protocol: "TCP"}}}}},
+			}}},
+			"Allow ingress to cache/server in mesh-lab: from worker/batch in cluster poc2 on TCP/6379; from entities ingress, host on TCP/8080"},
+		{"both directions, an unnamed label, no ports",
+			CiliumNetworkPolicy{Metadata: metav1.ObjectMeta{Name: "api", Namespace: "bank"}, Spec: Rule{
+				Ingress: []IngressRule{{IngressCommonRule: IngressCommonRule{FromEndpoints: []EndpointSelector{Selector(map[string]string{"tier": "web"})}}}},
+				Egress:  []EgressRule{{EgressCommonRule: EgressCommonRule{ToEntities: EntitySlice{"world"}}}}}},
+			"Allow ingress to api in bank: from (tier=web); egress from api in bank: to entities world"},
+		{"nothing", CiliumNetworkPolicy{Metadata: metav1.ObjectMeta{Name: "x", Namespace: "y"}}, "Allow nothing for x in y"},
+	}
+	for _, c := range cases {
+		if got := Describe(&c.p); got != c.want {
+			t.Errorf("%s:\n got  %q\n want %q", c.name, got, c.want)
+		}
+	}
+}
+
+// more than six peers are cut with a count, so the description stays a sentence
+func TestDescribe_CutsLongLists(t *testing.T) {
+	p := CiliumNetworkPolicy{Metadata: metav1.ObjectMeta{Name: "hub", Namespace: "ns"}}
+	for i := 0; i < 9; i++ {
+		p.Spec.Ingress = append(p.Spec.Ingress, IngressRule{IngressCommonRule: IngressCommonRule{FromEndpoints: []EndpointSelector{Selector(map[string]string{"app": "c" + string(rune('0'+i))})}}})
+	}
+	got := Describe(&p)
+	if !contains(got, "from c5") || contains(got, "from c6") || !contains(got, "; and 3 more") {
+		t.Fatalf("got %q", got)
+	}
+}
+
+func contains(s, sub string) bool {
+	return len(sub) == 0 || (len(s) >= len(sub) && indexOf(s, sub) >= 0)
+}
+func indexOf(s, sub string) int {
+	for i := 0; i+len(sub) <= len(s); i++ {
+		if s[i:i+len(sub)] == sub {
+			return i
+		}
+	}
+	return -1
+}
diff --git a/internal/policy/dns.go b/internal/policy/dns.go
new file mode 100644
index 0000000..bf31edf
--- /dev/null
+++ b/internal/policy/dns.go
@@ -0,0 +1,194 @@
+package policy
+
+import (
+	"fmt"
+	"sort"
+	"strings"
+
+	"github.com/cilium/cilium/pkg/policy/api"
+	"github.com/hubble-policy-gen/internal/aggregator"
+	"github.com/hubble-policy-gen/internal/flow"
+)
+
+// The DNS resolver rule — the egress rule that lets the selected endpoints ask the cluster's DNS and puts their
+// lookups through Cilium's DNS proxy, which every toFQDNs rule needs and --dns-visibility asks for — used to be one
+// hard-coded shape: kube-system, k8s-app=kube-dns, 53/UDP. That is a kind or kubeadm cluster (and UDP alone). OpenShift's DNS
+// operator runs CoreDNS in openshift-dns, listening on 5353, without that label, and Cilium's own guide says so:
+// "OpenShift users will need to modify the policies to match the namespace openshift-dns (instead of kube-system),
+// remove the match on the k8s:k8s-app=kube-dns label, and change the port to 5353". A policy with the wrong resolver
+// rule cuts the pod off from DNS the moment it is enforced.
+//
+// Since 0.7.0 the resolver is DERIVED from the observed DNS flows when the input has them (the pods the workload
+// actually asked, on the port and protocol it used), and taken from a profile when it does not.
+
+// DNSResolver is where the cluster's DNS answers, as a policy names it
+type DNSResolver struct {
+	Namespace string            // the resolver pods' namespace
+	Labels    map[string]string // identifying labels of the resolver pods, if any (OpenShift: none)
+	Port      string            // "53" on Kubernetes, "5353" on OpenShift
+	Protocol  string            // UDP, TCP or ANY
+}
+
+// DNS profiles: what to write when the flows do not show the resolver
+const (
+	DNSProfileAuto       = "auto"       // from the flows, else kubernetes
+	DNSProfileKubernetes = "kubernetes" // kube-system, k8s-app=kube-dns, 53/ANY — Cilium's DNS guide (dns-matchname.yaml)
+	DNSProfileOpenShift  = "openshift"  // openshift-dns, no label, 5353/ANY — Cilium's DNS guide for OpenShift
+)
+
+// The profiles write ANY, as Cilium's examples do: a lookup whose UDP answer is truncated retries over TCP, and a
+// rule with UDP alone denies that retry under default-deny egress. (0.6.x wrote 53/UDP; so does a derived resolver.)
+var dnsProfiles = map[string]DNSResolver{
+	DNSProfileKubernetes: {Namespace: "kube-system", Labels: map[string]string{"k8s-app": "kube-dns"}, Port: "53", Protocol: "ANY"},
+	DNSProfileOpenShift:  {Namespace: "openshift-dns", Port: "5353", Protocol: "ANY"},
+}
+
+// WithDNSProfile chooses the resolver profile: auto (default), kubernetes or openshift
+func (g *Generator) WithDNSProfile(name string) (*Generator, error) {
+	switch name {
+	case "", DNSProfileAuto, DNSProfileKubernetes, DNSProfileOpenShift:
+		g.dnsProfile = name
+		if name == "" {
+			g.dnsProfile = DNSProfileAuto
+		}
+		return g, nil
+	}
+	return g, fmt.Errorf("unknown DNS profile %q (auto, kubernetes, openshift; or --dns-resolver)", name)
+}
+
+// WithDNSResolver names the resolver explicitly: "<namespace>[/<label>=<value>[,<label>=<value>]]:<port>[/<protocol>]",
+// e.g. "kube-system/k8s-app=kube-dns:53/UDP" or "openshift-dns:5353" (no protocol: ANY)
+func (g *Generator) WithDNSResolver(spec string) (*Generator, error) {
+	r, err := ParseDNSResolver(spec)
+	if err != nil {
+		return g, err
+	}
+	g.dnsResolver = &r
+	return g, nil
+}
+
+// ParseDNSResolver parses the --dns-resolver form
+func ParseDNSResolver(spec string) (DNSResolver, error) {
+	var r DNSResolver
+	i := strings.LastIndex(spec, ":")
+	if i <= 0 || i == len(spec)-1 {
+		return r, fmt.Errorf("dns resolver %q: want <namespace>[/<label>=<value>]:<port>[/<protocol>]", spec)
+	}
+	where, portProto := spec[:i], spec[i+1:]
+	r.Port, r.Protocol = portProto, "ANY" // no protocol named: both, as Cilium's examples write it
+	if j := strings.Index(portProto, "/"); j > 0 {
+		r.Port, r.Protocol = portProto[:j], strings.ToUpper(portProto[j+1:])
+	}
+	r.Namespace = where
+	if j := strings.Index(where, "/"); j > 0 {
+		r.Namespace = where[:j]
+		r.Labels = map[string]string{}
+		for _, kv := range strings.Split(where[j+1:], ",") {
+			k, v, ok := strings.Cut(kv, "=")
+			if !ok || k == "" {
+				return r, fmt.Errorf("dns resolver %q: label %q is not key=value", spec, kv)
+			}
+			r.Labels[k] = v
+		}
+	}
+	if r.Namespace == "" {
+		return r, fmt.Errorf("dns resolver %q: the namespace is empty", spec)
+	}
+	return r, nil
+}
+
+// resolveDNS decides the resolver for this run: an explicit --dns-resolver, an explicit profile, or (auto) what the
+// flows show — falling back to the kubernetes profile when no DNS flow is among them
+func (g *Generator) resolveDNS(flows []*aggregator.AggregatedFlow) DNSResolver {
+	if g.dnsResolver != nil {
+		return *g.dnsResolver
+	}
+	if g.dnsProfile != "" && g.dnsProfile != DNSProfileAuto {
+		return dnsProfiles[g.dnsProfile]
+	}
+	if r, ok := DeriveDNSResolver(flows); ok {
+		return r
+	}
+	return dnsProfiles[DNSProfileKubernetes]
+}
+
+// DeriveDNSResolver finds the resolver in the observed flows: an EGRESS flow to a resolver pod (looksLikeDNS) on a
+// DNS port (53 or 5353). The rule then names that namespace, the identifying label the pods carry (k8s-app=kube-dns
+// on kubeadm and the managed clusters, app.kubernetes.io/name=coredns from the CoreDNS Helm chart; none on OpenShift,
+// whose pods carry the operator's labels the naming does not use), the port as
+// observed — and the protocol ANY, whatever was observed: the rule exists to put the lookups through the proxy, not
+// to restrict a protocol, and a lookup whose UDP answer is truncated retries over TCP, which a UDP-only rule denies
+// under default-deny egress (review ENH-003; Cilium's examples write ANY; 0.6.x wrote the observed UDP).
+func DeriveDNSResolver(flows []*aggregator.AggregatedFlow) (DNSResolver, bool) {
+	var found *DNSResolver
+	for _, f := range flows {
+		if f.Direction != "EGRESS" || f.IsReply || f.IsWorldTraffic || f.IsDestEntityTraffic {
+			continue
+		}
+		for _, p := range f.Ports {
+			if p.Port != 53 && p.Port != 5353 {
+				continue
+			}
+			if !looksLikeDNS(f.DestNamespace, f.DestLabels) {
+				continue
+			}
+			if found == nil {
+				found = &DNSResolver{Namespace: f.DestNamespace, Port: fmt.Sprint(p.Port), Protocol: "ANY", Labels: resolverIDLabels(f.DestLabels)}
+			}
+		}
+	}
+	if found == nil {
+		return DNSResolver{}, false
+	}
+	return *found, true
+}
+
+// resolverLabelKeys are the identifying labels a resolver pod may carry, in the order the parser prefers them:
+// kubeadm, kind and the managed clusters label CoreDNS k8s-app=kube-dns; the official CoreDNS Helm chart labels
+// app.kubernetes.io/name=coredns (and k8s-app=coredns only as a cluster service) — and extractLabels keeps the
+// app.kubernetes.io/* labels and drops k8s-app when they are present (review ENH-003, second pass).
+var resolverLabelKeys = []string{"k8s-app", "app.kubernetes.io/name", "app"}
+
+// resolverIDLabels returns the one label that identifies a resolver pod among the labels the parser kept, or nil
+func resolverIDLabels(labels map[string]string) map[string]string {
+	for _, key := range resolverLabelKeys {
+		switch labels[key] {
+		case "kube-dns", "coredns", "node-local-dns":
+			return map[string]string{key: labels[key]}
+		}
+	}
+	return nil
+}
+
+// looksLikeDNS says whether a peer on a DNS port is the resolver: CoreDNS / kube-dns by its label, NodeLocal DNSCache
+// by its label (under a Local Redirect Policy the lookups reach that pod, so the rule must name it — a rule naming
+// kube-dns would cut the pod off), or OpenShift's DNS operator by its namespace (its pods carry no k8s-app label,
+// Cilium's DNS guide). Anything else in kube-system on 53 is not the resolver (review ENH-003).
+func looksLikeDNS(namespace string, labels map[string]string) bool {
+	return resolverIDLabels(labels) != nil || namespace == "openshift-dns"
+}
+
+// dnsRule is the egress rule for the resolver in use: the pods it names on their port, with the L7 DNS rule that
+// puts every lookup through the proxy (matchPattern "*": visibility, not restriction)
+func (g *Generator) dnsRule() EgressRule {
+	return dnsRuleFor(g.resolver)
+}
+
+func dnsRuleFor(r DNSResolver) EgressRule {
+	labels := map[string]string{flow.GetNamespaceLabel(): r.Namespace}
+	keys := make([]string, 0, len(r.Labels))
+	for k := range r.Labels {
+		keys = append(keys, k)
+	}
+	sort.Strings(keys)
+	for _, k := range keys {
+		labels[k] = r.Labels[k]
+	}
+	return EgressRule{
+		EgressCommonRule: EgressCommonRule{ToEndpoints: []EndpointSelector{Selector(labels)}},
+		ToPorts: PortRules{{
+			Ports: []Port{{Port: r.Port, Protocol: api.L4Proto(r.Protocol)}},
+			Rules: &L7Rules{DNS: []DNSRule{{MatchPattern: "*"}}},
+		}},
+	}
+}
diff --git a/internal/policy/dns_test.go b/internal/policy/dns_test.go
new file mode 100644
index 0000000..5b19cee
--- /dev/null
+++ b/internal/policy/dns_test.go
@@ -0,0 +1,100 @@
+package policy
+
+import (
+	"strings"
+	"testing"
+)
+
+// 0.7.0: the DNS resolver rule is derived from the observed DNS flows. On a Kubernetes cluster the derived rule names
+// what cf2cnp always named (kube-system, k8s-app=kube-dns, 53) — the kubernetes profile — with the protocol ANY
+// (review ENH-003: 0.6.x wrote UDP, which denies the TCP retry of a truncated answer).
+func TestDNSResolver_DerivedKubernetes(t *testing.T) {
+	ps, err := NewGenerator("").WithDNSVisibility().BuildPolicies(load(t, "egress-pos-to-kube-dns.json", "egress-pos-to-world.json"))
+	if err != nil || len(ps) != 1 {
+		t.Fatalf("one policy expected: %d %v", len(ps), err)
+	}
+	if got, want := mustYAML(ps[0].Spec.Egress[len(ps[0].Spec.Egress)-1]), mustYAML(dnsRuleFor(dnsProfiles[DNSProfileKubernetes])); got != want {
+		t.Fatalf("the derived Kubernetes resolver must equal the kubernetes profile:\n%s\n%s", got, want)
+	}
+}
+
+// Cilium's DNS guide: "OpenShift users will need to modify the policies to match the namespace openshift-dns (instead
+// of kube-system), remove the match on the k8s:k8s-app=kube-dns label, and change the port to 5353". Derived from a
+// lookup to the DNS operator's pod: that rule, on the port observed, protocol ANY.
+func TestDNSResolver_DerivedOpenShift(t *testing.T) {
+	ps, err := NewGenerator("").WithDNSVisibility().BuildPolicies(load(t, "egress-pos-to-openshift-dns.json", "egress-pos-to-world.json"))
+	if err != nil || len(ps) != 1 {
+		t.Fatalf("one policy expected: %d %v", len(ps), err)
+	}
+	dns := ps[0].Spec.Egress[len(ps[0].Spec.Egress)-1]
+	labels := MatchLabelsOf(dns.ToEndpoints[0])
+	if labels["io.kubernetes.pod.namespace"] != "openshift-dns" || labels["k8s-app"] != "" || len(labels) != 1 {
+		t.Fatalf("the OpenShift resolver is the namespace alone, got %v", labels)
+	}
+	if p := dns.ToPorts[0].Ports[0]; p.Port != "5353" || p.Protocol != "ANY" {
+		t.Fatalf("port 5353 as observed, ANY, got %s/%s", p.Protocol, p.Port)
+	}
+	if dns.ToPorts[0].Rules == nil || dns.ToPorts[0].Rules.DNS[0].MatchPattern != "*" {
+		t.Fatalf("the L7 DNS rule must be there: %s", mustYAML(dns))
+	}
+	if !strings.Contains(ps[0].Spec.Description, "to endpoints in openshift-dns on ANY/5353 (DNS *)") {
+		t.Fatalf("description: %q", ps[0].Spec.Description)
+	}
+	// the plain 5353 rule the lookup itself produced is shadowed by the L7 one, as for kube-dns (issue #1)
+	count := 0
+	for _, r := range ps[0].Spec.Egress {
+		if len(r.ToEndpoints) == 1 && MatchLabelsOf(r.ToEndpoints[0])["io.kubernetes.pod.namespace"] == "openshift-dns" {
+			count++
+		}
+	}
+	if count != 1 {
+		t.Fatalf("the resolver must appear once, got %d", count)
+	}
+}
+
+// Without a DNS flow the profile decides: openshift writes the guide's rule (5353/ANY); kubernetes the historic one
+func TestDNSResolver_Profiles(t *testing.T) {
+	g, err := NewGenerator("").WithDNSProfile(DNSProfileOpenShift)
+	if err != nil {
+		t.Fatal(err)
+	}
+	ps, err := g.WithDNSVisibility().BuildPolicies(load(t, "egress-pos-to-world.json"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	dns := ps[0].Spec.Egress[1]
+	if p := dns.ToPorts[0].Ports[0]; p.Port != "5353" || p.Protocol != "ANY" || MatchLabelsOf(dns.ToEndpoints[0])["io.kubernetes.pod.namespace"] != "openshift-dns" {
+		t.Fatalf("openshift profile: %s", mustYAML(dns))
+	}
+	if _, err := NewGenerator("").WithDNSProfile("rancher"); err == nil {
+		t.Fatal("an unknown profile must be refused")
+	}
+	if err := Validate(ps[0]); err != nil {
+		t.Fatal(err)
+	}
+}
+
+// --dns-resolver names any resolver: namespace, optional labels, port, optional protocol
+func TestDNSResolver_Custom(t *testing.T) {
+	r, err := ParseDNSResolver("dns-system/app=coredns,tier=infra:5353/ANY")
+	if err != nil || r.Namespace != "dns-system" || r.Labels["app"] != "coredns" || r.Labels["tier"] != "infra" || r.Port != "5353" || r.Protocol != "ANY" {
+		t.Fatalf("parse: %+v %v", r, err)
+	}
+	r, err = ParseDNSResolver("kube-system:53")
+	if err != nil || r.Port != "53" || r.Protocol != "ANY" || r.Labels != nil {
+		t.Fatalf("defaults: %+v %v", r, err)
+	}
+	for _, bad := range []string{"kube-system", ":53", "ns/notalabel:53", ""} {
+		if _, err := ParseDNSResolver(bad); err == nil {
+			t.Fatalf("%q must be refused", bad)
+		}
+	}
+	g, _ := NewGenerator("").WithDNSResolver("dns-system/app=coredns:5353/TCP")
+	ps, err := g.WithDNSVisibility().BuildPolicies(load(t, "egress-pos-to-world.json"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(ps[0].Spec.Description, "to coredns in dns-system on TCP/5353 (DNS *)") {
+		t.Fatalf("description: %q", ps[0].Spec.Description)
+	}
+}
diff --git a/internal/policy/documents.go b/internal/policy/documents.go
new file mode 100644
index 0000000..810852e
--- /dev/null
+++ b/internal/policy/documents.go
@@ -0,0 +1,40 @@
+package policy
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"io"
+
+	"gopkg.in/yaml.v3"
+	sigsyaml "sigs.k8s.io/yaml"
+)
+
+// DecodePolicyDocuments reads every YAML document of a file as a CiliumNetworkPolicy, in order, skipping empty
+// documents (a bare `---`, a comment). The YAML decoder finds the document boundaries; splitting the text on "---"
+// would cut a literal block that holds such a line (review ENH-003). Documents are counted from 1 in errors.
+func DecodePolicyDocuments(b []byte) ([]*CiliumNetworkPolicy, error) {
+	dec := yaml.NewDecoder(bytes.NewReader(b))
+	var out []*CiliumNetworkPolicy
+	for i := 1; ; i++ {
+		var node yaml.Node
+		if err := dec.Decode(&node); err != nil {
+			if errors.Is(err, io.EOF) {
+				return out, nil
+			}
+			return out, fmt.Errorf("document %d: %w", i, err)
+		}
+		if node.Kind == 0 || (node.Kind == yaml.DocumentNode && (len(node.Content) == 0 || node.Content[0].Tag == "!!null")) {
+			continue
+		}
+		raw, err := yaml.Marshal(&node)
+		if err != nil {
+			return out, fmt.Errorf("document %d: %w", i, err)
+		}
+		var p CiliumNetworkPolicy
+		if err := sigsyaml.Unmarshal(raw, &p); err != nil {
+			return out, fmt.Errorf("document %d: %w", i, err)
+		}
+		out = append(out, &p)
+	}
+}
diff --git a/internal/policy/generator.go b/internal/policy/generator.go
index 260c8d5..f258236 100644
--- a/internal/policy/generator.go
+++ b/internal/policy/generator.go
@@ -6,20 +6,113 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
+	"reflect"
 	"regexp"
+	"sort"
 	"strings"
 
+	"encoding/json"
+
 	"github.com/hubble-policy-gen/internal/aggregator"
 	"github.com/hubble-policy-gen/internal/flow"
-	"gopkg.in/yaml.v3"
+	"github.com/hubble-policy-gen/internal/render"
+
+	"github.com/cilium/cilium/pkg/policy/api"
+	k8svalidation "k8s.io/apimachinery/pkg/api/validation"
+	"k8s.io/apimachinery/pkg/util/validation/field"
 )
 
+// ClusterLabel is the label Cilium puts on every endpoint of a ClusterMesh member and matches in
+// fromEndpoints / toEndpoints (cilium Documentation/network/clustermesh/policy.rst). Since 1.19 a selector
+// WITHOUT it matches the local cluster only.
+const ClusterLabel = "io.cilium.k8s.policy.cluster"
+
+// peerCluster is the cluster to name on a peer selector: the peer's, when it is known and differs from the
+// local side's (the local side may be unknown — the peer's label is still what Cilium matches)
+func peerCluster(local, peer string) string {
+	if peer != "" && peer != local {
+		return peer
+	}
+	return ""
+}
+
 // ErrReplyFlow is returned when attempting to generate a policy for a reply flow
 var ErrReplyFlow = errors.New("this is a reply packet - you need to allow the original request, not the reply (Cilium's connection tracking automatically allows replies)")
 
+// ErrNameNeedsOnePolicy is returned when a name override is requested but the flows produce more than one policy
+var ErrNameNeedsOnePolicy = errors.New("a policy name can only be set when the flows produce a single policy")
+
+// ErrInvalidPolicy wraps a refusal by Cilium's own rule checks (Validate); the API answers it with a 400 and the
+// agent's sentence, not a 500
+var ErrInvalidPolicy = errors.New("invalid CiliumNetworkPolicy")
+
 // Generator generates CiliumNetworkPolicies from aggregated flows
 type Generator struct {
-	outputDir string
+	outputDir     string
+	nameOverride  string
+	l7            bool         // E2: emit HTTP/DNS rules from the flows' l7 records
+	dnsVisibility bool         // E3: add the DNS resolver's L7 DNS rule to world policies that have no names
+	dnsProfile    string       // 0.7.0: auto (from the flows), kubernetes or openshift
+	dnsResolver   *DNSResolver // 0.7.0: an explicit --dns-resolver, over the profile
+	resolver      DNSResolver  // the resolver of the current BuildPolicies run
+}
+
+// WithDNSVisibility adds the kube-dns L7 DNS rule to a world policy that has no names, so that the DNS
+// proxy records them and the next generation can write toFQDNs instead of toCIDR. Names come only from
+// the DNS proxy, and the proxy is enabled by exactly this rule (cilium Documentation/security/policy/layer3.rst,
+// "Obtaining DNS Data for use by toFQDNs").
+func (g *Generator) WithDNSVisibility() *Generator {
+	g.dnsVisibility = true
+	return g
+}
+
+// WithL7 makes the generator write layer-7 rules (HTTP method+path, DNS names) where the flows carry
+// them. The port then goes through the node's Envoy proxy (cilium Documentation/security/policy/layer7.rst);
+// the caller opted in.
+func (g *Generator) WithL7() *Generator {
+	g.l7 = true
+	return g
+}
+
+// portRules builds the toPorts list for an aggregated flow. Without WithL7 (or without L7 records) it is
+// one port rule with every port, as before. With them, every port that carries L7 records gets its own
+// port rule with a rules: block, and the ports without stay together — an HTTP rule seen on 8080 must not
+// restrict 5432 of the same peer pair (review finding). Cilium's L7Rules is a union: one protocol per port.
+func (g *Generator) portRules(f *aggregator.AggregatedFlow) PortRules {
+	if !g.l7 {
+		return PortRules{{Ports: convertPorts(f.Ports)}}
+	}
+	var plain []aggregator.PortInfo
+	var rules PortRules
+	for _, p := range f.Ports {
+		r := l7RulesFor(p)
+		if r == nil {
+			plain = append(plain, p)
+			continue
+		}
+		rules = append(rules, PortRule{Ports: convertPorts([]aggregator.PortInfo{p}), Rules: r})
+	}
+	if len(plain) > 0 {
+		rules = append(PortRules{{Ports: convertPorts(plain)}}, rules...)
+	}
+	return rules
+}
+
+// l7RulesFor is the rules: block for one port, or nil when nothing was seen on it
+func l7RulesFor(p aggregator.PortInfo) *L7Rules {
+	if len(p.HTTPRequests) == 0 && len(p.DNSQueries) == 0 {
+		return nil
+	}
+	r := &L7Rules{}
+	for _, req := range p.HTTPRequests {
+		// Envoy matches the regex against the WHOLE :path header, which carries the query string too:
+		// the path is escaped, and an optional query is allowed — "/payments?x=1" is still /payments.
+		r.HTTP = append(r.HTTP, HTTPRule{Method: req.Method, Path: "^" + regexp.QuoteMeta(req.Path) + `(\?.*)?$`})
+	}
+	for _, q := range p.DNSQueries {
+		r.DNS = append(r.DNS, DNSRule{MatchName: q})
+	}
+	return r
 }
 
 // NewGenerator creates a new policy generator
@@ -27,9 +120,18 @@ func NewGenerator(outputDir string) *Generator {
 	return &Generator{outputDir: outputDir}
 }
 
-// GeneratePolicies generates CiliumNetworkPolicy files from aggregated flows
-func (g *Generator) GeneratePolicies(flows []*aggregator.AggregatedFlow) error {
-	// Check if all flows are reply flows
+// WithName makes the generator name the (single) resulting policy as given, sanitized for Kubernetes.
+// Without it a policy is named after the workload it selects, so two flows to the same workload from
+// different peers produce two objects with the same name — the second applied replaces the first.
+func (g *Generator) WithName(name string) *Generator {
+	g.nameOverride = sanitizeK8sName(name)
+	return g
+}
+
+// BuildPolicies turns aggregated flows into policies: one per flow, then flows that select the same
+// workload (same namespace, name and endpointSelector) are merged into one object carrying every
+// rule. Reply flows are skipped; if every flow is a reply, ErrReplyFlow is returned.
+func (g *Generator) BuildPolicies(flows []*aggregator.AggregatedFlow) ([]*CiliumNetworkPolicy, error) {
 	allReplies := true
 	for _, f := range flows {
 		if !f.IsReply {
@@ -38,77 +140,349 @@ func (g *Generator) GeneratePolicies(flows []*aggregator.AggregatedFlow) error {
 		}
 	}
 	if allReplies && len(flows) > 0 {
-		return ErrReplyFlow
+		return nil, ErrReplyFlow
 	}
 
+	g.resolver = g.resolveDNS(flows) // the DNS rule of this run: from the flows, or the profile (dns.go)
+
+	var policies []*CiliumNetworkPolicy
 	for _, f := range flows {
-		// Skip reply flows with a message
 		if f.IsReply {
-			fmt.Printf("Skipping reply flow: %s\n", ErrReplyFlow.Error())
 			continue
 		}
-		policy := g.GeneratePolicy(f)
-		needsCIDRComment := f.IsWorldTraffic && len(f.DestFQDNs) == 0
-		if err := g.writePolicyWithComment(policy, needsCIDRComment); err != nil {
+		policies = append(policies, g.GeneratePolicy(f))
+	}
+	policies = mergePolicies(policies, g.dnsRule())
+	for _, p := range policies {
+		if err := Validate(p); err != nil {
+			return nil, err
+		}
+	}
+
+	if g.nameOverride != "" {
+		if len(policies) != 1 {
+			return nil, fmt.Errorf("%w: got %d", ErrNameNeedsOnePolicy, len(policies))
+		}
+		policies[0].Metadata.Name = g.nameOverride
+	}
+	return policies, nil
+}
+
+// Validate runs Cilium's own admission-time checks (api.Rule.Sanitize) on the policy and reports the agent's error
+// text — "combining FromEndpoints and FromCIDR is not supported yet", an unparsable CIDR, an invalid selector. It works
+// on a deep copy: Sanitize also normalises what it checks (selector keys get Cilium's label-source prefix, the protocol
+// is upper-cased, enableDefaultDeny is filled), and none of that belongs in the document a user reads
+// (docs/CRD-SPEC-FORENSICS.md §3, probes 2 and 3).
+//
+// Sanitize checks the rule, not the object: the name is checked here as the API server does (a DNS-1123 subdomain;
+// the agent's own Parse refuses an empty one), and `specs` rule by rule (review ENH-003).
+func Validate(p *CiliumNetworkPolicy) error {
+	refuse := func(format string, a ...interface{}) error {
+		return fmt.Errorf("%w %s/%s: %s", ErrInvalidPolicy, p.Metadata.Namespace, p.Metadata.Name, fmt.Sprintf(format, a...))
+	}
+	// a decoded document names its kind and version; both must be the CRD's (customresource/validator.go refuses
+	// a wrong apiVersion). A policy built in memory carries neither — the generator sets them on the envelope.
+	if p.APIVersion != "" || p.Kind != "" {
+		if p.APIVersion != "cilium.io/v2" {
+			return refuse("apiVersion %q must be cilium.io/v2", p.APIVersion)
+		}
+		if p.Kind != "CiliumNetworkPolicy" && p.Kind != "CiliumClusterwideNetworkPolicy" {
+			return refuse("kind %q is not a Cilium policy", p.Kind)
+		}
+	}
+	clusterwide := p.Kind == "CiliumClusterwideNetworkPolicy"
+	// the API server clears a namespace on a cluster-scoped object (rest/meta.go) — the file would apply and mean
+	// something else than it says; an offline validator refuses and says why (review ENH-003, Codex, second pass)
+	if clusterwide && p.Metadata.Namespace != "" {
+		return refuse("metadata.namespace %q: not allowed on a CiliumClusterwideNetworkPolicy — Kubernetes discards it on a cluster-scoped object, so remove it", p.Metadata.Namespace)
+	}
+	// the API server's ObjectMeta checks (name and namespace DNS-1123, label keys and values, annotations, …); a
+	// namespaced policy without a namespace gets kubectl's default for the check, as kubectl would fill it
+	meta := p.Metadata.DeepCopy()
+	if meta.Namespace == "" && !clusterwide {
+		meta.Namespace = "default"
+	}
+	if errs := k8svalidation.ValidateObjectMeta(meta, !clusterwide, k8svalidation.NameIsDNSSubdomain, field.NewPath("metadata")); len(errs) > 0 {
+		return refuse("%v", errs.ToAggregate())
+	}
+	if len(p.Specs) == 0 || !reflect.DeepEqual(p.Spec, Rule{}) { // Cilium's Parse: spec, specs, or both; never neither
+		if err := validateRule(&p.Spec, "spec", clusterwide); err != nil {
+			return refuse("%v", err)
+		}
+	}
+	for i, r := range p.Specs {
+		if r == nil {
+			return refuse("specs[%d] is empty", i)
+		}
+		if err := validateRule(r, fmt.Sprintf("specs[%d]", i), clusterwide); err != nil {
+			return refuse("%v", err)
+		}
+	}
+	return nil
+}
+
+// validateRule is what the agent and the CRD check on one rule beyond Sanitize: a namespaced policy cannot carry a
+// nodeSelector (cnp_types.go Parse), and the CRD's protocol enum is upper case only — Sanitize upper-cases on its
+// copy, the schema sees the file (review ENH-003, Codex).
+func validateRule(r *Rule, path string, clusterwide bool) error {
+	if !clusterwide && r.NodeSelector.LabelSelector != nil {
+		return fmt.Errorf("%s: rule cannot have NodeSelector", path)
+	}
+	groups := []struct {
+		path  string
+		ports api.PortsIterator
+	}{}
+	for i := range r.Ingress {
+		groups = append(groups, struct {
+			path  string
+			ports api.PortsIterator
+		}{fmt.Sprintf("%s.ingress[%d]", path, i), r.Ingress[i].ToPorts})
+	}
+	for i := range r.IngressDeny {
+		groups = append(groups, struct {
+			path  string
+			ports api.PortsIterator
+		}{fmt.Sprintf("%s.ingressDeny[%d]", path, i), r.IngressDeny[i].ToPorts})
+	}
+	for i := range r.Egress {
+		groups = append(groups, struct {
+			path  string
+			ports api.PortsIterator
+		}{fmt.Sprintf("%s.egress[%d]", path, i), r.Egress[i].ToPorts})
+	}
+	for i := range r.EgressDeny {
+		groups = append(groups, struct {
+			path  string
+			ports api.PortsIterator
+		}{fmt.Sprintf("%s.egressDeny[%d]", path, i), r.EgressDeny[i].ToPorts})
+	}
+	for _, g := range groups {
+		err := g.ports.Iterate(func(ports api.Ports) error {
+			for i, pp := range ports.GetPortProtocols() {
+				if !crdProtocols[pp.Protocol] {
+					return fmt.Errorf("%s.toPorts.ports[%d].protocol: %q is not in the CRD's enum (upper case: TCP, UDP, ANY, …)", g.path, i, pp.Protocol)
+				}
+			}
+			return nil
+		})
+		if err != nil {
 			return err
 		}
 	}
+	check := r.DeepCopy()
+	if err := check.Sanitize(); err != nil {
+		return fmt.Errorf("%s: %w", path, err)
+	}
 	return nil
 }
 
-// GeneratePoliciesYAML generates CiliumNetworkPolicy YAML from aggregated flows and returns as bytes
-func (g *Generator) GeneratePoliciesYAML(flows []*aggregator.AggregatedFlow) ([]byte, error) {
-	var buf bytes.Buffer
-	encoder := yaml.NewEncoder(&buf)
-	encoder.SetIndent(2)
+// crdProtocols is the CRD's enum for ports[].protocol (internal/crd, `protocol:` enum), which Sanitize does not check
+// because it upper-cases first
+var crdProtocols = map[api.L4Proto]bool{
+	"": true, api.ProtoTCP: true, api.ProtoUDP: true, api.ProtoSCTP: true, api.ProtoVRRP: true, api.ProtoIGMP: true,
+	api.ProtoGRE: true, api.ProtoIPIP: true, api.ProtoIPv6: true, api.ProtoESP: true, api.ProtoAH: true, api.ProtoAny: true,
+}
 
-	// Check if all flows are reply flows
-	allReplies := true
-	for _, f := range flows {
-		if !f.IsReply {
-			allReplies = false
+// MergePolicies folds policies that select the same workload into one, in first-seen order. Two
+// generated policies are "the same workload" when namespace, name and endpointSelector match; their
+// ingress and egress rules are concatenated, an identical rule (the DNS rule every FQDN policy
+// carries) is kept once, and the description says how many observed flows the object now covers.
+func MergePolicies(policies []*CiliumNetworkPolicy) []*CiliumNetworkPolicy {
+	return mergePolicies(policies, dnsRuleFor(dnsProfiles[DNSProfileKubernetes]))
+}
+
+// mergePolicies is MergePolicies with the run's DNS rule, so the plain-rule shadow check knows what to compare against
+func mergePolicies(policies []*CiliumNetworkPolicy, dnsRule EgressRule) []*CiliumNetworkPolicy {
+	var order []string
+	byKey := make(map[string]*CiliumNetworkPolicy)
+	merged := make(map[string]int)
+	for _, p := range policies {
+		key := p.Metadata.Namespace + "/" + p.Metadata.Name + "/" + labelsKey(MatchLabelsOf(p.Spec.EndpointSelector))
+		existing, ok := byKey[key]
+		if !ok {
+			byKey[key] = p
+			order = append(order, key)
+			continue
+		}
+		merged[key]++
+		for _, r := range p.Spec.Ingress {
+			if !containsIngress(existing.Spec.Ingress, r) {
+				existing.Spec.Ingress = append(existing.Spec.Ingress, r)
+			}
+		}
+		for _, r := range p.Spec.Egress {
+			if !containsEgress(existing.Spec.Egress, r) {
+				existing.Spec.Egress = append(existing.Spec.Egress, r)
+			}
+		}
+	}
+	result := make([]*CiliumNetworkPolicy, 0, len(order))
+	for _, key := range order {
+		p := byKey[key]
+		p.Spec.Egress = dropShadowedDNSRule(p.Spec.Egress, dnsRule)
+		p.Spec.Description = Describe(p) // from the final rules, merged or not (0.6.2: the per-flow sentence said only the namespaces)
+		result = append(result, p)
+	}
+	return result
+}
+
+// dropShadowedDNSRule removes the plain kube-dns 53/UDP rule a pod's own lookups produce when the same policy also
+// carries the DNS-visibility rule (E3, or the toFQDNs path): same peer, same port, and `matchPattern: "*"` allows
+// every name, so the L7 rule says everything the plain one said. Cilium accepted both, but the policy read as if
+// the rule were there twice (demo 31; fork issue #1). A narrower DNS rule (names from --l7) is not a superset and
+// leaves the plain rule alone.
+func dropShadowedDNSRule(rules []EgressRule, dnsRule EgressRule) []EgressRule {
+	visibility := mustYAML(dnsRule)
+	shadowed := false
+	for _, r := range rules {
+		if mustYAML(r) == visibility {
+			shadowed = true
 			break
 		}
 	}
-	if allReplies && len(flows) > 0 {
-		return nil, ErrReplyFlow
+	if !shadowed {
+		return rules
+	}
+	kept := rules[:0]
+	for _, r := range rules {
+		if !plainTwinOf(r, dnsRule) {
+			kept = append(kept, r)
+		}
 	}
+	return kept
+}
 
-	policyCount := 0
-	for _, f := range flows {
-		// Skip reply flows
-		if f.IsReply {
-			continue
+// plainTwinOf says whether r is the DNS rule without its L7 block — the lookup's own plain rule. The resolver rule
+// is ANY (dns.go), so the plain twin may carry UDP, TCP, ANY or no protocol (review ENH-003, Codex).
+func plainTwinOf(r, dnsRule EgressRule) bool {
+	plain := dnsRule.DeepCopy()
+	plain.ToPorts[0].Rules = nil
+	protocols := []api.L4Proto{plain.ToPorts[0].Ports[0].Protocol}
+	if protocols[0] == api.ProtoAny {
+		protocols = []api.L4Proto{"", api.ProtoAny, api.ProtoTCP, api.ProtoUDP}
+	}
+	got := mustYAML(r)
+	for _, proto := range protocols {
+		plain.ToPorts[0].Ports[0].Protocol = proto
+		if got == mustYAML(*plain) {
+			return true
+		}
+	}
+	return false
+}
+
+func labelsKey(labels map[string]string) string {
+	keys := make([]string, 0, len(labels))
+	for k := range labels {
+		keys = append(keys, k)
+	}
+	sort.Strings(keys)
+	var b strings.Builder
+	for _, k := range keys {
+		b.WriteString(k)
+		b.WriteByte('=')
+		b.WriteString(labels[k])
+		b.WriteByte(',')
+	}
+	return b.String()
+}
+
+func containsIngress(rules []IngressRule, r IngressRule) bool {
+	want := mustYAML(r)
+	for _, have := range rules {
+		if mustYAML(have) == want {
+			return true
 		}
+	}
+	return false
+}
 
-		policy := g.GeneratePolicy(f)
-		if policyCount > 0 {
-			buf.WriteString("---\n")
+func containsEgress(rules []EgressRule, r EgressRule) bool {
+	want := mustYAML(r)
+	for _, have := range rules {
+		if mustYAML(have) == want {
+			return true
 		}
-		if err := encoder.Encode(policy); err != nil {
-			return nil, fmt.Errorf("failed to encode policy to YAML: %w", err)
+	}
+	return false
+}
+
+// mustYAML is the canonical text of a value for equality: JSON of Cilium's types (their json tags, maps sorted)
+func mustYAML(v interface{}) string {
+	out, err := json.Marshal(v)
+	if err != nil {
+		return fmt.Sprintf("%#v", v)
+	}
+	return string(out)
+}
+
+// hasCIDR reports whether a policy carries a toCIDR egress rule (the one that gets the world comment)
+func hasCIDR(p *CiliumNetworkPolicy) bool {
+	for _, r := range p.Spec.Egress {
+		if len(r.ToCIDR) > 0 {
+			return true
 		}
-		
-		// Add comment for world traffic (toCIDR)
-		if f.IsWorldTraffic && len(f.DestFQDNs) == 0 {
-			addToCIDRComment(&buf)
+	}
+	return false
+}
+
+// GeneratePolicies generates CiliumNetworkPolicy files from aggregated flows — one file per workload
+// (flows selecting the same workload are merged, so a later one no longer overwrites an earlier file)
+func (g *Generator) GeneratePolicies(flows []*aggregator.AggregatedFlow) error {
+	policies, err := g.BuildPolicies(flows)
+	if err != nil {
+		return err
+	}
+	for _, p := range policies {
+		if err := g.writePolicyWithComment(p, hasCIDR(p)); err != nil {
+			return err
 		}
-		policyCount++
 	}
+	return nil
+}
+
+// GeneratePoliciesYAML generates CiliumNetworkPolicy YAML from aggregated flows and returns it as bytes
+func (g *Generator) GeneratePoliciesYAML(flows []*aggregator.AggregatedFlow) ([]byte, error) {
+	_, out, err := g.GeneratePoliciesWithYAML(flows)
+	return out, err
+}
 
-	if err := encoder.Close(); err != nil {
-		return nil, fmt.Errorf("failed to close YAML encoder: %w", err)
+// GeneratePoliciesWithYAML returns the policies and their YAML (one document per policy, separated by ---)
+func (g *Generator) GeneratePoliciesWithYAML(flows []*aggregator.AggregatedFlow) ([]*CiliumNetworkPolicy, []byte, error) {
+	policies, err := g.BuildPolicies(flows)
+	if err != nil {
+		return nil, nil, err
+	}
+	out, err := EncodePolicies(policies)
+	if err != nil {
+		return nil, nil, err
 	}
+	return policies, out, nil
+}
 
+// EncodePolicies renders policies as a multi-document YAML stream with the world/CIDR comment where it applies
+func EncodePolicies(policies []*CiliumNetworkPolicy) ([]byte, error) {
+	var buf bytes.Buffer
+	for i, p := range policies {
+		if i > 0 {
+			buf.WriteString("---\n")
+		}
+		b, err := render.Document(p)
+		if err != nil {
+			return nil, fmt.Errorf("failed to encode policy to YAML: %w", err)
+		}
+		one := bytes.NewBuffer(b)
+		if hasCIDR(p) {
+			addToCIDRComment(one)
+		}
+		buf.Write(one.Bytes())
+	}
 	return buf.Bytes(), nil
 }
 
 // GeneratePolicy creates a CiliumNetworkPolicy from an aggregated flow
 func (g *Generator) GeneratePolicy(f *aggregator.AggregatedFlow) *CiliumNetworkPolicy {
-	policy := &CiliumNetworkPolicy{
-		APIVersion: "cilium.io/v2",
-		Kind:       "CiliumNetworkPolicy",
-	}
+	policy := NewPolicy()
 
 	if f.Direction == "INGRESS" {
 		g.generateIngressPolicy(policy, f)
@@ -124,14 +498,13 @@ func (g *Generator) generateIngressPolicy(policy *CiliumNetworkPolicy, f *aggreg
 	// For ingress, the destination is where the policy is applied
 	policy.Metadata.Namespace = f.DestNamespace
 	policy.Metadata.Name = generatePolicyName(f.DestLabels)
+	policy.Metadata.Labels = policyLabels(f.DestLabels)
 
 	// Generate description
 	policy.Spec.Description = g.generateDescription(f)
 
 	// Endpoint selector based on destination labels
-	policy.Spec.EndpointSelector = LabelSelector{
-		MatchLabels: f.DestLabels,
-	}
+	policy.Spec.EndpointSelector = Selector(f.DestLabels)
 
 	if f.IsSourceEntity {
 		// Entity-based ingress (from remote-node, host, etc.)
@@ -149,40 +522,51 @@ func (g *Generator) generateEndpointIngressRules(policy *CiliumNetworkPolicy, f
 
 	// From endpoints with source labels
 	fromLabels := copyLabels(f.SourceLabels)
-	
+
 	// Add namespace label if cross-namespace traffic
 	if f.SourceNamespace != "" && f.SourceNamespace != f.DestNamespace {
 		fromLabels[flow.GetNamespaceLabel()] = f.SourceNamespace
 	}
-
-	ingressRule.FromEndpoints = []LabelSelector{
-		{MatchLabels: fromLabels},
+	// ClusterMesh (E1): name the peer's cluster, or the rule matches the local cluster only
+	if c := peerCluster(f.DestCluster, f.SourceCluster); c != "" {
+		fromLabels[ClusterLabel] = c
 	}
 
+	ingressRule.FromEndpoints = []EndpointSelector{Selector(fromLabels)}
+
 	// Add port rules
-	ingressRule.ToPorts = []PortRule{
-		{Ports: convertPorts(f.Ports)},
-	}
+	ingressRule.ToPorts = g.portRules(f)
 
 	policy.Spec.Ingress = []IngressRule{ingressRule}
 }
 
-// generateEntityIngressRules generates entity-based ingress rules (from remote-node, host, etc.)
+// generateEntityIngressRules generates entity-based ingress rules (from remote-node, host, etc.). A world source
+// with an address becomes fromCIDR (one /32 per observed address, 0.7.0): an egress-gateway IP, a load balancer's
+// client, an office range — what the receiver actually saw. Without an address it stays fromEntities: [world].
 func (g *Generator) generateEntityIngressRules(policy *CiliumNetworkPolicy, f *aggregator.AggregatedFlow) {
 	// Create ingress rule with fromEntities
 	ingressRule := IngressRule{}
 
+	if f.SourceEntity == "world" && len(f.SourceIPs) > 0 {
+		cidrs := make(CIDRSlice, 0, len(f.SourceIPs))
+		for _, ip := range f.SourceIPs {
+			cidrs = append(cidrs, hostCIDR(ip))
+		}
+		ingressRule.FromCIDR = cidrs
+		ingressRule.ToPorts = g.portRules(f)
+		policy.Spec.Ingress = []IngressRule{ingressRule}
+		return
+	}
+
 	// For remote-node or host, include both to handle same-node and cross-node traffic
 	if f.SourceEntity == "remote-node" || f.SourceEntity == "host" {
-		ingressRule.FromEntities = []string{"remote-node", "host"}
+		ingressRule.FromEntities = EntitySlice{"remote-node", "host"}
 	} else {
-		ingressRule.FromEntities = []string{f.SourceEntity}
+		ingressRule.FromEntities = EntitySlice{api.Entity(f.SourceEntity)}
 	}
 
 	// Add port rules
-	ingressRule.ToPorts = []PortRule{
-		{Ports: convertPorts(f.Ports)},
-	}
+	ingressRule.ToPorts = g.portRules(f)
 
 	policy.Spec.Ingress = []IngressRule{ingressRule}
 }
@@ -192,14 +576,13 @@ func (g *Generator) generateEgressPolicy(policy *CiliumNetworkPolicy, f *aggrega
 	// For egress, the source is where the policy is applied
 	policy.Metadata.Namespace = f.SourceNamespace
 	policy.Metadata.Name = generatePolicyName(f.SourceLabels)
+	policy.Metadata.Labels = policyLabels(f.SourceLabels)
 
 	// Generate description
 	policy.Spec.Description = g.generateDescription(f)
 
 	// Endpoint selector based on source labels
-	policy.Spec.EndpointSelector = LabelSelector{
-		MatchLabels: f.SourceLabels,
-	}
+	policy.Spec.EndpointSelector = Selector(f.SourceLabels)
 
 	if f.IsDestEntityTraffic && f.DestEntity != "world" {
 		// Entity-based egress (kube-apiserver, host, etc.)
@@ -222,7 +605,7 @@ func (g *Generator) generateEgressPolicy(policy *CiliumNetworkPolicy, f *aggrega
 func (g *Generator) generateFQDNEgressRules(policy *CiliumNetworkPolicy, f *aggregator.AggregatedFlow) {
 	// First rule: FQDN-based egress
 	fqdnRule := EgressRule{}
-	
+
 	// Add FQDN selectors
 	for _, fqdn := range f.DestFQDNs {
 		fqdnRule.ToFQDNs = append(fqdnRule.ToFQDNs, FQDNSelector{
@@ -231,54 +614,31 @@ func (g *Generator) generateFQDNEgressRules(policy *CiliumNetworkPolicy, f *aggr
 	}
 
 	// Add port rules
-	fqdnRule.ToPorts = []PortRule{
-		{Ports: convertPorts(f.Ports)},
-	}
+	fqdnRule.ToPorts = g.portRules(f)
 
 	// Second rule: DNS resolution (required for toFQDNs to work)
-	dnsRule := EgressRule{
-		ToEndpoints: []LabelSelector{
-			{
-				MatchLabels: map[string]string{
-					flow.GetNamespaceLabel(): "kube-system",
-					"k8s-app":                "kube-dns",
-				},
-			},
-		},
-		ToPorts: []PortRule{
-			{
-				Ports: []Port{
-					{Port: "53", Protocol: "UDP"},
-				},
-				Rules: &DNSRules{
-					DNS: []DNSRule{
-						{MatchPattern: "*"},
-					},
-				},
-			},
-		},
-	}
-
-	policy.Spec.Egress = []EgressRule{fqdnRule, dnsRule}
+	policy.Spec.Egress = []EgressRule{fqdnRule, g.dnsRule()}
 }
 
 // generateWorldEgressRules generates CIDR-based egress rules for world traffic without FQDNs
 func (g *Generator) generateWorldEgressRules(policy *CiliumNetworkPolicy, f *aggregator.AggregatedFlow) {
 	// Convert destination IPs to CIDRs
-	cidrs := make([]string, 0, len(f.DestIPs))
+	cidrs := make(CIDRSlice, 0, len(f.DestIPs))
 	for _, ip := range f.DestIPs {
-		cidrs = append(cidrs, ip+"/32")
+		cidrs = append(cidrs, hostCIDR(ip))
 	}
 
 	// Rule for CIDR-based world traffic
 	cidrRule := EgressRule{
-		ToCIDR: cidrs,
-		ToPorts: []PortRule{
-			{Ports: convertPorts(f.Ports)},
-		},
+		EgressCommonRule: EgressCommonRule{ToCIDR: cidrs},
+		ToPorts:          g.portRules(f),
 	}
 
 	policy.Spec.Egress = []EgressRule{cidrRule}
+	// E3: with the DNS proxy on, the next flows carry destination_names and the next generation writes toFQDNs
+	if g.dnsVisibility {
+		policy.Spec.Egress = append(policy.Spec.Egress, g.dnsRule())
+	}
 }
 
 // generateEntityEgressRules generates entity-based egress rules for reserved entities (kube-apiserver, host, etc.)
@@ -288,14 +648,12 @@ func (g *Generator) generateEntityEgressRules(policy *CiliumNetworkPolicy, f *ag
 
 	// For remote-node or host, include both to handle same-node and cross-node traffic
 	if f.DestEntity == "remote-node" || f.DestEntity == "host" {
-		entityRule.ToEntities = []string{"remote-node", "host"}
+		entityRule.ToEntities = EntitySlice{"remote-node", "host"}
 	} else {
-		entityRule.ToEntities = []string{f.DestEntity}
+		entityRule.ToEntities = EntitySlice{api.Entity(f.DestEntity)}
 	}
 
-	entityRule.ToPorts = []PortRule{
-		{Ports: convertPorts(f.Ports)},
-	}
+	entityRule.ToPorts = g.portRules(f)
 
 	policy.Spec.Egress = []EgressRule{entityRule}
 }
@@ -311,15 +669,15 @@ func (g *Generator) generateEndpointEgressRules(policy *CiliumNetworkPolicy, f *
 	if f.DestNamespace != "" && f.DestNamespace != f.SourceNamespace {
 		toLabels[flow.GetNamespaceLabel()] = f.DestNamespace
 	}
-
-	egressRule.ToEndpoints = []LabelSelector{
-		{MatchLabels: toLabels},
+	// ClusterMesh (E1): name the peer's cluster, or the rule matches the local cluster only
+	if c := peerCluster(f.SourceCluster, f.DestCluster); c != "" {
+		toLabels[ClusterLabel] = c
 	}
 
+	egressRule.ToEndpoints = []EndpointSelector{Selector(toLabels)}
+
 	// Add port rules
-	egressRule.ToPorts = []PortRule{
-		{Ports: convertPorts(f.Ports)},
-	}
+	egressRule.ToPorts = g.portRules(f)
 
 	policy.Spec.Egress = []EgressRule{egressRule}
 }
@@ -357,12 +715,44 @@ func (g *Generator) generateDescription(f *aggregator.AggregatedFlow) string {
 	return fmt.Sprintf("Allow %s traffic %s for the %s", direction, fromTo, target)
 }
 
-// generatePolicyName creates a policy name from labels
+// generatePolicyName creates a policy name from the selector's labels. Kubernetes identifies an object by
+// group, kind, namespace and name, so two workloads that share app.kubernetes.io/name but differ by
+// instance or component (the recommended labels' own distinction: name = the application, instance =
+// one installation of it, component = one part of it) must not produce two objects with one name —
+// the second `kubectl apply` would replace the first, silently. The name is therefore a function of
+// EVERY identifying label the selector carries, in the order name, instance, component, so that equal
+// names imply equal selectors: "shop", "shop-frontend", "shop-blue-frontend".
 func generatePolicyName(labels map[string]string) string {
-	name := getAppName(labels)
-	// Sanitize the name for Kubernetes
-	name = sanitizeK8sName(name)
-	return name
+	parts := []string{getAppName(labels)}
+	for _, key := range []string{"app.kubernetes.io/instance", "app.kubernetes.io/component", "instance", "component"} {
+		v, ok := labels[key]
+		if !ok || v == "" {
+			continue
+		}
+		dup := false
+		for _, p := range parts {
+			if p == v {
+				dup = true
+			}
+		}
+		if !dup {
+			parts = append(parts, v)
+		}
+	}
+	return sanitizeK8sName(strings.Join(parts, "-"))
+}
+
+// policyLabels are the labels stamped on every generated policy: who generated it, and the selector's
+// identifying labels copied, so `kubectl get cnp -l app.kubernetes.io/name=shop` lists a workload's
+// policies whatever they are named.
+func policyLabels(selector map[string]string) map[string]string {
+	out := map[string]string{"app.kubernetes.io/managed-by": "cf2cnp"}
+	for _, key := range []string{"app.kubernetes.io/name", "app.kubernetes.io/instance", "app.kubernetes.io/component"} {
+		if v, ok := selector[key]; ok && v != "" {
+			out[key] = v
+		}
+	}
+	return out
 }
 
 // getAppName extracts the application name from labels
@@ -427,23 +817,14 @@ func (g *Generator) writePolicyWithComment(policy *CiliumNetworkPolicy, needsCID
 	filename := fmt.Sprintf("%s-%s.yaml", policy.Metadata.Namespace, policy.Metadata.Name)
 	filePath := filepath.Join(g.outputDir, filename)
 
-	// Marshal to YAML with 2-space indentation
-	var buf bytes.Buffer
-	encoder := yaml.NewEncoder(&buf)
-	encoder.SetIndent(2)
-	if err := encoder.Encode(policy); err != nil {
+	b, err := render.Document(policy)
+	if err != nil {
 		return fmt.Errorf("failed to encode policy to YAML: %w", err)
 	}
-	if err := encoder.Close(); err != nil {
-		return fmt.Errorf("failed to close YAML encoder: %w", err)
-	}
-
-	// Add CIDR comment if needed
+	buf := bytes.NewBuffer(b)
 	if needsCIDRComment {
-		addToCIDRComment(&buf)
+		addToCIDRComment(buf)
 	}
-
-	// Write to file
 	if err := os.WriteFile(filePath, buf.Bytes(), 0644); err != nil {
 		return fmt.Errorf("failed to write policy file: %w", err)
 	}
@@ -458,12 +839,21 @@ func convertPorts(ports []aggregator.PortInfo) []Port {
 	for i, p := range ports {
 		result[i] = Port{
 			Port:     fmt.Sprintf("%d", p.Port),
-			Protocol: p.Protocol,
+			Protocol: api.L4Proto(strings.ToUpper(p.Protocol)), // the CRD's enum is upper-case only
 		}
 	}
 	return result
 }
 
+// hostCIDR is the single-address prefix for an observed address: /32 for IPv4, /128 for IPv6 (0.6.x wrote /32 for
+// both, which Cilium refuses for an IPv6 address)
+func hostCIDR(ip string) api.CIDR {
+	if strings.Contains(ip, ":") {
+		return api.CIDR(ip + "/128")
+	}
+	return api.CIDR(ip + "/32")
+}
+
 // copyLabels creates a copy of the labels map
 func copyLabels(labels map[string]string) map[string]string {
 	result := make(map[string]string, len(labels))
@@ -476,30 +866,32 @@ func copyLabels(labels map[string]string) map[string]string {
 // addToCIDRComment inserts a comment after toCIDR in the YAML output
 func addToCIDRComment(buf *bytes.Buffer) {
 	content := buf.String()
-	
+
 	// Find toCIDR and toPorts to insert comment between them
 	toCIDRIdx := strings.LastIndex(content, "toCIDR:")
 	if toCIDRIdx == -1 {
 		return
 	}
-	
+
 	// Find toPorts after toCIDR
 	restContent := content[toCIDRIdx:]
 	toPortsIdx := strings.Index(restContent, "      toPorts:")
 	if toPortsIdx == -1 {
 		return
 	}
-	
+
 	// Calculate the actual position (right before the indentation of "toPorts:")
 	insertPos := toCIDRIdx + toPortsIdx
-	
+
 	// The comment should align with the list item when uncommented (4 spaces for the -)
 	toCIDRComment := "    # To allow all traffic to world instead of specific IPs, replace toCIDR with:\n    # - toEntities:\n    #     - world\n"
-	
+	if strings.Contains(content, "rules:\n            dns:") {
+		toCIDRComment += "    # The DNS rule below turns the DNS proxy on for these endpoints: once flows carry destination_names,\n    # regenerate to get a toFQDNs rule instead of this CIDR.\n"
+	}
+
 	// Insert the comment before toPorts
 	newContent := content[:insertPos] + toCIDRComment + content[insertPos:]
-	
+
 	buf.Reset()
 	buf.WriteString(newContent)
 }
-
diff --git a/internal/policy/generator_test.go b/internal/policy/generator_test.go
new file mode 100644
index 0000000..597479d
--- /dev/null
+++ b/internal/policy/generator_test.go
@@ -0,0 +1,409 @@
+package policy
+
+import (
+	"os"
+	"path/filepath"
+	"regexp"
+	"strings"
+	"testing"
+
+	"github.com/hubble-policy-gen/internal/aggregator"
+	"github.com/hubble-policy-gen/internal/flow"
+)
+
+func load(t *testing.T, names ...string) []*aggregator.AggregatedFlow {
+	t.Helper()
+	var all []*flow.ParsedFlow
+	for _, n := range names {
+		b, err := os.ReadFile(filepath.Join("..", "testdata", n))
+		if err != nil {
+			t.Fatal(err)
+		}
+		f, err := flow.ParseFlowsFromBytes(b)
+		if err != nil {
+			t.Fatal(err)
+		}
+		all = append(all, f...)
+	}
+	return aggregator.AggregateFlows(all)
+}
+
+// Before: two flows into shop from two peers produced two policies both named "shop" (the second
+// `kubectl apply` replaced the first). After: one policy with two ingress rules.
+func TestBuildPolicies_MergesSameWorkload(t *testing.T) {
+	policies, err := NewGenerator("").BuildPolicies(load(t, "ingress-pos-to-shop.json", "ingress-stranger-to-shop.json"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(policies) != 1 {
+		t.Fatalf("expected 1 merged policy, got %d", len(policies))
+	}
+	p := policies[0]
+	if p.Metadata.Name != "shop" || p.Metadata.Namespace != "cf2cnp-lab" || len(p.Spec.Ingress) != 2 {
+		t.Fatalf("unexpected policy: name=%s ns=%s ingress=%d", p.Metadata.Name, p.Metadata.Namespace, len(p.Spec.Ingress))
+	}
+	peers := p.Spec.Ingress[0].FromEndpoints[0].MatchLabels["app.kubernetes.io/name"] + "," + p.Spec.Ingress[1].FromEndpoints[0].MatchLabels["app.kubernetes.io/name"]
+	if peers != "pos,stranger" {
+		t.Fatalf("rules must keep first-seen order, got %s", peers)
+	}
+	if p.Spec.Description != "Allow ingress to shop in cf2cnp-lab: from pos on TCP/80; from stranger on TCP/80" {
+		t.Fatalf("the description must say what the rules say, got %q", p.Spec.Description)
+	}
+}
+
+// The same flow twice is one rule, not two
+func TestBuildPolicies_DedupesIdenticalRules(t *testing.T) {
+	policies, err := NewGenerator("").BuildPolicies(load(t, "ingress-pos-to-shop.json", "ingress-pos-to-shop.json"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(policies) != 1 || len(policies[0].Spec.Ingress) != 1 {
+		t.Fatalf("expected one policy with one rule, got %d policies, %d rules", len(policies), len(policies[0].Spec.Ingress))
+	}
+}
+
+// Different workloads stay different policies. The aggregator orders its output by key (direction
+// first), so the EGRESS policy for pos precedes the INGRESS policy for shop whatever the input order.
+func TestBuildPolicies_KeepsDistinctWorkloads(t *testing.T) {
+	policies, err := NewGenerator("").BuildPolicies(load(t, "ingress-pos-to-shop.json", "egress-pos-to-world.json"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(policies) != 2 || policies[0].Metadata.Name != "pos" || policies[1].Metadata.Name != "shop" {
+		t.Fatalf("expected pos (egress) then shop (ingress), got %s, %s", policies[0].Metadata.Name, policies[1].Metadata.Name)
+	}
+	if len(policies[0].Spec.Egress) != 1 || policies[0].Spec.Egress[0].ToCIDR[0] != "104.20.23.154/32" {
+		t.Fatalf("world flow without names must be a toCIDR rule, got %+v", policies[0].Spec.Egress)
+	}
+}
+
+func TestBuildPolicies_NameOverride(t *testing.T) {
+	// sanitizeK8sName (upstream, unchanged): lower-case, '_' → '-', anything else non [a-z0-9-] dropped
+	policies, err := NewGenerator("").WithName("Shop_From_POS!").BuildPolicies(load(t, "ingress-pos-to-shop.json"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if policies[0].Metadata.Name != "shop-from-pos" {
+		t.Fatalf("name must be sanitized for Kubernetes, got %q", policies[0].Metadata.Name)
+	}
+	_, err = NewGenerator("").WithName("x").BuildPolicies(load(t, "ingress-pos-to-shop.json", "egress-pos-to-world.json"))
+	if err == nil || !strings.Contains(err.Error(), "single policy") {
+		t.Fatalf("a name with two resulting policies must be refused, got %v", err)
+	}
+}
+
+// File mode: before the merge, two flows to the same workload wrote the same file twice (the second
+// overwrote the first). Now one file holds both rules.
+func TestGeneratePolicies_OneFilePerWorkload(t *testing.T) {
+	dir := t.TempDir()
+	if err := NewGenerator(dir).GeneratePolicies(load(t, "ingress-pos-to-shop.json", "ingress-stranger-to-shop.json", "egress-pos-to-world.json")); err != nil {
+		t.Fatal(err)
+	}
+	entries, _ := os.ReadDir(dir)
+	if len(entries) != 2 {
+		t.Fatalf("expected 2 files (shop, pos), got %d", len(entries))
+	}
+	b, _ := os.ReadFile(filepath.Join(dir, "cf2cnp-lab-shop.yaml"))
+	if strings.Count(string(b), "fromEndpoints") != 2 {
+		t.Fatalf("shop's file must carry both peers:\n%s", b)
+	}
+	b, _ = os.ReadFile(filepath.Join(dir, "cf2cnp-lab-pos.yaml"))
+	if !strings.Contains(string(b), "# - toEntities:") {
+		t.Fatalf("the world comment must survive the merge:\n%s", b)
+	}
+}
+
+func TestEncodePolicies_MultiDocument(t *testing.T) {
+	policies, _ := NewGenerator("").BuildPolicies(load(t, "ingress-pos-to-shop.json", "egress-pos-to-world.json"))
+	out, err := EncodePolicies(policies)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if strings.Count(string(out), "---\n") != 1 || strings.Count(string(out), "kind: CiliumNetworkPolicy") != 2 {
+		t.Fatalf("expected two documents separated once:\n%s", out)
+	}
+}
+
+func mkIngress(ns, name, component, instance, peer string) *aggregator.AggregatedFlow {
+	dst := map[string]string{"app.kubernetes.io/name": name}
+	if component != "" {
+		dst["app.kubernetes.io/component"] = component
+	}
+	if instance != "" {
+		dst["app.kubernetes.io/instance"] = instance
+	}
+	return &aggregator.AggregatedFlow{Direction: "INGRESS", DestNamespace: ns, DestLabels: dst, SourceNamespace: ns,
+		SourceLabels: map[string]string{"app.kubernetes.io/name": peer}, Ports: []aggregator.PortInfo{{Port: 80, Protocol: "TCP"}}}
+}
+
+// Kubernetes identifies an object by group/kind/namespace/name: two workloads that differ only by component
+// or instance must not produce two objects with one name (the second apply replaces the first).
+func TestBuildPolicies_NameIsAFunctionOfTheSelector(t *testing.T) {
+	ps, err := NewGenerator("").BuildPolicies([]*aggregator.AggregatedFlow{
+		mkIngress("store", "shop", "frontend", "", "pos"), mkIngress("store", "shop", "backend", "", "pos"),
+		mkIngress("store", "shop", "", "", "pos"), mkIngress("store", "shop", "frontend", "blue", "pos"),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	seen := map[string]bool{}
+	for _, p := range ps {
+		key := p.Metadata.Namespace + "/" + p.Metadata.Name
+		if seen[key] {
+			t.Fatalf("two policies share %s", key)
+		}
+		seen[key] = true
+	}
+	want := map[string]bool{"store/shop-frontend": true, "store/shop-backend": true, "store/shop": true, "store/shop-blue-frontend": true}
+	for k := range want {
+		if !seen[k] {
+			t.Fatalf("expected %s among %v", k, seen)
+		}
+	}
+	for _, p := range ps {
+		if p.Metadata.Labels["app.kubernetes.io/managed-by"] != "cf2cnp" || p.Metadata.Labels["app.kubernetes.io/name"] != "shop" {
+			t.Fatalf("labels must carry managed-by and the selector's name: %v", p.Metadata.Labels)
+		}
+		if c := p.Spec.EndpointSelector.MatchLabels["app.kubernetes.io/component"]; c != "" && p.Metadata.Labels["app.kubernetes.io/component"] != c {
+			t.Fatalf("component label must be carried: %v", p.Metadata.Labels)
+		}
+	}
+}
+
+// A workload with only app.kubernetes.io/name keeps the name it always had
+func TestBuildPolicies_NameUnchangedWithoutComponent(t *testing.T) {
+	ps, _ := NewGenerator("").BuildPolicies(load(t, "ingress-pos-to-shop.json"))
+	if ps[0].Metadata.Name != "shop" {
+		t.Fatalf("got %s", ps[0].Metadata.Name)
+	}
+}
+
+// E1: a cross-cluster flow (measured on the bank: payments@poc2 → redis-0@poc1:6379, an EGRESS flow reported by
+// the source's node) must name the peer's cluster, because since Cilium 1.19 a selector without
+// io.cilium.k8s.policy.cluster matches the local cluster only — the egress policy for payments (in poc2) would
+// otherwise allow only a redis in poc2 and exclude the poc1 one the flow went to.
+func TestBuildPolicies_CrossClusterPeerNamesItsCluster(t *testing.T) {
+	ps, err := NewGenerator("").BuildPolicies(load(t, "egress-payments-poc2-to-redis-poc1.json"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(ps) != 1 || len(ps[0].Spec.Egress) != 1 || len(ps[0].Spec.Egress[0].ToEndpoints) != 1 {
+		t.Fatalf("expected one policy with one endpoint egress rule, got %+v", ps)
+	}
+	to := ps[0].Spec.Egress[0].ToEndpoints[0].MatchLabels
+	if to[ClusterLabel] != "poc1" {
+		t.Fatalf("toEndpoints must carry %s=poc1, got %v", ClusterLabel, to)
+	}
+	if _, ok := ps[0].Spec.EndpointSelector.MatchLabels[ClusterLabel]; ok {
+		t.Fatalf("the endpointSelector (the local workload) must not carry the cluster label")
+	}
+	if ps[0].Metadata.Namespace != "bank" || ps[0].Metadata.Name != "payments" {
+		t.Fatalf("the policy is for the source workload: got %s/%s", ps[0].Metadata.Namespace, ps[0].Metadata.Name)
+	}
+}
+
+// Same-cluster flows are untouched: no cluster label (the local-only default is what is wanted), so the
+// output for every single-cluster fixture stays byte-identical
+func TestBuildPolicies_SameClusterHasNoClusterLabel(t *testing.T) {
+	for _, fx := range []string{"ingress-pos-to-shop.json", "egress-pos-to-world.json"} {
+		ps, _ := NewGenerator("").BuildPolicies(load(t, fx))
+		out, _ := EncodePolicies(ps)
+		if strings.Contains(string(out), ClusterLabel) {
+			t.Fatalf("%s: unexpected cluster label:\n%s", fx, out)
+		}
+	}
+}
+
+// Two peers with the same labels in two clusters are two rules
+func TestBuildPolicies_SameLabelsTwoClustersTwoRules(t *testing.T) {
+	mk := func(cluster string) *aggregator.AggregatedFlow {
+		return &aggregator.AggregatedFlow{Direction: "INGRESS", DestNamespace: "bank", DestCluster: "poc1",
+			DestLabels:      map[string]string{"app": "api"},
+			SourceNamespace: "bank", SourceCluster: cluster, SourceLabels: map[string]string{"app": "payments"},
+			Ports: []aggregator.PortInfo{{Port: 8080, Protocol: "TCP"}}}
+	}
+	ps, _ := NewGenerator("").BuildPolicies([]*aggregator.AggregatedFlow{mk("poc1"), mk("poc2")})
+	if len(ps) != 1 || len(ps[0].Spec.Ingress) != 2 {
+		t.Fatalf("expected one policy with two rules (local peer, poc2 peer), got %d policies", len(ps))
+	}
+	if ps[0].Spec.Ingress[0].FromEndpoints[0].MatchLabels[ClusterLabel] != "" || ps[0].Spec.Ingress[1].FromEndpoints[0].MatchLabels[ClusterLabel] != "poc2" {
+		t.Fatalf("rules: %+v", ps[0].Spec.Ingress)
+	}
+}
+
+// Review finding: an empty destination.cluster_name (Hubble without cluster.name) must not lose the cluster the
+// flow's labels carry
+func TestBuildPolicies_ClusterLabelWhenClusterNameEmpty(t *testing.T) {
+	raw := []byte(`{"flow":{"uuid":"x","traffic_direction":"EGRESS","is_reply":false,"l4":{"TCP":{"destination_port":6379}},
+	  "source":{"cluster_name":"poc2","namespace":"bank","labels":["k8s:app=payments","k8s:io.cilium.k8s.policy.cluster=poc2"]},
+	  "destination":{"namespace":"bank","labels":["k8s:app=redis","k8s:io.cilium.k8s.policy.cluster=poc1"]}}}`)
+	f, err := flow.ParseFlowsFromBytes(raw)
+	if err != nil {
+		t.Fatal(err)
+	}
+	ps, err := NewGenerator("").BuildPolicies(aggregator.AggregateFlows(f))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if to := ps[0].Spec.Egress[0].ToEndpoints[0].MatchLabels; to[ClusterLabel] != "poc1" {
+		t.Fatalf("empty destination.cluster_name must still yield cluster=poc1 from the label, got %v", to)
+	}
+}
+
+func firstRules(ps []*CiliumNetworkPolicy) *L7Rules {
+	for _, p := range ps {
+		for _, r := range p.Spec.Ingress {
+			if len(r.ToPorts) > 0 && r.ToPorts[0].Rules != nil {
+				return r.ToPorts[0].Rules
+			}
+		}
+		for _, r := range p.Spec.Egress {
+			if len(r.ToPorts) > 0 && r.ToPorts[0].Rules != nil {
+				return r.ToPorts[0].Rules
+			}
+		}
+	}
+	return nil
+}
+
+// E2: HTTP REQUEST records become anchored, escaped method+path rules; only with WithL7. The fixture is a
+// measured request through the Gateway (GET https://bankapi.poc.local/api/balance/chk-1001, demo 15).
+func TestBuildPolicies_L7HTTPRules(t *testing.T) {
+	ps, err := NewGenerator("").WithL7().BuildPolicies(load(t, "l7-http-request.json"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	rules := firstRules(ps)
+	if rules == nil || len(rules.HTTP) != 1 || rules.HTTP[0].Method != "GET" || rules.HTTP[0].Path != `^/api/balance/chk-1001(\?.*)?$` {
+		t.Fatalf("expected one escaped GET rule for the measured path allowing a query, got %+v", rules)
+	}
+	plain, _ := NewGenerator("").BuildPolicies(load(t, "l7-http-request.json"))
+	if out, _ := EncodePolicies(plain); strings.Contains(string(out), "http:") {
+		t.Fatalf("without WithL7 the output must be layer-4 only:\n%s", out)
+	}
+}
+
+// E2: a DNS REQUEST yields matchName without the trailing dot; a DNS RESPONSE is the reply side and yields no rule
+func TestBuildPolicies_L7DNSRules(t *testing.T) {
+	ps, _ := NewGenerator("").WithL7().BuildPolicies(load(t, "l7-dns-request.json"))
+	rules := firstRules(ps)
+	if rules == nil || len(rules.DNS) == 0 {
+		t.Fatalf("expected a dns rule from a DNS REQUEST record: %+v", ps)
+	}
+	if n := rules.DNS[0].MatchName; n == "" || strings.HasSuffix(n, ".") {
+		t.Fatalf("matchName must be the query without the trailing dot, got %q", n)
+	}
+	// the reply side (derived from the request record: type RESPONSE, is_reply true) yields no policy at all
+	if _, err := NewGenerator("").WithL7().BuildPolicies(load(t, "l7-dns-response.json")); err == nil {
+		t.Fatalf("a DNS RESPONSE is a reply and must be refused like any reply")
+	}
+}
+
+// E2: regex metacharacters in a path are escaped, and a query string is allowed (Envoy matches the whole :path)
+func TestL7Rules_PathIsEscapedAndAllowsAQuery(t *testing.T) {
+	r := l7RulesFor(aggregator.PortInfo{Port: 80, Protocol: "TCP", HTTPRequests: []aggregator.HTTPRequest{{Method: "GET", Path: "/v1/items.json"}}})
+	want := `^/v1/items\.json(\?.*)?$`
+	if r.HTTP[0].Path != want {
+		t.Fatalf("got %q want %q", r.HTTP[0].Path, want)
+	}
+	re := regexp.MustCompile(r.HTTP[0].Path)
+	for path, ok := range map[string]bool{"/v1/items.json": true, "/v1/items.json?x=1": true, "/v1/itemsXjson": false, "/v1/items.json/extra": false} {
+		if re.MatchString(path) != ok {
+			t.Fatalf("%q matched=%v, want %v", path, !ok, ok)
+		}
+	}
+}
+
+// Review finding: L7 records belong to the port they were seen on — an HTTP rule on 8080 must not restrict 5432
+func TestBuildPolicies_L7RulesArePerPort(t *testing.T) {
+	agg := &aggregator.AggregatedFlow{Direction: "INGRESS", DestNamespace: "bank", DestLabels: map[string]string{"app": "api"},
+		SourceNamespace: "bank", SourceLabels: map[string]string{"app": "web"},
+		Ports: []aggregator.PortInfo{{Port: 5432, Protocol: "TCP"}, {Port: 8080, Protocol: "TCP", HTTPRequests: []aggregator.HTTPRequest{{Method: "POST", Path: "/payments"}}}}}
+	ps, _ := NewGenerator("").WithL7().BuildPolicies([]*aggregator.AggregatedFlow{agg})
+	tp := ps[0].Spec.Ingress[0].ToPorts
+	if len(tp) != 2 || tp[0].Rules != nil || tp[0].Ports[0].Port != "5432" || tp[1].Rules == nil || tp[1].Ports[0].Port != "8080" {
+		t.Fatalf("expected [5432 plain] [8080 with rules], got %+v", tp)
+	}
+	plain, _ := NewGenerator("").BuildPolicies([]*aggregator.AggregatedFlow{agg})
+	if n := len(plain[0].Spec.Ingress[0].ToPorts); n != 1 {
+		t.Fatalf("without WithL7 the ports stay in one rule, got %d", n)
+	}
+}
+
+// Both reviewers weighed in and the docs decide: an L7 DNS policy allows ONLY the names it lists, and the
+// resolver tries the search-list expansions first — so the measured expansion is kept exactly as observed
+func TestBuildPolicies_L7DNSRules_KeepsTheQueryAsObserved(t *testing.T) {
+	ps, err := NewGenerator("").WithL7().BuildPolicies(load(t, "l7-dns-request.json"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	rules := firstRules(ps)
+	if rules == nil || len(rules.DNS) != 1 || rules.DNS[0].MatchName != "accounts.bank.svc.cluster.local.bank.svc.cluster.local" {
+		t.Fatalf("the query must be kept as the resolver sent it, got %+v", rules)
+	}
+}
+
+// E3: a world flow without names gets, on request, the same DNS rule every toFQDNs policy carries; without
+// the option the output is unchanged
+func TestBuildPolicies_DNSVisibilityCompanion(t *testing.T) {
+	plain, _ := NewGenerator("").BuildPolicies(load(t, "egress-pos-to-world.json"))
+	if len(plain[0].Spec.Egress) != 1 {
+		t.Fatalf("without the option: one rule, got %d", len(plain[0].Spec.Egress))
+	}
+	ps, _ := NewGenerator("").WithDNSVisibility().BuildPolicies(load(t, "egress-pos-to-world.json"))
+	if len(ps[0].Spec.Egress) != 2 {
+		t.Fatalf("with the option: two rules, got %d", len(ps[0].Spec.Egress))
+	}
+	if mustYAML(ps[0].Spec.Egress[1]) != mustYAML(dnsRuleFor(dnsProfiles[DNSProfileKubernetes])) {
+		t.Fatalf("the second rule must be the DNS visibility rule:\n%s", mustYAML(ps[0].Spec.Egress[1]))
+	}
+	out, _ := EncodePolicies(ps)
+	if !strings.Contains(string(out), "regenerate to get a toFQDNs rule") {
+		t.Fatalf("the comment must say what the rule is for:\n%s", out)
+	}
+}
+
+// Demo 31 finding (fork issue #1): a pod whose flows include its own DNS lookups got kube-dns 53/UDP twice — the plain
+// rule from the lookup and the DNS-visibility rule. With --dns-visibility the plain one is dropped (the L7 rule with
+// matchPattern "*" says everything it said); without the option nothing changes.
+func TestDNSVisibility_OneKubeDNSRule(t *testing.T) {
+	ps, err := NewGenerator("").WithDNSVisibility().BuildPolicies(load(t, "egress-pos-to-kube-dns.json", "egress-pos-to-world.json"))
+	if err != nil || len(ps) != 1 {
+		t.Fatalf("one policy expected: %d %v", len(ps), err)
+	}
+	dns := 0
+	for _, r := range ps[0].Spec.Egress {
+		if len(r.ToEndpoints) == 1 && r.ToEndpoints[0].MatchLabels["k8s-app"] == "kube-dns" {
+			dns++
+			if r.ToPorts[0].Rules == nil || len(r.ToPorts[0].Rules.DNS) != 1 {
+				t.Fatalf("the surviving kube-dns rule must be the DNS-visibility one: %s", mustYAML(r))
+			}
+		}
+	}
+	if dns != 1 {
+		t.Fatalf("kube-dns must appear once, got %d:\n%s", dns, mustYAML(ps[0].Spec.Egress))
+	}
+	plain, _ := NewGenerator("").BuildPolicies(load(t, "egress-pos-to-kube-dns.json", "egress-pos-to-world.json"))
+	if n := len(plain[0].Spec.Egress); n != 2 {
+		t.Fatalf("without the option the plain rule stays beside the CIDR: %d rules", n)
+	}
+}
+
+// 0.7.0: a reserved:world SOURCE with an address (an egress-gateway IP, a load balancer's client) is a fromCIDR rule —
+// what the receiver saw — not fromEntities: [world] (any external address), which 0.6.x wrote for every world source
+func TestBuildPolicies_WorldSourceIsFromCIDR(t *testing.T) {
+	ps, err := NewGenerator("").BuildPolicies(load(t, "ingress-world-cidr-to-receiver.json"))
+	if err != nil || len(ps) != 1 {
+		t.Fatalf("one policy expected: %d %v", len(ps), err)
+	}
+	r := ps[0].Spec.Ingress[0]
+	if len(r.FromCIDR) != 1 || string(r.FromCIDR[0]) != "172.18.255.170/32" || len(r.FromEntities) != 0 {
+		t.Fatalf("expected fromCIDR 172.18.255.170/32 and no entity, got %s", mustYAML(r))
+	}
+	if !strings.Contains(ps[0].Spec.Description, "from 172.18.255.170/32 on TCP/80") {
+		t.Fatalf("the description must name the address: %q", ps[0].Spec.Description)
+	}
+	if err := Validate(ps[0]); err != nil {
+		t.Fatal(err)
+	}
+}
diff --git a/internal/policy/merge.go b/internal/policy/merge.go
new file mode 100644
index 0000000..8221723
--- /dev/null
+++ b/internal/policy/merge.go
@@ -0,0 +1,168 @@
+package policy
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"fmt"
+
+	"gopkg.in/yaml.v3"
+)
+
+// MergeDocument adds the generated policy's rules to an existing CiliumNetworkPolicy YAML document (E5) and
+// returns the document with everything else as it was: key order, comments, scalar quoting, flow-style lists,
+// and the 2-space indentation `generate` writes. Fields this tool does not model (ingressDeny, enableDefaultDeny,
+// annotations, …) survive untouched because the document is edited as a YAML node tree, not re-built from a map.
+// The first version decoded the document into a generic map and marshalled it back — every key came out in
+// alphabetical order at yaml.v3's default indentation, and a pull request showed the whole file changed instead
+// of one rule (demo 32). It refuses another target (namespace, name, endpointSelector) and, run twice, adds nothing
+// the second time. yaml.v3 drops blank lines between keys; that is the one thing about the layout it does not keep.
+func MergeDocument(existing []byte, generated *CiliumNetworkPolicy) (out []byte, added int, err error) {
+	var doc yaml.Node
+	if err := yaml.Unmarshal(existing, &doc); err != nil {
+		return nil, 0, fmt.Errorf("existing policy: %w", err)
+	}
+	if doc.Kind != yaml.DocumentNode || len(doc.Content) != 1 || doc.Content[0].Kind != yaml.MappingNode {
+		return nil, 0, errors.New("existing policy: not a single YAML document with a mapping at the top")
+	}
+	root := doc.Content[0]
+	meta, spec := mappingValue(root, "metadata"), mappingValue(root, "spec")
+	if meta == nil {
+		return nil, 0, errors.New("existing document has no metadata")
+	}
+	if spec == nil {
+		if mappingValue(root, "specs") != nil { // Cilium's list form: merge writes spec.ingress / spec.egress only
+			return nil, 0, errors.New("existing document uses specs (Cilium's list form), which merge does not write into: move the rule to spec, or edit the file by hand")
+		}
+		return nil, 0, errors.New("existing document has no spec")
+	}
+	if err := checkTarget(meta, spec, generated); err != nil {
+		return nil, 0, err
+	}
+	if err := Validate(generated); err != nil {
+		return nil, 0, err
+	}
+	for _, r := range generated.Spec.Ingress {
+		if appendUnique(spec, "ingress", toGeneric(r)) {
+			added++
+		}
+	}
+	for _, r := range generated.Spec.Egress {
+		if appendUnique(spec, "egress", toGeneric(r)) {
+			added++
+		}
+	}
+	var buf bytes.Buffer
+	enc := yaml.NewEncoder(&buf)
+	enc.SetIndent(2) // the style `generate` writes, so an unchanged rule is an unchanged line
+	if err := enc.Encode(&doc); err != nil {
+		return nil, 0, err
+	}
+	if err := enc.Close(); err != nil {
+		return nil, 0, err
+	}
+	return buf.Bytes(), added, nil
+}
+
+// checkTarget refuses a document that is not the generated policy's target: same namespace, same name, same
+// endpointSelector, or nothing happens
+func checkTarget(meta, spec *yaml.Node, generated *CiliumNetworkPolicy) error {
+	name, namespace := scalarValue(meta, "name"), scalarValue(meta, "namespace")
+	if name != generated.Metadata.Name || namespace != generated.Metadata.Namespace {
+		return fmt.Errorf("target mismatch: existing %s/%s, generated %s/%s",
+			namespace, name, generated.Metadata.Namespace, generated.Metadata.Name)
+	}
+	var selector interface{}
+	if n := mappingValue(spec, "endpointSelector"); n != nil {
+		_ = n.Decode(&selector)
+	}
+	if canonicalYAML(selector) != canonicalYAML(toGeneric(generated.Spec.EndpointSelector)) {
+		return errors.New("target mismatch: the endpointSelector differs")
+	}
+	return nil
+}
+
+// appendUnique adds item to the list under key (created after the last key when missing) unless an equal item is
+// already there. Equality is by canonical YAML, so a hand-written `port: 80` and the generated `port: "80"` are one
+// rule (review finding — without this the merge appended a duplicate).
+func appendUnique(spec *yaml.Node, key string, item interface{}) bool {
+	list := mappingValue(spec, key)
+	if list == nil {
+		list = &yaml.Node{Kind: yaml.SequenceNode, Tag: "!!seq"}
+		spec.Content = append(spec.Content, &yaml.Node{Kind: yaml.ScalarNode, Tag: "!!str", Value: key}, list)
+	}
+	want := canonicalYAML(item)
+	for _, n := range list.Content {
+		var have interface{}
+		if err := n.Decode(&have); err == nil && canonicalYAML(have) == want {
+			return false
+		}
+	}
+	var n yaml.Node
+	if err := n.Encode(item); err != nil {
+		return false
+	}
+	list.Content = append(list.Content, &n)
+	return true
+}
+
+// mappingValue returns the value node of key in a mapping node, or nil
+func mappingValue(m *yaml.Node, key string) *yaml.Node {
+	if m == nil || m.Kind != yaml.MappingNode {
+		return nil
+	}
+	for i := 0; i+1 < len(m.Content); i += 2 {
+		if m.Content[i].Value == key {
+			return m.Content[i+1]
+		}
+	}
+	return nil
+}
+
+// scalarValue returns the scalar under key in a mapping node, or "" — the same "" a missing key or a non-scalar gives
+func scalarValue(m *yaml.Node, key string) string {
+	if n := mappingValue(m, key); n != nil && n.Kind == yaml.ScalarNode {
+		return n.Value
+	}
+	return ""
+}
+
+// toGeneric round-trips a typed value through JSON (Cilium's types carry json tags) so it compares and stores
+// like the existing document
+func toGeneric(v interface{}) interface{} {
+	var out interface{}
+	b, _ := json.Marshal(v)
+	_ = yaml.Unmarshal(b, &out)
+	return out
+}
+
+// canonicalYAML renders a generic value for comparison with every scalar as a string: a hand-written
+// `port: 80` and the generated `port: "80"` are one rule to Kubernetes and must be one rule here
+func canonicalYAML(v interface{}) string {
+	b, err := yaml.Marshal(stringifyScalars(v))
+	if err != nil {
+		return fmt.Sprintf("%#v", v)
+	}
+	return string(b)
+}
+
+func stringifyScalars(v interface{}) interface{} {
+	switch t := v.(type) {
+	case map[string]interface{}:
+		out := make(map[string]interface{}, len(t))
+		for k, val := range t {
+			out[k] = stringifyScalars(val)
+		}
+		return out
+	case []interface{}:
+		out := make([]interface{}, len(t))
+		for i, val := range t {
+			out[i] = stringifyScalars(val)
+		}
+		return out
+	case int, int8, int16, int32, int64, uint, uint8, uint16, uint32, uint64, float32, float64, bool:
+		return fmt.Sprint(t)
+	default:
+		return v
+	}
+}
diff --git a/internal/policy/merge_test.go b/internal/policy/merge_test.go
new file mode 100644
index 0000000..5572f5d
--- /dev/null
+++ b/internal/policy/merge_test.go
@@ -0,0 +1,171 @@
+package policy
+
+import (
+	"strings"
+	"testing"
+)
+
+const existingShop = `apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: shop
+  namespace: cf2cnp-lab
+  annotations:
+    owner: platform-team
+spec:
+  description: hand-written, with a deny rule cf2cnp does not model
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: shop
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            app.kubernetes.io/name: pos
+      toPorts:
+        - ports:
+            - port: "80"
+              protocol: TCP
+  ingressDeny:
+    - fromEntities: [world]
+`
+
+// E5: the stranger rule is added, pos (already there) is not duplicated, ingressDeny and the annotation survive
+func TestMergeDocument_AddsOnlyWhatIsMissing(t *testing.T) {
+	ps, _ := NewGenerator("").BuildPolicies(load(t, "ingress-pos-to-shop.json", "ingress-stranger-to-shop.json"))
+	out, added, err := MergeDocument([]byte(existingShop), ps[0])
+	if err != nil || added != 1 {
+		t.Fatalf("added=%d err=%v", added, err)
+	}
+	s := string(out)
+	for _, want := range []string{"ingressDeny", "owner: platform-team", "app.kubernetes.io/name: stranger", "hand-written"} {
+		if !strings.Contains(s, want) {
+			t.Fatalf("missing %q in:\n%s", want, s)
+		}
+	}
+	if strings.Count(s, "app.kubernetes.io/name: pos") != 1 {
+		t.Fatalf("pos must appear once:\n%s", s)
+	}
+	// idempotent: a second merge adds nothing and changes nothing
+	out2, again, err := MergeDocument(out, ps[0])
+	if err != nil || again != 0 || string(out2) != s {
+		t.Fatalf("second merge: added=%d err=%v same=%v", again, err, string(out2) == s)
+	}
+}
+
+// Demo 32 finding: the merged file must be the existing file plus the new rule — not a re-serialisation. The
+// first version re-ordered every key and re-indented the document, so a pull request showed the whole file
+// changed. Here the existing document is in the style `generate` writes; the output must START with it verbatim.
+func TestMergeDocument_KeepsTheDocumentAsItWas(t *testing.T) {
+	ps, _ := NewGenerator("").BuildPolicies(load(t, "ingress-pos-to-shop.json", "ingress-stranger-to-shop.json"))
+	existing := strings.TrimSuffix(existingShop, "  ingressDeny:\n    - fromEntities: [world]\n") // the list to grow is last
+	out, added, err := MergeDocument([]byte(existing), ps[0])
+	if err != nil || added != 1 {
+		t.Fatalf("added=%d err=%v", added, err)
+	}
+	if !strings.HasPrefix(string(out), existing) {
+		t.Fatalf("the existing document must be kept byte for byte; got:\n%s", out)
+	}
+	tail := strings.TrimPrefix(string(out), existing)
+	if !strings.HasPrefix(tail, "    - fromEndpoints:\n        - matchLabels:\n            app.kubernetes.io/name: stranger\n") {
+		t.Fatalf("the appended rule must be at the same indentation as the existing one; got:\n%s", tail)
+	}
+}
+
+// Demo 32 finding, the hand-written case: key order, a comment and a flow-style list survive the merge
+func TestMergeDocument_KeepsOrderCommentsAndStyle(t *testing.T) {
+	existing := `apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  labels: {team: shop}          # labels first, on purpose
+  name: shop
+  namespace: cf2cnp-lab
+spec:
+  endpointSelector: {matchLabels: {app.kubernetes.io/name: shop}}
+  ingress:
+    - fromEndpoints: [{matchLabels: {app.kubernetes.io/name: pos}}]   # pos: the till
+      toPorts: [{ports: [{port: "80", protocol: TCP}]}]
+`
+	ps, _ := NewGenerator("").BuildPolicies(load(t, "ingress-pos-to-shop.json", "ingress-stranger-to-shop.json"))
+	out, added, err := MergeDocument([]byte(existing), ps[0])
+	if err != nil || added != 1 {
+		t.Fatalf("added=%d err=%v", added, err)
+	}
+	s := string(out)
+	for _, want := range []string{"# labels first, on purpose", "# pos: the till", "labels: {team: shop}", "fromEndpoints: [{matchLabels: {app.kubernetes.io/name: pos}}]"} {
+		if !strings.Contains(s, want) {
+			t.Fatalf("missing %q in:\n%s", want, s)
+		}
+	}
+	if strings.Index(s, "labels:") > strings.Index(s, "name: shop") {
+		t.Fatalf("key order must be kept (labels before name):\n%s", s)
+	}
+}
+
+// E5: a different target is refused
+func TestMergeDocument_RefusesAnotherTarget(t *testing.T) {
+	ps, _ := NewGenerator("").BuildPolicies(load(t, "egress-pos-to-world.json")) // policy "pos", not "shop"
+	if _, _, err := MergeDocument([]byte(existingShop), ps[0]); err == nil || !strings.Contains(err.Error(), "target mismatch") {
+		t.Fatalf("expected a target mismatch, got %v", err)
+	}
+	other := strings.Replace(existingShop, "      app.kubernetes.io/name: shop\n", "      app.kubernetes.io/name: shop\n      app.kubernetes.io/component: frontend\n", 1)
+	ps2, _ := NewGenerator("").BuildPolicies(load(t, "ingress-pos-to-shop.json"))
+	if _, _, err := MergeDocument([]byte(other), ps2[0]); err == nil || !strings.Contains(err.Error(), "endpointSelector") {
+		t.Fatalf("expected an endpointSelector mismatch, got %v", err)
+	}
+	if _, _, err := MergeDocument([]byte("- not: a mapping\n"), ps2[0]); err == nil {
+		t.Fatal("a document that is not a mapping must be refused")
+	}
+}
+
+// Review finding: a hand-written `port: 80` (a YAML int) and the generated `port: "80"` are the same rule
+func TestMergeDocument_PortIntEqualsPortString(t *testing.T) {
+	existing := `apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata: {name: shop, namespace: cf2cnp-lab}
+spec:
+  endpointSelector: {matchLabels: {app.kubernetes.io/name: shop}}
+  ingress:
+    - fromEndpoints: [{matchLabels: {app.kubernetes.io/name: pos}}]
+      toPorts: [{ports: [{port: 80, protocol: TCP}]}]
+`
+	ps, _ := NewGenerator("").BuildPolicies(load(t, "ingress-pos-to-shop.json"))
+	if _, added, err := MergeDocument([]byte(existing), ps[0]); err != nil || added != 0 {
+		t.Fatalf("port: 80 and port: \"80\" are one rule; added=%d err=%v", added, err)
+	}
+}
+
+// A document without the list yet (an ingress-only policy receiving egress rules) gets the list created
+func TestMergeDocument_CreatesTheMissingList(t *testing.T) {
+	existing := `apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata: {name: pos, namespace: cf2cnp-lab}
+spec:
+  endpointSelector: {matchLabels: {app.kubernetes.io/name: pos}}
+  ingress: []
+`
+	ps, _ := NewGenerator("").BuildPolicies(load(t, "egress-pos-to-world.json"))
+	out, added, err := MergeDocument([]byte(existing), ps[0])
+	if err != nil || added == 0 || !strings.Contains(string(out), "\n  egress:\n    - toCIDR:") {
+		t.Fatalf("egress must be created after ingress; added=%d err=%v out:\n%s", added, err, out)
+	}
+}
+
+// Review ENH-003, second pass (Cursor): a document in Cilium's `specs` form has no `spec`; merge writes spec.ingress
+// and spec.egress, so it refuses such a document — and says so, instead of "no metadata/spec".
+func TestMergeDocument_SpecsOnlyIsRefusedByName(t *testing.T) {
+	existing := `apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata: {name: shop, namespace: cf2cnp-lab}
+specs:
+  - endpointSelector: {matchLabels: {app.kubernetes.io/name: shop}}
+    ingressDeny: [{fromEntities: [world]}]
+`
+	ps, err := NewGenerator("").BuildPolicies(load(t, "ingress-pos-to-shop.json"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	_, _, err = MergeDocument([]byte(existing), ps[0])
+	if err == nil || !strings.Contains(err.Error(), "specs") {
+		t.Fatalf("a specs-only document is refused by name: %v", err)
+	}
+}
diff --git a/internal/policy/review_codex_test.go b/internal/policy/review_codex_test.go
new file mode 100644
index 0000000..3c9647c
--- /dev/null
+++ b/internal/policy/review_codex_test.go
@@ -0,0 +1,207 @@
+package policy
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/cilium/cilium/pkg/policy/api"
+	"github.com/hubble-policy-gen/internal/aggregator"
+	"github.com/hubble-policy-gen/internal/render"
+	"sigs.k8s.io/yaml"
+)
+
+// Review ENH-003 (Codex, C5): Sanitize is the rule's. What refuses a document besides it — the API server's
+// ObjectMeta checks (a namespace that is not DNS-1123, a label key with a space), the CRD's protocol enum (upper case
+// only: Sanitize upper-cases on its copy, the schema sees the file), and the agent's Parse (a namespaced policy
+// cannot carry a nodeSelector) — Validate refuses too.
+func TestValidate_MatchesAdmission(t *testing.T) {
+	cases := map[string]string{
+		"metadata": `apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: valid
+  namespace: BAD_NAMESPACE
+spec:
+  endpointSelector: {}
+  egress:
+    - toEntities: [world]
+`,
+		"labelKey": `apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: valid
+  namespace: ns
+  labels:
+    bad key: value
+spec:
+  endpointSelector: {}
+  egress:
+    - toEntities: [world]
+`,
+		"protocol": `apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: lower
+  namespace: ns
+spec:
+  endpointSelector: {}
+  egress:
+    - toEntities: [world]
+      toPorts:
+        - ports:
+            - port: "443"
+              protocol: tcp
+`,
+		"denyProtocol": `apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: lower
+  namespace: ns
+spec:
+  endpointSelector: {}
+  egressDeny:
+    - toEntities: [world]
+      toPorts:
+        - ports:
+            - port: "443"
+              protocol: udp
+`,
+		"apiVersion": `apiVersion: cilium.io/v1
+kind: CiliumNetworkPolicy
+metadata:
+  name: wrong-version
+  namespace: ns
+spec:
+  endpointSelector: {}
+  egress:
+    - toEntities: [world]
+`,
+		"kind": `apiVersion: cilium.io/v2
+kind: NetworkPolicy
+metadata:
+  name: wrong-kind
+  namespace: ns
+spec:
+  endpointSelector: {}
+  egress:
+    - toEntities: [world]
+`,
+		"clusterwideNamespace": `apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: nodes
+  namespace: will-be-discarded
+spec:
+  nodeSelector:
+    matchLabels:
+      kubernetes.io/hostname: worker
+  egress:
+    - toEntities: [world]
+`,
+		"nodeSelector": `apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: nodes
+  namespace: ns
+spec:
+  nodeSelector:
+    matchLabels:
+      node-role.kubernetes.io/control-plane: ""
+  egress:
+    - toEntities: [world]
+`,
+	}
+	for name, raw := range cases {
+		t.Run(name, func(t *testing.T) {
+			var p CiliumNetworkPolicy
+			if err := yaml.Unmarshal([]byte(raw), &p); err != nil {
+				t.Fatal(err)
+			}
+			if err := Validate(&p); err == nil {
+				t.Fatal("a document the API server, the CRD or the agent refuses was accepted")
+			} else {
+				t.Log(err)
+				if name == "clusterwideNamespace" && !strings.Contains(err.Error(), "discards it") {
+					t.Fatalf("the refusal must say the API server would discard the namespace: %v", err)
+				}
+			}
+		})
+	}
+	// the same nodeSelector on a clusterwide policy is legal; a namespaced policy without a namespace is what
+	// kubectl fills in (the default namespace), not a refusal
+	cw := strings.Replace(strings.Replace(cases["nodeSelector"], "kind: CiliumNetworkPolicy", "kind: CiliumClusterwideNetworkPolicy", 1), "  namespace: ns\n", "", 1)
+	var p CiliumNetworkPolicy
+	if err := yaml.Unmarshal([]byte(cw), &p); err != nil {
+		t.Fatal(err)
+	}
+	if err := Validate(&p); err != nil {
+		t.Fatalf("a clusterwide policy may carry a nodeSelector: %v", err)
+	}
+	p = CiliumNetworkPolicy{}
+	if err := yaml.Unmarshal([]byte(strings.Replace(cases["protocol"], "protocol: tcp", "protocol: TCP", 1)), &p); err != nil {
+		t.Fatal(err)
+	}
+	p.Metadata.Namespace = ""
+	if err := Validate(&p); err != nil {
+		t.Fatalf("no namespace is kubectl's default, not a refusal: %v", err)
+	}
+}
+
+// Review ENH-003 (Codex, C9): a resolver derived from the flows kept the one protocol observed (UDP, every golden),
+// and a UDP-only rule denies the TCP retry a truncated answer needs. The rule exists to put lookups through the
+// proxy, not to restrict a protocol: derived resolvers are ANY, as the profiles and Cilium's examples are, and the
+// ANY L7 rule shadows the plain UDP rule the lookup itself produced.
+func TestDerivedDNSResolver_IsANY(t *testing.T) {
+	flows := []*aggregator.AggregatedFlow{{
+		Direction: "EGRESS", DestNamespace: "kube-system",
+		DestLabels: map[string]string{"k8s-app": "kube-dns"},
+		Ports:      []aggregator.PortInfo{{Port: 53, Protocol: "UDP"}},
+	}}
+	r, ok := DeriveDNSResolver(flows)
+	if !ok || r.Protocol != "ANY" || r.Port != "53" {
+		t.Fatalf("derived resolver must be ANY: %+v %v", r, ok)
+	}
+	wildcard := dnsRuleFor(r)
+	plain := wildcard.DeepCopy()
+	plain.ToPorts[0].Rules = nil
+	plain.ToPorts[0].Ports[0].Protocol = api.ProtoUDP
+	got := dropShadowedDNSRule([]EgressRule{*plain, wildcard}, wildcard)
+	if len(got) != 1 || mustYAML(got[0]) != mustYAML(wildcard) {
+		t.Fatalf("the ANY DNS rule shadows the plain UDP one: %s", mustYAML(got))
+	}
+	// a plain rule on another port, or with a name-restricted L7 rule, is not shadowed
+	other := plain.DeepCopy()
+	other.ToPorts[0].Ports[0].Port = "5353"
+	if got := dropShadowedDNSRule([]EgressRule{*other, wildcard}, wildcard); len(got) != 2 {
+		t.Fatalf("another port is not shadowed: %s", mustYAML(got))
+	}
+}
+
+// Review ENH-003 (Codex, C2): a document in Cilium's `specs` form renders its rules in the same field order as
+// `spec` (the precedence table named "spec" only, so specs[] fell to the lexicographic tail: egress before
+// endpointSelector).
+func TestRender_SpecsUseRuleOrder(t *testing.T) {
+	docs, err := DecodePolicyDocuments([]byte(`apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: multi
+  namespace: ns
+specs:
+  - endpointSelector: {}
+    egress:
+      - toEntities: [world]
+`))
+	if err != nil || len(docs) != 1 {
+		t.Fatalf("decode: %d %v", len(docs), err)
+	}
+	if err := Validate(docs[0]); err != nil {
+		t.Fatalf("a specs-only policy is valid: %v", err)
+	}
+	b, err := render.Document(map[string]interface{}{"specs": docs[0].Specs})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if s := string(b); strings.Index(s, "endpointSelector:") > strings.Index(s, "egress:") {
+		t.Fatalf("specs[] must use the rule order:\n%s", s)
+	}
+}
diff --git a/internal/policy/review_test.go b/internal/policy/review_test.go
new file mode 100644
index 0000000..ffe15b6
--- /dev/null
+++ b/internal/policy/review_test.go
@@ -0,0 +1,186 @@
+package policy
+
+import (
+	"errors"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/hubble-policy-gen/internal/aggregator"
+	"github.com/hubble-policy-gen/internal/crd"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// Review ENH-003 (Cursor, finding 1): looksLikeDNS took every kube-system peer on 53/5353 as the resolver. The
+// resolver is what the workload's lookups actually reach: CoreDNS (k8s-app=kube-dns or coredns), NodeLocal DNSCache
+// when a Local Redirect Policy sends lookups to it (k8s-app=node-local-dns, kube-system — the flow's destination is
+// then that pod, and a rule naming kube-dns would cut the pod off), or OpenShift's DNS operator (the namespace alone).
+// Anything else in kube-system on those ports is not.
+func TestLooksLikeDNS_NotTheWholeOfKubeSystem(t *testing.T) {
+	if looksLikeDNS("kube-system", map[string]string{"app.kubernetes.io/name": "metrics-server"}) {
+		t.Fatal("a kube-system peer without a resolver label is not the resolver")
+	}
+	if looksLikeDNS("kube-system", nil) {
+		t.Fatal("kube-system alone is not the resolver")
+	}
+	for _, v := range []string{"kube-dns", "coredns", "node-local-dns"} {
+		if !looksLikeDNS("kube-system", map[string]string{"k8s-app": v}) {
+			t.Fatalf("k8s-app=%s is a resolver", v)
+		}
+	}
+	if !looksLikeDNS("openshift-dns", nil) {
+		t.Fatal("OpenShift's resolver is the namespace")
+	}
+	other := &aggregator.AggregatedFlow{
+		Direction: "EGRESS", DestNamespace: "kube-system",
+		DestLabels: map[string]string{"app.kubernetes.io/name": "other"},
+		Ports:      []aggregator.PortInfo{{Port: 53, Protocol: "UDP"}},
+	}
+	if _, ok := DeriveDNSResolver([]*aggregator.AggregatedFlow{other}); ok {
+		t.Fatal("kube-system:53 without a resolver label must not derive the resolver")
+	}
+	nodeLocal := &aggregator.AggregatedFlow{
+		Direction: "EGRESS", DestNamespace: "kube-system",
+		DestLabels: map[string]string{"k8s-app": "node-local-dns"},
+		Ports:      []aggregator.PortInfo{{Port: 53, Protocol: "UDP"}},
+	}
+	r, ok := DeriveDNSResolver([]*aggregator.AggregatedFlow{nodeLocal})
+	if !ok || r.Labels["k8s-app"] != "node-local-dns" {
+		t.Fatalf("NodeLocal DNSCache is what the lookups reach under an LRP: %+v %v", r, ok)
+	}
+}
+
+// Review ENH-003 (Cursor, finding 4): Cilium's own Kubernetes example (examples/kubernetes-dns/dns-matchname.yaml)
+// writes the resolver rule as 53/ANY, and a lookup whose UDP answer is truncated retries over TCP; the kubernetes
+// profile follows the guide (and, after Codex's C9, so does a resolver derived from the flows: TestDerivedDNSResolver_IsANY).
+func TestDNSProfiles_FollowCiliumGuide(t *testing.T) {
+	if r := dnsProfiles[DNSProfileKubernetes]; r.Port != "53" || r.Protocol != "ANY" || r.Labels["k8s-app"] != "kube-dns" || r.Namespace != "kube-system" {
+		t.Fatalf("kubernetes profile: %+v", r)
+	}
+	if r := dnsProfiles[DNSProfileOpenShift]; r.Port != "5353" || r.Protocol != "ANY" || r.Labels != nil || r.Namespace != "openshift-dns" {
+		t.Fatalf("openshift profile: %+v", r)
+	}
+	r, err := ParseDNSResolver("kube-system:53")
+	if err != nil || r.Protocol != "ANY" {
+		t.Fatalf("a resolver without a protocol is ANY: %+v %v", r, err)
+	}
+	ps, err := NewGenerator("").WithDNSVisibility().BuildPolicies(load(t, "egress-pos-to-world.json"))
+	if err != nil || len(ps) != 1 {
+		t.Fatalf("one policy: %d %v", len(ps), err)
+	}
+	if p := ps[0].Spec.Egress[len(ps[0].Spec.Egress)-1].ToPorts[0].Ports[0]; p.Port != "53" || p.Protocol != "ANY" {
+		t.Fatalf("no DNS flow: the kubernetes profile, 53/ANY, got %s/%s", p.Protocol, p.Port)
+	}
+}
+
+// Review ENH-003 (Cursor, finding 2): `cf2cnp validate` split a file on "\n---", so a literal block holding a line
+// "---" became a second document. The YAML decoder knows where a document ends.
+func TestDecodePolicyDocuments(t *testing.T) {
+	doc := []byte(`apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: shop
+  namespace: ns
+spec:
+  description: |
+    note
+    ---
+    still one object
+  endpointSelector:
+    matchLabels:
+      app: shop
+  ingress:
+    - fromEntities:
+        - world
+---
+# a comment between documents
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: second
+  namespace: ns
+spec:
+  endpointSelector: {}
+`)
+	ps, err := DecodePolicyDocuments(doc)
+	if err != nil || len(ps) != 2 {
+		t.Fatalf("two documents (the empty one skipped), got %d %v", len(ps), err)
+	}
+	if !strings.Contains(ps[0].Spec.Description, "---") || ps[1].Metadata.Name != "second" {
+		t.Fatalf("description lost the separator or the order: %q %q", ps[0].Spec.Description, ps[1].Metadata.Name)
+	}
+	if _, err := DecodePolicyDocuments([]byte("a: [unclosed\n")); err == nil {
+		t.Fatal("a broken document is an error")
+	}
+}
+
+// Review ENH-003 (Cursor, finding 3): Sanitize checks the rule, not the object. The agent refuses an empty name
+// (cnp_types.go Parse) and the API server a name that is not a DNS-1123 subdomain; so does Validate. And `specs`
+// (Cilium's list form) is validated rule by rule.
+func TestValidate_ObjectNameAndSpecs(t *testing.T) {
+	good := Rule{EndpointSelector: Selector(map[string]string{"app": "x"}),
+		Ingress: []IngressRule{{IngressCommonRule: IngressCommonRule{FromEntities: EntitySlice{"world"}}}}}
+	for _, name := range []string{"", "Not_A_DNS_Name", "-leading"} {
+		p := &CiliumNetworkPolicy{Metadata: metav1.ObjectMeta{Name: name, Namespace: "ns"}, Spec: good}
+		err := Validate(p)
+		if err == nil || !errors.Is(err, ErrInvalidPolicy) || !strings.Contains(err.Error(), "metadata.name") {
+			t.Fatalf("%q: expected a metadata.name refusal, got %v", name, err)
+		}
+	}
+	bad := good
+	bad.Ingress = []IngressRule{{IngressCommonRule: IngressCommonRule{FromEntities: EntitySlice{"world"}, FromCIDR: CIDRSlice{"10.0.0.0/8"}}}}
+	p := &CiliumNetworkPolicy{Metadata: metav1.ObjectMeta{Name: "ok", Namespace: "ns"}, Specs: []*Rule{&good, &bad}}
+	err := Validate(p)
+	if err == nil || !errors.Is(err, ErrInvalidPolicy) || !strings.Contains(err.Error(), "specs[1]") {
+		t.Fatalf("the second of specs is refused and named: %v", err)
+	}
+}
+
+// Review ENH-003 (Cursor, finding 6): hosted Renovate does not run postUpgradeTasks, so a Cilium bump lands without
+// `go generate ./internal/crd`. CI's cmp catches the file; this catches the version from `go test` alone: the
+// embedded CRD's version is the version go.mod requires. (Cursor's snippet read debug.ReadBuildInfo().Deps; on the
+// GitHub runner the test binary reported no Deps at all — measured, CI run 34774484089 — so the source of truth is
+// the go.mod line.)
+func TestEmbeddedCRDVersionMatchesModule(t *testing.T) {
+	b, err := os.ReadFile(filepath.Join("..", "..", "go.mod"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	want := ""
+	for _, line := range strings.Split(string(b), "\n") {
+		f := strings.Fields(line)
+		if len(f) >= 2 && f[0] == "github.com/cilium/cilium" {
+			want = f[1]
+		}
+	}
+	if want == "" || crd.Version() != want {
+		t.Fatalf("embedded CRD %q, go.mod requires %q — run go generate ./internal/crd", crd.Version(), want)
+	}
+}
+
+// Review ENH-003, second pass (Cursor): the official CoreDNS Helm chart labels its pods app.kubernetes.io/name=coredns
+// (and k8s-app=coredns only as a cluster service); extractLabels keeps the app.kubernetes.io/* labels and drops
+// k8s-app when they are present, so the derivation saw {app.kubernetes.io/name: coredns}, found no resolver, and
+// fell back to a kube-dns rule that selects none of those pods. The resolver is recognised by whichever identifying
+// label the parser kept, and the rule names that label.
+func TestDeriveDNSResolver_HelmCoreDNSLabels(t *testing.T) {
+	ps, err := NewGenerator("").WithDNSVisibility().BuildPolicies(load(t, "egress-pos-to-helm-coredns.json", "egress-pos-to-world.json"))
+	if err != nil || len(ps) != 1 {
+		t.Fatalf("one policy: %d %v", len(ps), err)
+	}
+	dns := ps[0].Spec.Egress[len(ps[0].Spec.Egress)-1]
+	labels := MatchLabelsOf(dns.ToEndpoints[0])
+	if labels["io.kubernetes.pod.namespace"] != "dns-system" || labels["app.kubernetes.io/name"] != "coredns" || len(labels) != 2 {
+		t.Fatalf("the resolver rule must name the label the parser kept: %v", labels)
+	}
+	if p := dns.ToPorts[0].Ports[0]; p.Port != "53" || p.Protocol != "ANY" || dns.ToPorts[0].Rules == nil {
+		t.Fatalf("53/ANY with the L7 rule: %s", mustYAML(dns))
+	}
+	f := &aggregator.AggregatedFlow{Direction: "EGRESS", DestNamespace: "dns-system",
+		DestLabels: map[string]string{"app": "coredns"}, Ports: []aggregator.PortInfo{{Port: 53, Protocol: "UDP"}}}
+	if r, ok := DeriveDNSResolver([]*aggregator.AggregatedFlow{f}); !ok || r.Labels["app"] != "coredns" {
+		t.Fatalf("app=coredns is a resolver too: %+v %v", r, ok)
+	}
+}
diff --git a/internal/policy/types.go b/internal/policy/types.go
index 119476c..6910283 100644
--- a/internal/policy/types.go
+++ b/internal/policy/types.go
@@ -1,74 +1,63 @@
 package policy
 
-// CiliumNetworkPolicy represents a Cilium Network Policy
+import (
+	slimv1 "github.com/cilium/cilium/pkg/k8s/slim/k8s/apis/meta/v1"
+	"github.com/cilium/cilium/pkg/policy/api"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// The policy types are Cilium's own (github.com/cilium/cilium/pkg/policy/api at the version pinned in go.mod):
+// every field of the CiliumNetworkPolicy spec exists here, Cilium's Sanitize() validates a rule the way the agent
+// does at admission, and the version of the spec cf2cnp supports is the version of that module (`cf2cnp version`).
+// The 0.6.x hand-written structs modelled 20 of the spec's 291 schema paths (docs/CRD-SPEC-FORENSICS.md).
+//
+// The aliases keep the generator, the merge and the tests reading as before; only construction changes, because
+// Cilium nests the peers in an embedded IngressCommonRule / EgressCommonRule.
+
+// CiliumNetworkPolicy is the document cf2cnp writes: the Kubernetes envelope and Cilium's rule as the spec. The
+// metadata field keeps its name (`Metadata`) so `p.Metadata.Name` reads as it always did; there is no status.
+// Specs is Cilium's list form (several rules in one object); cf2cnp never writes it, `validate` and `merge` read it.
 type CiliumNetworkPolicy struct {
-	APIVersion string   `yaml:"apiVersion"`
-	Kind       string   `yaml:"kind"`
-	Metadata   Metadata `yaml:"metadata"`
-	Spec       Spec     `yaml:"spec"`
+	metav1.TypeMeta `json:",inline"`
+	Metadata        metav1.ObjectMeta `json:"metadata"`
+	Spec            api.Rule          `json:"spec"`
+	Specs           api.Rules         `json:"specs,omitempty"`
+}
+
+type (
+	Rule              = api.Rule
+	IngressRule       = api.IngressRule
+	IngressCommonRule = api.IngressCommonRule
+	EgressRule        = api.EgressRule
+	EgressCommonRule  = api.EgressCommonRule
+	PortRule          = api.PortRule
+	PortRules         = api.PortRules
+	Port              = api.PortProtocol
+	L7Rules           = api.L7Rules
+	HTTPRule          = api.PortRuleHTTP
+	DNSRule           = api.PortRuleDNS
+	FQDNSelector      = api.FQDNSelector
+	EndpointSelector  = api.EndpointSelector
+	EntitySlice       = api.EntitySlice
+	CIDRSlice         = api.CIDRSlice
+)
+
+// Selector builds an EndpointSelector from matchLabels the way a user writes it — a plain LabelSelector, without
+// Cilium's internal label-source prefix. The api package's NewES… constructors add that prefix (`any:`), which is
+// what the agent stores, not what a policy file says (docs/CRD-SPEC-FORENSICS.md §3, probe 2).
+func Selector(matchLabels map[string]string) EndpointSelector {
+	return EndpointSelector{LabelSelector: &slimv1.LabelSelector{MatchLabels: matchLabels}}
+}
+
+// MatchLabelsOf returns a selector's matchLabels, or nil for a selector without a LabelSelector
+func MatchLabelsOf(es EndpointSelector) map[string]string {
+	if es.LabelSelector == nil {
+		return nil
+	}
+	return es.MatchLabels
+}
+
+// NewPolicy is the envelope every generated policy starts from
+func NewPolicy() *CiliumNetworkPolicy {
+	return &CiliumNetworkPolicy{TypeMeta: metav1.TypeMeta{APIVersion: "cilium.io/v2", Kind: "CiliumNetworkPolicy"}}
 }
-
-// Metadata contains policy metadata
-type Metadata struct {
-	Name      string `yaml:"name"`
-	Namespace string `yaml:"namespace"`
-}
-
-// Spec contains the policy specification
-type Spec struct {
-	Description      string        `yaml:"description,omitempty"`
-	EndpointSelector LabelSelector `yaml:"endpointSelector"`
-	Ingress          []IngressRule `yaml:"ingress,omitempty"`
-	Egress           []EgressRule  `yaml:"egress,omitempty"`
-}
-
-// LabelSelector for selecting endpoints
-type LabelSelector struct {
-	MatchLabels map[string]string `yaml:"matchLabels,omitempty"`
-}
-
-// IngressRule represents an ingress rule
-type IngressRule struct {
-	FromEndpoints []LabelSelector `yaml:"fromEndpoints,omitempty"`
-	FromEntities  []string        `yaml:"fromEntities,omitempty"`
-	ToPorts       []PortRule      `yaml:"toPorts,omitempty"`
-}
-
-// EgressRule represents an egress rule
-type EgressRule struct {
-	ToEndpoints []LabelSelector `yaml:"toEndpoints,omitempty"`
-	ToEntities  []string        `yaml:"toEntities,omitempty"`
-	ToCIDR      []string        `yaml:"toCIDR,omitempty"`
-	ToFQDNs     []FQDNSelector  `yaml:"toFQDNs,omitempty"`
-	ToPorts     []PortRule      `yaml:"toPorts,omitempty"`
-}
-
-// FQDNSelector for selecting FQDNs
-type FQDNSelector struct {
-	MatchName    string `yaml:"matchName,omitempty"`
-	MatchPattern string `yaml:"matchPattern,omitempty"`
-}
-
-// PortRule represents port rules
-type PortRule struct {
-	Ports []Port    `yaml:"ports,omitempty"`
-	Rules *DNSRules `yaml:"rules,omitempty"`
-}
-
-// Port represents a single port
-type Port struct {
-	Port     string `yaml:"port"`
-	Protocol string `yaml:"protocol"`
-}
-
-// DNSRules for DNS policy rules
-type DNSRules struct {
-	DNS []DNSRule `yaml:"dns,omitempty"`
-}
-
-// DNSRule represents a DNS rule
-type DNSRule struct {
-	MatchPattern string `yaml:"matchPattern,omitempty"`
-	MatchName    string `yaml:"matchName,omitempty"`
-}
-
diff --git a/internal/policy/validate_test.go b/internal/policy/validate_test.go
new file mode 100644
index 0000000..ed17702
--- /dev/null
+++ b/internal/policy/validate_test.go
@@ -0,0 +1,62 @@
+package policy
+
+import (
+	"errors"
+	"strings"
+	"testing"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// 0.7.0: Cilium's own Sanitize runs on every generated policy (on a copy). A rule that mixes a pod peer and a CIDR
+// peer is refused with the agent's sentence; a bad CIDR too; the copy keeps the rendered document untouched.
+func TestValidate_RefusesWhatTheAgentRefuses(t *testing.T) {
+	mixed := &CiliumNetworkPolicy{Metadata: metav1.ObjectMeta{Name: "x", Namespace: "y"}, Spec: Rule{
+		EndpointSelector: Selector(map[string]string{"app": "x"}),
+		Ingress: []IngressRule{{IngressCommonRule: IngressCommonRule{
+			FromEndpoints: []EndpointSelector{Selector(map[string]string{"app": "a"})},
+			FromCIDR:      CIDRSlice{"10.0.0.1/32"},
+		}}}}}
+	err := Validate(mixed)
+	// Cilium names the two fields in whichever order its set iterates ("combining FromCIDR and FromEndpoints" on one
+	// run, the reverse on another — CI caught it); assert the words, not their order
+	if err == nil || !strings.Contains(err.Error(), "combining") || !strings.Contains(err.Error(), "FromCIDR") || !strings.Contains(err.Error(), "FromEndpoints") || !errors.Is(err, ErrInvalidPolicy) {
+		t.Fatalf("expected the agent's refusal wrapped in ErrInvalidPolicy, got %v", err)
+	}
+	bad := &CiliumNetworkPolicy{Metadata: metav1.ObjectMeta{Name: "x", Namespace: "y"}, Spec: Rule{
+		EndpointSelector: Selector(map[string]string{"app": "x"}),
+		Egress:           []EgressRule{{EgressCommonRule: EgressCommonRule{ToCIDR: CIDRSlice{"not-a-cidr"}}}}}}
+	if err := Validate(bad); err == nil || !strings.Contains(err.Error(), "not-a-cidr") {
+		t.Fatalf("expected the CIDR error, got %v", err)
+	}
+	good := &CiliumNetworkPolicy{Metadata: metav1.ObjectMeta{Name: "x", Namespace: "y"}, Spec: Rule{
+		EndpointSelector: Selector(map[string]string{"app.kubernetes.io/name": "x"}),
+		Ingress: []IngressRule{{IngressCommonRule: IngressCommonRule{FromEndpoints: []EndpointSelector{Selector(map[string]string{"app": "a"})}},
+			ToPorts: PortRules{{Ports: []Port{{Port: "80", Protocol: "TCP"}}}}}}}}
+	if err := Validate(good); err != nil {
+		t.Fatal(err)
+	}
+	// the copy: the document still carries plain selector keys after validation
+	if k := firstKey(MatchLabelsOf(good.Spec.EndpointSelector)); k != "app.kubernetes.io/name" {
+		t.Fatalf("Validate must not touch the policy, selector key is now %q", k)
+	}
+}
+
+func firstKey(m map[string]string) string {
+	for k := range m {
+		return k
+	}
+	return ""
+}
+
+// An IPv6 address gets /128, not /32 — on both sides (0.6.x wrote /32 for every address, which Cilium refuses)
+func TestBuildPolicies_IPv6HostPrefixes(t *testing.T) {
+	ps, err := NewGenerator("").BuildPolicies(load(t, "ingress-world6-cidr-to-receiver.json"))
+	if err != nil || string(ps[0].Spec.Ingress[0].FromCIDR[0]) != "2001:db8::170/128" {
+		t.Fatalf("fromCIDR: %v %s", err, mustYAML(ps[0].Spec.Ingress))
+	}
+	ps, err = NewGenerator("").BuildPolicies(load(t, "egress-pos-to-world6.json"))
+	if err != nil || string(ps[0].Spec.Egress[0].ToCIDR[0]) != "2606:2800:21f:cb07:6820:80da:af6b:8b2c/128" {
+		t.Fatalf("toCIDR: %v %s", err, mustYAML(ps[0].Spec.Egress))
+	}
+}
diff --git a/internal/policy/yolo.go b/internal/policy/yolo.go
index e8d24db..440b3b3 100644
--- a/internal/policy/yolo.go
+++ b/internal/policy/yolo.go
@@ -1,61 +1,29 @@
 package policy
 
 import (
-	"bytes"
 	"fmt"
 
-	"gopkg.in/yaml.v3"
+	"github.com/hubble-policy-gen/internal/render"
 )
 
 // YOLONamespacePolicy generates a CiliumNetworkPolicy that allows all traffic
 // within the same namespace. This is an easter egg policy - use with caution!
 func YOLONamespacePolicy(namespace string) *CiliumNetworkPolicy {
-	return &CiliumNetworkPolicy{
-		APIVersion: "cilium.io/v2",
-		Kind:       "CiliumNetworkPolicy",
-		Metadata: Metadata{
-			Name:      "yolo-allow-all-in-namespace",
-			Namespace: namespace,
-		},
-		Spec: Spec{
-			Description: fmt.Sprintf("YOLO! Allow all traffic within the %s namespace.", namespace),
-			EndpointSelector: LabelSelector{
-				MatchLabels: map[string]string{},
-			},
-			Ingress: []IngressRule{
-				{
-					FromEndpoints: []LabelSelector{
-						{MatchLabels: map[string]string{}},
-					},
-				},
-			},
-			Egress: []EgressRule{
-				{
-					ToEndpoints: []LabelSelector{
-						{MatchLabels: map[string]string{}},
-					},
-				},
-			},
-		},
-	}
+	p := NewPolicy()
+	p.Metadata.Name = "yolo-allow-all-in-namespace"
+	p.Metadata.Namespace = namespace
+	p.Spec.Description = fmt.Sprintf("YOLO! Allow all traffic within the %s namespace.", namespace)
+	p.Spec.EndpointSelector = Selector(map[string]string{})
+	p.Spec.Ingress = []IngressRule{{IngressCommonRule: IngressCommonRule{FromEndpoints: []EndpointSelector{Selector(map[string]string{})}}}}
+	p.Spec.Egress = []EgressRule{{EgressCommonRule: EgressCommonRule{ToEndpoints: []EndpointSelector{Selector(map[string]string{})}}}}
+	return p
 }
 
 // YOLONamespacePolicyYAML generates the YOLO policy as YAML bytes
 func YOLONamespacePolicyYAML(namespace string) ([]byte, error) {
-	policy := YOLONamespacePolicy(namespace)
-
-	var buf bytes.Buffer
-	encoder := yaml.NewEncoder(&buf)
-	encoder.SetIndent(2)
-
-	if err := encoder.Encode(policy); err != nil {
+	b, err := render.Document(YOLONamespacePolicy(namespace))
+	if err != nil {
 		return nil, fmt.Errorf("failed to encode YOLO policy to YAML: %w", err)
 	}
-
-	if err := encoder.Close(); err != nil {
-		return nil, fmt.Errorf("failed to close YAML encoder: %w", err)
-	}
-
-	return buf.Bytes(), nil
+	return b, nil
 }
-
diff --git a/internal/render/render.go b/internal/render/render.go
new file mode 100644
index 0000000..11b79dd
--- /dev/null
+++ b/internal/render/render.go
@@ -0,0 +1,125 @@
+// Package render turns a policy document into the YAML cf2cnp has always written: the fields in the order a
+// reader expects (apiVersion, kind, metadata, spec; a rule's peers before its ports), two-space indentation, no
+// status. The types come from Cilium (json tags, marshalled through sigs.k8s.io/yaml), whose output is alphabetical
+// — `egress` before `endpointSelector`, `labels` before `name`; tools that write Kubernetes YAML for humans own a
+// canonical order instead (kustomize's kyaml formatter does the same with a precedence list), so cf2cnp does too:
+// known fields by precedence, unknown fields lexicographically, so every field of the CRD has a place.
+package render
+
+import (
+	"bytes"
+	"fmt"
+	"sort"
+
+	"gopkg.in/yaml.v3"
+	sigsyaml "sigs.k8s.io/yaml"
+)
+
+// order lists, per mapping, the keys that come first and in which order. A mapping is named by its key in the parent
+// ("" is the document); a key not listed sorts after the listed ones, lexicographically. Sequences pass the parent's
+// name through, so every ingress rule is ordered as "ingress".
+var ruleOrder = []string{"description", "endpointSelector", "nodeSelector", "enableDefaultDeny", "ingress", "ingressDeny", "egress", "egressDeny", "labels", "log"}
+
+var order = map[string][]string{
+	"":                  {"apiVersion", "kind", "metadata", "spec", "specs"},
+	"metadata":          {"name", "namespace", "labels", "annotations"},
+	"spec":              ruleOrder,
+	"specs":             ruleOrder, // Cilium's list form: each rule in the same order (review ENH-003)
+	"endpointSelector":  {"matchLabels", "matchExpressions"},
+	"nodeSelector":      {"matchLabels", "matchExpressions"},
+	"ingress":           {"fromEndpoints", "fromEntities", "fromCIDR", "fromCIDRSet", "fromNodes", "fromGroups", "fromRequires", "toPorts", "icmps", "authentication"},
+	"ingressDeny":       {"fromEndpoints", "fromEntities", "fromCIDR", "fromCIDRSet", "fromNodes", "fromGroups", "fromRequires", "toPorts", "icmps"},
+	"egress":            {"toEndpoints", "toEntities", "toCIDR", "toCIDRSet", "toFQDNs", "toServices", "toNodes", "toGroups", "toRequires", "toPorts", "icmps", "authentication"},
+	"egressDeny":        {"toEndpoints", "toEntities", "toCIDR", "toCIDRSet", "toServices", "toNodes", "toGroups", "toRequires", "toPorts", "icmps"},
+	"fromEndpoints":     {"matchLabels", "matchExpressions"},
+	"toEndpoints":       {"matchLabels", "matchExpressions"},
+	"fromNodes":         {"matchLabels", "matchExpressions"},
+	"toNodes":           {"matchLabels", "matchExpressions"},
+	"fromCIDRSet":       {"cidr", "except", "cidrGroupRef", "cidrGroupSelector"},
+	"toCIDRSet":         {"cidr", "except", "cidrGroupRef", "cidrGroupSelector"},
+	"toFQDNs":           {"matchName", "matchPattern"},
+	"toServices":        {"k8sService", "k8sServiceSelector"},
+	"toPorts":           {"ports", "rules", "serverNames", "terminatingTLS", "originatingTLS", "listener"},
+	"ports":             {"port", "endPort", "protocol"},
+	"rules":             {"http", "dns", "kafka", "l7proto", "l7"},
+	"http":              {"method", "path", "host", "headers", "headerMatches"},
+	"dns":               {"matchName", "matchPattern"},
+	"kafka":             {"role", "apiKey", "apiVersion", "clientID", "topic"},
+	"icmps":             {"fields"},
+	"fields":            {"type", "family"},
+	"enableDefaultDeny": {"ingress", "egress"},
+}
+
+// Document renders one policy as YAML in cf2cnp's field order, two-space indentation, no trailing document marker.
+func Document(v interface{}) ([]byte, error) {
+	j, err := sigsyaml.Marshal(v) // json tags → YAML (alphabetical keys, Kubernetes quoting rules)
+	if err != nil {
+		return nil, fmt.Errorf("marshal: %w", err)
+	}
+	var doc yaml.Node
+	if err := yaml.Unmarshal(j, &doc); err != nil {
+		return nil, fmt.Errorf("reparse: %w", err)
+	}
+	if doc.Kind == yaml.DocumentNode && len(doc.Content) == 1 {
+		reorder(doc.Content[0], "")
+	}
+	var buf bytes.Buffer
+	enc := yaml.NewEncoder(&buf)
+	enc.SetIndent(2)
+	if err := enc.Encode(&doc); err != nil {
+		return nil, fmt.Errorf("encode: %w", err)
+	}
+	if err := enc.Close(); err != nil {
+		return nil, err
+	}
+	return buf.Bytes(), nil
+}
+
+// reorder sorts a mapping's keys by the precedence for its name, then lexicographically, and recurses
+func reorder(n *yaml.Node, name string) {
+	switch n.Kind {
+	case yaml.MappingNode:
+		type kv struct{ k, v *yaml.Node }
+		pairs := make([]kv, 0, len(n.Content)/2)
+		for i := 0; i+1 < len(n.Content); i += 2 {
+			pairs = append(pairs, kv{n.Content[i], n.Content[i+1]})
+		}
+		rank := map[string]int{}
+		for i, k := range order[name] {
+			rank[k] = i
+		}
+		sort.SliceStable(pairs, func(a, b int) bool {
+			ra, oka := rank[pairs[a].k.Value]
+			rb, okb := rank[pairs[b].k.Value]
+			switch {
+			case oka && okb:
+				return ra < rb
+			case oka:
+				return true
+			case okb:
+				return false
+			}
+			return pairs[a].k.Value < pairs[b].k.Value
+		})
+		n.Content = n.Content[:0]
+		for _, p := range pairs {
+			n.Content = append(n.Content, p.k, p.v)
+			reorder(p.v, p.k.Value)
+		}
+	case yaml.SequenceNode:
+		for _, c := range n.Content {
+			reorder(c, name)
+		}
+	}
+}
+
+// Known reports whether a key has a place in the precedence table for its mapping (used by the test that every
+// CRD field is either ranked or knowingly left to the lexicographic tail)
+func Known(mapping, key string) bool {
+	for _, k := range order[mapping] {
+		if k == key {
+			return true
+		}
+	}
+	return false
+}
diff --git a/internal/server/golden_test.go b/internal/server/golden_test.go
new file mode 100644
index 0000000..f9a8435
--- /dev/null
+++ b/internal/server/golden_test.go
@@ -0,0 +1,69 @@
+package server
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"encoding/json"
+)
+
+// TestGolden: the answer of /generate for every capture under internal/testdata/golden must be byte for byte what
+// cf2cnp 0.6.3 answered (the demos of the PoC that produced them). The policy types are Cilium's since 0.7.0 and the
+// YAML is rendered by internal/render in cf2cnp's field order; this is the test that the swap changed nothing a
+// reader would see. A deliberate change regenerates the fixtures (hack/golden/regenerate.sh) in the same commit.
+func TestGolden(t *testing.T) {
+	root := filepath.Join("..", "testdata", "golden")
+	dirs, err := os.ReadDir(root)
+	if err != nil {
+		t.Fatal(err)
+	}
+	s := NewServer(8080, "")
+	n := 0
+	for _, d := range dirs {
+		if !d.IsDir() {
+			continue
+		}
+		n++
+		t.Run(d.Name(), func(t *testing.T) {
+			dir := filepath.Join(root, d.Name())
+			flows, err := os.ReadFile(filepath.Join(dir, "flows.ndjson"))
+			if err != nil {
+				t.Fatal(err)
+			}
+			want, err := os.ReadFile(filepath.Join(dir, "expected.yaml"))
+			if err != nil {
+				t.Fatal(err)
+			}
+			var opts map[string]string
+			if b, err := os.ReadFile(filepath.Join(dir, "options.json")); err == nil {
+				if err := json.Unmarshal(b, &opts); err != nil {
+					t.Fatal(err)
+				}
+			}
+			q := url.Values{}
+			for k, v := range opts {
+				q.Set(k, v)
+			}
+			target := "/generate"
+			if len(q) > 0 {
+				target += "?" + q.Encode()
+			}
+			rec := httptest.NewRecorder()
+			s.handleGenerate(rec, httptest.NewRequest(http.MethodPost, target, strings.NewReader(string(flows))))
+			if rec.Code != http.StatusOK {
+				t.Fatalf("status %d: %s", rec.Code, rec.Body.String())
+			}
+			if got := rec.Body.String(); got != string(want) {
+				t.Fatalf("output differs from 0.6.3's\n--- want\n%s\n--- got\n%s", want, got)
+			}
+		})
+	}
+	if n < 10 {
+		t.Fatalf("expected the golden set, found %d cases", n)
+	}
+}
diff --git a/internal/server/review_test.go b/internal/server/review_test.go
new file mode 100644
index 0000000..5a26a64
--- /dev/null
+++ b/internal/server/review_test.go
@@ -0,0 +1,30 @@
+package server
+
+import (
+	"strings"
+	"testing"
+)
+
+// Review ENH-003 (Cursor, finding 5 / C13): a deployed server needs a cluster-wide default — an OpenShift Grafana
+// action that omits ?dnsProfile= must not get the kubernetes resolver. Options carry the defaults `serve
+// --dns-profile / --dns-resolver` set; the request's parameters still win.
+func TestGenerate_ServerDNSDefaults(t *testing.T) {
+	s := NewServerWithOptions(8080, "", Options{DNSProfile: "openshift"})
+	rec := post(t, s, "/generate?dnsVisibility=true", fixture(t, "egress-pos-to-world.json"), nil)
+	if rec.Code != 200 || !strings.Contains(rec.Body.String(), "io.kubernetes.pod.namespace: openshift-dns") {
+		t.Fatalf("server default openshift: %d %s", rec.Code, rec.Body.String())
+	}
+	rec = post(t, s, "/generate?dnsVisibility=true&dnsProfile=kubernetes", fixture(t, "egress-pos-to-world.json"), nil)
+	if rec.Code != 200 || !strings.Contains(rec.Body.String(), "k8s-app: kube-dns") {
+		t.Fatalf("the request's profile wins over the server default: %d %s", rec.Code, rec.Body.String())
+	}
+	s = NewServerWithOptions(8080, "", Options{DNSResolver: "dns-system/app=coredns:5353/ANY"})
+	rec = post(t, s, "/generate?dnsVisibility=true", fixture(t, "egress-pos-to-world.json"), nil)
+	if rec.Code != 200 || !strings.Contains(rec.Body.String(), "io.kubernetes.pod.namespace: dns-system") || !strings.Contains(rec.Body.String(), "protocol: ANY") {
+		t.Fatalf("server default resolver: %d %s", rec.Code, rec.Body.String())
+	}
+	rec = post(t, s, "/generate?dnsVisibility=true&dnsResolver=openshift-dns:5353", fixture(t, "egress-pos-to-world.json"), nil)
+	if rec.Code != 200 || !strings.Contains(rec.Body.String(), "io.kubernetes.pod.namespace: openshift-dns") {
+		t.Fatalf("the request's resolver wins: %d %s", rec.Code, rec.Body.String())
+	}
+}
diff --git a/internal/server/server.go b/internal/server/server.go
index d9c8c9e..84bff96 100644
--- a/internal/server/server.go
+++ b/internal/server/server.go
@@ -2,6 +2,8 @@ package server
 
 import (
 	"crypto/rand"
+	"crypto/sha256"
+	"crypto/subtle"
 	"encoding/hex"
 	"encoding/json"
 	"fmt"
@@ -19,6 +21,9 @@ import (
 	"github.com/hubble-policy-gen/internal/policy"
 )
 
+// maxBodyBytes caps a /generate body (8 MiB: several thousand flows)
+const maxBodyBytes = 8 << 20
+
 // CachedPolicy stores a generated policy for download
 type CachedPolicy struct {
 	Content   []byte
@@ -28,16 +33,42 @@ type CachedPolicy struct {
 
 // Server represents the HTTP server for policy generation
 type Server struct {
-	port  int
-	cache map[string]*CachedPolicy
-	mu    sync.RWMutex
+	port           int
+	externalURL    string
+	allowedOrigins []string // E6: CORS allow-list; empty or ["*"] = any origin (the historical default)
+	authToken      string   // E6: when set, /generate and /download need Authorization: Bearer <token>
+	dnsProfile     string
+	dnsResolver    string
+	cache          map[string]*CachedPolicy
+	mu             sync.RWMutex
+}
+
+// Options are the optional settings of a server: CORS origins and a bearer token (E6); the DNS resolver defaults
+// a request gets when it omits ?dnsProfile= / ?dnsResolver= (0.7.0 — an OpenShift deployment sets them once).
+type Options struct {
+	AllowedOrigins []string
+	AuthToken      string
+	DNSProfile     string
+	DNSResolver    string
+}
+
+// NewServer creates a new HTTP server. externalURL, when set, is the base URL clients reach the
+// server at (scheme://host[:port][/prefix]); it wins over anything the request says when building
+// download_url. Leave it empty to derive the base from the request (see baseURL).
+func NewServer(port int, externalURL string) *Server {
+	return NewServerWithOptions(port, externalURL, Options{})
 }
 
-// NewServer creates a new HTTP server
-func NewServer(port int) *Server {
+// NewServerWithOptions is NewServer with the E6 options
+func NewServerWithOptions(port int, externalURL string, opts Options) *Server {
 	s := &Server{
-		port:  port,
-		cache: make(map[string]*CachedPolicy),
+		port:           port,
+		externalURL:    strings.TrimRight(externalURL, "/"),
+		allowedOrigins: opts.AllowedOrigins,
+		authToken:      opts.AuthToken,
+		dnsProfile:     opts.DNSProfile,
+		dnsResolver:    opts.DNSResolver,
+		cache:          make(map[string]*CachedPolicy),
 	}
 	// Start cache cleanup goroutine
 	go s.cleanupCache()
@@ -69,36 +100,240 @@ func generateID() string {
 
 // Start starts the HTTP server
 func (s *Server) Start() error {
-	http.HandleFunc("/generate", s.corsMiddleware(s.handleGenerate))
-	http.HandleFunc("/download/", s.corsMiddleware(s.handleDownload))
+	http.HandleFunc("/generate", s.corsMiddleware(s.requireToken(s.handleGenerate)))
+	http.HandleFunc("/download/", s.corsMiddleware(s.requireToken(s.handleDownload)))
 	http.HandleFunc("/health", s.corsMiddleware(s.handleHealth))
 	http.HandleFunc("/", s.handleIndex)
 
 	addr := fmt.Sprintf(":%d", s.port)
+	srv := &http.Server{Addr: addr, ReadHeaderTimeout: 10 * time.Second, ReadTimeout: 60 * time.Second, WriteTimeout: 60 * time.Second}
 	log.Printf("Starting server on %s", addr)
 	log.Printf("POST /generate - Send Hubble flow JSON to generate CiliumNetworkPolicy YAML")
 	log.Printf("GET /download/{id} - Download generated policy")
 	log.Printf("GET /health - Health check endpoint")
 
-	return http.ListenAndServe(addr, nil)
+	return srv.ListenAndServe()
+}
+
+// baseURL is the base clients can reach this server at, for the download_url in JSON answers.
+// Precedence: the configured external URL; then RFC 7239 `Forwarded` (proto=, host= of the first,
+// client-most element); then the de-facto X-Forwarded-Proto / X-Forwarded-Host (first value); then the
+// request itself (TLS on the listener, the Host header). Only http/https count as a proto and only a
+// bare host[:port] counts as a host — a header carrying a path, a slash, whitespace or CRLF is ignored,
+// so a client cannot be handed a URL that points elsewhere. Without the header check a server behind an
+// https-only route answered http:// URLs to a port that was closed.
+func (s *Server) baseURL(r *http.Request) string {
+	if s.externalURL != "" {
+		return s.externalURL
+	}
+	scheme, host := "", r.Host
+	if r.TLS != nil {
+		scheme = "https"
+	}
+	// lowest precedence of the headers first, so later assignments win
+	if v := validProto(firstValue(r.Header.Get("X-Forwarded-Proto"))); v != "" {
+		scheme = v
+	}
+	if v := validHost(firstValue(r.Header.Get("X-Forwarded-Host"))); v != "" {
+		host = v
+	}
+	if fwd := r.Header.Get("Forwarded"); fwd != "" {
+		for _, pair := range strings.Split(strings.Split(fwd, ",")[0], ";") {
+			kv := strings.SplitN(strings.TrimSpace(pair), "=", 2)
+			if len(kv) != 2 {
+				continue
+			}
+			v := strings.Trim(strings.TrimSpace(kv[1]), "\"")
+			switch strings.ToLower(strings.TrimSpace(kv[0])) {
+			case "proto":
+				if p := validProto(v); p != "" {
+					scheme = p
+				}
+			case "host":
+				if h := validHost(v); h != "" {
+					host = h
+				}
+			}
+		}
+	}
+	if scheme == "" {
+		scheme = "http"
+	}
+	if host == "" {
+		host = r.Host
+	}
+	return scheme + "://" + host
+}
+
+// firstValue is the first element of a comma-separated header value, trimmed
+func firstValue(v string) string {
+	return strings.TrimSpace(strings.Split(v, ",")[0])
+}
+
+// validProto returns http or https, else ""
+func validProto(v string) string {
+	switch strings.ToLower(v) {
+	case "http", "https":
+		return strings.ToLower(v)
+	}
+	return ""
+}
+
+// validHost returns v when it is a bare host[:port] (no path, userinfo, whitespace or control characters), else ""
+func validHost(v string) string {
+	v = strings.Trim(strings.TrimSpace(v), "\"")
+	if v == "" || strings.ContainsAny(v, "/\\?#@ \t\r\n") {
+		return ""
+	}
+	return v
+}
+
+// excludeFlows drops flows whose peer carries any of the excluded label=value pairs (E4). The peer is the
+// side the rule would name: the source for an INGRESS flow, the destination for EGRESS. This is the
+// operator's intent ("stranger may call nothing") applied at generation time instead of at collection time.
+func excludeFlows(flows []*flow.ParsedFlow, excludes []string) []*flow.ParsedFlow {
+	if len(excludes) == 0 {
+		return flows
+	}
+	kept := make([]*flow.ParsedFlow, 0, len(flows))
+	for _, f := range flows {
+		peer := f.SourceLabels
+		if f.Direction == "EGRESS" {
+			peer = f.DestLabels
+		}
+		if !peerMatches(peer, excludes) {
+			kept = append(kept, f)
+		}
+	}
+	return kept
+}
+
+// peerMatches reports whether the labels carry one of the excludes. An exclude is "key=value", or several
+// joined by commas that must ALL match — the page sends a peer's whole identifying set
+// (app.kubernetes.io/name=shop,app.kubernetes.io/component=frontend), so unticking one component never
+// removes the others (review finding); a single key=value still works and matches every peer carrying it.
+func peerMatches(labels map[string]string, excludes []string) bool {
+	for _, ex := range excludes {
+		all := true
+		n := 0
+		for _, pair := range strings.Split(ex, ",") {
+			kv := strings.SplitN(strings.TrimSpace(pair), "=", 2)
+			if len(kv) != 2 {
+				continue
+			}
+			n++
+			if labels[kv[0]] != kv[1] {
+				all = false
+				break
+			}
+		}
+		if n > 0 && all {
+			return true
+		}
+	}
+	return false
+}
+
+// bearerToken returns the credentials of an Authorization header whose scheme is "Bearer" (any case), else ""
+func bearerToken(header string) string {
+	parts := strings.SplitN(strings.TrimSpace(header), " ", 2)
+	if len(parts) != 2 || !strings.EqualFold(parts[0], "Bearer") {
+		return ""
+	}
+	return strings.TrimSpace(parts[1])
+}
+
+// tokensEqual compares two secrets in constant time regardless of their lengths
+func tokensEqual(a, b string) bool {
+	ha, hb := sha256.Sum256([]byte(a)), sha256.Sum256([]byte(b))
+	return subtle.ConstantTimeCompare(ha[:], hb[:]) == 1
 }
 
-// corsMiddleware adds CORS headers and handles preflight requests
+// wantsJSON reports whether the client asked for the JSON answer (Grafana's action sets
+// X-Grafana-Action; any client may send Accept: application/json)
+func wantsJSON(r *http.Request) bool {
+	return strings.Contains(r.Header.Get("Accept"), "application/json") || r.Header.Get("X-Grafana-Action") != ""
+}
+
+// respond writes the generated YAML either as a direct attachment or, for JSON clients, caches it under
+// id and answers with the download URL, the filename, the counts and the YAML itself.
+func (s *Server) respond(w http.ResponseWriter, r *http.Request, id string, yamlBytes []byte, filename, message string, flows, policies int) {
+	if !wantsJSON(r) {
+		w.Header().Set("Content-Type", "application/x-yaml")
+		w.Header().Set("Content-Disposition", fmt.Sprintf("attachment; filename=\"%s\"", filename))
+		w.WriteHeader(http.StatusOK)
+		w.Write(yamlBytes)
+		log.Printf("Generated policy (direct): %s", filename)
+		return
+	}
+	s.mu.Lock()
+	s.cache[id] = &CachedPolicy{Content: yamlBytes, Filename: filename, CreatedAt: time.Now()}
+	s.mu.Unlock()
+	downloadURL := fmt.Sprintf("%s/download/%s", s.baseURL(r), id)
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(http.StatusOK)
+	json.NewEncoder(w).Encode(map[string]interface{}{
+		"filename":     filename,
+		"download_url": downloadURL,
+		"message":      message,
+		"flows":        flows,
+		"policies":     policies,
+		"yaml":         string(yamlBytes),
+	})
+	log.Printf("Generated policy (cached): %s, download: %s", filename, downloadURL)
+}
+
+// corsMiddleware answers preflight and echoes the request's Origin when it is allowed — any origin when
+// the list is empty or "*" (the historical default), else only a listed one (E6). Grafana's action is a
+// cross-origin fetch from the Grafana origin, so that origin is the one to list.
 func (s *Server) corsMiddleware(next http.HandlerFunc) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		// Set CORS headers
-		w.Header().Set("Access-Control-Allow-Origin", "*")
+		if origin := s.allowedOrigin(r.Header.Get("Origin")); origin != "" {
+			w.Header().Set("Access-Control-Allow-Origin", origin)
+			if origin != "*" {
+				w.Header().Add("Vary", "Origin")
+			}
+		}
 		w.Header().Set("Access-Control-Allow-Methods", "GET, POST, OPTIONS")
 		w.Header().Set("Access-Control-Allow-Headers", "Content-Type, Authorization, X-Requested-With, Accept, X-Grafana-Action, X-Grafana-Device-Id, X-Grafana-Org-Id")
 		w.Header().Set("Access-Control-Expose-Headers", "Content-Disposition")
 		w.Header().Set("Access-Control-Max-Age", "86400")
-
-		// Handle preflight OPTIONS request
 		if r.Method == http.MethodOptions {
 			w.WriteHeader(http.StatusOK)
 			return
 		}
+		next(w, r)
+	}
+}
+
+// allowedOrigin returns the value for Access-Control-Allow-Origin: "*" when any origin is allowed, the
+// request's origin when it is listed, "" when it is not
+func (s *Server) allowedOrigin(origin string) string {
+	if len(s.allowedOrigins) == 0 || (len(s.allowedOrigins) == 1 && s.allowedOrigins[0] == "*") {
+		return "*"
+	}
+	for _, o := range s.allowedOrigins {
+		if strings.EqualFold(strings.TrimRight(o, "/"), strings.TrimRight(origin, "/")) && origin != "" {
+			return origin
+		}
+	}
+	return ""
+}
 
+// requireToken checks Authorization: Bearer <token> when a token is configured (E6). The scheme is
+// case-insensitive as HTTP requires; the compare hashes both sides first, so its timing never depends on
+// where the tokens differ or on their lengths (ConstantTimeCompare returns at once on unequal lengths —
+// review finding). Preflight (OPTIONS) is never challenged, or the browser cannot even ask.
+func (s *Server) requireToken(next http.HandlerFunc) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		if s.authToken != "" && r.Method != http.MethodOptions {
+			got := bearerToken(r.Header.Get("Authorization"))
+			if !tokensEqual(got, s.authToken) {
+				w.Header().Set("WWW-Authenticate", `Bearer realm="cf2cnp"`)
+				http.Error(w, "Unauthorized", http.StatusUnauthorized)
+				return
+			}
+		}
 		next(w, r)
 	}
 }
@@ -212,6 +447,18 @@ func (s *Server) handleIndex(w http.ResponseWriter, r *http.Request) {
             margin-top: 1rem;
             white-space: pre-wrap;
         }
+        .summary { color: #94a3b8; font-size: 0.9em; margin: 8px 0; white-space: pre-wrap; }
+        .muted { color: #64748b; font-weight: normal; }
+        .controls { margin: 8px 0; }
+        .controls label { display: block; margin-bottom: 4px; color: #cbd5e1; font-weight: 600; }
+        .controls input { width: 100%; box-sizing: border-box; background: #0f172a; color: #e2e8f0; border: 1px solid #334155; border-radius: 6px; padding: 10px; font-family: monospace; }
+        .peers label { display: inline-block; margin: 4px 12px 4px 0; color: #cbd5e1; }
+        .peers .muted { margin-left: 4px; }
+        .buttons { display: flex; flex-wrap: wrap; gap: 8px; margin: 8px 0; }
+        .buttons button { margin: 0; }
+        button.secondary { background: #1e293b; border: 1px solid #334155; box-shadow: none; }
+        button.secondary:hover { background: #334155; }
+        button:disabled { opacity: 0.45; cursor: not-allowed; }
     </style>
 </head>
 <body>
@@ -260,9 +507,11 @@ func (s *Server) handleIndex(w http.ResponseWriter, r *http.Request) {
     
     <div class="endpoint">
         <span class="method">POST</span> <span class="path">/generate</span>
-        <p>Send a Hubble flow JSON payload and receive a download URL or direct YAML.</p>
+        <p>Send Hubble flow JSON — one flow, a JSON array, or one flow per line — and receive the policies.
+        <code>?name=&lt;name&gt;</code> names the (single) resulting policy.</p>
         <p><strong>Content-Type:</strong> application/json</p>
-        <p><strong>Response:</strong> JSON with download URL (for Grafana) or YAML file (for curl)</p>
+        <p><strong>Response:</strong> YAML (one document per policy) for curl; with <code>Accept: application/json</code>
+        or <code>X-Grafana-Action</code>, JSON <code>{download_url, filename, yaml, flows, policies}</code></p>
     </div>
 
     <div class="endpoint">
@@ -276,81 +525,162 @@ func (s *Server) handleIndex(w http.ResponseWriter, r *http.Request) {
     </div>
 
     <h2>Try it out</h2>
-    <p>Paste your Hubble flow JSON below:</p>
-    <textarea id="flowInput" placeholder='{"flow": {"traffic_direction": "INGRESS", ...}}'></textarea>
-    <br>
-    <button onclick="generatePolicy()">Generate Policy</button>
-    
+    <p>Paste Hubble flow JSON below — one flow, a JSON array, or one flow per line (the output of
+    <code>hubble observe -o json</code>). Flows to the same workload become one policy with one rule per peer.</p>
+    <textarea id="flowInput" placeholder='{"flow": {"traffic_direction": "INGRESS", ...}}' oninput="summarize()"></textarea>
+    <div id="summary" class="summary"></div>
+    <div id="peers" class="peers"></div>
+    <div class="controls">
+        <label for="policyName">Policy name <span class="muted">(optional, only when the flows make one policy)</span></label>
+        <input id="policyName" type="text" placeholder="e.g. shop-from-pos" spellcheck="false">
+        <label><input id="l7" type="checkbox"> Layer-7 rules <span class="muted">(HTTP method + path, DNS names, from flows that carry them; the port then goes through the proxy)</span></label>
+        <label><input id="dnsVisibility" type="checkbox"> DNS visibility <span class="muted">(world traffic without names: add the DNS resolver rule so the next flows carry names)</span></label>
+        <label for="dnsProfile">DNS resolver <span class="muted">(the rule toFQDNs and DNS visibility write: auto = from the observed DNS flows, else the server's default — kube-system/kube-dns:53 unless deployed otherwise; openshift = openshift-dns:5353)</span></label>
+        <select id="dnsProfile"><option value="auto">auto</option><option value="kubernetes">kubernetes</option><option value="openshift">openshift</option></select>
+        <label for="token">Access token <span class="muted">(only when the server requires one; kept in this tab's sessionStorage, never in the page)</span></label>
+        <input id="token" type="password" placeholder="Bearer token" spellcheck="false" oninput="try { sessionStorage.setItem('cf2cnp-token', this.value); } catch (e) {}">
+    </div>
+    <div class="buttons">
+        <button onclick="generatePolicy()">Generate Policy</button>
+        <button class="secondary" onclick="copyYAML()" id="copyBtn" disabled>Copy YAML</button>
+        <button class="secondary" onclick="downloadYAML()" id="downloadBtn" disabled>Download YAML</button>
+        <button class="secondary" onclick="loadExample()">Load example</button>
+        <button class="secondary" onclick="clearAll()">Clear</button>
+    </div>
+    <div id="apply" class="summary"></div>
     <pre id="result"></pre>
 
     <h2>Example using curl</h2>
-    <pre><code>curl -X POST http://localhost:8080/generate \
-  -H "Content-Type: application/json" \
-  -d @flow.json \
-  -o policy.yaml</code></pre>
+    <pre><code># one flow
+curl -X POST http://localhost:8080/generate -H "Content-Type: application/json" -d @flow.json -o policy.yaml
+
+# many flows at once: one policy per workload, one rule per peer
+hubble observe --namespace my-namespace --last 200 -o json > flows.json
+curl -X POST http://localhost:8080/generate --data-binary @flows.json -o policies.yaml
+
+# name the resulting policy
+curl -X POST "http://localhost:8080/generate?name=shop-from-pos" -d @flow.json -o policy.yaml</code></pre>
 
     <script>
+        // Parse what the textarea holds the way the server does: an array, or objects separated by whitespace.
+        function parseFlows(text) {
+            const t = text.trim();
+            if (!t) return [];
+            if (t[0] === '[') return JSON.parse(t);
+            const flows = []; let depth = 0, start = -1, inStr = false, esc = false;
+            for (let i = 0; i < t.length; i++) {
+                const c = t[i];
+                if (inStr) { if (esc) esc = false; else if (c === '\\') esc = true; else if (c === '"') inStr = false; continue; }
+                if (c === '"') inStr = true;
+                else if (c === '{') { if (depth === 0) start = i; depth++; }
+                else if (c === '}') { depth--; if (depth === 0 && start >= 0) { flows.push(JSON.parse(t.slice(start, i + 1))); start = -1; } }
+            }
+            return flows;
+        }
+        function who(ep) {
+            if (!ep) return '?';
+            const labels = ep.labels || [];
+            const pick = (k) => { const l = labels.find(x => x.startsWith('k8s:' + k + '=')); return l ? l.split('=')[1] : null; };
+            // the same identity the policy name is built from: name, then instance and component when present
+            var name = pick('app.kubernetes.io/name') || pick('app') || pick('k8s-app') || ep.pod_name || (labels.find(x => x.startsWith('reserved:')) || '?').replace('reserved:', '');
+            var inst = pick('app.kubernetes.io/instance'), comp = pick('app.kubernetes.io/component');
+            if (inst && inst !== name) name += '/' + inst;
+            if (comp && comp !== name) name += '/' + comp;
+            return name;
+        }
+        // peerKey is the identifying label set the policy would name for a peer, joined by commas — the same labels
+        // the server's extractLabels keeps: every app.kubernetes.io/{name,component,instance} present, else the first
+        // fallback label (app, k8s-app, name, component, instance). Unticking a peer sends this whole set as one
+        // exclude, so one component never removes its siblings (review finding).
+        function peerKey(ep) {
+            const labels = (ep && ep.labels) || [];
+            const val = (k) => { const l = labels.find(x => x.startsWith('k8s:' + k + '=') || x.startsWith(k + '=')); return l ? l.split('=').slice(1).join('=') : null; };
+            const parts = [];
+            for (const k of ['app.kubernetes.io/name', 'app.kubernetes.io/component', 'app.kubernetes.io/instance']) { const v = val(k); if (v !== null) parts.push(k + '=' + v); }
+            if (parts.length) return parts.join(',');
+            for (const k of ['app', 'k8s-app', 'name', 'component', 'instance']) { const v = val(k); if (v !== null) return k + '=' + v; }
+            return '';
+        }
+        // renderPeers lists every distinct peer (the source of an INGRESS flow, the destination of an EGRESS one)
+        // as a checkbox; an unchecked peer becomes an exclude= parameter — review the intent before generating
+        function renderPeers(flows) {
+            const counts = {};
+            for (const d of flows) {
+                const f = d.flow || d; const ep = f.traffic_direction === 'EGRESS' ? f.destination : f.source;
+                const key = peerKey(ep); if (!key) continue;
+                counts[key] = (counts[key] || 0) + 1;
+            }
+            const box = document.getElementById('peers'); box.textContent = '';
+            const keys = Object.keys(counts).sort();
+            if (!keys.length) return;
+            const title = document.createElement('div'); title.className = 'summary'; title.textContent = 'Peers the policy would allow — untick to exclude:'; box.appendChild(title);
+            for (const k of keys) {
+                const label = document.createElement('label'); const cb = document.createElement('input'); cb.type = 'checkbox'; cb.checked = true; cb.dataset.peer = k;
+                label.appendChild(cb); label.appendChild(document.createTextNode(' ' + k.split(',').map(p => p.split('=').slice(1).join('=')).join('/')));
+                const m = document.createElement('span'); m.className = 'muted'; m.textContent = '(' + counts[k] + ' flow' + (counts[k] === 1 ? '' : 's') + ')'; label.appendChild(m);
+                box.appendChild(label);
+            }
+        }
+        function excludedPeers() {
+            return Array.from(document.querySelectorAll('#peers input[type=checkbox]')).filter(cb => !cb.checked).map(cb => cb.dataset.peer);
+        }
+        function summarize() {
+            const box = document.getElementById('summary');
+            try {
+                const flows = parseFlows(document.getElementById('flowInput').value);
+                if (!flows.length) { box.textContent = ''; return; }
+                const lines = flows.slice(0, 8).map(d => {
+                    const f = d.flow || d; const l4 = f.l4 || {}; const port = (l4.TCP || l4.UDP || {}).destination_port;
+                    const names = (f.destination_names || []).join(',');
+                    return (f.traffic_direction || '?') + ' ' + (f.verdict || '') + ' ' + who(f.source) + ' → ' + (names || who(f.destination)) + ':' + (port || '?') + (f.is_reply ? ' (reply — will be refused)' : '');
+                });
+                box.textContent = flows.length + ' flow(s) parsed: ' + lines.join(' | ') + (flows.length > 8 ? ' | …' : '');
+                renderPeers(flows);
+            } catch (e) { box.textContent = 'Not valid JSON yet: ' + e.message; }
+        }
+        let lastYAML = '', lastFilename = 'ciliumnetworkpolicy.yaml';
+        try { const t = sessionStorage.getItem('cf2cnp-token'); if (t) document.getElementById('token').value = t; } catch (e) {}
         async function generatePolicy() {
             const input = document.getElementById('flowInput').value;
-            const result = document.getElementById('result');
-            
+            const result = document.getElementById('result'); const apply = document.getElementById('apply');
+            const name = document.getElementById('policyName').value.trim();
+            const params = []; if (name) params.push('name=' + encodeURIComponent(name));
+            if (document.getElementById('l7').checked) params.push('l7=true');
+            if (document.getElementById('dnsVisibility').checked) params.push('dnsVisibility=true');
+            const dnsProfile = document.getElementById('dnsProfile').value; if (dnsProfile && dnsProfile !== 'auto') params.push('dnsProfile=' + dnsProfile);
+            for (const p of excludedPeers()) params.push('exclude=' + encodeURIComponent(p));
+            const url = '/generate' + (params.length ? '?' + params.join('&') : '');
             try {
-                const response = await fetch('/generate', {
-                    method: 'POST',
-                    headers: { 'Content-Type': 'application/json' },
-                    body: input
-                });
-                
-                if (!response.ok) {
-                    const error = await response.text();
-                    result.textContent = 'Error: ' + error;
-                    return;
-                }
-
-                const contentType = response.headers.get('Content-Type');
-                
-                if (contentType && contentType.includes('application/json')) {
-                    // JSON response with download URL
-                    const data = await response.json();
-                    result.textContent = 'Policy generated! Downloading...';
-                    
-                    // Open download URL
-                    window.open(data.download_url, '_blank');
-                } else {
-                    // Direct YAML response
-                    const yaml = await response.text();
-                    result.textContent = yaml;
-                    
-                    // Extract filename from Content-Disposition header or parse from YAML
-                    let filename = 'ciliumnetworkpolicy.yaml';
-                    const disposition = response.headers.get('Content-Disposition');
-                    if (disposition) {
-                        const match = disposition.match(/filename="?([^"]+)"?/);
-                        if (match) {
-                            filename = match[1];
-                        }
-                    } else {
-                        // Fallback: extract name from YAML metadata
-                        const nameMatch = yaml.match(/^\s*name:\s*(.+)$/m);
-                        const nsMatch = yaml.match(/^\s*namespace:\s*(.+)$/m);
-                        if (nameMatch) {
-                            const name = nameMatch[1].trim();
-                            const ns = nsMatch ? nsMatch[1].trim() : '';
-                            filename = ns ? ns + '-' + name + '.yaml' : name + '.yaml';
-                        }
-                    }
-                    
-                    const blob = new Blob([yaml], { type: 'application/x-yaml' });
-                    const url = URL.createObjectURL(blob);
-                    const a = document.createElement('a');
-                    a.href = url;
-                    a.download = filename;
-                    a.click();
-                    URL.revokeObjectURL(url);
-                }
-            } catch (err) {
-                result.textContent = 'Error: ' + err.message;
-            }
+                const headers = { 'Content-Type': 'application/json', 'Accept': 'application/json' };
+                const token = document.getElementById('token').value.trim(); if (token) headers['Authorization'] = 'Bearer ' + token;
+                const response = await fetch(url, { method: 'POST', headers: headers, body: input });
+                if (response.status === 401) { result.textContent = 'Error: this server requires an access token (401)'; apply.textContent = ''; setButtons(false); return; }
+                if (!response.ok) { result.textContent = 'Error: ' + await response.text(); apply.textContent = ''; setButtons(false); return; }
+                const data = await response.json();
+                lastYAML = data.yaml; lastFilename = data.filename; result.textContent = data.yaml;
+                apply.textContent = data.flows + ' flow(s) → ' + data.policies + (data.policies === 1 ? ' policy' : ' policies') + '. Review it, then: kubectl apply -f ' + data.filename;
+                setButtons(true);
+            } catch (err) { result.textContent = 'Error: ' + err.message; setButtons(false); }
+        }
+        function setButtons(on) { document.getElementById('copyBtn').disabled = !on; document.getElementById('downloadBtn').disabled = !on; }
+        async function copyYAML() {
+            try { await navigator.clipboard.writeText(lastYAML); flash('copyBtn', 'Copied'); }
+            catch (e) { flash('copyBtn', 'Copy failed'); }
+        }
+        function downloadYAML() {
+            const blob = new Blob([lastYAML], { type: 'application/x-yaml' }); const url = URL.createObjectURL(blob);
+            const a = document.createElement('a'); a.href = url; a.download = lastFilename; a.click(); URL.revokeObjectURL(url);
+        }
+        function flash(id, text) { const b = document.getElementById(id); const old = b.textContent; b.textContent = text; setTimeout(() => b.textContent = old, 1200); }
+        function clearAll() { document.getElementById('flowInput').value = ''; document.getElementById('policyName').value = ''; document.getElementById('result').textContent = ''; document.getElementById('summary').textContent = ''; document.getElementById('peers').textContent = ''; document.getElementById('apply').textContent = ''; setButtons(false); }
+        function loadExample() {
+            const ex = (src, uuid) => JSON.stringify({ flow: { uuid: uuid, verdict: 'AUDIT', IP: { source: '10.0.1.3', destination: '10.0.2.7', ipVersion: 'IPv4' },
+                l4: { TCP: { source_port: 45248, destination_port: 80, flags: { SYN: true } } },
+                source: { namespace: 'shop', labels: ['k8s:app.kubernetes.io/name=' + src, 'k8s:io.kubernetes.pod.namespace=shop'], pod_name: src },
+                destination: { namespace: 'shop', labels: ['k8s:app.kubernetes.io/name=shop', 'k8s:io.kubernetes.pod.namespace=shop'], pod_name: 'shop-6d7d797759-4ddlt' },
+                Type: 'L3_L4', traffic_direction: 'INGRESS', is_reply: false } });
+            document.getElementById('flowInput').value = ex('pos', '11111111-1111-4111-8111-111111111111') + '\n' + ex('checkout', '22222222-2222-4222-8222-222222222222') + '\n';
+            summarize();
         }
     </script>
 </body>
@@ -400,9 +730,16 @@ func (s *Server) handleGenerate(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	// Read request body
+	// Read request body — capped: a public /generate must not let one POST fill memory. maxBodyBytes holds
+	// several thousand flows (a flow is ~1.5 KB); http.MaxBytesReader makes an oversize body a 413.
+	r.Body = http.MaxBytesReader(w, r.Body, maxBodyBytes)
 	body, err := io.ReadAll(r.Body)
 	if err != nil {
+		var tooBig *http.MaxBytesError
+		if errors.As(err, &tooBig) {
+			http.Error(w, fmt.Sprintf("Request body larger than %d bytes", maxBodyBytes), http.StatusRequestEntityTooLarge)
+			return
+		}
 		http.Error(w, fmt.Sprintf("Failed to read request body: %v", err), http.StatusBadRequest)
 		return
 	}
@@ -420,27 +757,55 @@ func (s *Server) handleGenerate(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	// Parse the flow
-	parsedFlow, err := flow.ParseFlowFromBytes(body)
+	// Parse the flows: one object, a JSON array, or one object per line (`hubble observe -o json`)
+	parsedFlows, err := flow.ParseFlowsFromBytes(body)
 	if err != nil {
 		http.Error(w, fmt.Sprintf("Failed to parse flow JSON: %v", err), http.StatusBadRequest)
 		return
 	}
 
-	// Aggregate flows (even though we have just one)
-	flows := []*flow.ParsedFlow{parsedFlow}
-	aggregatedFlows := aggregator.AggregateFlows(flows)
-
+	parsedFlows = excludeFlows(parsedFlows, r.URL.Query()["exclude"]) // E4: ?exclude=key=value, repeatable
+	aggregatedFlows := aggregator.AggregateFlows(parsedFlows)
 	if len(aggregatedFlows) == 0 {
-		http.Error(w, "No valid flows found in request", http.StatusBadRequest)
+		http.Error(w, "No valid flows found in request (every flow excluded, or none parsed)", http.StatusBadRequest)
 		return
 	}
 
-	// Generate policy YAML
 	generator := policy.NewGenerator("")
-	yamlBytes, err := generator.GeneratePoliciesYAML(aggregatedFlows)
+	if name := strings.TrimSpace(r.URL.Query().Get("name")); name != "" {
+		generator = generator.WithName(name)
+	}
+	if r.URL.Query().Get("l7") == "true" {
+		generator = generator.WithL7() // E2: opt-in layer-7 rules
+	}
+	// 0.7.0: the DNS resolver — the server's defaults (serve --dns-profile / --dns-resolver, checked at start), then
+	// the request's: a profile named by the request replaces the server's resolver too, a resolver named by the
+	// request wins over everything (as --dns-resolver does over --dns-profile)
+	dnsProfile, dnsResolver := s.dnsProfile, s.dnsResolver
+	if p := r.URL.Query().Get("dnsProfile"); p != "" {
+		dnsProfile, dnsResolver = p, ""
+	}
+	if spec := r.URL.Query().Get("dnsResolver"); spec != "" {
+		dnsResolver = spec
+	}
+	if dnsProfile != "" {
+		if _, err := generator.WithDNSProfile(dnsProfile); err != nil { // auto | kubernetes | openshift
+			http.Error(w, err.Error(), http.StatusBadRequest)
+			return
+		}
+	}
+	if dnsResolver != "" {
+		if _, err := generator.WithDNSResolver(dnsResolver); err != nil { // <namespace>[/<label>=<value>]:<port>[/<proto>]
+			http.Error(w, err.Error(), http.StatusBadRequest)
+			return
+		}
+	}
+	if r.URL.Query().Get("dnsVisibility") == "true" {
+		generator = generator.WithDNSVisibility() // E3: opt-in DNS visibility companion rule
+	}
+	policies, yamlBytes, err := generator.GeneratePoliciesWithYAML(aggregatedFlows)
 	if err != nil {
-		if errors.Is(err, policy.ErrReplyFlow) {
+		if errors.Is(err, policy.ErrReplyFlow) || errors.Is(err, policy.ErrNameNeedsOnePolicy) || errors.Is(err, policy.ErrInvalidPolicy) {
 			http.Error(w, err.Error(), http.StatusBadRequest)
 			return
 		}
@@ -448,71 +813,21 @@ func (s *Server) handleGenerate(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	// Determine filename from policy
-	filename := "ciliumnetworkpolicy.yaml"
-	if len(aggregatedFlows) > 0 {
-		agg := aggregatedFlows[0]
-		var namespace, appName string
-		if agg.Direction == "INGRESS" {
-			namespace = agg.DestNamespace
-			appName = getAppName(agg.DestLabels)
-		} else {
-			namespace = agg.SourceNamespace
-			appName = getAppName(agg.SourceLabels)
-		}
-		if namespace != "" && appName != "" {
-			filename = fmt.Sprintf("%s-%s.yaml", namespace, sanitizeName(appName))
-		}
+	// One policy is named after it; several get one file that holds them all
+	filename := fmt.Sprintf("ciliumnetworkpolicies-%d.yaml", len(policies))
+	if len(policies) == 1 && policies[0].Metadata.Namespace != "" && policies[0].Metadata.Name != "" {
+		filename = fmt.Sprintf("%s-%s.yaml", policies[0].Metadata.Namespace, sanitizeName(policies[0].Metadata.Name))
 	}
 
-	// Check if request comes from Grafana or wants JSON response
-	acceptHeader := r.Header.Get("Accept")
-	grafanaAction := r.Header.Get("X-Grafana-Action")
-	wantsJSON := strings.Contains(acceptHeader, "application/json") || grafanaAction != ""
-
-	if wantsJSON {
-		// Use flow UUID as cache ID, fallback to generated ID if empty
-		id := parsedFlow.UUID
-		if id == "" {
-			id = generateID()
-		}
-
-		s.mu.Lock()
-		s.cache[id] = &CachedPolicy{
-			Content:   yamlBytes,
-			Filename:  filename,
-			CreatedAt: time.Now(),
-		}
-		s.mu.Unlock()
-
-		// Build download URL
-		scheme := "http"
-		if r.TLS != nil {
-			scheme = "https"
-		}
-		host := r.Host
-		downloadURL := fmt.Sprintf("%s://%s/download/%s", scheme, host, id)
-
-		// Return JSON response
-		w.Header().Set("Content-Type", "application/json")
-		w.WriteHeader(http.StatusOK)
-		response := map[string]string{
-			"filename":     filename,
-			"download_url": downloadURL,
-			"message":      "Policy generated successfully. Use the download_url to download the file.",
-		}
-		json.NewEncoder(w).Encode(response)
-
-		log.Printf("Generated policy (cached): %s, download: %s", filename, downloadURL)
-	} else {
-		// Direct file download for curl/wget
-		w.Header().Set("Content-Type", "application/x-yaml")
-		w.Header().Set("Content-Disposition", fmt.Sprintf("attachment; filename=\"%s\"", filename))
-		w.WriteHeader(http.StatusOK)
-		w.Write(yamlBytes)
-
-		log.Printf("Generated policy (direct): %s", filename)
+	// The cache key is the flow's UUID for a single flow (Grafana's Download link is built from it), else random
+	id := ""
+	if len(parsedFlows) == 1 {
+		id = parsedFlows[0].UUID
+	}
+	if id == "" {
+		id = generateID()
 	}
+	s.respond(w, r, id, yamlBytes, filename, "Policy generated successfully. Use the download_url to download the file.", len(parsedFlows), len(policies))
 }
 
 // handleYoloNs handles the YOLO namespace easter egg
@@ -534,80 +849,7 @@ func (s *Server) handleYoloNs(w http.ResponseWriter, r *http.Request, bodyStr st
 	}
 
 	filename := fmt.Sprintf("%s-yolo-allow-all-in-namespace.yaml", namespace)
-
-	// Check if request comes from Grafana or wants JSON response
-	acceptHeader := r.Header.Get("Accept")
-	grafanaAction := r.Header.Get("X-Grafana-Action")
-	wantsJSON := strings.Contains(acceptHeader, "application/json") || grafanaAction != ""
-
-	if wantsJSON {
-		id := generateID()
-
-		s.mu.Lock()
-		s.cache[id] = &CachedPolicy{
-			Content:   yamlBytes,
-			Filename:  filename,
-			CreatedAt: time.Now(),
-		}
-		s.mu.Unlock()
-
-		// Build download URL
-		scheme := "http"
-		if r.TLS != nil {
-			scheme = "https"
-		}
-		host := r.Host
-		downloadURL := fmt.Sprintf("%s://%s/download/%s", scheme, host, id)
-
-		// Return JSON response
-		w.Header().Set("Content-Type", "application/json")
-		w.WriteHeader(http.StatusOK)
-		response := map[string]string{
-			"filename":     filename,
-			"download_url": downloadURL,
-			"message":      "YOLO! Policy generated. Use the download_url to download the file.",
-		}
-		json.NewEncoder(w).Encode(response)
-
-		log.Printf("Generated YOLO policy (cached): %s, download: %s", filename, downloadURL)
-	} else {
-		// Direct file download
-		w.Header().Set("Content-Type", "application/x-yaml")
-		w.Header().Set("Content-Disposition", fmt.Sprintf("attachment; filename=\"%s\"", filename))
-		w.WriteHeader(http.StatusOK)
-		w.Write(yamlBytes)
-
-		log.Printf("Generated YOLO policy (direct): %s", filename)
-	}
-}
-
-// getAppName extracts the application name from labels
-func getAppName(labels map[string]string) string {
-	// Priority order for app name
-	priorityLabels := []string{
-		"app.kubernetes.io/name",
-		"app.kubernetes.io/instance",
-		"app.kubernetes.io/component",
-	}
-	fallbackLabels := []string{
-		"app",
-		"k8s-app",
-		"name",
-		"component",
-		"instance",
-	}
-
-	for _, label := range priorityLabels {
-		if name, ok := labels[label]; ok {
-			return name
-		}
-	}
-	for _, label := range fallbackLabels {
-		if name, ok := labels[label]; ok {
-			return name
-		}
-	}
-	return "policy"
+	s.respond(w, r, generateID(), yamlBytes, filename, "YOLO! Policy generated. Use the download_url to download the file.", 0, 1)
 }
 
 // sanitizeName ensures the name is valid for filenames
diff --git a/internal/server/server_test.go b/internal/server/server_test.go
new file mode 100644
index 0000000..119667e
--- /dev/null
+++ b/internal/server/server_test.go
@@ -0,0 +1,346 @@
+package server
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/hubble-policy-gen/internal/flow"
+)
+
+func fixture(t *testing.T, name string) string {
+	t.Helper()
+	b, err := os.ReadFile(filepath.Join("..", "testdata", name))
+	if err != nil {
+		t.Fatal(err)
+	}
+	return string(b)
+}
+
+func post(t *testing.T, s *Server, path, body string, headers map[string]string) *httptest.ResponseRecorder {
+	t.Helper()
+	req := httptest.NewRequest(http.MethodPost, path, strings.NewReader(body))
+	req.Host = "cf2cnp.example.test"
+	for k, v := range headers {
+		req.Header.Set(k, v)
+	}
+	rec := httptest.NewRecorder()
+	s.handleGenerate(rec, req)
+	return rec
+}
+
+func jsonBody(t *testing.T, rec *httptest.ResponseRecorder) map[string]interface{} {
+	t.Helper()
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status %d: %s", rec.Code, rec.Body.String())
+	}
+	var m map[string]interface{}
+	if err := json.Unmarshal(rec.Body.Bytes(), &m); err != nil {
+		t.Fatalf("not JSON: %v: %s", err, rec.Body.String())
+	}
+	return m
+}
+
+// Before the fix a server behind a TLS-terminating gateway answered http://…: the listener has no TLS,
+// and the proxy headers were not read. Each case is one way the base can be known.
+func TestDownloadURL_Scheme(t *testing.T) {
+	flow := fixture(t, "ingress-pos-to-shop.json")
+	cases := []struct {
+		name    string
+		server  *Server
+		headers map[string]string
+		want    string
+	}{
+		{"plain request, no proxy", NewServer(8080, ""), nil, "http://cf2cnp.example.test/download/"},
+		{"X-Forwarded-Proto https", NewServer(8080, ""), map[string]string{"X-Forwarded-Proto": "https"}, "https://cf2cnp.example.test/download/"},
+		{"X-Forwarded-Proto list (first wins)", NewServer(8080, ""), map[string]string{"X-Forwarded-Proto": "https, http"}, "https://cf2cnp.example.test/download/"},
+		{"X-Forwarded-Host too", NewServer(8080, ""), map[string]string{"X-Forwarded-Proto": "https", "X-Forwarded-Host": "cf2cnp.poc.local"}, "https://cf2cnp.poc.local/download/"},
+		{"RFC 7239 Forwarded", NewServer(8080, ""), map[string]string{"Forwarded": `for=10.0.0.1;proto=https;host="cf2cnp.poc.local"`}, "https://cf2cnp.poc.local/download/"},
+		{"garbage proto is ignored", NewServer(8080, ""), map[string]string{"X-Forwarded-Proto": "gopher"}, "http://cf2cnp.example.test/download/"},
+		{"--external-url wins over headers", NewServer(8080, "https://policies.example.com/cf2cnp/"), map[string]string{"X-Forwarded-Proto": "http"}, "https://policies.example.com/cf2cnp/download/"},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			h := map[string]string{"Accept": "application/json"}
+			for k, v := range c.headers {
+				h[k] = v
+			}
+			m := jsonBody(t, post(t, c.server, "/generate", flow, h))
+			got, _ := m["download_url"].(string)
+			if !strings.HasPrefix(got, c.want) {
+				t.Fatalf("download_url = %q, want prefix %q", got, c.want)
+			}
+		})
+	}
+}
+
+// Review finding: Forwarded (RFC 7239) must beat X-Forwarded-*, and a host header is a host, not a path
+func TestDownloadURL_PrecedenceAndHostSanity(t *testing.T) {
+	flow := fixture(t, "ingress-pos-to-shop.json")
+	cases := []struct {
+		name    string
+		headers map[string]string
+		want    string
+	}{
+		{"Forwarded wins over X-Forwarded-*", map[string]string{"Forwarded": `for=10.0.0.1;proto=https;host="cf2cnp.poc.local"`, "X-Forwarded-Proto": "http", "X-Forwarded-Host": "evil.example"}, "https://cf2cnp.poc.local/download/"},
+		{"X-Forwarded-Host with a path is ignored", map[string]string{"X-Forwarded-Proto": "https", "X-Forwarded-Host": "evil.example/steal"}, "https://cf2cnp.example.test/download/"},
+		{"trailing slash is not a host", map[string]string{"X-Forwarded-Proto": "https", "X-Forwarded-Host": "cf2cnp.poc.local/"}, "https://cf2cnp.example.test/download/"},
+		{"CRLF in host is ignored", map[string]string{"X-Forwarded-Host": "evil.example\r\nX-Injected: 1"}, "http://cf2cnp.example.test/download/"},
+		{"blank X-Forwarded-Host keeps r.Host", map[string]string{"X-Forwarded-Host": "   "}, "http://cf2cnp.example.test/download/"},
+		{"Forwarded for= only", map[string]string{"Forwarded": "for=10.0.0.1"}, "http://cf2cnp.example.test/download/"},
+		{"userinfo in host is ignored", map[string]string{"X-Forwarded-Host": "a@evil.example"}, "http://cf2cnp.example.test/download/"},
+		{"host with port is a host", map[string]string{"X-Forwarded-Host": "cf2cnp.poc.local:8443", "X-Forwarded-Proto": "https"}, "https://cf2cnp.poc.local:8443/download/"},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			h := map[string]string{"Accept": "application/json"}
+			for k, v := range c.headers {
+				h[k] = v
+			}
+			m := jsonBody(t, post(t, NewServer(8080, ""), "/generate", flow, h))
+			got, _ := m["download_url"].(string)
+			if !strings.HasPrefix(got, c.want) || strings.Contains(got, "//download") {
+				t.Fatalf("download_url = %q, want prefix %q", got, c.want)
+			}
+		})
+	}
+}
+
+func TestGenerate_BodyLimit(t *testing.T) {
+	s := NewServer(8080, "")
+	rec := post(t, s, "/generate", strings.Repeat("x", maxBodyBytes+1), nil)
+	if rec.Code != http.StatusRequestEntityTooLarge {
+		t.Fatalf("oversize body: %d %s", rec.Code, rec.Body.String())
+	}
+	// a large but legitimate body: 500 flows
+	body := strings.Repeat(fixture(t, "ingress-pos-to-shop.json")+"\n", 500)
+	m := jsonBody(t, post(t, s, "/generate", body, map[string]string{"Accept": "application/json"}))
+	if m["flows"].(float64) != 500 || m["policies"].(float64) != 1 {
+		t.Fatalf("500 identical flows must be one policy: flows=%v policies=%v", m["flows"], m["policies"])
+	}
+}
+
+func TestGenerate_GrafanaActionKeepsFlowUUIDAndServesDownload(t *testing.T) {
+	s := NewServer(8080, "")
+	flow := fixture(t, "ingress-pos-to-shop.json")
+	m := jsonBody(t, post(t, s, "/generate", flow, map[string]string{"X-Grafana-Action": "1", "X-Forwarded-Proto": "https"}))
+	url, _ := m["download_url"].(string)
+	if !strings.HasSuffix(url, "/download/6a6f5d0f-9a1e-4a7e-9f39-1e1c6b7a2c11") && !strings.Contains(url, "/download/") {
+		t.Fatalf("unexpected download_url %q", url)
+	}
+	id := url[strings.LastIndex(url, "/")+1:]
+	var uuid struct {
+		Flow struct {
+			UUID string `json:"uuid"`
+		} `json:"flow"`
+	}
+	json.Unmarshal([]byte(flow), &uuid)
+	if id != uuid.Flow.UUID {
+		t.Fatalf("cache id must be the flow's uuid (%s), got %s", uuid.Flow.UUID, id)
+	}
+	if m["filename"] != "cf2cnp-lab-shop.yaml" || m["flows"].(float64) != 1 || m["policies"].(float64) != 1 || !strings.Contains(m["yaml"].(string), "kind: CiliumNetworkPolicy") {
+		t.Fatalf("answer must carry filename, counts and the yaml: %v", m)
+	}
+	req := httptest.NewRequest(http.MethodGet, "/download/"+id, nil)
+	rec := httptest.NewRecorder()
+	s.handleDownload(rec, req)
+	if rec.Code != 200 || rec.Header().Get("Content-Disposition") != `attachment; filename="cf2cnp-lab-shop.yaml"` {
+		t.Fatalf("download: %d %v", rec.Code, rec.Header())
+	}
+}
+
+func TestGenerate_ManyFlowsOneBody(t *testing.T) {
+	s := NewServer(8080, "")
+	body := fixture(t, "ingress-pos-to-shop.json") + "\n" + fixture(t, "ingress-stranger-to-shop.json") + "\n" + fixture(t, "egress-pos-to-world.json")
+	rec := post(t, s, "/generate", body, nil)
+	if rec.Code != 200 {
+		t.Fatalf("%d %s", rec.Code, rec.Body.String())
+	}
+	yaml := rec.Body.String()
+	if strings.Count(yaml, "kind: CiliumNetworkPolicy") != 2 || strings.Count(yaml, "fromEndpoints") != 2 {
+		t.Fatalf("three flows must become two policies, shop with two peers:\n%s", yaml)
+	}
+	if rec.Header().Get("Content-Disposition") != `attachment; filename="ciliumnetworkpolicies-2.yaml"` {
+		t.Fatalf("filename for several policies: %s", rec.Header().Get("Content-Disposition"))
+	}
+	m := jsonBody(t, post(t, s, "/generate", body, map[string]string{"Accept": "application/json"}))
+	if m["flows"].(float64) != 3 || m["policies"].(float64) != 2 {
+		t.Fatalf("counts: %v", m)
+	}
+}
+
+func TestGenerate_NameParam(t *testing.T) {
+	s := NewServer(8080, "")
+	rec := post(t, s, "/generate?name=shop-from-pos", fixture(t, "ingress-pos-to-shop.json"), nil)
+	if rec.Code != 200 || !strings.Contains(rec.Body.String(), "name: shop-from-pos") || rec.Header().Get("Content-Disposition") != `attachment; filename="cf2cnp-lab-shop-from-pos.yaml"` {
+		t.Fatalf("%d %s %s", rec.Code, rec.Header().Get("Content-Disposition"), rec.Body.String())
+	}
+	rec = post(t, s, "/generate?name=x", fixture(t, "ingress-pos-to-shop.json")+"\n"+fixture(t, "egress-pos-to-world.json"), nil)
+	if rec.Code != http.StatusBadRequest || !strings.Contains(rec.Body.String(), "single policy") {
+		t.Fatalf("a name over two policies must be a 400 with the reason, got %d %s", rec.Code, rec.Body.String())
+	}
+}
+
+func TestGenerate_BadInputs(t *testing.T) {
+	s := NewServer(8080, "")
+	if rec := post(t, s, "/generate", "", nil); rec.Code != 400 || !strings.Contains(rec.Body.String(), "empty") {
+		t.Fatalf("empty body: %d %s", rec.Code, rec.Body.String())
+	}
+	if rec := post(t, s, "/generate", "{not json", nil); rec.Code != 400 {
+		t.Fatalf("bad json: %d", rec.Code)
+	}
+	reply := strings.Replace(fixture(t, "ingress-pos-to-shop.json"), `"is_reply":false`, `"is_reply":true`, 1)
+	if rec := post(t, s, "/generate", reply, nil); rec.Code != 400 || !strings.Contains(rec.Body.String(), "reply packet") {
+		t.Fatalf("reply flow: %d %s", rec.Code, rec.Body.String())
+	}
+}
+
+func TestYolo_JSONUsesBaseURL(t *testing.T) {
+	m := jsonBody(t, post(t, NewServer(8080, ""), "/generate", "yolo ns dev", map[string]string{"Accept": "application/json", "X-Forwarded-Proto": "https"}))
+	if !strings.HasPrefix(m["download_url"].(string), "https://cf2cnp.example.test/download/") || m["filename"] != "dev-yolo-allow-all-in-namespace.yaml" {
+		t.Fatalf("%v", m)
+	}
+}
+
+// E4: ?exclude=key=value drops the flows whose peer carries it; the peer is the source for INGRESS
+func TestGenerate_ExcludePeers(t *testing.T) {
+	s := NewServer(8080, "")
+	body := fixture(t, "ingress-pos-to-shop.json") + "\n" + fixture(t, "ingress-stranger-to-shop.json")
+	rec := post(t, s, "/generate?exclude=app.kubernetes.io%2Fname%3Dstranger", body, nil)
+	if rec.Code != 200 || strings.Contains(rec.Body.String(), "stranger") || !strings.Contains(rec.Body.String(), "pos") {
+		t.Fatalf("stranger must be gone, pos kept: %d %s", rec.Code, rec.Body.String())
+	}
+	rec = post(t, s, "/generate?exclude=app.kubernetes.io%2Fname%3Dnobody", body, nil)
+	if rec.Code != 200 || strings.Count(rec.Body.String(), "fromEndpoints") != 2 {
+		t.Fatalf("an exclude that matches nothing changes nothing: %d %s", rec.Code, rec.Body.String())
+	}
+	rec = post(t, s, "/generate?exclude=app.kubernetes.io%2Fname%3Dpos&exclude=app.kubernetes.io%2Fname%3Dstranger", body, nil)
+	if rec.Code != http.StatusBadRequest {
+		t.Fatalf("everything excluded must be a 400, got %d", rec.Code)
+	}
+	// EGRESS: the peer is the destination; excluding the source does nothing
+	rec = post(t, s, "/generate?exclude=app.kubernetes.io%2Fname%3Dpos", fixture(t, "egress-pos-to-world.json"), nil)
+	if rec.Code != 200 {
+		t.Fatalf("egress flow: the source is not the peer, got %d", rec.Code)
+	}
+}
+
+// Review finding: a peer is identified by its whole priority label set — unticking shop/frontend must not remove
+// shop/backend, while a bare name=shop exclude still removes every shop component
+func TestExclude_WholeLabelSetAndSingleLabel(t *testing.T) {
+	front := &flow.ParsedFlow{Direction: "INGRESS", SourceLabels: map[string]string{"app.kubernetes.io/name": "shop", "app.kubernetes.io/component": "frontend"}}
+	back := &flow.ParsedFlow{Direction: "INGRESS", SourceLabels: map[string]string{"app.kubernetes.io/name": "shop", "app.kubernetes.io/component": "backend"}}
+	if n := excludeFlows([]*flow.ParsedFlow{front, back}, []string{"app.kubernetes.io/name=shop,app.kubernetes.io/component=frontend"}); len(n) != 1 || n[0] != back {
+		t.Fatalf("the whole set must exclude only the frontend, got %d", len(n))
+	}
+	if n := excludeFlows([]*flow.ParsedFlow{front, back}, []string{"app.kubernetes.io/name=shop"}); len(n) != 0 {
+		t.Fatalf("a bare name excludes every component, got %d", len(n))
+	}
+	inst := &flow.ParsedFlow{Direction: "INGRESS", SourceLabels: map[string]string{"app.kubernetes.io/instance": "blue"}}
+	if n := excludeFlows([]*flow.ParsedFlow{inst}, []string{"app=payments"}); len(n) != 1 {
+		t.Fatalf("exclude=app= must not drop a peer the parser named by instance")
+	}
+	// the page's key lists exactly the parser's priority labels, then the fallbacks, in order
+	rec := httptest.NewRecorder()
+	NewServer(8080, "").handleIndex(rec, httptest.NewRequest(http.MethodGet, "/", nil))
+	page := rec.Body.String()
+	i := strings.Index(page, "function peerKey")
+	for _, k := range []string{"'app.kubernetes.io/name'", "'app.kubernetes.io/component'", "'app.kubernetes.io/instance'", "'app'", "'k8s-app'", "'name'", "'component'", "'instance'"} {
+		j := strings.Index(page[i:], k)
+		if j < 0 {
+			t.Fatalf("the page's peerKey must list %s", k)
+		}
+		i += j
+	}
+}
+
+// E6: CORS — any origin by default; a listed origin is echoed with Vary; an unlisted one gets no allow header
+func TestCORS_AllowedOrigins(t *testing.T) {
+	flow := fixture(t, "ingress-pos-to-shop.json")
+	open := NewServer(8080, "")
+	rec := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodPost, "/generate", strings.NewReader(flow))
+	req.Header.Set("Origin", "https://anything.example")
+	open.corsMiddleware(open.handleGenerate)(rec, req)
+	if rec.Header().Get("Access-Control-Allow-Origin") != "*" {
+		t.Fatalf("default must be *: %v", rec.Header())
+	}
+	strict := NewServerWithOptions(8080, "", Options{AllowedOrigins: []string{"https://grafana.poc.local"}})
+	for origin, want := range map[string]string{"https://grafana.poc.local": "https://grafana.poc.local", "https://evil.example": ""} {
+		rec := httptest.NewRecorder()
+		req := httptest.NewRequest(http.MethodOptions, "/generate", nil)
+		req.Header.Set("Origin", origin)
+		strict.corsMiddleware(strict.handleGenerate)(rec, req)
+		if got := rec.Header().Get("Access-Control-Allow-Origin"); got != want {
+			t.Fatalf("origin %s: got %q want %q", origin, got, want)
+		}
+		if want != "" && rec.Header().Get("Vary") != "Origin" {
+			t.Fatalf("a listed origin must set Vary: Origin")
+		}
+	}
+}
+
+// E6: the bearer token guards /generate and /download, not /health; preflight passes; wrong token is 401
+func TestAuthToken(t *testing.T) {
+	s := NewServerWithOptions(8080, "", Options{AuthToken: "s3cret"})
+	flow := fixture(t, "ingress-pos-to-shop.json")
+	call := func(method, path, token string) *httptest.ResponseRecorder {
+		rec := httptest.NewRecorder()
+		req := httptest.NewRequest(method, path, strings.NewReader(flow))
+		if token != "" {
+			req.Header.Set("Authorization", "Bearer "+token)
+		}
+		s.corsMiddleware(s.requireToken(s.handleGenerate))(rec, req)
+		return rec
+	}
+	if rec := call(http.MethodPost, "/generate", ""); rec.Code != http.StatusUnauthorized || rec.Header().Get("WWW-Authenticate") == "" {
+		t.Fatalf("no token: %d %v", rec.Code, rec.Header())
+	}
+	if rec := call(http.MethodPost, "/generate", "wrong"); rec.Code != http.StatusUnauthorized {
+		t.Fatalf("wrong token: %d", rec.Code)
+	}
+	if rec := call(http.MethodPost, "/generate", "s3cret"); rec.Code != http.StatusOK {
+		t.Fatalf("right token: %d %s", rec.Code, rec.Body.String())
+	}
+	if rec := call(http.MethodOptions, "/generate", ""); rec.Code != http.StatusOK {
+		t.Fatalf("preflight must not be challenged: %d", rec.Code)
+	}
+	rec := httptest.NewRecorder()
+	s.handleHealth(rec, httptest.NewRequest(http.MethodGet, "/health", nil))
+	if rec.Code != http.StatusOK {
+		t.Fatalf("/health is open: %d", rec.Code)
+	}
+}
+
+// Review finding: the scheme is case-insensitive, and a wrong token of ANY length is refused the same way
+func TestAuthToken_SchemeCaseAndLengths(t *testing.T) {
+	s := NewServerWithOptions(8080, "", Options{AuthToken: "s3cret"})
+	flow := fixture(t, "ingress-pos-to-shop.json")
+	for header, want := range map[string]int{"bearer s3cret": 200, "BEARER s3cret": 200, "Bearer s3cret": 200, "Bearer s3cre": 401, "Bearer s3cret-and-more": 401, "Basic s3cret": 401, "": 401} {
+		rec := httptest.NewRecorder()
+		req := httptest.NewRequest(http.MethodPost, "/generate", strings.NewReader(flow))
+		if header != "" {
+			req.Header.Set("Authorization", header)
+		}
+		s.corsMiddleware(s.requireToken(s.handleGenerate))(rec, req)
+		if rec.Code != want {
+			t.Fatalf("%q: got %d want %d", header, rec.Code, want)
+		}
+	}
+}
+
+// 0.7.0: ?dnsProfile=openshift writes the OpenShift resolver rule; an unknown profile is a 400
+func TestGenerate_DNSProfile(t *testing.T) {
+	s := NewServer(8080, "")
+	rec := post(t, s, "/generate?dnsVisibility=true&dnsProfile=openshift", fixture(t, "egress-pos-to-world.json"), nil)
+	if rec.Code != 200 || !strings.Contains(rec.Body.String(), "io.kubernetes.pod.namespace: openshift-dns") || !strings.Contains(rec.Body.String(), "port: \"5353\"") {
+		t.Fatalf("openshift profile: %d %s", rec.Code, rec.Body.String())
+	}
+	if rec := post(t, s, "/generate?dnsProfile=nope", fixture(t, "egress-pos-to-world.json"), nil); rec.Code != http.StatusBadRequest {
+		t.Fatalf("unknown profile must be a 400, got %d", rec.Code)
+	}
+}
diff --git a/internal/testdata/egress-payments-poc2-to-redis-poc1.json b/internal/testdata/egress-payments-poc2-to-redis-poc1.json
new file mode 100644
index 0000000..a81bf78
--- /dev/null
+++ b/internal/testdata/egress-payments-poc2-to-redis-poc1.json
@@ -0,0 +1 @@
+{"flow": {"time": "2026-09-13T04:38:06.796159947Z", "uuid": "f2bbdd29-b9f4-4c2a-b5ab-a1e234e5860d", "emitter": {"name": "Hubble", "version": "1.20.1+g7d68cfb3"}, "verdict": "FORWARDED", "ethernet": {"source": "6e:7a:be:97:be:91", "destination": "c2:7a:2d:dd:e2:c3"}, "IP": {"source": "10.20.1.17", "destination": "10.10.4.114", "ipVersion": "IPv4"}, "l4": {"TCP": {"source_port": 58910, "destination_port": 6379, "flags": {"ACK": true}}}, "source": {"identity": 138635, "cluster_name": "poc2", "namespace": "bank", "labels": ["k8s:app=payments", "k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=bank", "k8s:io.cilium.k8s.policy.cluster=poc2", "k8s:io.cilium.k8s.policy.serviceaccount=default", "k8s:io.kubernetes.pod.namespace=bank"], "pod_name": "payments-7dbb8cdfdb-5bsf5"}, "destination": {"ID": 747, "identity": 88608, "cluster_name": "poc1", "namespace": "bank", "labels": ["k8s:app=redis", "k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=bank", "k8s:io.cilium.k8s.policy.cluster=poc1", "k8s:io.cilium.k8s.policy.serviceaccount=default", "k8s:io.kubernetes.pod.namespace=bank"], "pod_name": "redis-0", "workloads": [{"name": "redis", "kind": "StatefulSet"}]}, "Type": "L3_L4", "node_name": "poc1/poc1-worker", "node_labels": ["beta.kubernetes.io/arch=amd64", "beta.kubernetes.io/os=linux", "kubernetes.io/arch=amd64", "kubernetes.io/hostname=poc1-worker", "kubernetes.io/os=linux"], "event_type": {"type": 4}, "traffic_direction": "EGRESS", "trace_observation_point": "TO_ENDPOINT", "trace_reason": "ESTABLISHED", "is_reply": false, "interface": {"index": 129, "name": "lxc5076723f6920"}, "Summary": "TCP Flags: ACK"}, "node_name": "poc1/poc1-worker", "time": "2026-09-13T04:38:06.796159947Z"}
\ No newline at end of file
diff --git a/internal/testdata/egress-pos-to-helm-coredns.json b/internal/testdata/egress-pos-to-helm-coredns.json
new file mode 100644
index 0000000..7c19fbf
--- /dev/null
+++ b/internal/testdata/egress-pos-to-helm-coredns.json
@@ -0,0 +1 @@
+{"flow":{"time":"2026-09-13T11:15:24.514646998Z","uuid":"7cee56e7-f53a-42df-b11e-92ad7c33ac55","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","ethernet":{"source":"e6:fe:44:c2:b3:b6","destination":"2a:b2:c2:39:45:76"},"IP":{"source":"10.10.4.93","destination":"10.10.1.35","ipVersion":"IPv4"},"l4":{"UDP":{"source_port":41406,"destination_port":53}},"source":{"identity":82359,"cluster_name":"poc1","namespace":"cf2cnp-lab","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab"],"pod_name":"pos"},"destination":{"ID":591,"identity":80806,"cluster_name":"poc1","namespace":"dns-system","labels":["gen:io.cilium.k8s.named-ports-1=metrics.TCP.9153_readiness-probe.TCP.8181","gen:io.cilium.k8s.named-ports=dns.UDP.53_dns-tcp.TCP.53_liveness-probe.TCP.8080","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=coredns","k8s:app.kubernetes.io/instance=coredns","k8s:app.kubernetes.io/name=coredns","k8s:k8s-app=coredns","k8s:io.kubernetes.pod.namespace=dns-system","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=dns-system"],"pod_name":"coredns-coredns-7d4f8c9b6-abcde","workloads":[{"name":"coredns","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-control-plane2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-control-plane2","kubernetes.io/os=linux","node-role.kubernetes.io/control-plane=","node.kubernetes.io/exclude-from-external-load-balancers="],"event_type":{"type":4},"traffic_direction":"EGRESS","trace_observation_point":"TO_ENDPOINT","trace_reason":"NEW","is_reply":false,"interface":{"index":39,"name":"lxc1a237d3e277a"},"Summary":"UDP"},"node_name":"poc1/poc1-control-plane2","time":"2026-09-13T11:15:24.514646998Z"}
\ No newline at end of file
diff --git a/internal/testdata/egress-pos-to-kube-dns.json b/internal/testdata/egress-pos-to-kube-dns.json
new file mode 100644
index 0000000..83356fb
--- /dev/null
+++ b/internal/testdata/egress-pos-to-kube-dns.json
@@ -0,0 +1,87 @@
+{
+  "flow": {
+    "time": "2026-09-13T11:15:24.514646998Z",
+    "uuid": "eb427f52-8fbd-41fb-bb19-228369ec61d3",
+    "emitter": {
+      "name": "Hubble",
+      "version": "1.20.1+g7d68cfb3"
+    },
+    "verdict": "FORWARDED",
+    "ethernet": {
+      "source": "e6:fe:44:c2:b3:b6",
+      "destination": "2a:b2:c2:39:45:76"
+    },
+    "IP": {
+      "source": "10.10.4.93",
+      "destination": "10.10.1.35",
+      "ipVersion": "IPv4"
+    },
+    "l4": {
+      "UDP": {
+        "source_port": 41406,
+        "destination_port": 53
+      }
+    },
+    "source": {
+      "identity": 82359,
+      "cluster_name": "poc1",
+      "namespace": "cf2cnp-lab",
+      "labels": [
+        "k8s:app.kubernetes.io/name=pos",
+        "k8s:app=pos",
+        "k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab",
+        "k8s:io.cilium.k8s.policy.cluster=poc1",
+        "k8s:io.cilium.k8s.policy.serviceaccount=default",
+        "k8s:io.kubernetes.pod.namespace=cf2cnp-lab"
+      ],
+      "pod_name": "pos"
+    },
+    "destination": {
+      "ID": 591,
+      "identity": 80806,
+      "cluster_name": "poc1",
+      "namespace": "kube-system",
+      "labels": [
+        "gen:io.cilium.k8s.named-ports-1=metrics.TCP.9153_readiness-probe.TCP.8181",
+        "gen:io.cilium.k8s.named-ports=dns.UDP.53_dns-tcp.TCP.53_liveness-probe.TCP.8080",
+        "k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=kube-system",
+        "k8s:io.cilium.k8s.policy.cluster=poc1",
+        "k8s:io.cilium.k8s.policy.serviceaccount=coredns",
+        "k8s:io.kubernetes.pod.namespace=kube-system",
+        "k8s:k8s-app=kube-dns"
+      ],
+      "pod_name": "coredns-789c5fbdb4-qhj2d",
+      "workloads": [
+        {
+          "name": "coredns",
+          "kind": "Deployment"
+        }
+      ]
+    },
+    "Type": "L3_L4",
+    "node_name": "poc1/poc1-control-plane2",
+    "node_labels": [
+      "beta.kubernetes.io/arch=amd64",
+      "beta.kubernetes.io/os=linux",
+      "kubernetes.io/arch=amd64",
+      "kubernetes.io/hostname=poc1-control-plane2",
+      "kubernetes.io/os=linux",
+      "node-role.kubernetes.io/control-plane=",
+      "node.kubernetes.io/exclude-from-external-load-balancers="
+    ],
+    "event_type": {
+      "type": 4
+    },
+    "traffic_direction": "EGRESS",
+    "trace_observation_point": "TO_ENDPOINT",
+    "trace_reason": "NEW",
+    "is_reply": false,
+    "interface": {
+      "index": 39,
+      "name": "lxc1a237d3e277a"
+    },
+    "Summary": "UDP"
+  },
+  "node_name": "poc1/poc1-control-plane2",
+  "time": "2026-09-13T11:15:24.514646998Z"
+}
diff --git a/internal/testdata/egress-pos-to-openshift-dns.json b/internal/testdata/egress-pos-to-openshift-dns.json
new file mode 100644
index 0000000..3f67e71
--- /dev/null
+++ b/internal/testdata/egress-pos-to-openshift-dns.json
@@ -0,0 +1,85 @@
+{
+  "flow": {
+    "time": "2026-09-13T11:15:24.514646998Z",
+    "uuid": "eb427f52-8fbd-41fb-bb19-228369ec61d3",
+    "emitter": {
+      "name": "Hubble",
+      "version": "1.20.1+g7d68cfb3"
+    },
+    "verdict": "FORWARDED",
+    "ethernet": {
+      "source": "e6:fe:44:c2:b3:b6",
+      "destination": "2a:b2:c2:39:45:76"
+    },
+    "IP": {
+      "source": "10.10.4.93",
+      "destination": "10.128.0.7",
+      "ipVersion": "IPv4"
+    },
+    "l4": {
+      "UDP": {
+        "source_port": 41406,
+        "destination_port": 5353
+      }
+    },
+    "source": {
+      "identity": 82359,
+      "cluster_name": "poc1",
+      "namespace": "cf2cnp-lab",
+      "labels": [
+        "k8s:app.kubernetes.io/name=pos",
+        "k8s:app=pos",
+        "k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab",
+        "k8s:io.cilium.k8s.policy.cluster=poc1",
+        "k8s:io.cilium.k8s.policy.serviceaccount=default",
+        "k8s:io.kubernetes.pod.namespace=cf2cnp-lab"
+      ],
+      "pod_name": "pos"
+    },
+    "destination": {
+      "ID": 591,
+      "identity": 80806,
+      "cluster_name": "poc1",
+      "namespace": "openshift-dns",
+      "labels": [
+        "k8s:dns.operator.openshift.io/daemonset-dns=default",
+        "k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=openshift-dns",
+        "k8s:io.cilium.k8s.policy.cluster=poc1",
+        "k8s:io.cilium.k8s.policy.serviceaccount=dns",
+        "k8s:io.kubernetes.pod.namespace=openshift-dns"
+      ],
+      "pod_name": "dns-default-x9k2p",
+      "workloads": [
+        {
+          "name": "coredns",
+          "kind": "Deployment"
+        }
+      ]
+    },
+    "Type": "L3_L4",
+    "node_name": "poc1/poc1-control-plane2",
+    "node_labels": [
+      "beta.kubernetes.io/arch=amd64",
+      "beta.kubernetes.io/os=linux",
+      "kubernetes.io/arch=amd64",
+      "kubernetes.io/hostname=poc1-control-plane2",
+      "kubernetes.io/os=linux",
+      "node-role.kubernetes.io/control-plane=",
+      "node.kubernetes.io/exclude-from-external-load-balancers="
+    ],
+    "event_type": {
+      "type": 4
+    },
+    "traffic_direction": "EGRESS",
+    "trace_observation_point": "TO_ENDPOINT",
+    "trace_reason": "NEW",
+    "is_reply": false,
+    "interface": {
+      "index": 39,
+      "name": "lxc1a237d3e277a"
+    },
+    "Summary": "UDP"
+  },
+  "node_name": "poc1/poc1-control-plane2",
+  "time": "2026-09-13T11:15:24.514646998Z"
+}
diff --git a/internal/testdata/egress-pos-to-world-ipv4.json b/internal/testdata/egress-pos-to-world-ipv4.json
new file mode 100644
index 0000000..e33ab9f
--- /dev/null
+++ b/internal/testdata/egress-pos-to-world-ipv4.json
@@ -0,0 +1 @@
+{"flow":{"time":"2026-09-12T23:28:27.980513760Z","uuid":"7cee56e7-f53a-42df-b11e-92ad7c33ac44","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","ethernet":{"source":"fe:45:4b:8e:61:55","destination":"66:5a:4c:b8:5f:09"},"IP":{"source":"10.10.4.93","destination":"104.20.23.154","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":48674,"destination_port":443,"flags":{"PSH":true,"ACK":true}}},"source":{"ID":4091,"identity":82359,"cluster_name":"poc1","namespace":"cf2cnp-lab","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab"],"pod_name":"pos"},"destination":{"identity":9,"labels":["reserved:world-ipv4"]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":4,"sub_type":11},"traffic_direction":"EGRESS","trace_observation_point":"TO_NETWORK","trace_reason":"ESTABLISHED","is_reply":false,"interface":{"index":233,"name":"eth0"},"Summary":"TCP Flags: ACK, PSH"},"node_name":"poc1/poc1-worker","time":"2026-09-12T23:28:27.980513760Z"}
\ No newline at end of file
diff --git a/internal/testdata/egress-pos-to-world.json b/internal/testdata/egress-pos-to-world.json
new file mode 100644
index 0000000..cbe0ff7
--- /dev/null
+++ b/internal/testdata/egress-pos-to-world.json
@@ -0,0 +1 @@
+{"flow":{"time":"2026-09-12T23:28:27.980513760Z","uuid":"7cee56e7-f53a-42df-b11e-92ad7c33ac33","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","ethernet":{"source":"fe:45:4b:8e:61:55","destination":"66:5a:4c:b8:5f:09"},"IP":{"source":"10.10.4.93","destination":"104.20.23.154","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":48674,"destination_port":443,"flags":{"PSH":true,"ACK":true}}},"source":{"ID":4091,"identity":82359,"cluster_name":"poc1","namespace":"cf2cnp-lab","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab"],"pod_name":"pos"},"destination":{"identity":2,"labels":["reserved:world"]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":4,"sub_type":11},"traffic_direction":"EGRESS","trace_observation_point":"TO_NETWORK","trace_reason":"ESTABLISHED","is_reply":false,"interface":{"index":233,"name":"eth0"},"Summary":"TCP Flags: ACK, PSH"},"node_name":"poc1/poc1-worker","time":"2026-09-12T23:28:27.980513760Z"}
diff --git a/internal/testdata/egress-pos-to-world6.json b/internal/testdata/egress-pos-to-world6.json
new file mode 100644
index 0000000..ebbe857
--- /dev/null
+++ b/internal/testdata/egress-pos-to-world6.json
@@ -0,0 +1,75 @@
+{
+  "flow": {
+    "time": "2026-09-12T23:28:27.980513760Z",
+    "uuid": "7cee56e7-f53a-42df-b11e-92ad7c33ac33",
+    "emitter": {
+      "name": "Hubble",
+      "version": "1.20.1+g7d68cfb3"
+    },
+    "verdict": "FORWARDED",
+    "ethernet": {
+      "source": "fe:45:4b:8e:61:55",
+      "destination": "66:5a:4c:b8:5f:09"
+    },
+    "IP": {
+      "source": "10.10.4.93",
+      "destination": "2606:2800:21f:cb07:6820:80da:af6b:8b2c",
+      "ipVersion": "IPv6"
+    },
+    "l4": {
+      "TCP": {
+        "source_port": 48674,
+        "destination_port": 443,
+        "flags": {
+          "PSH": true,
+          "ACK": true
+        }
+      }
+    },
+    "source": {
+      "ID": 4091,
+      "identity": 82359,
+      "cluster_name": "poc1",
+      "namespace": "cf2cnp-lab",
+      "labels": [
+        "k8s:app.kubernetes.io/name=pos",
+        "k8s:app=pos",
+        "k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab",
+        "k8s:io.cilium.k8s.policy.cluster=poc1",
+        "k8s:io.cilium.k8s.policy.serviceaccount=default",
+        "k8s:io.kubernetes.pod.namespace=cf2cnp-lab"
+      ],
+      "pod_name": "pos"
+    },
+    "destination": {
+      "identity": 2,
+      "labels": [
+        "reserved:world"
+      ]
+    },
+    "Type": "L3_L4",
+    "node_name": "poc1/poc1-worker",
+    "node_labels": [
+      "beta.kubernetes.io/arch=amd64",
+      "beta.kubernetes.io/os=linux",
+      "kubernetes.io/arch=amd64",
+      "kubernetes.io/hostname=poc1-worker",
+      "kubernetes.io/os=linux"
+    ],
+    "event_type": {
+      "type": 4,
+      "sub_type": 11
+    },
+    "traffic_direction": "EGRESS",
+    "trace_observation_point": "TO_NETWORK",
+    "trace_reason": "ESTABLISHED",
+    "is_reply": false,
+    "interface": {
+      "index": 233,
+      "name": "eth0"
+    },
+    "Summary": "TCP Flags: ACK, PSH"
+  },
+  "node_name": "poc1/poc1-worker",
+  "time": "2026-09-12T23:28:27.980513760Z"
+}
diff --git a/internal/testdata/golden/26-pos-to-shop/expected.yaml b/internal/testdata/golden/26-pos-to-shop/expected.yaml
new file mode 100644
index 0000000..126b474
--- /dev/null
+++ b/internal/testdata/golden/26-pos-to-shop/expected.yaml
@@ -0,0 +1,21 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: shop
+  namespace: cf2cnp-lab
+  labels:
+    app.kubernetes.io/managed-by: cf2cnp
+    app.kubernetes.io/name: shop
+spec:
+  description: 'Allow ingress to shop in cf2cnp-lab: from pos on TCP/80'
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: shop
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            app.kubernetes.io/name: pos
+      toPorts:
+        - ports:
+            - port: "80"
+              protocol: TCP
diff --git a/internal/testdata/golden/26-pos-to-shop/flows.ndjson b/internal/testdata/golden/26-pos-to-shop/flows.ndjson
new file mode 100644
index 0000000..4065de4
--- /dev/null
+++ b/internal/testdata/golden/26-pos-to-shop/flows.ndjson
@@ -0,0 +1 @@
+{"flow":{"time":"2026-09-12T23:35:40.070891704Z","uuid":"e8bd1ea8-7f6d-419b-97d0-8e8e05e867a2","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"3e:c8:bc:d2:45:74","destination":"9a:95:6d:a3:3c:ba"},"IP":{"source":"10.10.4.93","destination":"10.10.3.7","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":45248,"destination_port":80,"flags":{"SYN":true}}},"source":{"identity":82359,"cluster_name":"poc1","namespace":"cf2cnp-lab","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab"],"pod_name":"pos"},"destination":{"ID":1955,"identity":94334,"cluster_name":"poc1","namespace":"cf2cnp-lab","labels":["k8s:app.kubernetes.io/name=shop","k8s:app=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab"],"pod_name":"shop-6d7d797759-4ddlt","workloads":[{"name":"shop","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-12T23:35:40.070891704Z"}
diff --git a/internal/testdata/golden/26-pos-to-shop/options.json b/internal/testdata/golden/26-pos-to-shop/options.json
new file mode 100644
index 0000000..0967ef4
--- /dev/null
+++ b/internal/testdata/golden/26-pos-to-shop/options.json
@@ -0,0 +1 @@
+{}
diff --git a/internal/testdata/golden/26-pos-to-world-cidr/expected.yaml b/internal/testdata/golden/26-pos-to-world-cidr/expected.yaml
new file mode 100644
index 0000000..700a3a1
--- /dev/null
+++ b/internal/testdata/golden/26-pos-to-world-cidr/expected.yaml
@@ -0,0 +1,23 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: pos
+  namespace: cf2cnp-lab
+  labels:
+    app.kubernetes.io/managed-by: cf2cnp
+    app.kubernetes.io/name: pos
+spec:
+  description: 'Allow egress from pos in cf2cnp-lab: to 104.20.23.154/32 on TCP/443'
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: pos
+  egress:
+    - toCIDR:
+        - 104.20.23.154/32
+    # To allow all traffic to world instead of specific IPs, replace toCIDR with:
+    # - toEntities:
+    #     - world
+      toPorts:
+        - ports:
+            - port: "443"
+              protocol: TCP
diff --git a/internal/testdata/golden/26-pos-to-world-cidr/flows.ndjson b/internal/testdata/golden/26-pos-to-world-cidr/flows.ndjson
new file mode 100644
index 0000000..cbe0ff7
--- /dev/null
+++ b/internal/testdata/golden/26-pos-to-world-cidr/flows.ndjson
@@ -0,0 +1 @@
+{"flow":{"time":"2026-09-12T23:28:27.980513760Z","uuid":"7cee56e7-f53a-42df-b11e-92ad7c33ac33","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","ethernet":{"source":"fe:45:4b:8e:61:55","destination":"66:5a:4c:b8:5f:09"},"IP":{"source":"10.10.4.93","destination":"104.20.23.154","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":48674,"destination_port":443,"flags":{"PSH":true,"ACK":true}}},"source":{"ID":4091,"identity":82359,"cluster_name":"poc1","namespace":"cf2cnp-lab","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab"],"pod_name":"pos"},"destination":{"identity":2,"labels":["reserved:world"]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":4,"sub_type":11},"traffic_direction":"EGRESS","trace_observation_point":"TO_NETWORK","trace_reason":"ESTABLISHED","is_reply":false,"interface":{"index":233,"name":"eth0"},"Summary":"TCP Flags: ACK, PSH"},"node_name":"poc1/poc1-worker","time":"2026-09-12T23:28:27.980513760Z"}
diff --git a/internal/testdata/golden/26-pos-to-world-cidr/options.json b/internal/testdata/golden/26-pos-to-world-cidr/options.json
new file mode 100644
index 0000000..0967ef4
--- /dev/null
+++ b/internal/testdata/golden/26-pos-to-world-cidr/options.json
@@ -0,0 +1 @@
+{}
diff --git a/internal/testdata/golden/26-stranger-to-shop/expected.yaml b/internal/testdata/golden/26-stranger-to-shop/expected.yaml
new file mode 100644
index 0000000..01947bb
--- /dev/null
+++ b/internal/testdata/golden/26-stranger-to-shop/expected.yaml
@@ -0,0 +1,21 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: shop
+  namespace: cf2cnp-lab
+  labels:
+    app.kubernetes.io/managed-by: cf2cnp
+    app.kubernetes.io/name: shop
+spec:
+  description: 'Allow ingress to shop in cf2cnp-lab: from stranger on TCP/80'
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: shop
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            app.kubernetes.io/name: stranger
+      toPorts:
+        - ports:
+            - port: "80"
+              protocol: TCP
diff --git a/internal/testdata/golden/26-stranger-to-shop/flows.ndjson b/internal/testdata/golden/26-stranger-to-shop/flows.ndjson
new file mode 100644
index 0000000..2e549fb
--- /dev/null
+++ b/internal/testdata/golden/26-stranger-to-shop/flows.ndjson
@@ -0,0 +1 @@
+{"flow":{"time":"2026-09-12T23:35:42.738361432Z","uuid":"034db8e8-0240-4582-b94d-47a3411ab5d5","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"3e:c8:bc:d2:45:74","destination":"9a:95:6d:a3:3c:ba"},"IP":{"source":"10.10.4.3","destination":"10.10.3.7","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":35528,"destination_port":80,"flags":{"SYN":true}}},"source":{"identity":117659,"cluster_name":"poc1","namespace":"cf2cnp-lab","labels":["k8s:app.kubernetes.io/name=stranger","k8s:app=stranger","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab"],"pod_name":"stranger"},"destination":{"ID":1955,"identity":94334,"cluster_name":"poc1","namespace":"cf2cnp-lab","labels":["k8s:app.kubernetes.io/name=shop","k8s:app=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab"],"pod_name":"shop-6d7d797759-4ddlt","workloads":[{"name":"shop","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-12T23:35:42.738361432Z"}
diff --git a/internal/testdata/golden/26-stranger-to-shop/options.json b/internal/testdata/golden/26-stranger-to-shop/options.json
new file mode 100644
index 0000000..0967ef4
--- /dev/null
+++ b/internal/testdata/golden/26-stranger-to-shop/options.json
@@ -0,0 +1 @@
+{}
diff --git a/internal/testdata/golden/27-shop-two-components/expected.yaml b/internal/testdata/golden/27-shop-two-components/expected.yaml
new file mode 100644
index 0000000..1d4e885
--- /dev/null
+++ b/internal/testdata/golden/27-shop-two-components/expected.yaml
@@ -0,0 +1,48 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: shop-backend
+  namespace: cf2cnp-lab27
+  labels:
+    app.kubernetes.io/component: backend
+    app.kubernetes.io/managed-by: cf2cnp
+    app.kubernetes.io/name: shop
+spec:
+  description: 'Allow ingress to shop/backend in cf2cnp-lab27: from shop/frontend on TCP/80'
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/component: backend
+      app.kubernetes.io/name: shop
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            app.kubernetes.io/component: frontend
+            app.kubernetes.io/name: shop
+      toPorts:
+        - ports:
+            - port: "80"
+              protocol: TCP
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: shop-frontend
+  namespace: cf2cnp-lab27
+  labels:
+    app.kubernetes.io/component: frontend
+    app.kubernetes.io/managed-by: cf2cnp
+    app.kubernetes.io/name: shop
+spec:
+  description: 'Allow ingress to shop/frontend in cf2cnp-lab27: from pos on TCP/80'
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/component: frontend
+      app.kubernetes.io/name: shop
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            app.kubernetes.io/name: pos
+      toPorts:
+        - ports:
+            - port: "80"
+              protocol: TCP
diff --git a/internal/testdata/golden/27-shop-two-components/flows.ndjson b/internal/testdata/golden/27-shop-two-components/flows.ndjson
new file mode 100644
index 0000000..98250a4
--- /dev/null
+++ b/internal/testdata/golden/27-shop-two-components/flows.ndjson
@@ -0,0 +1,30 @@
+{"flow":{"time":"2026-09-13T02:51:03.858118120Z","uuid":"86c1ab81-027f-423f-9702-099757b09ef6","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"72:0f:98:92:ce:fc","destination":"42:c8:01:29:0f:3f"},"IP":{"source":"10.10.3.20","destination":"10.10.3.151","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":55638,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"destination":{"ID":564,"identity":68863,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=backend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-backend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-backend-5d6f5c9759-mdtg2","workloads":[{"name":"shop-backend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T02:51:03.858118120Z"}
+{"flow":{"time":"2026-09-13T02:51:05.577109381Z","uuid":"52a4d30a-de5c-4db9-b58d-fca4cc95a76e","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.60","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":38374,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":815,"identity":98139,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"pos"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T02:51:05.577109381Z"}
+{"flow":{"time":"2026-09-13T02:51:08.889179454Z","uuid":"8b6395b2-5a3a-4bca-9c89-5ca99e253890","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"72:0f:98:92:ce:fc","destination":"42:c8:01:29:0f:3f"},"IP":{"source":"10.10.3.20","destination":"10.10.3.151","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":55652,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"destination":{"ID":564,"identity":68863,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=backend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-backend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-backend-5d6f5c9759-mdtg2","workloads":[{"name":"shop-backend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T02:51:08.889179454Z"}
+{"flow":{"time":"2026-09-13T02:51:10.613960082Z","uuid":"dce08af7-2394-4ad0-afe4-22d7a9afd911","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.60","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":38376,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":815,"identity":98139,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"pos"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T02:51:10.613960082Z"}
+{"flow":{"time":"2026-09-13T02:51:13.969489957Z","uuid":"87e8b6eb-2fc2-4793-a661-31eefd4e91ef","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"72:0f:98:92:ce:fc","destination":"42:c8:01:29:0f:3f"},"IP":{"source":"10.10.3.20","destination":"10.10.3.151","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":55978,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"destination":{"ID":564,"identity":68863,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=backend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-backend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-backend-5d6f5c9759-mdtg2","workloads":[{"name":"shop-backend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T02:51:13.969489957Z"}
+{"flow":{"time":"2026-09-13T02:51:15.642738941Z","uuid":"7b26f61a-7f0d-4870-8a4e-9337e2bd22ac","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.60","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":44538,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":815,"identity":98139,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"pos"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T02:51:15.642738941Z"}
+{"flow":{"time":"2026-09-13T02:51:19.054241468Z","uuid":"a9fde0f5-e082-4c55-8296-6fbf8e0bd119","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"72:0f:98:92:ce:fc","destination":"42:c8:01:29:0f:3f"},"IP":{"source":"10.10.3.20","destination":"10.10.3.151","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":55984,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"destination":{"ID":564,"identity":68863,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=backend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-backend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-backend-5d6f5c9759-mdtg2","workloads":[{"name":"shop-backend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T02:51:19.054241468Z"}
+{"flow":{"time":"2026-09-13T02:51:20.724271524Z","uuid":"4aedded4-705d-4d31-ba9f-11dd8e4ede4f","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.60","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":44548,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":815,"identity":98139,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"pos"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T02:51:20.724271524Z"}
+{"flow":{"time":"2026-09-13T02:51:24.120543756Z","uuid":"5698f0c8-bd1f-4168-b9c0-28e9d54fef7a","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"72:0f:98:92:ce:fc","destination":"42:c8:01:29:0f:3f"},"IP":{"source":"10.10.3.20","destination":"10.10.3.151","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":43788,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"destination":{"ID":564,"identity":68863,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=backend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-backend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-backend-5d6f5c9759-mdtg2","workloads":[{"name":"shop-backend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T02:51:24.120543756Z"}
+{"flow":{"time":"2026-09-13T02:51:25.748977500Z","uuid":"ce0d124a-83ed-4f47-b74b-7cd3df89049b","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.60","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":41024,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":815,"identity":98139,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"pos"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T02:51:25.748977500Z"}
+{"flow":{"time":"2026-09-13T02:51:29.225609767Z","uuid":"0d16e8b6-1b22-468d-8706-c50df05fa8a6","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"72:0f:98:92:ce:fc","destination":"42:c8:01:29:0f:3f"},"IP":{"source":"10.10.3.20","destination":"10.10.3.151","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":43802,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"destination":{"ID":564,"identity":68863,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=backend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-backend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-backend-5d6f5c9759-mdtg2","workloads":[{"name":"shop-backend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T02:51:29.225609767Z"}
+{"flow":{"time":"2026-09-13T02:51:30.772267614Z","uuid":"3858e284-be14-4b41-8e5e-c3ac6d434c3c","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.60","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":41038,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":815,"identity":98139,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"pos"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T02:51:30.772267614Z"}
+{"flow":{"time":"2026-09-13T02:51:34.285440479Z","uuid":"df642e53-70f6-49e6-ae7f-99afe4e7758f","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"72:0f:98:92:ce:fc","destination":"42:c8:01:29:0f:3f"},"IP":{"source":"10.10.3.20","destination":"10.10.3.151","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":37254,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"destination":{"ID":564,"identity":68863,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=backend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-backend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-backend-5d6f5c9759-mdtg2","workloads":[{"name":"shop-backend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T02:51:34.285440479Z"}
+{"flow":{"time":"2026-09-13T02:51:35.880332472Z","uuid":"9b75563a-7940-4ca6-90a8-4e043603f81e","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.60","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":43750,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":815,"identity":98139,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"pos"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T02:51:35.880332472Z"}
+{"flow":{"time":"2026-09-13T02:51:39.622269805Z","uuid":"fee2fc63-a0a2-4c70-869b-c3813bf565fd","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"72:0f:98:92:ce:fc","destination":"42:c8:01:29:0f:3f"},"IP":{"source":"10.10.3.20","destination":"10.10.3.151","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":37270,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"destination":{"ID":564,"identity":68863,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=backend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-backend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-backend-5d6f5c9759-mdtg2","workloads":[{"name":"shop-backend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T02:51:39.622269805Z"}
+{"flow":{"time":"2026-09-13T02:51:40.969403806Z","uuid":"6cd326a0-8c95-4a47-81f8-a97edf6344ca","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.60","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":43756,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":815,"identity":98139,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"pos"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T02:51:40.969403806Z"}
+{"flow":{"time":"2026-09-13T02:51:44.686490361Z","uuid":"a385e032-3d9c-44fc-ba8e-619ad9056bb8","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"72:0f:98:92:ce:fc","destination":"42:c8:01:29:0f:3f"},"IP":{"source":"10.10.3.20","destination":"10.10.3.151","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":56968,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"destination":{"ID":564,"identity":68863,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=backend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-backend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-backend-5d6f5c9759-mdtg2","workloads":[{"name":"shop-backend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T02:51:44.686490361Z"}
+{"flow":{"time":"2026-09-13T02:51:46.026660300Z","uuid":"37d6ed43-7312-4a14-8c81-1657c3781d15","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.60","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":41772,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":815,"identity":98139,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"pos"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T02:51:46.026660300Z"}
+{"flow":{"time":"2026-09-13T02:51:47.603098934Z","uuid":"e0630ec2-869e-49ab-a944-d151d341a7fa","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.60","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":41778,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":815,"identity":98139,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"pos"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T02:51:47.603098934Z"}
+{"flow":{"time":"2026-09-13T02:51:49.747268460Z","uuid":"9e384a42-c42c-4730-8743-a0fd9474f526","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"72:0f:98:92:ce:fc","destination":"42:c8:01:29:0f:3f"},"IP":{"source":"10.10.3.20","destination":"10.10.3.151","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":56976,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"destination":{"ID":564,"identity":68863,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=backend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-backend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-backend-5d6f5c9759-mdtg2","workloads":[{"name":"shop-backend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T02:51:49.747268460Z"}
+{"flow":{"time":"2026-09-13T02:51:51.062773577Z","uuid":"32808e84-413e-40be-9647-fcdd2e649ecd","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.60","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":41784,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":815,"identity":98139,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"pos"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T02:51:51.062773577Z"}
+{"flow":{"time":"2026-09-13T02:51:54.835960636Z","uuid":"962d8e5c-8898-471f-8796-72232eacd451","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"72:0f:98:92:ce:fc","destination":"42:c8:01:29:0f:3f"},"IP":{"source":"10.10.3.20","destination":"10.10.3.151","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":52050,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"destination":{"ID":564,"identity":68863,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=backend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-backend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-backend-5d6f5c9759-mdtg2","workloads":[{"name":"shop-backend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T02:51:54.835960636Z"}
+{"flow":{"time":"2026-09-13T02:51:56.112130395Z","uuid":"3483677d-80f3-4c6d-a2e0-d3d92865aeae","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.60","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":35834,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":815,"identity":98139,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"pos"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T02:51:56.112130395Z"}
+{"flow":{"time":"2026-09-13T02:51:59.864228421Z","uuid":"a3a2fba9-f1ef-4a5e-be82-94874f03acfb","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"72:0f:98:92:ce:fc","destination":"42:c8:01:29:0f:3f"},"IP":{"source":"10.10.3.20","destination":"10.10.3.151","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":52054,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"destination":{"ID":564,"identity":68863,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=backend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-backend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-backend-5d6f5c9759-mdtg2","workloads":[{"name":"shop-backend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T02:51:59.864228421Z"}
+{"flow":{"time":"2026-09-13T02:52:01.147333775Z","uuid":"77b17ef4-18fb-4dba-b1db-e04a3e6c073b","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.60","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":35846,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":815,"identity":98139,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"pos"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T02:52:01.147333775Z"}
+{"flow":{"time":"2026-09-13T02:52:04.970865846Z","uuid":"d35dc22f-e81c-4ff1-946f-07b21693c5c5","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"72:0f:98:92:ce:fc","destination":"42:c8:01:29:0f:3f"},"IP":{"source":"10.10.3.20","destination":"10.10.3.151","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":34984,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"destination":{"ID":564,"identity":68863,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=backend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-backend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-backend-5d6f5c9759-mdtg2","workloads":[{"name":"shop-backend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T02:52:04.970865846Z"}
+{"flow":{"time":"2026-09-13T02:52:06.180812652Z","uuid":"993d96c6-3e12-419a-921e-a521538ec551","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.60","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":43424,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":815,"identity":98139,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"pos"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T02:52:06.180812652Z"}
+{"flow":{"time":"2026-09-13T02:52:10.069495468Z","uuid":"bceabf54-7de5-4f8a-b4a2-f9ce31a12a22","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"72:0f:98:92:ce:fc","destination":"42:c8:01:29:0f:3f"},"IP":{"source":"10.10.3.20","destination":"10.10.3.151","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":35000,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"destination":{"ID":564,"identity":68863,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=backend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-backend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-backend-5d6f5c9759-mdtg2","workloads":[{"name":"shop-backend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T02:52:10.069495468Z"}
+{"flow":{"time":"2026-09-13T02:52:11.301770611Z","uuid":"4254315f-9522-412a-8596-5eb2fef5b6d4","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.60","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":43428,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":815,"identity":98139,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"pos"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T02:52:11.301770611Z"}
+{"flow":{"time":"2026-09-13T02:52:15.182185934Z","uuid":"12543f0a-451f-4443-9b79-623081e1a88a","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"72:0f:98:92:ce:fc","destination":"42:c8:01:29:0f:3f"},"IP":{"source":"10.10.3.20","destination":"10.10.3.151","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":34386,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"destination":{"ID":564,"identity":68863,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=backend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-backend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-backend-5d6f5c9759-mdtg2","workloads":[{"name":"shop-backend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T02:52:15.182185934Z"}
diff --git a/internal/testdata/golden/27-shop-two-components/options.json b/internal/testdata/golden/27-shop-two-components/options.json
new file mode 100644
index 0000000..0967ef4
--- /dev/null
+++ b/internal/testdata/golden/27-shop-two-components/options.json
@@ -0,0 +1 @@
+{}
diff --git a/internal/testdata/golden/29-cache-from-poc2/expected.yaml b/internal/testdata/golden/29-cache-from-poc2/expected.yaml
new file mode 100644
index 0000000..e93c6c4
--- /dev/null
+++ b/internal/testdata/golden/29-cache-from-poc2/expected.yaml
@@ -0,0 +1,25 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: cache-server
+  namespace: mesh-lab
+  labels:
+    app.kubernetes.io/component: server
+    app.kubernetes.io/managed-by: cf2cnp
+    app.kubernetes.io/name: cache
+spec:
+  description: 'Allow ingress to cache/server in mesh-lab: from worker/batch in cluster poc2 on TCP/6379'
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/component: server
+      app.kubernetes.io/name: cache
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            app.kubernetes.io/component: batch
+            app.kubernetes.io/name: worker
+            io.cilium.k8s.policy.cluster: poc2
+      toPorts:
+        - ports:
+            - port: "6379"
+              protocol: TCP
diff --git a/internal/testdata/golden/29-cache-from-poc2/flows.ndjson b/internal/testdata/golden/29-cache-from-poc2/flows.ndjson
new file mode 100644
index 0000000..2323e1d
--- /dev/null
+++ b/internal/testdata/golden/29-cache-from-poc2/flows.ndjson
@@ -0,0 +1,3 @@
+{"flow":{"time":"2026-09-13T10:57:30.266844864Z","uuid":"0c97f0d1-9eaf-49d6-99ad-50e7d6f73d1c","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"12:d1:e0:52:5f:16","destination":"4e:74:c4:e7:97:25"},"IP":{"source":"10.20.1.153","destination":"10.10.3.235","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":49750,"destination_port":6379,"flags":{"SYN":true}}},"source":{"identity":139460,"cluster_name":"poc2","namespace":"mesh-lab","labels":["k8s:app.kubernetes.io/component=batch","k8s:app.kubernetes.io/name=worker","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=mesh-lab","k8s:io.cilium.k8s.policy.cluster=poc2","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=mesh-lab"],"pod_name":"worker"},"destination":{"ID":703,"identity":97240,"cluster_name":"poc1","namespace":"mesh-lab","labels":["k8s:app.kubernetes.io/component=server","k8s:app.kubernetes.io/name=cache","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=mesh-lab","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=mesh-lab"],"pod_name":"cache-6d88ffb646-4nbtg","workloads":[{"name":"cache","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T10:57:30.266844864Z"}
+{"flow":{"time":"2026-09-13T10:57:30.293038232Z","uuid":"a16d15d4-ae63-4520-b7a2-5b46b6221123","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"12:d1:e0:52:5f:16","destination":"4e:74:c4:e7:97:25"},"IP":{"source":"10.20.1.153","destination":"10.10.3.235","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":49764,"destination_port":6379,"flags":{"SYN":true}}},"source":{"identity":139460,"cluster_name":"poc2","namespace":"mesh-lab","labels":["k8s:app.kubernetes.io/component=batch","k8s:app.kubernetes.io/name=worker","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=mesh-lab","k8s:io.cilium.k8s.policy.cluster=poc2","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=mesh-lab"],"pod_name":"worker"},"destination":{"ID":703,"identity":97240,"cluster_name":"poc1","namespace":"mesh-lab","labels":["k8s:app.kubernetes.io/component=server","k8s:app.kubernetes.io/name=cache","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=mesh-lab","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=mesh-lab"],"pod_name":"cache-6d88ffb646-4nbtg","workloads":[{"name":"cache","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T10:57:30.293038232Z"}
+{"flow":{"time":"2026-09-13T10:57:30.308257911Z","uuid":"82c40c91-5860-4da3-8325-ab88426c05fa","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"12:d1:e0:52:5f:16","destination":"4e:74:c4:e7:97:25"},"IP":{"source":"10.20.1.153","destination":"10.10.3.235","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":49768,"destination_port":6379,"flags":{"SYN":true}}},"source":{"identity":139460,"cluster_name":"poc2","namespace":"mesh-lab","labels":["k8s:app.kubernetes.io/component=batch","k8s:app.kubernetes.io/name=worker","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=mesh-lab","k8s:io.cilium.k8s.policy.cluster=poc2","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=mesh-lab"],"pod_name":"worker"},"destination":{"ID":703,"identity":97240,"cluster_name":"poc1","namespace":"mesh-lab","labels":["k8s:app.kubernetes.io/component=server","k8s:app.kubernetes.io/name=cache","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=mesh-lab","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=mesh-lab"],"pod_name":"cache-6d88ffb646-4nbtg","workloads":[{"name":"cache","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T10:57:30.308257911Z"}
diff --git a/internal/testdata/golden/29-cache-from-poc2/options.json b/internal/testdata/golden/29-cache-from-poc2/options.json
new file mode 100644
index 0000000..0967ef4
--- /dev/null
+++ b/internal/testdata/golden/29-cache-from-poc2/options.json
@@ -0,0 +1 @@
+{}
diff --git a/internal/testdata/golden/29-worker-poc2-egress/expected.yaml b/internal/testdata/golden/29-worker-poc2-egress/expected.yaml
new file mode 100644
index 0000000..a8e5d13
--- /dev/null
+++ b/internal/testdata/golden/29-worker-poc2-egress/expected.yaml
@@ -0,0 +1,33 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: worker-batch
+  namespace: mesh-lab
+  labels:
+    app.kubernetes.io/component: batch
+    app.kubernetes.io/managed-by: cf2cnp
+    app.kubernetes.io/name: worker
+spec:
+  description: 'Allow egress from worker/batch in mesh-lab: to kube-dns in kube-system on UDP/53; to cache/server in cluster poc1 on TCP/6379'
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/component: batch
+      app.kubernetes.io/name: worker
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            io.kubernetes.pod.namespace: kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+    - toEndpoints:
+        - matchLabels:
+            app.kubernetes.io/component: server
+            app.kubernetes.io/name: cache
+            io.cilium.k8s.policy.cluster: poc1
+      toPorts:
+        - ports:
+            - port: "6379"
+              protocol: TCP
diff --git a/internal/testdata/golden/29-worker-poc2-egress/flows.ndjson b/internal/testdata/golden/29-worker-poc2-egress/flows.ndjson
new file mode 100644
index 0000000..71aad02
--- /dev/null
+++ b/internal/testdata/golden/29-worker-poc2-egress/flows.ndjson
@@ -0,0 +1,18 @@
+{"flow":{"time":"2026-09-13T10:57:30.221457712Z","uuid":"51f8b07a-a597-4007-a273-9cd25ec3ce23","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","ethernet":{"source":"e6:ef:1a:04:ad:63","destination":"66:1b:49:84:c4:1b"},"IP":{"source":"10.20.1.153","destination":"10.20.1.136","ipVersion":"IPv4"},"l4":{"UDP":{"source_port":43649,"destination_port":53}},"source":{"ID":422,"identity":139460,"cluster_name":"poc2","namespace":"mesh-lab","labels":["k8s:app.kubernetes.io/component=batch","k8s:app.kubernetes.io/name=worker","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=mesh-lab","k8s:io.cilium.k8s.policy.cluster=poc2","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=mesh-lab"],"pod_name":"worker"},"destination":{"ID":575,"identity":136885,"cluster_name":"poc2","namespace":"kube-system","labels":["gen:io.cilium.k8s.named-ports-1=metrics.TCP.9153_readiness-probe.TCP.8181","gen:io.cilium.k8s.named-ports=dns.UDP.53_dns-tcp.TCP.53_liveness-probe.TCP.8080","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=kube-system","k8s:io.cilium.k8s.policy.cluster=poc2","k8s:io.cilium.k8s.policy.serviceaccount=coredns","k8s:io.kubernetes.pod.namespace=kube-system","k8s:k8s-app=kube-dns"],"pod_name":"coredns-879947797-f4bdb","workloads":[{"name":"coredns","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc2/poc2-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc2-worker","kubernetes.io/os=linux"],"event_type":{"type":4},"traffic_direction":"EGRESS","trace_observation_point":"TO_ENDPOINT","trace_reason":"NEW","is_reply":false,"interface":{"index":215,"name":"lxc229cede77785"},"Summary":"UDP"},"node_name":"poc2/poc2-worker","time":"2026-09-13T10:57:30.221457712Z"}
+{"flow":{"time":"2026-09-13T10:57:30.264664045Z","uuid":"dbd0263c-fcea-4a28-a641-e9fb6474d9a3","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","ethernet":{"source":"9a:6c:e7:18:19:55","destination":"22:18:38:38:27:8f"},"IP":{"source":"10.20.1.153","destination":"10.10.3.235","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":49750,"destination_port":6379,"flags":{"SYN":true}}},"source":{"ID":422,"identity":139460,"cluster_name":"poc2","namespace":"mesh-lab","labels":["k8s:app.kubernetes.io/component=batch","k8s:app.kubernetes.io/name=worker","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=mesh-lab","k8s:io.cilium.k8s.policy.cluster=poc2","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=mesh-lab"],"pod_name":"worker"},"destination":{"identity":97240,"cluster_name":"poc1","namespace":"mesh-lab","labels":["k8s:app.kubernetes.io/component=server","k8s:app.kubernetes.io/name=cache","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=mesh-lab","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=mesh-lab"],"pod_name":"cache-6d88ffb646-4nbtg"},"Type":"L3_L4","node_name":"poc2/poc2-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc2-worker","kubernetes.io/os=linux"],"event_type":{"type":4,"sub_type":4},"traffic_direction":"EGRESS","trace_observation_point":"TO_OVERLAY","trace_reason":"NEW","is_reply":false,"interface":{"index":13,"name":"cilium_vxlan"},"Summary":"TCP Flags: SYN"},"node_name":"poc2/poc2-worker","time":"2026-09-13T10:57:30.264664045Z"}
+{"flow":{"time":"2026-09-13T10:57:30.266285032Z","uuid":"b6339c34-4a0f-4fd4-a2b2-7fe22db638d1","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","ethernet":{"source":"9a:6c:e7:18:19:55","destination":"22:18:38:38:27:8f"},"IP":{"source":"10.20.1.153","destination":"10.10.3.235","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":49750,"destination_port":6379,"flags":{"ACK":true}}},"source":{"ID":422,"identity":139460,"cluster_name":"poc2","namespace":"mesh-lab","labels":["k8s:app.kubernetes.io/component=batch","k8s:app.kubernetes.io/name=worker","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=mesh-lab","k8s:io.cilium.k8s.policy.cluster=poc2","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=mesh-lab"],"pod_name":"worker"},"destination":{"identity":97240,"cluster_name":"poc1","namespace":"mesh-lab","labels":["k8s:app.kubernetes.io/component=server","k8s:app.kubernetes.io/name=cache","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=mesh-lab","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=mesh-lab"],"pod_name":"cache-6d88ffb646-4nbtg"},"Type":"L3_L4","node_name":"poc2/poc2-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc2-worker","kubernetes.io/os=linux"],"event_type":{"type":4,"sub_type":4},"traffic_direction":"EGRESS","trace_observation_point":"TO_OVERLAY","trace_reason":"ESTABLISHED","is_reply":false,"interface":{"index":13,"name":"cilium_vxlan"},"Summary":"TCP Flags: ACK"},"node_name":"poc2/poc2-worker","time":"2026-09-13T10:57:30.266285032Z"}
+{"flow":{"time":"2026-09-13T10:57:30.267255460Z","uuid":"d304bac9-7329-479f-8dd2-766ce31db728","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","ethernet":{"source":"9a:6c:e7:18:19:55","destination":"22:18:38:38:27:8f"},"IP":{"source":"10.20.1.153","destination":"10.10.3.235","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":49750,"destination_port":6379,"flags":{"PSH":true,"ACK":true}}},"source":{"ID":422,"identity":139460,"cluster_name":"poc2","namespace":"mesh-lab","labels":["k8s:app.kubernetes.io/component=batch","k8s:app.kubernetes.io/name=worker","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=mesh-lab","k8s:io.cilium.k8s.policy.cluster=poc2","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=mesh-lab"],"pod_name":"worker"},"destination":{"identity":97240,"cluster_name":"poc1","namespace":"mesh-lab","labels":["k8s:app.kubernetes.io/component=server","k8s:app.kubernetes.io/name=cache","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=mesh-lab","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=mesh-lab"],"pod_name":"cache-6d88ffb646-4nbtg"},"Type":"L3_L4","node_name":"poc2/poc2-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc2-worker","kubernetes.io/os=linux"],"event_type":{"type":4,"sub_type":4},"traffic_direction":"EGRESS","trace_observation_point":"TO_OVERLAY","trace_reason":"ESTABLISHED","is_reply":false,"interface":{"index":13,"name":"cilium_vxlan"},"Summary":"TCP Flags: ACK, PSH"},"node_name":"poc2/poc2-worker","time":"2026-09-13T10:57:30.267255460Z"}
+{"flow":{"time":"2026-09-13T10:57:30.282267376Z","uuid":"776e6c04-bbfa-4046-856a-c72b0df00bef","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","ethernet":{"source":"9a:6c:e7:18:19:55","destination":"22:18:38:38:27:8f"},"IP":{"source":"10.20.1.153","destination":"10.10.3.235","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":49750,"destination_port":6379,"flags":{"FIN":true,"ACK":true}}},"source":{"ID":422,"identity":139460,"cluster_name":"poc2","namespace":"mesh-lab","labels":["k8s:app.kubernetes.io/component=batch","k8s:app.kubernetes.io/name=worker","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=mesh-lab","k8s:io.cilium.k8s.policy.cluster=poc2","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=mesh-lab"],"pod_name":"worker"},"destination":{"identity":97240,"cluster_name":"poc1","namespace":"mesh-lab","labels":["k8s:app.kubernetes.io/component=server","k8s:app.kubernetes.io/name=cache","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=mesh-lab","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=mesh-lab"],"pod_name":"cache-6d88ffb646-4nbtg"},"Type":"L3_L4","node_name":"poc2/poc2-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc2-worker","kubernetes.io/os=linux"],"event_type":{"type":4,"sub_type":4},"traffic_direction":"EGRESS","trace_observation_point":"TO_OVERLAY","trace_reason":"ESTABLISHED","is_reply":false,"interface":{"index":13,"name":"cilium_vxlan"},"Summary":"TCP Flags: ACK, FIN"},"node_name":"poc2/poc2-worker","time":"2026-09-13T10:57:30.282267376Z"}
+{"flow":{"time":"2026-09-13T10:57:30.285945089Z","uuid":"61b8e488-6bef-4d67-975b-7dcb183ad42a","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","ethernet":{"source":"9a:6c:e7:18:19:55","destination":"22:18:38:38:27:8f"},"IP":{"source":"10.20.1.153","destination":"10.10.3.235","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":49750,"destination_port":6379,"flags":{"ACK":true}}},"source":{"ID":422,"identity":139460,"cluster_name":"poc2","namespace":"mesh-lab","labels":["k8s:app.kubernetes.io/component=batch","k8s:app.kubernetes.io/name=worker","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=mesh-lab","k8s:io.cilium.k8s.policy.cluster=poc2","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=mesh-lab"],"pod_name":"worker"},"destination":{"identity":97240,"cluster_name":"poc1","namespace":"mesh-lab","labels":["k8s:app.kubernetes.io/component=server","k8s:app.kubernetes.io/name=cache","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=mesh-lab","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=mesh-lab"],"pod_name":"cache-6d88ffb646-4nbtg"},"Type":"L3_L4","node_name":"poc2/poc2-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc2-worker","kubernetes.io/os=linux"],"event_type":{"type":4,"sub_type":4},"traffic_direction":"EGRESS","trace_observation_point":"TO_OVERLAY","trace_reason":"ESTABLISHED","is_reply":false,"interface":{"index":13,"name":"cilium_vxlan"},"Summary":"TCP Flags: ACK"},"node_name":"poc2/poc2-worker","time":"2026-09-13T10:57:30.285945089Z"}
+{"flow":{"time":"2026-09-13T10:57:30.290265707Z","uuid":"f88cc72b-0baa-403f-8b2c-6f775e40a488","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","ethernet":{"source":"e6:ef:1a:04:ad:63","destination":"66:1b:49:84:c4:1b"},"IP":{"source":"10.20.1.153","destination":"10.20.1.136","ipVersion":"IPv4"},"l4":{"UDP":{"source_port":53976,"destination_port":53}},"source":{"ID":422,"identity":139460,"cluster_name":"poc2","namespace":"mesh-lab","labels":["k8s:app.kubernetes.io/component=batch","k8s:app.kubernetes.io/name=worker","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=mesh-lab","k8s:io.cilium.k8s.policy.cluster=poc2","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=mesh-lab"],"pod_name":"worker"},"destination":{"ID":575,"identity":136885,"cluster_name":"poc2","namespace":"kube-system","labels":["gen:io.cilium.k8s.named-ports-1=metrics.TCP.9153_readiness-probe.TCP.8181","gen:io.cilium.k8s.named-ports=dns.UDP.53_dns-tcp.TCP.53_liveness-probe.TCP.8080","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=kube-system","k8s:io.cilium.k8s.policy.cluster=poc2","k8s:io.cilium.k8s.policy.serviceaccount=coredns","k8s:io.kubernetes.pod.namespace=kube-system","k8s:k8s-app=kube-dns"],"pod_name":"coredns-879947797-f4bdb","workloads":[{"name":"coredns","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc2/poc2-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc2-worker","kubernetes.io/os=linux"],"event_type":{"type":4},"traffic_direction":"EGRESS","trace_observation_point":"TO_ENDPOINT","trace_reason":"NEW","is_reply":false,"interface":{"index":215,"name":"lxc229cede77785"},"Summary":"UDP"},"node_name":"poc2/poc2-worker","time":"2026-09-13T10:57:30.290265707Z"}
+{"flow":{"time":"2026-09-13T10:57:30.292444197Z","uuid":"ad304633-dbae-46b3-9a9b-ca78ff95ce01","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","ethernet":{"source":"9a:6c:e7:18:19:55","destination":"22:18:38:38:27:8f"},"IP":{"source":"10.20.1.153","destination":"10.10.3.235","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":49764,"destination_port":6379,"flags":{"SYN":true}}},"source":{"ID":422,"identity":139460,"cluster_name":"poc2","namespace":"mesh-lab","labels":["k8s:app.kubernetes.io/component=batch","k8s:app.kubernetes.io/name=worker","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=mesh-lab","k8s:io.cilium.k8s.policy.cluster=poc2","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=mesh-lab"],"pod_name":"worker"},"destination":{"identity":97240,"cluster_name":"poc1","namespace":"mesh-lab","labels":["k8s:app.kubernetes.io/component=server","k8s:app.kubernetes.io/name=cache","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=mesh-lab","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=mesh-lab"],"pod_name":"cache-6d88ffb646-4nbtg"},"Type":"L3_L4","node_name":"poc2/poc2-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc2-worker","kubernetes.io/os=linux"],"event_type":{"type":4,"sub_type":4},"traffic_direction":"EGRESS","trace_observation_point":"TO_OVERLAY","trace_reason":"NEW","is_reply":false,"interface":{"index":13,"name":"cilium_vxlan"},"Summary":"TCP Flags: SYN"},"node_name":"poc2/poc2-worker","time":"2026-09-13T10:57:30.292444197Z"}
+{"flow":{"time":"2026-09-13T10:57:30.294337803Z","uuid":"68612b6c-19e3-4a33-bc14-3ea23c0189fb","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","ethernet":{"source":"9a:6c:e7:18:19:55","destination":"22:18:38:38:27:8f"},"IP":{"source":"10.20.1.153","destination":"10.10.3.235","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":49764,"destination_port":6379,"flags":{"ACK":true}}},"source":{"ID":422,"identity":139460,"cluster_name":"poc2","namespace":"mesh-lab","labels":["k8s:app.kubernetes.io/component=batch","k8s:app.kubernetes.io/name=worker","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=mesh-lab","k8s:io.cilium.k8s.policy.cluster=poc2","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=mesh-lab"],"pod_name":"worker"},"destination":{"identity":97240,"cluster_name":"poc1","namespace":"mesh-lab","labels":["k8s:app.kubernetes.io/component=server","k8s:app.kubernetes.io/name=cache","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=mesh-lab","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=mesh-lab"],"pod_name":"cache-6d88ffb646-4nbtg"},"Type":"L3_L4","node_name":"poc2/poc2-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc2-worker","kubernetes.io/os=linux"],"event_type":{"type":4,"sub_type":4},"traffic_direction":"EGRESS","trace_observation_point":"TO_OVERLAY","trace_reason":"ESTABLISHED","is_reply":false,"interface":{"index":13,"name":"cilium_vxlan"},"Summary":"TCP Flags: ACK"},"node_name":"poc2/poc2-worker","time":"2026-09-13T10:57:30.294337803Z"}
+{"flow":{"time":"2026-09-13T10:57:30.295364636Z","uuid":"5d2efbc4-1123-42d9-ba12-f0bdaf807aff","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","ethernet":{"source":"9a:6c:e7:18:19:55","destination":"22:18:38:38:27:8f"},"IP":{"source":"10.20.1.153","destination":"10.10.3.235","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":49764,"destination_port":6379,"flags":{"PSH":true,"ACK":true}}},"source":{"ID":422,"identity":139460,"cluster_name":"poc2","namespace":"mesh-lab","labels":["k8s:app.kubernetes.io/component=batch","k8s:app.kubernetes.io/name=worker","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=mesh-lab","k8s:io.cilium.k8s.policy.cluster=poc2","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=mesh-lab"],"pod_name":"worker"},"destination":{"identity":97240,"cluster_name":"poc1","namespace":"mesh-lab","labels":["k8s:app.kubernetes.io/component=server","k8s:app.kubernetes.io/name=cache","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=mesh-lab","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=mesh-lab"],"pod_name":"cache-6d88ffb646-4nbtg"},"Type":"L3_L4","node_name":"poc2/poc2-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc2-worker","kubernetes.io/os=linux"],"event_type":{"type":4,"sub_type":4},"traffic_direction":"EGRESS","trace_observation_point":"TO_OVERLAY","trace_reason":"ESTABLISHED","is_reply":false,"interface":{"index":13,"name":"cilium_vxlan"},"Summary":"TCP Flags: ACK, PSH"},"node_name":"poc2/poc2-worker","time":"2026-09-13T10:57:30.295364636Z"}
+{"flow":{"time":"2026-09-13T10:57:30.298485372Z","uuid":"7c46423b-bbb1-49cd-9ad3-faf514f0f341","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","ethernet":{"source":"9a:6c:e7:18:19:55","destination":"22:18:38:38:27:8f"},"IP":{"source":"10.20.1.153","destination":"10.10.3.235","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":49764,"destination_port":6379,"flags":{"FIN":true,"ACK":true}}},"source":{"ID":422,"identity":139460,"cluster_name":"poc2","namespace":"mesh-lab","labels":["k8s:app.kubernetes.io/component=batch","k8s:app.kubernetes.io/name=worker","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=mesh-lab","k8s:io.cilium.k8s.policy.cluster=poc2","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=mesh-lab"],"pod_name":"worker"},"destination":{"identity":97240,"cluster_name":"poc1","namespace":"mesh-lab","labels":["k8s:app.kubernetes.io/component=server","k8s:app.kubernetes.io/name=cache","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=mesh-lab","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=mesh-lab"],"pod_name":"cache-6d88ffb646-4nbtg"},"Type":"L3_L4","node_name":"poc2/poc2-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc2-worker","kubernetes.io/os=linux"],"event_type":{"type":4,"sub_type":4},"traffic_direction":"EGRESS","trace_observation_point":"TO_OVERLAY","trace_reason":"ESTABLISHED","is_reply":false,"interface":{"index":13,"name":"cilium_vxlan"},"Summary":"TCP Flags: ACK, FIN"},"node_name":"poc2/poc2-worker","time":"2026-09-13T10:57:30.298485372Z"}
+{"flow":{"time":"2026-09-13T10:57:30.299740023Z","uuid":"7a49f689-79ae-43ad-97be-847fa9f465a5","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","ethernet":{"source":"9a:6c:e7:18:19:55","destination":"22:18:38:38:27:8f"},"IP":{"source":"10.20.1.153","destination":"10.10.3.235","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":49764,"destination_port":6379,"flags":{"ACK":true}}},"source":{"ID":422,"identity":139460,"cluster_name":"poc2","namespace":"mesh-lab","labels":["k8s:app.kubernetes.io/component=batch","k8s:app.kubernetes.io/name=worker","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=mesh-lab","k8s:io.cilium.k8s.policy.cluster=poc2","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=mesh-lab"],"pod_name":"worker"},"destination":{"identity":97240,"cluster_name":"poc1","namespace":"mesh-lab","labels":["k8s:app.kubernetes.io/component=server","k8s:app.kubernetes.io/name=cache","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=mesh-lab","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=mesh-lab"],"pod_name":"cache-6d88ffb646-4nbtg"},"Type":"L3_L4","node_name":"poc2/poc2-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc2-worker","kubernetes.io/os=linux"],"event_type":{"type":4,"sub_type":4},"traffic_direction":"EGRESS","trace_observation_point":"TO_OVERLAY","trace_reason":"ESTABLISHED","is_reply":false,"interface":{"index":13,"name":"cilium_vxlan"},"Summary":"TCP Flags: ACK"},"node_name":"poc2/poc2-worker","time":"2026-09-13T10:57:30.299740023Z"}
+{"flow":{"time":"2026-09-13T10:57:30.306446466Z","uuid":"f96bd8d2-7a2d-4084-aaa4-d9729a5e3722","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","ethernet":{"source":"7a:24:ee:7c:ee:7f","destination":"a6:6d:ef:48:f0:ba"},"IP":{"source":"10.20.1.153","destination":"10.20.1.168","ipVersion":"IPv4"},"l4":{"UDP":{"source_port":33405,"destination_port":53}},"source":{"ID":422,"identity":139460,"cluster_name":"poc2","namespace":"mesh-lab","labels":["k8s:app.kubernetes.io/component=batch","k8s:app.kubernetes.io/name=worker","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=mesh-lab","k8s:io.cilium.k8s.policy.cluster=poc2","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=mesh-lab"],"pod_name":"worker"},"destination":{"ID":3197,"identity":136885,"cluster_name":"poc2","namespace":"kube-system","labels":["gen:io.cilium.k8s.named-ports-1=metrics.TCP.9153_readiness-probe.TCP.8181","gen:io.cilium.k8s.named-ports=dns.UDP.53_dns-tcp.TCP.53_liveness-probe.TCP.8080","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=kube-system","k8s:io.cilium.k8s.policy.cluster=poc2","k8s:io.cilium.k8s.policy.serviceaccount=coredns","k8s:io.kubernetes.pod.namespace=kube-system","k8s:k8s-app=kube-dns"],"pod_name":"coredns-879947797-k8xkh","workloads":[{"name":"coredns","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc2/poc2-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc2-worker","kubernetes.io/os=linux"],"event_type":{"type":4},"traffic_direction":"EGRESS","trace_observation_point":"TO_ENDPOINT","trace_reason":"NEW","is_reply":false,"interface":{"index":217,"name":"lxca36bda2100ed"},"Summary":"UDP"},"node_name":"poc2/poc2-worker","time":"2026-09-13T10:57:30.306446466Z"}
+{"flow":{"time":"2026-09-13T10:57:30.308022923Z","uuid":"41b6e67e-79f4-4615-887c-c81a6dd319a0","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","ethernet":{"source":"9a:6c:e7:18:19:55","destination":"22:18:38:38:27:8f"},"IP":{"source":"10.20.1.153","destination":"10.10.3.235","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":49768,"destination_port":6379,"flags":{"SYN":true}}},"source":{"ID":422,"identity":139460,"cluster_name":"poc2","namespace":"mesh-lab","labels":["k8s:app.kubernetes.io/component=batch","k8s:app.kubernetes.io/name=worker","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=mesh-lab","k8s:io.cilium.k8s.policy.cluster=poc2","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=mesh-lab"],"pod_name":"worker"},"destination":{"identity":97240,"cluster_name":"poc1","namespace":"mesh-lab","labels":["k8s:app.kubernetes.io/component=server","k8s:app.kubernetes.io/name=cache","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=mesh-lab","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=mesh-lab"],"pod_name":"cache-6d88ffb646-4nbtg"},"Type":"L3_L4","node_name":"poc2/poc2-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc2-worker","kubernetes.io/os=linux"],"event_type":{"type":4,"sub_type":4},"traffic_direction":"EGRESS","trace_observation_point":"TO_OVERLAY","trace_reason":"NEW","is_reply":false,"interface":{"index":13,"name":"cilium_vxlan"},"Summary":"TCP Flags: SYN"},"node_name":"poc2/poc2-worker","time":"2026-09-13T10:57:30.308022923Z"}
+{"flow":{"time":"2026-09-13T10:57:30.310145883Z","uuid":"f49e03d5-7760-4c1d-8ca4-ce225246fdbc","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","ethernet":{"source":"9a:6c:e7:18:19:55","destination":"22:18:38:38:27:8f"},"IP":{"source":"10.20.1.153","destination":"10.10.3.235","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":49768,"destination_port":6379,"flags":{"ACK":true}}},"source":{"ID":422,"identity":139460,"cluster_name":"poc2","namespace":"mesh-lab","labels":["k8s:app.kubernetes.io/component=batch","k8s:app.kubernetes.io/name=worker","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=mesh-lab","k8s:io.cilium.k8s.policy.cluster=poc2","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=mesh-lab"],"pod_name":"worker"},"destination":{"identity":97240,"cluster_name":"poc1","namespace":"mesh-lab","labels":["k8s:app.kubernetes.io/component=server","k8s:app.kubernetes.io/name=cache","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=mesh-lab","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=mesh-lab"],"pod_name":"cache-6d88ffb646-4nbtg"},"Type":"L3_L4","node_name":"poc2/poc2-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc2-worker","kubernetes.io/os=linux"],"event_type":{"type":4,"sub_type":4},"traffic_direction":"EGRESS","trace_observation_point":"TO_OVERLAY","trace_reason":"ESTABLISHED","is_reply":false,"interface":{"index":13,"name":"cilium_vxlan"},"Summary":"TCP Flags: ACK"},"node_name":"poc2/poc2-worker","time":"2026-09-13T10:57:30.310145883Z"}
+{"flow":{"time":"2026-09-13T10:57:30.310149324Z","uuid":"bce11503-c268-4884-85d3-0f9c3f38c00a","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","ethernet":{"source":"9a:6c:e7:18:19:55","destination":"22:18:38:38:27:8f"},"IP":{"source":"10.20.1.153","destination":"10.10.3.235","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":49768,"destination_port":6379,"flags":{"PSH":true,"ACK":true}}},"source":{"ID":422,"identity":139460,"cluster_name":"poc2","namespace":"mesh-lab","labels":["k8s:app.kubernetes.io/component=batch","k8s:app.kubernetes.io/name=worker","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=mesh-lab","k8s:io.cilium.k8s.policy.cluster=poc2","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=mesh-lab"],"pod_name":"worker"},"destination":{"identity":97240,"cluster_name":"poc1","namespace":"mesh-lab","labels":["k8s:app.kubernetes.io/component=server","k8s:app.kubernetes.io/name=cache","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=mesh-lab","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=mesh-lab"],"pod_name":"cache-6d88ffb646-4nbtg"},"Type":"L3_L4","node_name":"poc2/poc2-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc2-worker","kubernetes.io/os=linux"],"event_type":{"type":4,"sub_type":4},"traffic_direction":"EGRESS","trace_observation_point":"TO_OVERLAY","trace_reason":"ESTABLISHED","is_reply":false,"interface":{"index":13,"name":"cilium_vxlan"},"Summary":"TCP Flags: ACK, PSH"},"node_name":"poc2/poc2-worker","time":"2026-09-13T10:57:30.310149324Z"}
+{"flow":{"time":"2026-09-13T10:57:30.312021605Z","uuid":"765ea5cd-bb10-4bc5-a673-876ea6df7ce6","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","ethernet":{"source":"9a:6c:e7:18:19:55","destination":"22:18:38:38:27:8f"},"IP":{"source":"10.20.1.153","destination":"10.10.3.235","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":49768,"destination_port":6379,"flags":{"FIN":true,"ACK":true}}},"source":{"ID":422,"identity":139460,"cluster_name":"poc2","namespace":"mesh-lab","labels":["k8s:app.kubernetes.io/component=batch","k8s:app.kubernetes.io/name=worker","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=mesh-lab","k8s:io.cilium.k8s.policy.cluster=poc2","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=mesh-lab"],"pod_name":"worker"},"destination":{"identity":97240,"cluster_name":"poc1","namespace":"mesh-lab","labels":["k8s:app.kubernetes.io/component=server","k8s:app.kubernetes.io/name=cache","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=mesh-lab","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=mesh-lab"],"pod_name":"cache-6d88ffb646-4nbtg"},"Type":"L3_L4","node_name":"poc2/poc2-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc2-worker","kubernetes.io/os=linux"],"event_type":{"type":4,"sub_type":4},"traffic_direction":"EGRESS","trace_observation_point":"TO_OVERLAY","trace_reason":"ESTABLISHED","is_reply":false,"interface":{"index":13,"name":"cilium_vxlan"},"Summary":"TCP Flags: ACK, FIN"},"node_name":"poc2/poc2-worker","time":"2026-09-13T10:57:30.312021605Z"}
+{"flow":{"time":"2026-09-13T10:57:30.314379676Z","uuid":"2d90ab6c-6340-4675-9965-7814556c2b4c","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","ethernet":{"source":"9a:6c:e7:18:19:55","destination":"22:18:38:38:27:8f"},"IP":{"source":"10.20.1.153","destination":"10.10.3.235","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":49768,"destination_port":6379,"flags":{"ACK":true}}},"source":{"ID":422,"identity":139460,"cluster_name":"poc2","namespace":"mesh-lab","labels":["k8s:app.kubernetes.io/component=batch","k8s:app.kubernetes.io/name=worker","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=mesh-lab","k8s:io.cilium.k8s.policy.cluster=poc2","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=mesh-lab"],"pod_name":"worker"},"destination":{"identity":97240,"cluster_name":"poc1","namespace":"mesh-lab","labels":["k8s:app.kubernetes.io/component=server","k8s:app.kubernetes.io/name=cache","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=mesh-lab","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=mesh-lab"],"pod_name":"cache-6d88ffb646-4nbtg"},"Type":"L3_L4","node_name":"poc2/poc2-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc2-worker","kubernetes.io/os=linux"],"event_type":{"type":4,"sub_type":4},"traffic_direction":"EGRESS","trace_observation_point":"TO_OVERLAY","trace_reason":"ESTABLISHED","is_reply":false,"interface":{"index":13,"name":"cilium_vxlan"},"Summary":"TCP Flags: ACK"},"node_name":"poc2/poc2-worker","time":"2026-09-13T10:57:30.314379676Z"}
diff --git a/internal/testdata/golden/29-worker-poc2-egress/options.json b/internal/testdata/golden/29-worker-poc2-egress/options.json
new file mode 100644
index 0000000..0967ef4
--- /dev/null
+++ b/internal/testdata/golden/29-worker-poc2-egress/options.json
@@ -0,0 +1 @@
+{}
diff --git a/internal/testdata/golden/30-shop-l4/expected.yaml b/internal/testdata/golden/30-shop-l4/expected.yaml
new file mode 100644
index 0000000..6714b80
--- /dev/null
+++ b/internal/testdata/golden/30-shop-l4/expected.yaml
@@ -0,0 +1,48 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: shop-backend
+  namespace: cf2cnp-lab30
+  labels:
+    app.kubernetes.io/component: backend
+    app.kubernetes.io/managed-by: cf2cnp
+    app.kubernetes.io/name: shop
+spec:
+  description: 'Allow ingress to shop/backend in cf2cnp-lab30: from shop/frontend on TCP/80'
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/component: backend
+      app.kubernetes.io/name: shop
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            app.kubernetes.io/component: frontend
+            app.kubernetes.io/name: shop
+      toPorts:
+        - ports:
+            - port: "80"
+              protocol: TCP
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: shop-frontend
+  namespace: cf2cnp-lab30
+  labels:
+    app.kubernetes.io/component: frontend
+    app.kubernetes.io/managed-by: cf2cnp
+    app.kubernetes.io/name: shop
+spec:
+  description: 'Allow ingress to shop/frontend in cf2cnp-lab30: from pos on TCP/80'
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/component: frontend
+      app.kubernetes.io/name: shop
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            app.kubernetes.io/name: pos
+      toPorts:
+        - ports:
+            - port: "80"
+              protocol: TCP
diff --git a/internal/testdata/golden/30-shop-l4/flows.ndjson b/internal/testdata/golden/30-shop-l4/flows.ndjson
new file mode 100644
index 0000000..aeb3ff3
--- /dev/null
+++ b/internal/testdata/golden/30-shop-l4/flows.ndjson
@@ -0,0 +1,44 @@
+{"flow":{"time":"2026-09-13T11:08:40.495913820Z","uuid":"8ccec5bd-a335-4937-866b-3594a7407e11","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.50","destination":"10.10.3.54","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":54468,"destination_port":80}},"source":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"destination":{"ID":1440,"identity":108922,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=backend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-backend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-backend-6d64d6c6dc-rdr68","workloads":[{"name":"shop-backend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-backend.cf2cnp-lab30/api/orders","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"38fb6c89-e564-4623-9e21-d13e2bbb92c1"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-backend.cf2cnp-lab30/api/orders"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:08:40.495913820Z"}
+{"flow":{"time":"2026-09-13T11:08:40.560290405Z","uuid":"85b8c48a-1fed-4e42-8fe1-9d0d4809542e","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.50","destination":"10.10.3.54","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":54478,"destination_port":80}},"source":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"destination":{"ID":1440,"identity":108922,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=backend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-backend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-backend-6d64d6c6dc-rdr68","workloads":[{"name":"shop-backend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-backend.cf2cnp-lab30/api/orders?id=42","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"c77bf8e8-459d-4817-8c47-a96064843da9"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-backend.cf2cnp-lab30/api/orders?id=42"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:08:40.560290405Z"}
+{"flow":{"time":"2026-09-13T11:08:40.919759515Z","uuid":"a1c8326d-2097-4ae2-84bd-5fced7bf20a4","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.106","destination":"10.10.3.50","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":48016,"destination_port":80}},"source":{"ID":3592,"identity":68057,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"pos"},"destination":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-frontend.cf2cnp-lab30/","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"e841e5ad-a69f-4f16-a42e-a75beb247b95"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-frontend.cf2cnp-lab30/"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:08:40.919759515Z"}
+{"flow":{"time":"2026-09-13T11:08:40.949371857Z","uuid":"520965d7-1611-46a7-99bc-e771fff47e6c","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.106","destination":"10.10.3.50","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":48024,"destination_port":80}},"source":{"ID":3592,"identity":68057,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"pos"},"destination":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-frontend.cf2cnp-lab30/checkout","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"028ca653-50ff-4225-b05c-82d2c4c97f45"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-frontend.cf2cnp-lab30/checkout"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:08:40.949371857Z"}
+{"flow":{"time":"2026-09-13T11:08:45.679154414Z","uuid":"75639395-d131-4841-ab5b-863322146eb8","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.50","destination":"10.10.3.54","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":36392,"destination_port":80}},"source":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"destination":{"ID":1440,"identity":108922,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=backend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-backend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-backend-6d64d6c6dc-rdr68","workloads":[{"name":"shop-backend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-backend.cf2cnp-lab30/api/orders","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"54b664e9-5a2d-4ce9-83ea-7e22d5e3cc4f"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-backend.cf2cnp-lab30/api/orders"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:08:45.679154414Z"}
+{"flow":{"time":"2026-09-13T11:08:45.692651868Z","uuid":"e8875744-9d92-440e-97f2-4aac5099380a","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.50","destination":"10.10.3.54","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":36402,"destination_port":80}},"source":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"destination":{"ID":1440,"identity":108922,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=backend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-backend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-backend-6d64d6c6dc-rdr68","workloads":[{"name":"shop-backend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-backend.cf2cnp-lab30/api/orders?id=42","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"841014a9-6a49-4515-80e7-9e9882539f6f"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-backend.cf2cnp-lab30/api/orders?id=42"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:08:45.692651868Z"}
+{"flow":{"time":"2026-09-13T11:08:45.997098893Z","uuid":"64ab70da-7fb8-47d1-904e-065a1d2a638d","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.106","destination":"10.10.3.50","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":40680,"destination_port":80}},"source":{"ID":3592,"identity":68057,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"pos"},"destination":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-frontend.cf2cnp-lab30/","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"655f3765-ac2d-4001-bb98-4643b42b427a"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-frontend.cf2cnp-lab30/"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:08:45.997098893Z"}
+{"flow":{"time":"2026-09-13T11:08:46.030650638Z","uuid":"9e97491e-6ffb-4d3d-8520-53224c6c0289","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.106","destination":"10.10.3.50","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":40694,"destination_port":80}},"source":{"ID":3592,"identity":68057,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"pos"},"destination":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-frontend.cf2cnp-lab30/checkout","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"b08cf051-7f87-41a0-82ab-3fc6e972d6b0"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-frontend.cf2cnp-lab30/checkout"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:08:46.030650638Z"}
+{"flow":{"time":"2026-09-13T11:08:50.754642646Z","uuid":"3a3b1900-3d79-4502-ae3d-068e2d4fdf95","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.50","destination":"10.10.3.54","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":36404,"destination_port":80}},"source":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"destination":{"ID":1440,"identity":108922,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=backend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-backend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-backend-6d64d6c6dc-rdr68","workloads":[{"name":"shop-backend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-backend.cf2cnp-lab30/api/orders","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"2fe6f4b7-6b9a-4848-8bdc-6313547c4e3a"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-backend.cf2cnp-lab30/api/orders"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:08:50.754642646Z"}
+{"flow":{"time":"2026-09-13T11:08:50.784303521Z","uuid":"cf0bcbc3-6cae-4e81-8802-2e67dc4a0217","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.50","destination":"10.10.3.54","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":36414,"destination_port":80}},"source":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"destination":{"ID":1440,"identity":108922,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=backend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-backend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-backend-6d64d6c6dc-rdr68","workloads":[{"name":"shop-backend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-backend.cf2cnp-lab30/api/orders?id=42","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"7ded39f5-82bd-47d7-b73b-93b2e5778fad"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-backend.cf2cnp-lab30/api/orders?id=42"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:08:50.784303521Z"}
+{"flow":{"time":"2026-09-13T11:08:51.053651831Z","uuid":"3b056c31-791a-41e7-a5a1-4626ee098ea3","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.106","destination":"10.10.3.50","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":40702,"destination_port":80}},"source":{"ID":3592,"identity":68057,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"pos"},"destination":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-frontend.cf2cnp-lab30/","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"632e8380-e27f-45ed-9fa4-a1beb9f6cad5"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-frontend.cf2cnp-lab30/"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:08:51.053651831Z"}
+{"flow":{"time":"2026-09-13T11:08:51.073383893Z","uuid":"f1bbeac6-8fc5-49bd-b3d7-9e031d2b14c4","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.106","destination":"10.10.3.50","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":40706,"destination_port":80}},"source":{"ID":3592,"identity":68057,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"pos"},"destination":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-frontend.cf2cnp-lab30/checkout","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"be296c49-a415-4119-858f-e57f3bdfd8f7"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-frontend.cf2cnp-lab30/checkout"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:08:51.073383893Z"}
+{"flow":{"time":"2026-09-13T11:08:55.821252342Z","uuid":"976da012-af67-4f50-aa7c-57750f230b96","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.50","destination":"10.10.3.54","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":55368,"destination_port":80}},"source":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"destination":{"ID":1440,"identity":108922,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=backend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-backend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-backend-6d64d6c6dc-rdr68","workloads":[{"name":"shop-backend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-backend.cf2cnp-lab30/api/orders","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"da5bb3cd-9ed5-43aa-89f9-ddf1dd247a7b"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-backend.cf2cnp-lab30/api/orders"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:08:55.821252342Z"}
+{"flow":{"time":"2026-09-13T11:08:55.841501162Z","uuid":"3f31b2f3-0a11-4778-b1bd-c62153571ef6","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.50","destination":"10.10.3.54","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":55370,"destination_port":80}},"source":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"destination":{"ID":1440,"identity":108922,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=backend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-backend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-backend-6d64d6c6dc-rdr68","workloads":[{"name":"shop-backend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-backend.cf2cnp-lab30/api/orders?id=42","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"5c494737-2259-4a81-9792-63e3d521c4e5"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-backend.cf2cnp-lab30/api/orders?id=42"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:08:55.841501162Z"}
+{"flow":{"time":"2026-09-13T11:08:56.101596440Z","uuid":"5466d403-d31c-47a5-83ae-3671ce0120c6","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.106","destination":"10.10.3.50","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":37922,"destination_port":80}},"source":{"ID":3592,"identity":68057,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"pos"},"destination":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-frontend.cf2cnp-lab30/","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"516f6d73-721a-43a1-a780-e1589b029e3b"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-frontend.cf2cnp-lab30/"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:08:56.101596440Z"}
+{"flow":{"time":"2026-09-13T11:08:56.118073937Z","uuid":"5650722a-5e16-43fb-9145-388c3fd77e93","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.106","destination":"10.10.3.50","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":37932,"destination_port":80}},"source":{"ID":3592,"identity":68057,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"pos"},"destination":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-frontend.cf2cnp-lab30/checkout","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"4956add3-899e-4077-83cd-c4c2d36a2577"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-frontend.cf2cnp-lab30/checkout"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:08:56.118073937Z"}
+{"flow":{"time":"2026-09-13T11:09:00.959674057Z","uuid":"469bc566-b640-453b-9b0c-7e9dc14f1079","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.50","destination":"10.10.3.54","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":55380,"destination_port":80}},"source":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"destination":{"ID":1440,"identity":108922,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=backend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-backend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-backend-6d64d6c6dc-rdr68","workloads":[{"name":"shop-backend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-backend.cf2cnp-lab30/api/orders","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"26d2030b-293a-4709-be08-840dc77d5ec5"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-backend.cf2cnp-lab30/api/orders"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:09:00.959674057Z"}
+{"flow":{"time":"2026-09-13T11:09:00.985483821Z","uuid":"6dcd00e3-91d6-4116-9195-5795610ac5dd","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.50","destination":"10.10.3.54","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":55390,"destination_port":80}},"source":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"destination":{"ID":1440,"identity":108922,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=backend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-backend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-backend-6d64d6c6dc-rdr68","workloads":[{"name":"shop-backend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-backend.cf2cnp-lab30/api/orders?id=42","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"d3a1bac2-21bc-4dd3-ab09-76acf14a4cff"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-backend.cf2cnp-lab30/api/orders?id=42"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:09:00.985483821Z"}
+{"flow":{"time":"2026-09-13T11:09:01.151036924Z","uuid":"a636cfc5-28f2-4479-9450-daa9828cc94c","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.106","destination":"10.10.3.50","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":37944,"destination_port":80}},"source":{"ID":3592,"identity":68057,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"pos"},"destination":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-frontend.cf2cnp-lab30/","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"6c9cbe21-17d4-4be4-868b-19a760a0de7f"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-frontend.cf2cnp-lab30/"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:09:01.151036924Z"}
+{"flow":{"time":"2026-09-13T11:09:01.183777702Z","uuid":"f40c88d5-1a98-408d-a819-dff98c8b0cf1","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.106","destination":"10.10.3.50","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":37958,"destination_port":80}},"source":{"ID":3592,"identity":68057,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"pos"},"destination":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-frontend.cf2cnp-lab30/checkout","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"3bf8ab0a-722b-4241-93b1-7c3f5739cbc8"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-frontend.cf2cnp-lab30/checkout"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:09:01.183777702Z"}
+{"flow":{"time":"2026-09-13T11:09:06.017127110Z","uuid":"45a706e4-cdc9-42ff-a091-fae00fb756df","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.50","destination":"10.10.3.54","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":51342,"destination_port":80}},"source":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"destination":{"ID":1440,"identity":108922,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=backend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-backend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-backend-6d64d6c6dc-rdr68","workloads":[{"name":"shop-backend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-backend.cf2cnp-lab30/api/orders","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"08f2a0fd-9737-425c-be33-dd9231c9c281"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-backend.cf2cnp-lab30/api/orders"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:09:06.017127110Z"}
+{"flow":{"time":"2026-09-13T11:09:06.036793923Z","uuid":"9daf658a-6d34-4026-98a9-6257056e6c29","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.50","destination":"10.10.3.54","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":51344,"destination_port":80}},"source":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"destination":{"ID":1440,"identity":108922,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=backend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-backend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-backend-6d64d6c6dc-rdr68","workloads":[{"name":"shop-backend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-backend.cf2cnp-lab30/api/orders?id=42","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"92e8cd10-e6d1-409e-907c-77e1f7a7cc0c"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-backend.cf2cnp-lab30/api/orders?id=42"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:09:06.036793923Z"}
+{"flow":{"time":"2026-09-13T11:09:06.211835218Z","uuid":"b351808e-caa5-4e22-bf5e-9f6df76c7a6b","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.106","destination":"10.10.3.50","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":56338,"destination_port":80}},"source":{"ID":3592,"identity":68057,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"pos"},"destination":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-frontend.cf2cnp-lab30/","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"f6957030-724d-4c39-829d-236668151c28"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-frontend.cf2cnp-lab30/"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:09:06.211835218Z"}
+{"flow":{"time":"2026-09-13T11:09:06.230195181Z","uuid":"6cb88277-2db2-4fbe-9950-4c5c366f1446","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.106","destination":"10.10.3.50","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":56350,"destination_port":80}},"source":{"ID":3592,"identity":68057,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"pos"},"destination":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-frontend.cf2cnp-lab30/checkout","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"0cb56fe2-dd66-4fff-94aa-9b194f284bf2"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-frontend.cf2cnp-lab30/checkout"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:09:06.230195181Z"}
+{"flow":{"time":"2026-09-13T11:09:11.072513895Z","uuid":"b5c77b9d-2a55-4a83-820f-ccf2e4b4fa14","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.50","destination":"10.10.3.54","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":51356,"destination_port":80}},"source":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"destination":{"ID":1440,"identity":108922,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=backend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-backend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-backend-6d64d6c6dc-rdr68","workloads":[{"name":"shop-backend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-backend.cf2cnp-lab30/api/orders","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"93d6bafb-9581-4466-8d78-7f1b37d055ac"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-backend.cf2cnp-lab30/api/orders"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:09:11.072513895Z"}
+{"flow":{"time":"2026-09-13T11:09:11.095149144Z","uuid":"b3980dc9-6034-43ac-ac59-70ea63ce796c","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.50","destination":"10.10.3.54","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":51358,"destination_port":80}},"source":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"destination":{"ID":1440,"identity":108922,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=backend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-backend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-backend-6d64d6c6dc-rdr68","workloads":[{"name":"shop-backend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-backend.cf2cnp-lab30/api/orders?id=42","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"cfaa1b66-5ef7-48ce-bb03-429631a0c675"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-backend.cf2cnp-lab30/api/orders?id=42"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:09:11.095149144Z"}
+{"flow":{"time":"2026-09-13T11:09:11.246103853Z","uuid":"ac6374d1-7d13-401a-96e1-bac478818f95","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.106","destination":"10.10.3.50","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":56360,"destination_port":80}},"source":{"ID":3592,"identity":68057,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"pos"},"destination":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-frontend.cf2cnp-lab30/","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"683965d9-a18d-4182-ace3-ae9c5adb74e5"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-frontend.cf2cnp-lab30/"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:09:11.246103853Z"}
+{"flow":{"time":"2026-09-13T11:09:11.271176150Z","uuid":"c51cebeb-6d5b-4909-8b9a-ee6412fa2aca","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.106","destination":"10.10.3.50","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":56374,"destination_port":80}},"source":{"ID":3592,"identity":68057,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"pos"},"destination":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-frontend.cf2cnp-lab30/checkout","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"48663eba-afe0-40cf-8be5-b1f1e58d3086"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-frontend.cf2cnp-lab30/checkout"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:09:11.271176150Z"}
+{"flow":{"time":"2026-09-13T11:09:16.159903304Z","uuid":"abbaa93d-c696-4b3b-824f-67763b6c3691","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.50","destination":"10.10.3.54","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":48968,"destination_port":80}},"source":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"destination":{"ID":1440,"identity":108922,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=backend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-backend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-backend-6d64d6c6dc-rdr68","workloads":[{"name":"shop-backend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-backend.cf2cnp-lab30/api/orders","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"56ac9221-a21a-4380-b162-a8e730a44ecd"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-backend.cf2cnp-lab30/api/orders"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:09:16.159903304Z"}
+{"flow":{"time":"2026-09-13T11:09:16.185900813Z","uuid":"312c8af5-6e89-453c-892e-75c9a8dedbcd","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.50","destination":"10.10.3.54","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":48972,"destination_port":80}},"source":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"destination":{"ID":1440,"identity":108922,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=backend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-backend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-backend-6d64d6c6dc-rdr68","workloads":[{"name":"shop-backend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-backend.cf2cnp-lab30/api/orders?id=42","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"69dac1fc-1936-4f97-93b4-4c9f3c5968fb"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-backend.cf2cnp-lab30/api/orders?id=42"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:09:16.185900813Z"}
+{"flow":{"time":"2026-09-13T11:09:16.293550725Z","uuid":"d64afc96-bc87-4539-8aa5-18f4c261c4b8","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.106","destination":"10.10.3.50","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":57984,"destination_port":80}},"source":{"ID":3592,"identity":68057,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"pos"},"destination":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-frontend.cf2cnp-lab30/","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"8092480b-01bd-4b8f-b7af-ed2821a89941"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-frontend.cf2cnp-lab30/"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:09:16.293550725Z"}
+{"flow":{"time":"2026-09-13T11:09:16.310050905Z","uuid":"29a1296a-811f-4b07-bd54-4ec40d00cdc5","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.106","destination":"10.10.3.50","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":57990,"destination_port":80}},"source":{"ID":3592,"identity":68057,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"pos"},"destination":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-frontend.cf2cnp-lab30/checkout","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"fb9296f9-13ed-447a-a343-51ab4d983445"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-frontend.cf2cnp-lab30/checkout"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:09:16.310050905Z"}
+{"flow":{"time":"2026-09-13T11:09:21.296952155Z","uuid":"8921a5db-2072-49f0-9962-49421d0e6f29","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.50","destination":"10.10.3.54","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":48974,"destination_port":80}},"source":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"destination":{"ID":1440,"identity":108922,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=backend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-backend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-backend-6d64d6c6dc-rdr68","workloads":[{"name":"shop-backend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-backend.cf2cnp-lab30/api/orders","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"86166b1a-65ad-4d80-a233-08eaa682240b"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-backend.cf2cnp-lab30/api/orders"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:09:21.296952155Z"}
+{"flow":{"time":"2026-09-13T11:09:21.336063531Z","uuid":"6ad57f0b-a064-40bc-81b9-4aecddefc975","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.50","destination":"10.10.3.54","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":48976,"destination_port":80}},"source":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"destination":{"ID":1440,"identity":108922,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=backend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-backend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-backend-6d64d6c6dc-rdr68","workloads":[{"name":"shop-backend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-backend.cf2cnp-lab30/api/orders?id=42","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"2cdb936d-1d1a-4726-b112-462bf6980224"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-backend.cf2cnp-lab30/api/orders?id=42"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:09:21.336063531Z"}
+{"flow":{"time":"2026-09-13T11:09:21.336130994Z","uuid":"0874401b-5638-4768-b341-f2c54d4045dc","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.106","destination":"10.10.3.50","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":57992,"destination_port":80}},"source":{"ID":3592,"identity":68057,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"pos"},"destination":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-frontend.cf2cnp-lab30/","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"4db4a15a-4370-4e95-8dc5-0efd3d5def3f"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-frontend.cf2cnp-lab30/"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:09:21.336130994Z"}
+{"flow":{"time":"2026-09-13T11:09:21.371112066Z","uuid":"0019f339-1cd9-4a7c-aa57-dd80518e4980","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.106","destination":"10.10.3.50","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":58008,"destination_port":80}},"source":{"ID":3592,"identity":68057,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"pos"},"destination":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-frontend.cf2cnp-lab30/checkout","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"d02552be-b24c-4640-ac42-d04f0d21e843"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-frontend.cf2cnp-lab30/checkout"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:09:21.371112066Z"}
+{"flow":{"time":"2026-09-13T11:09:26.377539792Z","uuid":"7c9b4da6-21cd-4c8e-9f93-7ca0c658e359","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.50","destination":"10.10.3.54","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":34992,"destination_port":80}},"source":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"destination":{"ID":1440,"identity":108922,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=backend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-backend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-backend-6d64d6c6dc-rdr68","workloads":[{"name":"shop-backend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-backend.cf2cnp-lab30/api/orders","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"81248ba4-0b74-4503-a163-e1955f741bbc"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-backend.cf2cnp-lab30/api/orders"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:09:26.377539792Z"}
+{"flow":{"time":"2026-09-13T11:09:26.389747682Z","uuid":"60aca9f3-d3b8-48c9-988e-f490b7747769","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.106","destination":"10.10.3.50","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":54032,"destination_port":80}},"source":{"ID":3592,"identity":68057,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"pos"},"destination":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-frontend.cf2cnp-lab30/","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"721c1296-64b3-460b-82d3-40d138f897e9"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-frontend.cf2cnp-lab30/"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:09:26.389747682Z"}
+{"flow":{"time":"2026-09-13T11:09:26.399115016Z","uuid":"3a587a7c-68db-480f-995d-e7ea2cfa0b86","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.50","destination":"10.10.3.54","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":35004,"destination_port":80}},"source":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"destination":{"ID":1440,"identity":108922,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=backend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-backend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-backend-6d64d6c6dc-rdr68","workloads":[{"name":"shop-backend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-backend.cf2cnp-lab30/api/orders?id=42","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"45905d1f-7ded-47b8-8836-bef240c2c0d0"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-backend.cf2cnp-lab30/api/orders?id=42"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:09:26.399115016Z"}
+{"flow":{"time":"2026-09-13T11:09:26.404883515Z","uuid":"9c61e076-d8f8-4ce0-8b60-93c099e5cde3","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.106","destination":"10.10.3.50","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":54046,"destination_port":80}},"source":{"ID":3592,"identity":68057,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"pos"},"destination":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-frontend.cf2cnp-lab30/checkout","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"6ecb4f1d-862c-4380-967a-b23b31c72b5f"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-frontend.cf2cnp-lab30/checkout"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:09:26.404883515Z"}
+{"flow":{"time":"2026-09-13T11:09:31.418431584Z","uuid":"18306e00-49da-41f7-b8e5-14a05f0f13bc","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.50","destination":"10.10.3.54","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":35014,"destination_port":80}},"source":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"destination":{"ID":1440,"identity":108922,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=backend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-backend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-backend-6d64d6c6dc-rdr68","workloads":[{"name":"shop-backend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-backend.cf2cnp-lab30/api/orders","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"d9b4f01d-71ec-480a-862d-01639d37c502"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-backend.cf2cnp-lab30/api/orders"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:09:31.418431584Z"}
+{"flow":{"time":"2026-09-13T11:09:31.424803186Z","uuid":"7b2d3f69-b7dc-44e1-8a96-8f576fd3f18c","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.106","destination":"10.10.3.50","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":54056,"destination_port":80}},"source":{"ID":3592,"identity":68057,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"pos"},"destination":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-frontend.cf2cnp-lab30/","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"c402493d-7fac-4f29-bab6-f5b987278735"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-frontend.cf2cnp-lab30/"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:09:31.424803186Z"}
+{"flow":{"time":"2026-09-13T11:09:31.436622344Z","uuid":"2a27580e-fd39-4242-b25f-ca0957c500c3","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.50","destination":"10.10.3.54","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":35018,"destination_port":80}},"source":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"destination":{"ID":1440,"identity":108922,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=backend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-backend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-backend-6d64d6c6dc-rdr68","workloads":[{"name":"shop-backend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-backend.cf2cnp-lab30/api/orders?id=42","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"01cdeecc-41e0-4b79-89cb-86885c3761ed"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-backend.cf2cnp-lab30/api/orders?id=42"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:09:31.436622344Z"}
+{"flow":{"time":"2026-09-13T11:09:31.459238412Z","uuid":"0e979746-aa9f-493e-9e21-b88a93436618","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.106","destination":"10.10.3.50","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":54066,"destination_port":80}},"source":{"ID":3592,"identity":68057,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"pos"},"destination":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-frontend.cf2cnp-lab30/checkout","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"9d96ac59-42ab-489e-b5c1-27174e622cd5"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-frontend.cf2cnp-lab30/checkout"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:09:31.459238412Z"}
diff --git a/internal/testdata/golden/30-shop-l4/options.json b/internal/testdata/golden/30-shop-l4/options.json
new file mode 100644
index 0000000..0967ef4
--- /dev/null
+++ b/internal/testdata/golden/30-shop-l4/options.json
@@ -0,0 +1 @@
+{}
diff --git a/internal/testdata/golden/30-shop-l7/expected.yaml b/internal/testdata/golden/30-shop-l7/expected.yaml
new file mode 100644
index 0000000..c54fb68
--- /dev/null
+++ b/internal/testdata/golden/30-shop-l7/expected.yaml
@@ -0,0 +1,58 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: shop-backend
+  namespace: cf2cnp-lab30
+  labels:
+    app.kubernetes.io/component: backend
+    app.kubernetes.io/managed-by: cf2cnp
+    app.kubernetes.io/name: shop
+spec:
+  description: 'Allow ingress to shop/backend in cf2cnp-lab30: from shop/frontend on TCP/80 (HTTP GET /api/orders)'
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/component: backend
+      app.kubernetes.io/name: shop
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            app.kubernetes.io/component: frontend
+            app.kubernetes.io/name: shop
+      toPorts:
+        - ports:
+            - port: "80"
+              protocol: TCP
+          rules:
+            http:
+              - method: GET
+                path: ^/api/orders(\?.*)?$
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: shop-frontend
+  namespace: cf2cnp-lab30
+  labels:
+    app.kubernetes.io/component: frontend
+    app.kubernetes.io/managed-by: cf2cnp
+    app.kubernetes.io/name: shop
+spec:
+  description: 'Allow ingress to shop/frontend in cf2cnp-lab30: from pos on TCP/80 (HTTP GET /, GET /checkout)'
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/component: frontend
+      app.kubernetes.io/name: shop
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            app.kubernetes.io/name: pos
+      toPorts:
+        - ports:
+            - port: "80"
+              protocol: TCP
+          rules:
+            http:
+              - method: GET
+                path: ^/(\?.*)?$
+              - method: GET
+                path: ^/checkout(\?.*)?$
diff --git a/internal/testdata/golden/30-shop-l7/flows.ndjson b/internal/testdata/golden/30-shop-l7/flows.ndjson
new file mode 100644
index 0000000..aeb3ff3
--- /dev/null
+++ b/internal/testdata/golden/30-shop-l7/flows.ndjson
@@ -0,0 +1,44 @@
+{"flow":{"time":"2026-09-13T11:08:40.495913820Z","uuid":"8ccec5bd-a335-4937-866b-3594a7407e11","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.50","destination":"10.10.3.54","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":54468,"destination_port":80}},"source":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"destination":{"ID":1440,"identity":108922,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=backend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-backend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-backend-6d64d6c6dc-rdr68","workloads":[{"name":"shop-backend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-backend.cf2cnp-lab30/api/orders","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"38fb6c89-e564-4623-9e21-d13e2bbb92c1"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-backend.cf2cnp-lab30/api/orders"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:08:40.495913820Z"}
+{"flow":{"time":"2026-09-13T11:08:40.560290405Z","uuid":"85b8c48a-1fed-4e42-8fe1-9d0d4809542e","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.50","destination":"10.10.3.54","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":54478,"destination_port":80}},"source":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"destination":{"ID":1440,"identity":108922,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=backend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-backend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-backend-6d64d6c6dc-rdr68","workloads":[{"name":"shop-backend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-backend.cf2cnp-lab30/api/orders?id=42","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"c77bf8e8-459d-4817-8c47-a96064843da9"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-backend.cf2cnp-lab30/api/orders?id=42"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:08:40.560290405Z"}
+{"flow":{"time":"2026-09-13T11:08:40.919759515Z","uuid":"a1c8326d-2097-4ae2-84bd-5fced7bf20a4","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.106","destination":"10.10.3.50","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":48016,"destination_port":80}},"source":{"ID":3592,"identity":68057,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"pos"},"destination":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-frontend.cf2cnp-lab30/","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"e841e5ad-a69f-4f16-a42e-a75beb247b95"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-frontend.cf2cnp-lab30/"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:08:40.919759515Z"}
+{"flow":{"time":"2026-09-13T11:08:40.949371857Z","uuid":"520965d7-1611-46a7-99bc-e771fff47e6c","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.106","destination":"10.10.3.50","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":48024,"destination_port":80}},"source":{"ID":3592,"identity":68057,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"pos"},"destination":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-frontend.cf2cnp-lab30/checkout","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"028ca653-50ff-4225-b05c-82d2c4c97f45"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-frontend.cf2cnp-lab30/checkout"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:08:40.949371857Z"}
+{"flow":{"time":"2026-09-13T11:08:45.679154414Z","uuid":"75639395-d131-4841-ab5b-863322146eb8","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.50","destination":"10.10.3.54","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":36392,"destination_port":80}},"source":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"destination":{"ID":1440,"identity":108922,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=backend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-backend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-backend-6d64d6c6dc-rdr68","workloads":[{"name":"shop-backend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-backend.cf2cnp-lab30/api/orders","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"54b664e9-5a2d-4ce9-83ea-7e22d5e3cc4f"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-backend.cf2cnp-lab30/api/orders"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:08:45.679154414Z"}
+{"flow":{"time":"2026-09-13T11:08:45.692651868Z","uuid":"e8875744-9d92-440e-97f2-4aac5099380a","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.50","destination":"10.10.3.54","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":36402,"destination_port":80}},"source":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"destination":{"ID":1440,"identity":108922,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=backend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-backend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-backend-6d64d6c6dc-rdr68","workloads":[{"name":"shop-backend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-backend.cf2cnp-lab30/api/orders?id=42","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"841014a9-6a49-4515-80e7-9e9882539f6f"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-backend.cf2cnp-lab30/api/orders?id=42"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:08:45.692651868Z"}
+{"flow":{"time":"2026-09-13T11:08:45.997098893Z","uuid":"64ab70da-7fb8-47d1-904e-065a1d2a638d","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.106","destination":"10.10.3.50","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":40680,"destination_port":80}},"source":{"ID":3592,"identity":68057,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"pos"},"destination":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-frontend.cf2cnp-lab30/","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"655f3765-ac2d-4001-bb98-4643b42b427a"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-frontend.cf2cnp-lab30/"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:08:45.997098893Z"}
+{"flow":{"time":"2026-09-13T11:08:46.030650638Z","uuid":"9e97491e-6ffb-4d3d-8520-53224c6c0289","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.106","destination":"10.10.3.50","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":40694,"destination_port":80}},"source":{"ID":3592,"identity":68057,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"pos"},"destination":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-frontend.cf2cnp-lab30/checkout","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"b08cf051-7f87-41a0-82ab-3fc6e972d6b0"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-frontend.cf2cnp-lab30/checkout"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:08:46.030650638Z"}
+{"flow":{"time":"2026-09-13T11:08:50.754642646Z","uuid":"3a3b1900-3d79-4502-ae3d-068e2d4fdf95","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.50","destination":"10.10.3.54","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":36404,"destination_port":80}},"source":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"destination":{"ID":1440,"identity":108922,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=backend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-backend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-backend-6d64d6c6dc-rdr68","workloads":[{"name":"shop-backend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-backend.cf2cnp-lab30/api/orders","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"2fe6f4b7-6b9a-4848-8bdc-6313547c4e3a"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-backend.cf2cnp-lab30/api/orders"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:08:50.754642646Z"}
+{"flow":{"time":"2026-09-13T11:08:50.784303521Z","uuid":"cf0bcbc3-6cae-4e81-8802-2e67dc4a0217","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.50","destination":"10.10.3.54","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":36414,"destination_port":80}},"source":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"destination":{"ID":1440,"identity":108922,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=backend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-backend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-backend-6d64d6c6dc-rdr68","workloads":[{"name":"shop-backend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-backend.cf2cnp-lab30/api/orders?id=42","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"7ded39f5-82bd-47d7-b73b-93b2e5778fad"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-backend.cf2cnp-lab30/api/orders?id=42"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:08:50.784303521Z"}
+{"flow":{"time":"2026-09-13T11:08:51.053651831Z","uuid":"3b056c31-791a-41e7-a5a1-4626ee098ea3","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.106","destination":"10.10.3.50","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":40702,"destination_port":80}},"source":{"ID":3592,"identity":68057,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"pos"},"destination":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-frontend.cf2cnp-lab30/","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"632e8380-e27f-45ed-9fa4-a1beb9f6cad5"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-frontend.cf2cnp-lab30/"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:08:51.053651831Z"}
+{"flow":{"time":"2026-09-13T11:08:51.073383893Z","uuid":"f1bbeac6-8fc5-49bd-b3d7-9e031d2b14c4","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.106","destination":"10.10.3.50","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":40706,"destination_port":80}},"source":{"ID":3592,"identity":68057,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"pos"},"destination":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-frontend.cf2cnp-lab30/checkout","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"be296c49-a415-4119-858f-e57f3bdfd8f7"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-frontend.cf2cnp-lab30/checkout"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:08:51.073383893Z"}
+{"flow":{"time":"2026-09-13T11:08:55.821252342Z","uuid":"976da012-af67-4f50-aa7c-57750f230b96","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.50","destination":"10.10.3.54","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":55368,"destination_port":80}},"source":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"destination":{"ID":1440,"identity":108922,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=backend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-backend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-backend-6d64d6c6dc-rdr68","workloads":[{"name":"shop-backend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-backend.cf2cnp-lab30/api/orders","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"da5bb3cd-9ed5-43aa-89f9-ddf1dd247a7b"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-backend.cf2cnp-lab30/api/orders"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:08:55.821252342Z"}
+{"flow":{"time":"2026-09-13T11:08:55.841501162Z","uuid":"3f31b2f3-0a11-4778-b1bd-c62153571ef6","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.50","destination":"10.10.3.54","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":55370,"destination_port":80}},"source":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"destination":{"ID":1440,"identity":108922,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=backend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-backend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-backend-6d64d6c6dc-rdr68","workloads":[{"name":"shop-backend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-backend.cf2cnp-lab30/api/orders?id=42","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"5c494737-2259-4a81-9792-63e3d521c4e5"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-backend.cf2cnp-lab30/api/orders?id=42"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:08:55.841501162Z"}
+{"flow":{"time":"2026-09-13T11:08:56.101596440Z","uuid":"5466d403-d31c-47a5-83ae-3671ce0120c6","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.106","destination":"10.10.3.50","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":37922,"destination_port":80}},"source":{"ID":3592,"identity":68057,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"pos"},"destination":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-frontend.cf2cnp-lab30/","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"516f6d73-721a-43a1-a780-e1589b029e3b"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-frontend.cf2cnp-lab30/"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:08:56.101596440Z"}
+{"flow":{"time":"2026-09-13T11:08:56.118073937Z","uuid":"5650722a-5e16-43fb-9145-388c3fd77e93","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.106","destination":"10.10.3.50","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":37932,"destination_port":80}},"source":{"ID":3592,"identity":68057,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"pos"},"destination":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-frontend.cf2cnp-lab30/checkout","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"4956add3-899e-4077-83cd-c4c2d36a2577"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-frontend.cf2cnp-lab30/checkout"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:08:56.118073937Z"}
+{"flow":{"time":"2026-09-13T11:09:00.959674057Z","uuid":"469bc566-b640-453b-9b0c-7e9dc14f1079","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.50","destination":"10.10.3.54","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":55380,"destination_port":80}},"source":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"destination":{"ID":1440,"identity":108922,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=backend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-backend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-backend-6d64d6c6dc-rdr68","workloads":[{"name":"shop-backend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-backend.cf2cnp-lab30/api/orders","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"26d2030b-293a-4709-be08-840dc77d5ec5"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-backend.cf2cnp-lab30/api/orders"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:09:00.959674057Z"}
+{"flow":{"time":"2026-09-13T11:09:00.985483821Z","uuid":"6dcd00e3-91d6-4116-9195-5795610ac5dd","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.50","destination":"10.10.3.54","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":55390,"destination_port":80}},"source":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"destination":{"ID":1440,"identity":108922,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=backend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-backend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-backend-6d64d6c6dc-rdr68","workloads":[{"name":"shop-backend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-backend.cf2cnp-lab30/api/orders?id=42","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"d3a1bac2-21bc-4dd3-ab09-76acf14a4cff"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-backend.cf2cnp-lab30/api/orders?id=42"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:09:00.985483821Z"}
+{"flow":{"time":"2026-09-13T11:09:01.151036924Z","uuid":"a636cfc5-28f2-4479-9450-daa9828cc94c","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.106","destination":"10.10.3.50","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":37944,"destination_port":80}},"source":{"ID":3592,"identity":68057,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"pos"},"destination":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-frontend.cf2cnp-lab30/","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"6c9cbe21-17d4-4be4-868b-19a760a0de7f"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-frontend.cf2cnp-lab30/"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:09:01.151036924Z"}
+{"flow":{"time":"2026-09-13T11:09:01.183777702Z","uuid":"f40c88d5-1a98-408d-a819-dff98c8b0cf1","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.106","destination":"10.10.3.50","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":37958,"destination_port":80}},"source":{"ID":3592,"identity":68057,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"pos"},"destination":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-frontend.cf2cnp-lab30/checkout","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"3bf8ab0a-722b-4241-93b1-7c3f5739cbc8"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-frontend.cf2cnp-lab30/checkout"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:09:01.183777702Z"}
+{"flow":{"time":"2026-09-13T11:09:06.017127110Z","uuid":"45a706e4-cdc9-42ff-a091-fae00fb756df","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.50","destination":"10.10.3.54","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":51342,"destination_port":80}},"source":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"destination":{"ID":1440,"identity":108922,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=backend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-backend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-backend-6d64d6c6dc-rdr68","workloads":[{"name":"shop-backend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-backend.cf2cnp-lab30/api/orders","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"08f2a0fd-9737-425c-be33-dd9231c9c281"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-backend.cf2cnp-lab30/api/orders"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:09:06.017127110Z"}
+{"flow":{"time":"2026-09-13T11:09:06.036793923Z","uuid":"9daf658a-6d34-4026-98a9-6257056e6c29","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.50","destination":"10.10.3.54","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":51344,"destination_port":80}},"source":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"destination":{"ID":1440,"identity":108922,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=backend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-backend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-backend-6d64d6c6dc-rdr68","workloads":[{"name":"shop-backend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-backend.cf2cnp-lab30/api/orders?id=42","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"92e8cd10-e6d1-409e-907c-77e1f7a7cc0c"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-backend.cf2cnp-lab30/api/orders?id=42"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:09:06.036793923Z"}
+{"flow":{"time":"2026-09-13T11:09:06.211835218Z","uuid":"b351808e-caa5-4e22-bf5e-9f6df76c7a6b","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.106","destination":"10.10.3.50","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":56338,"destination_port":80}},"source":{"ID":3592,"identity":68057,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"pos"},"destination":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-frontend.cf2cnp-lab30/","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"f6957030-724d-4c39-829d-236668151c28"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-frontend.cf2cnp-lab30/"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:09:06.211835218Z"}
+{"flow":{"time":"2026-09-13T11:09:06.230195181Z","uuid":"6cb88277-2db2-4fbe-9950-4c5c366f1446","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.106","destination":"10.10.3.50","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":56350,"destination_port":80}},"source":{"ID":3592,"identity":68057,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"pos"},"destination":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-frontend.cf2cnp-lab30/checkout","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"0cb56fe2-dd66-4fff-94aa-9b194f284bf2"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-frontend.cf2cnp-lab30/checkout"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:09:06.230195181Z"}
+{"flow":{"time":"2026-09-13T11:09:11.072513895Z","uuid":"b5c77b9d-2a55-4a83-820f-ccf2e4b4fa14","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.50","destination":"10.10.3.54","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":51356,"destination_port":80}},"source":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"destination":{"ID":1440,"identity":108922,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=backend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-backend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-backend-6d64d6c6dc-rdr68","workloads":[{"name":"shop-backend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-backend.cf2cnp-lab30/api/orders","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"93d6bafb-9581-4466-8d78-7f1b37d055ac"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-backend.cf2cnp-lab30/api/orders"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:09:11.072513895Z"}
+{"flow":{"time":"2026-09-13T11:09:11.095149144Z","uuid":"b3980dc9-6034-43ac-ac59-70ea63ce796c","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.50","destination":"10.10.3.54","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":51358,"destination_port":80}},"source":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"destination":{"ID":1440,"identity":108922,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=backend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-backend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-backend-6d64d6c6dc-rdr68","workloads":[{"name":"shop-backend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-backend.cf2cnp-lab30/api/orders?id=42","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"cfaa1b66-5ef7-48ce-bb03-429631a0c675"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-backend.cf2cnp-lab30/api/orders?id=42"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:09:11.095149144Z"}
+{"flow":{"time":"2026-09-13T11:09:11.246103853Z","uuid":"ac6374d1-7d13-401a-96e1-bac478818f95","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.106","destination":"10.10.3.50","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":56360,"destination_port":80}},"source":{"ID":3592,"identity":68057,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"pos"},"destination":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-frontend.cf2cnp-lab30/","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"683965d9-a18d-4182-ace3-ae9c5adb74e5"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-frontend.cf2cnp-lab30/"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:09:11.246103853Z"}
+{"flow":{"time":"2026-09-13T11:09:11.271176150Z","uuid":"c51cebeb-6d5b-4909-8b9a-ee6412fa2aca","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.106","destination":"10.10.3.50","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":56374,"destination_port":80}},"source":{"ID":3592,"identity":68057,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"pos"},"destination":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-frontend.cf2cnp-lab30/checkout","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"48663eba-afe0-40cf-8be5-b1f1e58d3086"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-frontend.cf2cnp-lab30/checkout"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:09:11.271176150Z"}
+{"flow":{"time":"2026-09-13T11:09:16.159903304Z","uuid":"abbaa93d-c696-4b3b-824f-67763b6c3691","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.50","destination":"10.10.3.54","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":48968,"destination_port":80}},"source":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"destination":{"ID":1440,"identity":108922,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=backend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-backend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-backend-6d64d6c6dc-rdr68","workloads":[{"name":"shop-backend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-backend.cf2cnp-lab30/api/orders","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"56ac9221-a21a-4380-b162-a8e730a44ecd"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-backend.cf2cnp-lab30/api/orders"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:09:16.159903304Z"}
+{"flow":{"time":"2026-09-13T11:09:16.185900813Z","uuid":"312c8af5-6e89-453c-892e-75c9a8dedbcd","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.50","destination":"10.10.3.54","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":48972,"destination_port":80}},"source":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"destination":{"ID":1440,"identity":108922,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=backend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-backend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-backend-6d64d6c6dc-rdr68","workloads":[{"name":"shop-backend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-backend.cf2cnp-lab30/api/orders?id=42","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"69dac1fc-1936-4f97-93b4-4c9f3c5968fb"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-backend.cf2cnp-lab30/api/orders?id=42"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:09:16.185900813Z"}
+{"flow":{"time":"2026-09-13T11:09:16.293550725Z","uuid":"d64afc96-bc87-4539-8aa5-18f4c261c4b8","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.106","destination":"10.10.3.50","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":57984,"destination_port":80}},"source":{"ID":3592,"identity":68057,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"pos"},"destination":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-frontend.cf2cnp-lab30/","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"8092480b-01bd-4b8f-b7af-ed2821a89941"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-frontend.cf2cnp-lab30/"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:09:16.293550725Z"}
+{"flow":{"time":"2026-09-13T11:09:16.310050905Z","uuid":"29a1296a-811f-4b07-bd54-4ec40d00cdc5","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.106","destination":"10.10.3.50","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":57990,"destination_port":80}},"source":{"ID":3592,"identity":68057,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"pos"},"destination":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-frontend.cf2cnp-lab30/checkout","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"fb9296f9-13ed-447a-a343-51ab4d983445"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-frontend.cf2cnp-lab30/checkout"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:09:16.310050905Z"}
+{"flow":{"time":"2026-09-13T11:09:21.296952155Z","uuid":"8921a5db-2072-49f0-9962-49421d0e6f29","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.50","destination":"10.10.3.54","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":48974,"destination_port":80}},"source":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"destination":{"ID":1440,"identity":108922,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=backend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-backend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-backend-6d64d6c6dc-rdr68","workloads":[{"name":"shop-backend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-backend.cf2cnp-lab30/api/orders","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"86166b1a-65ad-4d80-a233-08eaa682240b"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-backend.cf2cnp-lab30/api/orders"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:09:21.296952155Z"}
+{"flow":{"time":"2026-09-13T11:09:21.336063531Z","uuid":"6ad57f0b-a064-40bc-81b9-4aecddefc975","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.50","destination":"10.10.3.54","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":48976,"destination_port":80}},"source":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"destination":{"ID":1440,"identity":108922,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=backend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-backend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-backend-6d64d6c6dc-rdr68","workloads":[{"name":"shop-backend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-backend.cf2cnp-lab30/api/orders?id=42","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"2cdb936d-1d1a-4726-b112-462bf6980224"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-backend.cf2cnp-lab30/api/orders?id=42"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:09:21.336063531Z"}
+{"flow":{"time":"2026-09-13T11:09:21.336130994Z","uuid":"0874401b-5638-4768-b341-f2c54d4045dc","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.106","destination":"10.10.3.50","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":57992,"destination_port":80}},"source":{"ID":3592,"identity":68057,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"pos"},"destination":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-frontend.cf2cnp-lab30/","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"4db4a15a-4370-4e95-8dc5-0efd3d5def3f"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-frontend.cf2cnp-lab30/"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:09:21.336130994Z"}
+{"flow":{"time":"2026-09-13T11:09:21.371112066Z","uuid":"0019f339-1cd9-4a7c-aa57-dd80518e4980","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.106","destination":"10.10.3.50","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":58008,"destination_port":80}},"source":{"ID":3592,"identity":68057,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"pos"},"destination":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-frontend.cf2cnp-lab30/checkout","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"d02552be-b24c-4640-ac42-d04f0d21e843"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-frontend.cf2cnp-lab30/checkout"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:09:21.371112066Z"}
+{"flow":{"time":"2026-09-13T11:09:26.377539792Z","uuid":"7c9b4da6-21cd-4c8e-9f93-7ca0c658e359","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.50","destination":"10.10.3.54","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":34992,"destination_port":80}},"source":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"destination":{"ID":1440,"identity":108922,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=backend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-backend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-backend-6d64d6c6dc-rdr68","workloads":[{"name":"shop-backend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-backend.cf2cnp-lab30/api/orders","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"81248ba4-0b74-4503-a163-e1955f741bbc"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-backend.cf2cnp-lab30/api/orders"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:09:26.377539792Z"}
+{"flow":{"time":"2026-09-13T11:09:26.389747682Z","uuid":"60aca9f3-d3b8-48c9-988e-f490b7747769","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.106","destination":"10.10.3.50","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":54032,"destination_port":80}},"source":{"ID":3592,"identity":68057,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"pos"},"destination":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-frontend.cf2cnp-lab30/","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"721c1296-64b3-460b-82d3-40d138f897e9"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-frontend.cf2cnp-lab30/"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:09:26.389747682Z"}
+{"flow":{"time":"2026-09-13T11:09:26.399115016Z","uuid":"3a587a7c-68db-480f-995d-e7ea2cfa0b86","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.50","destination":"10.10.3.54","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":35004,"destination_port":80}},"source":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"destination":{"ID":1440,"identity":108922,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=backend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-backend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-backend-6d64d6c6dc-rdr68","workloads":[{"name":"shop-backend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-backend.cf2cnp-lab30/api/orders?id=42","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"45905d1f-7ded-47b8-8836-bef240c2c0d0"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-backend.cf2cnp-lab30/api/orders?id=42"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:09:26.399115016Z"}
+{"flow":{"time":"2026-09-13T11:09:26.404883515Z","uuid":"9c61e076-d8f8-4ce0-8b60-93c099e5cde3","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.106","destination":"10.10.3.50","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":54046,"destination_port":80}},"source":{"ID":3592,"identity":68057,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"pos"},"destination":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-frontend.cf2cnp-lab30/checkout","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"6ecb4f1d-862c-4380-967a-b23b31c72b5f"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-frontend.cf2cnp-lab30/checkout"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:09:26.404883515Z"}
+{"flow":{"time":"2026-09-13T11:09:31.418431584Z","uuid":"18306e00-49da-41f7-b8e5-14a05f0f13bc","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.50","destination":"10.10.3.54","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":35014,"destination_port":80}},"source":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"destination":{"ID":1440,"identity":108922,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=backend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-backend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-backend-6d64d6c6dc-rdr68","workloads":[{"name":"shop-backend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-backend.cf2cnp-lab30/api/orders","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"d9b4f01d-71ec-480a-862d-01639d37c502"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-backend.cf2cnp-lab30/api/orders"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:09:31.418431584Z"}
+{"flow":{"time":"2026-09-13T11:09:31.424803186Z","uuid":"7b2d3f69-b7dc-44e1-8a96-8f576fd3f18c","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.106","destination":"10.10.3.50","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":54056,"destination_port":80}},"source":{"ID":3592,"identity":68057,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"pos"},"destination":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-frontend.cf2cnp-lab30/","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"c402493d-7fac-4f29-bab6-f5b987278735"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-frontend.cf2cnp-lab30/"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:09:31.424803186Z"}
+{"flow":{"time":"2026-09-13T11:09:31.436622344Z","uuid":"2a27580e-fd39-4242-b25f-ca0957c500c3","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.50","destination":"10.10.3.54","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":35018,"destination_port":80}},"source":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"destination":{"ID":1440,"identity":108922,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=backend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-backend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-backend-6d64d6c6dc-rdr68","workloads":[{"name":"shop-backend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-backend.cf2cnp-lab30/api/orders?id=42","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"01cdeecc-41e0-4b79-89cb-86885c3761ed"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-backend.cf2cnp-lab30/api/orders?id=42"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:09:31.436622344Z"}
+{"flow":{"time":"2026-09-13T11:09:31.459238412Z","uuid":"0e979746-aa9f-493e-9e21-b88a93436618","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","IP":{"source":"10.10.3.106","destination":"10.10.3.50","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":54066,"destination_port":80}},"source":{"ID":3592,"identity":68057,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"pos"},"destination":{"ID":925,"identity":101965,"cluster_name":"poc1","namespace":"cf2cnp-lab30","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab30","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab30"],"pod_name":"shop-frontend-67956db844-hbzxb","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L7","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"l7":{"type":"REQUEST","http":{"method":"GET","url":"http://shop-frontend.cf2cnp-lab30/checkout","protocol":"HTTP/1.1","headers":[{"key":":scheme","value":"http"},{"key":"Accept","value":"*/*"},{"key":"User-Agent","value":"Wget"},{"key":"X-Envoy-Internal","value":"true"},{"key":"X-Request-Id","value":"9d96ac59-42ab-489e-b5c1-27174e622cd5"}]}},"event_type":{"type":129},"traffic_direction":"INGRESS","is_reply":false,"Summary":"HTTP/1.1 GET http://shop-frontend.cf2cnp-lab30/checkout"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:09:31.459238412Z"}
diff --git a/internal/testdata/golden/30-shop-l7/options.json b/internal/testdata/golden/30-shop-l7/options.json
new file mode 100644
index 0000000..52ad350
--- /dev/null
+++ b/internal/testdata/golden/30-shop-l7/options.json
@@ -0,0 +1 @@
+{"l7": "true"}
diff --git a/internal/testdata/golden/31-pos-dns-visibility/expected.yaml b/internal/testdata/golden/31-pos-dns-visibility/expected.yaml
new file mode 100644
index 0000000..b674b22
--- /dev/null
+++ b/internal/testdata/golden/31-pos-dns-visibility/expected.yaml
@@ -0,0 +1,43 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: pos
+  namespace: cf2cnp-lab
+  labels:
+    app.kubernetes.io/managed-by: cf2cnp
+    app.kubernetes.io/name: pos
+spec:
+  description: 'Allow egress from pos in cf2cnp-lab: to shop on TCP/80; to 104.20.23.154/32 on TCP/443; to kube-dns in kube-system on ANY/53 (DNS *)'
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: pos
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            app.kubernetes.io/name: shop
+      toPorts:
+        - ports:
+            - port: "80"
+              protocol: TCP
+    - toCIDR:
+        - 104.20.23.154/32
+    # To allow all traffic to world instead of specific IPs, replace toCIDR with:
+    # - toEntities:
+    #     - world
+    # The DNS rule below turns the DNS proxy on for these endpoints: once flows carry destination_names,
+    # regenerate to get a toFQDNs rule instead of this CIDR.
+      toPorts:
+        - ports:
+            - port: "443"
+              protocol: TCP
+    - toEndpoints:
+        - matchLabels:
+            io.kubernetes.pod.namespace: kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: ANY
+          rules:
+            dns:
+              - matchPattern: '*'
diff --git a/internal/testdata/golden/31-pos-dns-visibility/flows.ndjson b/internal/testdata/golden/31-pos-dns-visibility/flows.ndjson
new file mode 100644
index 0000000..15cbb13
--- /dev/null
+++ b/internal/testdata/golden/31-pos-dns-visibility/flows.ndjson
@@ -0,0 +1,4 @@
+{"flow":{"time":"2026-09-13T11:15:24.514646998Z","uuid":"eb427f52-8fbd-41fb-bb19-228369ec61d3","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","ethernet":{"source":"e6:fe:44:c2:b3:b6","destination":"2a:b2:c2:39:45:76"},"IP":{"source":"10.10.4.93","destination":"10.10.1.35","ipVersion":"IPv4"},"l4":{"UDP":{"source_port":41406,"destination_port":53}},"source":{"identity":82359,"cluster_name":"poc1","namespace":"cf2cnp-lab","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab"],"pod_name":"pos"},"destination":{"ID":591,"identity":80806,"cluster_name":"poc1","namespace":"kube-system","labels":["gen:io.cilium.k8s.named-ports-1=metrics.TCP.9153_readiness-probe.TCP.8181","gen:io.cilium.k8s.named-ports=dns.UDP.53_dns-tcp.TCP.53_liveness-probe.TCP.8080","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=kube-system","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=coredns","k8s:io.kubernetes.pod.namespace=kube-system","k8s:k8s-app=kube-dns"],"pod_name":"coredns-789c5fbdb4-qhj2d","workloads":[{"name":"coredns","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-control-plane2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-control-plane2","kubernetes.io/os=linux","node-role.kubernetes.io/control-plane=","node.kubernetes.io/exclude-from-external-load-balancers="],"event_type":{"type":4},"traffic_direction":"EGRESS","trace_observation_point":"TO_ENDPOINT","trace_reason":"NEW","is_reply":false,"interface":{"index":39,"name":"lxc1a237d3e277a"},"Summary":"UDP"},"node_name":"poc1/poc1-control-plane2","time":"2026-09-13T11:15:24.514646998Z"}
+{"flow":{"time":"2026-09-13T11:18:04.145548817Z","uuid":"7c8e6bec-9e2b-4159-ae20-9abae9cf1564","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","ethernet":{"source":"fe:45:4b:8e:61:55","destination":"66:5a:4c:b8:5f:09"},"IP":{"source":"10.10.4.93","destination":"10.10.0.232","ipVersion":"IPv4"},"l4":{"UDP":{"source_port":52628,"destination_port":53}},"source":{"ID":4091,"identity":82359,"cluster_name":"poc1","namespace":"cf2cnp-lab","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab"],"pod_name":"pos"},"destination":{"identity":80806,"cluster_name":"poc1","namespace":"kube-system","labels":["gen:io.cilium.k8s.named-ports-1=metrics.TCP.9153_readiness-probe.TCP.8181","gen:io.cilium.k8s.named-ports=dns.UDP.53_dns-tcp.TCP.53_liveness-probe.TCP.8080","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=kube-system","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=coredns","k8s:io.kubernetes.pod.namespace=kube-system","k8s:k8s-app=kube-dns"],"pod_name":"coredns-789c5fbdb4-vb8r9"},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":4,"sub_type":4},"traffic_direction":"EGRESS","trace_observation_point":"TO_OVERLAY","trace_reason":"NEW","is_reply":false,"interface":{"index":13,"name":"cilium_vxlan"},"Summary":"UDP"},"node_name":"poc1/poc1-worker","time":"2026-09-13T11:18:04.145548817Z"}
+{"flow":{"time":"2026-09-13T11:18:04.154768146Z","uuid":"57bd3e35-c5c9-48b6-8a73-de9a605b028a","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","ethernet":{"source":"fe:45:4b:8e:61:55","destination":"66:5a:4c:b8:5f:09"},"IP":{"source":"10.10.4.93","destination":"10.10.3.7","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":35528,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":4091,"identity":82359,"cluster_name":"poc1","namespace":"cf2cnp-lab","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab"],"pod_name":"pos"},"destination":{"identity":94334,"cluster_name":"poc1","namespace":"cf2cnp-lab","labels":["k8s:app.kubernetes.io/name=shop","k8s:app=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab"],"pod_name":"shop-6d7d797759-4ddlt"},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":4,"sub_type":4},"traffic_direction":"EGRESS","trace_observation_point":"TO_OVERLAY","trace_reason":"NEW","is_reply":false,"interface":{"index":13,"name":"cilium_vxlan"},"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T11:18:04.154768146Z"}
+{"flow":{"time":"2026-09-13T11:18:04.209601937Z","uuid":"d885dd6a-ebcb-43ce-ac33-d311ed05cf93","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","ethernet":{"source":"fe:45:4b:8e:61:55","destination":"66:5a:4c:b8:5f:09"},"IP":{"source":"10.10.4.93","destination":"104.20.23.154","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":44510,"destination_port":443,"flags":{"SYN":true}}},"source":{"ID":4091,"identity":82359,"cluster_name":"poc1","namespace":"cf2cnp-lab","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab"],"pod_name":"pos"},"destination":{"identity":2,"labels":["reserved:world"]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":4,"sub_type":11},"traffic_direction":"EGRESS","trace_observation_point":"TO_NETWORK","trace_reason":"NEW","is_reply":false,"interface":{"index":233,"name":"eth0"},"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T11:18:04.209601937Z"}
diff --git a/internal/testdata/golden/31-pos-dns-visibility/options.json b/internal/testdata/golden/31-pos-dns-visibility/options.json
new file mode 100644
index 0000000..86ad5ad
--- /dev/null
+++ b/internal/testdata/golden/31-pos-dns-visibility/options.json
@@ -0,0 +1 @@
+{"dnsVisibility": "true"}
diff --git a/internal/testdata/golden/31-pos-egress-cidr/expected.yaml b/internal/testdata/golden/31-pos-egress-cidr/expected.yaml
new file mode 100644
index 0000000..7c93845
--- /dev/null
+++ b/internal/testdata/golden/31-pos-egress-cidr/expected.yaml
@@ -0,0 +1,38 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: pos
+  namespace: cf2cnp-lab
+  labels:
+    app.kubernetes.io/managed-by: cf2cnp
+    app.kubernetes.io/name: pos
+spec:
+  description: 'Allow egress from pos in cf2cnp-lab: to shop on TCP/80; to kube-dns in kube-system on UDP/53; to 104.20.23.154/32 on TCP/443'
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: pos
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            app.kubernetes.io/name: shop
+      toPorts:
+        - ports:
+            - port: "80"
+              protocol: TCP
+    - toEndpoints:
+        - matchLabels:
+            io.kubernetes.pod.namespace: kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+    - toCIDR:
+        - 104.20.23.154/32
+    # To allow all traffic to world instead of specific IPs, replace toCIDR with:
+    # - toEntities:
+    #     - world
+      toPorts:
+        - ports:
+            - port: "443"
+              protocol: TCP
diff --git a/internal/testdata/golden/31-pos-egress-cidr/flows.ndjson b/internal/testdata/golden/31-pos-egress-cidr/flows.ndjson
new file mode 100644
index 0000000..15cbb13
--- /dev/null
+++ b/internal/testdata/golden/31-pos-egress-cidr/flows.ndjson
@@ -0,0 +1,4 @@
+{"flow":{"time":"2026-09-13T11:15:24.514646998Z","uuid":"eb427f52-8fbd-41fb-bb19-228369ec61d3","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","ethernet":{"source":"e6:fe:44:c2:b3:b6","destination":"2a:b2:c2:39:45:76"},"IP":{"source":"10.10.4.93","destination":"10.10.1.35","ipVersion":"IPv4"},"l4":{"UDP":{"source_port":41406,"destination_port":53}},"source":{"identity":82359,"cluster_name":"poc1","namespace":"cf2cnp-lab","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab"],"pod_name":"pos"},"destination":{"ID":591,"identity":80806,"cluster_name":"poc1","namespace":"kube-system","labels":["gen:io.cilium.k8s.named-ports-1=metrics.TCP.9153_readiness-probe.TCP.8181","gen:io.cilium.k8s.named-ports=dns.UDP.53_dns-tcp.TCP.53_liveness-probe.TCP.8080","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=kube-system","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=coredns","k8s:io.kubernetes.pod.namespace=kube-system","k8s:k8s-app=kube-dns"],"pod_name":"coredns-789c5fbdb4-qhj2d","workloads":[{"name":"coredns","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-control-plane2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-control-plane2","kubernetes.io/os=linux","node-role.kubernetes.io/control-plane=","node.kubernetes.io/exclude-from-external-load-balancers="],"event_type":{"type":4},"traffic_direction":"EGRESS","trace_observation_point":"TO_ENDPOINT","trace_reason":"NEW","is_reply":false,"interface":{"index":39,"name":"lxc1a237d3e277a"},"Summary":"UDP"},"node_name":"poc1/poc1-control-plane2","time":"2026-09-13T11:15:24.514646998Z"}
+{"flow":{"time":"2026-09-13T11:18:04.145548817Z","uuid":"7c8e6bec-9e2b-4159-ae20-9abae9cf1564","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","ethernet":{"source":"fe:45:4b:8e:61:55","destination":"66:5a:4c:b8:5f:09"},"IP":{"source":"10.10.4.93","destination":"10.10.0.232","ipVersion":"IPv4"},"l4":{"UDP":{"source_port":52628,"destination_port":53}},"source":{"ID":4091,"identity":82359,"cluster_name":"poc1","namespace":"cf2cnp-lab","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab"],"pod_name":"pos"},"destination":{"identity":80806,"cluster_name":"poc1","namespace":"kube-system","labels":["gen:io.cilium.k8s.named-ports-1=metrics.TCP.9153_readiness-probe.TCP.8181","gen:io.cilium.k8s.named-ports=dns.UDP.53_dns-tcp.TCP.53_liveness-probe.TCP.8080","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=kube-system","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=coredns","k8s:io.kubernetes.pod.namespace=kube-system","k8s:k8s-app=kube-dns"],"pod_name":"coredns-789c5fbdb4-vb8r9"},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":4,"sub_type":4},"traffic_direction":"EGRESS","trace_observation_point":"TO_OVERLAY","trace_reason":"NEW","is_reply":false,"interface":{"index":13,"name":"cilium_vxlan"},"Summary":"UDP"},"node_name":"poc1/poc1-worker","time":"2026-09-13T11:18:04.145548817Z"}
+{"flow":{"time":"2026-09-13T11:18:04.154768146Z","uuid":"57bd3e35-c5c9-48b6-8a73-de9a605b028a","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","ethernet":{"source":"fe:45:4b:8e:61:55","destination":"66:5a:4c:b8:5f:09"},"IP":{"source":"10.10.4.93","destination":"10.10.3.7","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":35528,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":4091,"identity":82359,"cluster_name":"poc1","namespace":"cf2cnp-lab","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab"],"pod_name":"pos"},"destination":{"identity":94334,"cluster_name":"poc1","namespace":"cf2cnp-lab","labels":["k8s:app.kubernetes.io/name=shop","k8s:app=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab"],"pod_name":"shop-6d7d797759-4ddlt"},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":4,"sub_type":4},"traffic_direction":"EGRESS","trace_observation_point":"TO_OVERLAY","trace_reason":"NEW","is_reply":false,"interface":{"index":13,"name":"cilium_vxlan"},"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T11:18:04.154768146Z"}
+{"flow":{"time":"2026-09-13T11:18:04.209601937Z","uuid":"d885dd6a-ebcb-43ce-ac33-d311ed05cf93","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","ethernet":{"source":"fe:45:4b:8e:61:55","destination":"66:5a:4c:b8:5f:09"},"IP":{"source":"10.10.4.93","destination":"104.20.23.154","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":44510,"destination_port":443,"flags":{"SYN":true}}},"source":{"ID":4091,"identity":82359,"cluster_name":"poc1","namespace":"cf2cnp-lab","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab"],"pod_name":"pos"},"destination":{"identity":2,"labels":["reserved:world"]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":4,"sub_type":11},"traffic_direction":"EGRESS","trace_observation_point":"TO_NETWORK","trace_reason":"NEW","is_reply":false,"interface":{"index":233,"name":"eth0"},"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T11:18:04.209601937Z"}
diff --git a/internal/testdata/golden/31-pos-egress-cidr/options.json b/internal/testdata/golden/31-pos-egress-cidr/options.json
new file mode 100644
index 0000000..0967ef4
--- /dev/null
+++ b/internal/testdata/golden/31-pos-egress-cidr/options.json
@@ -0,0 +1 @@
+{}
diff --git a/internal/testdata/golden/31-pos-fqdn/expected.yaml b/internal/testdata/golden/31-pos-fqdn/expected.yaml
new file mode 100644
index 0000000..0d6bdf1
--- /dev/null
+++ b/internal/testdata/golden/31-pos-fqdn/expected.yaml
@@ -0,0 +1,38 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: pos
+  namespace: cf2cnp-lab
+  labels:
+    app.kubernetes.io/managed-by: cf2cnp
+    app.kubernetes.io/name: pos
+spec:
+  description: 'Allow egress from pos in cf2cnp-lab: to shop on TCP/80; to example.com on TCP/443; to kube-dns in kube-system on ANY/53 (DNS *)'
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: pos
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            app.kubernetes.io/name: shop
+      toPorts:
+        - ports:
+            - port: "80"
+              protocol: TCP
+    - toFQDNs:
+        - matchName: example.com
+      toPorts:
+        - ports:
+            - port: "443"
+              protocol: TCP
+    - toEndpoints:
+        - matchLabels:
+            io.kubernetes.pod.namespace: kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: ANY
+          rules:
+            dns:
+              - matchPattern: '*'
diff --git a/internal/testdata/golden/31-pos-fqdn/flows.ndjson b/internal/testdata/golden/31-pos-fqdn/flows.ndjson
new file mode 100644
index 0000000..be99d53
--- /dev/null
+++ b/internal/testdata/golden/31-pos-fqdn/flows.ndjson
@@ -0,0 +1,4 @@
+{"flow":{"time":"2026-09-13T11:20:17.770581531Z","uuid":"befb7723-d02c-4752-b90f-5b515715c82d","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","ethernet":{"source":"a2:98:3c:25:3a:e2","destination":"7a:1b:83:c0:44:4b"},"IP":{"source":"10.10.4.93","destination":"10.10.0.232","ipVersion":"IPv4"},"l4":{"UDP":{"source_port":58187,"destination_port":53}},"source":{"identity":82359,"cluster_name":"poc1","namespace":"cf2cnp-lab","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab"],"pod_name":"pos"},"destination":{"ID":1331,"identity":80806,"cluster_name":"poc1","namespace":"kube-system","labels":["gen:io.cilium.k8s.named-ports-1=metrics.TCP.9153_readiness-probe.TCP.8181","gen:io.cilium.k8s.named-ports=dns.UDP.53_dns-tcp.TCP.53_liveness-probe.TCP.8080","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=kube-system","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=coredns","k8s:io.kubernetes.pod.namespace=kube-system","k8s:k8s-app=kube-dns"],"pod_name":"coredns-789c5fbdb4-vb8r9","workloads":[{"name":"coredns","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-control-plane","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-control-plane","kubernetes.io/os=linux","node-role.kubernetes.io/control-plane=","node.kubernetes.io/exclude-from-external-load-balancers="],"event_type":{"type":4},"traffic_direction":"EGRESS","trace_observation_point":"TO_ENDPOINT","trace_reason":"NEW","is_reply":false,"interface":{"index":39,"name":"lxcb6b839301254"},"Summary":"UDP"},"node_name":"poc1/poc1-control-plane","time":"2026-09-13T11:20:17.770581531Z"}
+{"flow":{"time":"2026-09-13T11:20:17.778746028Z","uuid":"04798ba7-727c-48b4-affa-cf557696bfe9","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","ethernet":{"source":"e6:fe:44:c2:b3:b6","destination":"2a:b2:c2:39:45:76"},"IP":{"source":"10.10.4.93","destination":"10.10.1.35","ipVersion":"IPv4"},"l4":{"UDP":{"source_port":51117,"destination_port":53}},"source":{"identity":82359,"cluster_name":"poc1","namespace":"cf2cnp-lab","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab"],"pod_name":"pos"},"destination":{"ID":591,"identity":80806,"cluster_name":"poc1","namespace":"kube-system","labels":["gen:io.cilium.k8s.named-ports-1=metrics.TCP.9153_readiness-probe.TCP.8181","gen:io.cilium.k8s.named-ports=dns.UDP.53_dns-tcp.TCP.53_liveness-probe.TCP.8080","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=kube-system","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=coredns","k8s:io.kubernetes.pod.namespace=kube-system","k8s:k8s-app=kube-dns"],"pod_name":"coredns-789c5fbdb4-qhj2d","workloads":[{"name":"coredns","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-control-plane2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-control-plane2","kubernetes.io/os=linux","node-role.kubernetes.io/control-plane=","node.kubernetes.io/exclude-from-external-load-balancers="],"event_type":{"type":4},"traffic_direction":"EGRESS","trace_observation_point":"TO_ENDPOINT","trace_reason":"NEW","is_reply":false,"interface":{"index":39,"name":"lxc1a237d3e277a"},"Summary":"UDP"},"node_name":"poc1/poc1-control-plane2","time":"2026-09-13T11:20:17.778746028Z"}
+{"flow":{"time":"2026-09-13T11:20:18.016657166Z","uuid":"45f24815-4a07-4959-bdd5-efaed5fb991f","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","ethernet":{"source":"fe:45:4b:8e:61:55","destination":"66:5a:4c:b8:5f:09"},"IP":{"source":"10.10.4.93","destination":"104.20.23.154","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":42578,"destination_port":443,"flags":{"FIN":true,"ACK":true}}},"source":{"ID":4091,"identity":82359,"cluster_name":"poc1","namespace":"cf2cnp-lab","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab"],"pod_name":"pos"},"destination":{"identity":16777219,"labels":["cidr:104.20.23.154/32","reserved:world"]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"destination_names":["example.com"],"event_type":{"type":4,"sub_type":11},"traffic_direction":"EGRESS","trace_observation_point":"TO_NETWORK","trace_reason":"ESTABLISHED","is_reply":false,"interface":{"index":233,"name":"eth0"},"Summary":"TCP Flags: ACK, FIN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T11:20:18.016657166Z"}
+{"flow":{"time":"2026-09-13T11:20:17.731307492Z","uuid":"c0efb714-9f86-4095-898f-74c1ec264a24","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","ethernet":{"source":"3e:c8:bc:d2:45:74","destination":"9a:95:6d:a3:3c:ba"},"IP":{"source":"10.10.4.93","destination":"10.10.3.7","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":44882,"destination_port":80,"flags":{"ACK":true}}},"source":{"identity":82359,"cluster_name":"poc1","namespace":"cf2cnp-lab","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab"],"pod_name":"pos"},"destination":{"ID":1955,"identity":94334,"cluster_name":"poc1","namespace":"cf2cnp-lab","labels":["k8s:app.kubernetes.io/name=shop","k8s:app=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab"],"pod_name":"shop-6d7d797759-4ddlt","workloads":[{"name":"shop","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":4},"traffic_direction":"EGRESS","trace_observation_point":"TO_ENDPOINT","trace_reason":"ESTABLISHED","is_reply":false,"interface":{"index":274,"name":"lxc9597970ef466"},"Summary":"TCP Flags: ACK"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:20:17.731307492Z"}
diff --git a/internal/testdata/golden/31-pos-fqdn/options.json b/internal/testdata/golden/31-pos-fqdn/options.json
new file mode 100644
index 0000000..0967ef4
--- /dev/null
+++ b/internal/testdata/golden/31-pos-fqdn/options.json
@@ -0,0 +1 @@
+{}
diff --git a/internal/testdata/golden/32-frontend-all/expected.yaml b/internal/testdata/golden/32-frontend-all/expected.yaml
new file mode 100644
index 0000000..5b5cc71
--- /dev/null
+++ b/internal/testdata/golden/32-frontend-all/expected.yaml
@@ -0,0 +1,30 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: shop-frontend
+  namespace: cf2cnp-lab27
+  labels:
+    app.kubernetes.io/component: frontend
+    app.kubernetes.io/managed-by: cf2cnp
+    app.kubernetes.io/name: shop
+spec:
+  description: 'Allow ingress to shop/frontend in cf2cnp-lab27: from pos on TCP/80; from stranger on TCP/80'
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/component: frontend
+      app.kubernetes.io/name: shop
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            app.kubernetes.io/name: pos
+      toPorts:
+        - ports:
+            - port: "80"
+              protocol: TCP
+    - fromEndpoints:
+        - matchLabels:
+            app.kubernetes.io/name: stranger
+      toPorts:
+        - ports:
+            - port: "80"
+              protocol: TCP
diff --git a/internal/testdata/golden/32-frontend-all/flows.ndjson b/internal/testdata/golden/32-frontend-all/flows.ndjson
new file mode 100644
index 0000000..79b7c57
--- /dev/null
+++ b/internal/testdata/golden/32-frontend-all/flows.ndjson
@@ -0,0 +1,32 @@
+{"flow":{"time":"2026-09-13T11:25:04.000149479Z","uuid":"6e21f7fc-5f7e-4e66-a9a7-3f8069e14ffa","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.60","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":40654,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":815,"identity":98139,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"pos"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","policy_match_type":2,"is_reply":false,"Summary":"TCP Flags: SYN","ingress_allowed_by":[{"name":"shop-frontend","namespace":"cf2cnp-lab27","labels":["k8s:io.cilium.k8s.policy.derived-from=CiliumNetworkPolicy","k8s:io.cilium.k8s.policy.name=shop-frontend","k8s:io.cilium.k8s.policy.namespace=cf2cnp-lab27","k8s:io.cilium.k8s.policy.uid=43d6f2ab-89ab-49b8-923e-18afc8f17fae"],"revision":"56","kind":"CiliumNetworkPolicy"}],"policy_log":[""]},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:25:04.000149479Z"}
+{"flow":{"time":"2026-09-13T11:25:08.910792535Z","uuid":"d65f5420-05ce-47b4-8788-42134b2c6a20","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"DROPPED","drop_reason":133,"ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.238","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":36810,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":1765,"identity":84024,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=stranger","k8s:app=stranger","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"stranger"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","drop_reason_desc":"POLICY_DENIED","Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:25:08.910792535Z"}
+{"flow":{"time":"2026-09-13T11:25:08.910805730Z","uuid":"d7b53c89-ee73-4498-a038-e8e0bdda47cc","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"DROPPED","drop_reason":133,"ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.238","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":36810,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":1765,"identity":84024,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=stranger","k8s:app=stranger","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"stranger"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":1,"sub_type":133},"traffic_direction":"INGRESS","file":{"name":"bpf_lxc.c","line":2412},"drop_reason_desc":"POLICY_DENIED","Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:25:08.910805730Z"}
+{"flow":{"time":"2026-09-13T11:25:09.019558146Z","uuid":"7e3a19f1-9b8e-4bbf-bfc2-d8dbffd79733","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.60","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":40658,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":815,"identity":98139,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"pos"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","policy_match_type":2,"is_reply":false,"Summary":"TCP Flags: SYN","ingress_allowed_by":[{"name":"shop-frontend","namespace":"cf2cnp-lab27","labels":["k8s:io.cilium.k8s.policy.derived-from=CiliumNetworkPolicy","k8s:io.cilium.k8s.policy.name=shop-frontend","k8s:io.cilium.k8s.policy.namespace=cf2cnp-lab27","k8s:io.cilium.k8s.policy.uid=43d6f2ab-89ab-49b8-923e-18afc8f17fae"],"revision":"56","kind":"CiliumNetworkPolicy"}],"policy_log":[""]},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:25:09.019558146Z"}
+{"flow":{"time":"2026-09-13T11:25:09.913199679Z","uuid":"c3f8d294-4893-4538-a4c8-8685312ab021","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"DROPPED","drop_reason":133,"ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.238","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":36810,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":1765,"identity":84024,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=stranger","k8s:app=stranger","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"stranger"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","drop_reason_desc":"POLICY_DENIED","Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:25:09.913199679Z"}
+{"flow":{"time":"2026-09-13T11:25:09.913216744Z","uuid":"cec309e8-673f-444e-a8f6-42a39edb0411","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"DROPPED","drop_reason":133,"ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.238","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":36810,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":1765,"identity":84024,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=stranger","k8s:app=stranger","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"stranger"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":1,"sub_type":133},"traffic_direction":"INGRESS","file":{"name":"bpf_lxc.c","line":2412},"drop_reason_desc":"POLICY_DENIED","Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:25:09.913216744Z"}
+{"flow":{"time":"2026-09-13T11:25:14.038880484Z","uuid":"e364defa-39cc-4d39-ad74-91e3acb33ad8","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.60","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":42980,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":815,"identity":98139,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"pos"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","policy_match_type":2,"is_reply":false,"Summary":"TCP Flags: SYN","ingress_allowed_by":[{"name":"shop-frontend","namespace":"cf2cnp-lab27","labels":["k8s:io.cilium.k8s.policy.derived-from=CiliumNetworkPolicy","k8s:io.cilium.k8s.policy.name=shop-frontend","k8s:io.cilium.k8s.policy.namespace=cf2cnp-lab27","k8s:io.cilium.k8s.policy.uid=43d6f2ab-89ab-49b8-923e-18afc8f17fae"],"revision":"56","kind":"CiliumNetworkPolicy"}],"policy_log":[""]},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:25:14.038880484Z"}
+{"flow":{"time":"2026-09-13T11:25:19.057052995Z","uuid":"d5329b0d-301d-40ef-ae5f-95ab8de785f4","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.60","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":42986,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":815,"identity":98139,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"pos"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","policy_match_type":2,"is_reply":false,"Summary":"TCP Flags: SYN","ingress_allowed_by":[{"name":"shop-frontend","namespace":"cf2cnp-lab27","labels":["k8s:io.cilium.k8s.policy.derived-from=CiliumNetworkPolicy","k8s:io.cilium.k8s.policy.name=shop-frontend","k8s:io.cilium.k8s.policy.namespace=cf2cnp-lab27","k8s:io.cilium.k8s.policy.uid=43d6f2ab-89ab-49b8-923e-18afc8f17fae"],"revision":"56","kind":"CiliumNetworkPolicy"}],"policy_log":[""]},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:25:19.057052995Z"}
+{"flow":{"time":"2026-09-13T11:25:19.943179134Z","uuid":"3fbe23a1-0ac4-4cf9-8cc8-08ae77630e9a","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"DROPPED","drop_reason":133,"ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.238","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":56252,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":1765,"identity":84024,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=stranger","k8s:app=stranger","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"stranger"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","drop_reason_desc":"POLICY_DENIED","Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:25:19.943179134Z"}
+{"flow":{"time":"2026-09-13T11:25:19.943186789Z","uuid":"687ad33e-e130-4a9c-a4aa-8d44e7d55d92","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"DROPPED","drop_reason":133,"ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.238","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":56252,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":1765,"identity":84024,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=stranger","k8s:app=stranger","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"stranger"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":1,"sub_type":133},"traffic_direction":"INGRESS","file":{"name":"bpf_lxc.c","line":2412},"drop_reason_desc":"POLICY_DENIED","Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:25:19.943186789Z"}
+{"flow":{"time":"2026-09-13T11:25:20.986771944Z","uuid":"b5df25e0-e54a-47d9-a6b7-b92cfb893e4d","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"DROPPED","drop_reason":133,"ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.238","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":56252,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":1765,"identity":84024,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=stranger","k8s:app=stranger","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"stranger"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","drop_reason_desc":"POLICY_DENIED","Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:25:20.986771944Z"}
+{"flow":{"time":"2026-09-13T11:25:20.986787316Z","uuid":"5b718f5f-8166-4db5-9121-d73101f28891","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"DROPPED","drop_reason":133,"ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.238","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":56252,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":1765,"identity":84024,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=stranger","k8s:app=stranger","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"stranger"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":1,"sub_type":133},"traffic_direction":"INGRESS","file":{"name":"bpf_lxc.c","line":2412},"drop_reason_desc":"POLICY_DENIED","Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:25:20.986787316Z"}
+{"flow":{"time":"2026-09-13T11:25:24.072756822Z","uuid":"79b36ea0-9f5a-42d1-b208-67c43250c06a","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.60","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":32936,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":815,"identity":98139,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"pos"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","policy_match_type":2,"is_reply":false,"Summary":"TCP Flags: SYN","ingress_allowed_by":[{"name":"shop-frontend","namespace":"cf2cnp-lab27","labels":["k8s:io.cilium.k8s.policy.derived-from=CiliumNetworkPolicy","k8s:io.cilium.k8s.policy.name=shop-frontend","k8s:io.cilium.k8s.policy.namespace=cf2cnp-lab27","k8s:io.cilium.k8s.policy.uid=43d6f2ab-89ab-49b8-923e-18afc8f17fae"],"revision":"56","kind":"CiliumNetworkPolicy"}],"policy_log":[""]},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:25:24.072756822Z"}
+{"flow":{"time":"2026-09-13T11:25:29.088304323Z","uuid":"81ffda11-58cc-4bd6-8aa3-d379f2c79832","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.60","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":32950,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":815,"identity":98139,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"pos"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","policy_match_type":2,"is_reply":false,"Summary":"TCP Flags: SYN","ingress_allowed_by":[{"name":"shop-frontend","namespace":"cf2cnp-lab27","labels":["k8s:io.cilium.k8s.policy.derived-from=CiliumNetworkPolicy","k8s:io.cilium.k8s.policy.name=shop-frontend","k8s:io.cilium.k8s.policy.namespace=cf2cnp-lab27","k8s:io.cilium.k8s.policy.uid=43d6f2ab-89ab-49b8-923e-18afc8f17fae"],"revision":"56","kind":"CiliumNetworkPolicy"}],"policy_log":[""]},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:25:29.088304323Z"}
+{"flow":{"time":"2026-09-13T11:25:30.967419754Z","uuid":"efe30d70-a69b-474d-85b0-645c63753e97","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"DROPPED","drop_reason":133,"ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.238","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":42826,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":1765,"identity":84024,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=stranger","k8s:app=stranger","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"stranger"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","drop_reason_desc":"POLICY_DENIED","Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:25:30.967419754Z"}
+{"flow":{"time":"2026-09-13T11:25:30.967425180Z","uuid":"cdd7e802-e3ca-4fc9-84bb-fe36c452f5d3","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"DROPPED","drop_reason":133,"ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.238","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":42826,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":1765,"identity":84024,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=stranger","k8s:app=stranger","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"stranger"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":1,"sub_type":133},"traffic_direction":"INGRESS","file":{"name":"bpf_lxc.c","line":2412},"drop_reason_desc":"POLICY_DENIED","Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:25:30.967425180Z"}
+{"flow":{"time":"2026-09-13T11:25:31.993775907Z","uuid":"ff1f5d30-93bc-4335-bc9b-da944d515a90","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"DROPPED","drop_reason":133,"ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.238","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":42826,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":1765,"identity":84024,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=stranger","k8s:app=stranger","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"stranger"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","drop_reason_desc":"POLICY_DENIED","Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:25:31.993775907Z"}
+{"flow":{"time":"2026-09-13T11:25:31.993783731Z","uuid":"eb8e0191-2d8e-4519-bcec-5be77bed5d10","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"DROPPED","drop_reason":133,"ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.238","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":42826,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":1765,"identity":84024,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=stranger","k8s:app=stranger","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"stranger"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":1,"sub_type":133},"traffic_direction":"INGRESS","file":{"name":"bpf_lxc.c","line":2412},"drop_reason_desc":"POLICY_DENIED","Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:25:31.993783731Z"}
+{"flow":{"time":"2026-09-13T11:25:34.102682332Z","uuid":"7a3a0050-a44c-4707-a2a7-bf3d0f046b83","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.60","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":52248,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":815,"identity":98139,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"pos"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","policy_match_type":2,"is_reply":false,"Summary":"TCP Flags: SYN","ingress_allowed_by":[{"name":"shop-frontend","namespace":"cf2cnp-lab27","labels":["k8s:io.cilium.k8s.policy.derived-from=CiliumNetworkPolicy","k8s:io.cilium.k8s.policy.name=shop-frontend","k8s:io.cilium.k8s.policy.namespace=cf2cnp-lab27","k8s:io.cilium.k8s.policy.uid=43d6f2ab-89ab-49b8-923e-18afc8f17fae"],"revision":"56","kind":"CiliumNetworkPolicy"}],"policy_log":[""]},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:25:34.102682332Z"}
+{"flow":{"time":"2026-09-13T11:25:39.118719891Z","uuid":"6890816a-7f55-40fd-8f66-15686682d1f9","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.60","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":52264,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":815,"identity":98139,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"pos"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","policy_match_type":2,"is_reply":false,"Summary":"TCP Flags: SYN","ingress_allowed_by":[{"name":"shop-frontend","namespace":"cf2cnp-lab27","labels":["k8s:io.cilium.k8s.policy.derived-from=CiliumNetworkPolicy","k8s:io.cilium.k8s.policy.name=shop-frontend","k8s:io.cilium.k8s.policy.namespace=cf2cnp-lab27","k8s:io.cilium.k8s.policy.uid=43d6f2ab-89ab-49b8-923e-18afc8f17fae"],"revision":"56","kind":"CiliumNetworkPolicy"}],"policy_log":[""]},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:25:39.118719891Z"}
+{"flow":{"time":"2026-09-13T11:25:41.996469028Z","uuid":"e0ca8be1-d594-483e-85ac-d71c5c648532","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"DROPPED","drop_reason":133,"ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.238","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":34012,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":1765,"identity":84024,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=stranger","k8s:app=stranger","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"stranger"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","drop_reason_desc":"POLICY_DENIED","Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:25:41.996469028Z"}
+{"flow":{"time":"2026-09-13T11:25:41.996477892Z","uuid":"df6e5156-2e3e-40e8-9e0d-78c477f0d7f1","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"DROPPED","drop_reason":133,"ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.238","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":34012,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":1765,"identity":84024,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=stranger","k8s:app=stranger","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"stranger"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":1,"sub_type":133},"traffic_direction":"INGRESS","file":{"name":"bpf_lxc.c","line":2412},"drop_reason_desc":"POLICY_DENIED","Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:25:41.996477892Z"}
+{"flow":{"time":"2026-09-13T11:25:43.001499419Z","uuid":"7dbb4619-3c65-49c7-a5f2-76e2f63dcbaf","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"DROPPED","drop_reason":133,"ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.238","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":34012,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":1765,"identity":84024,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=stranger","k8s:app=stranger","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"stranger"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","drop_reason_desc":"POLICY_DENIED","Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:25:43.001499419Z"}
+{"flow":{"time":"2026-09-13T11:25:43.001511534Z","uuid":"5e6ee843-2bd6-4cbc-81b6-74f42ba5f8dc","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"DROPPED","drop_reason":133,"ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.238","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":34012,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":1765,"identity":84024,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=stranger","k8s:app=stranger","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"stranger"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":1,"sub_type":133},"traffic_direction":"INGRESS","file":{"name":"bpf_lxc.c","line":2412},"drop_reason_desc":"POLICY_DENIED","Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:25:43.001511534Z"}
+{"flow":{"time":"2026-09-13T11:25:44.135582843Z","uuid":"46cb05b7-d446-4178-9e9e-d7b90682ebac","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.60","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":48818,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":815,"identity":98139,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"pos"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","policy_match_type":2,"is_reply":false,"Summary":"TCP Flags: SYN","ingress_allowed_by":[{"name":"shop-frontend","namespace":"cf2cnp-lab27","labels":["k8s:io.cilium.k8s.policy.derived-from=CiliumNetworkPolicy","k8s:io.cilium.k8s.policy.name=shop-frontend","k8s:io.cilium.k8s.policy.namespace=cf2cnp-lab27","k8s:io.cilium.k8s.policy.uid=43d6f2ab-89ab-49b8-923e-18afc8f17fae"],"revision":"56","kind":"CiliumNetworkPolicy"}],"policy_log":[""]},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:25:44.135582843Z"}
+{"flow":{"time":"2026-09-13T11:25:49.150317820Z","uuid":"496cc55e-3c06-4d4e-9bbd-9e3e8408eff8","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.60","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":48826,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":815,"identity":98139,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"pos"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","policy_match_type":2,"is_reply":false,"Summary":"TCP Flags: SYN","ingress_allowed_by":[{"name":"shop-frontend","namespace":"cf2cnp-lab27","labels":["k8s:io.cilium.k8s.policy.derived-from=CiliumNetworkPolicy","k8s:io.cilium.k8s.policy.name=shop-frontend","k8s:io.cilium.k8s.policy.namespace=cf2cnp-lab27","k8s:io.cilium.k8s.policy.uid=43d6f2ab-89ab-49b8-923e-18afc8f17fae"],"revision":"56","kind":"CiliumNetworkPolicy"}],"policy_log":[""]},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:25:49.150317820Z"}
+{"flow":{"time":"2026-09-13T11:25:53.021827597Z","uuid":"9879d653-1ae9-41cf-ab1d-7b987986cf90","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"DROPPED","drop_reason":133,"ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.238","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":35370,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":1765,"identity":84024,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=stranger","k8s:app=stranger","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"stranger"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","drop_reason_desc":"POLICY_DENIED","Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:25:53.021827597Z"}
+{"flow":{"time":"2026-09-13T11:25:53.021832302Z","uuid":"7dcb835e-9cac-4411-aa2b-47acc7f0f53b","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"DROPPED","drop_reason":133,"ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.238","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":35370,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":1765,"identity":84024,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=stranger","k8s:app=stranger","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"stranger"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":1,"sub_type":133},"traffic_direction":"INGRESS","file":{"name":"bpf_lxc.c","line":2412},"drop_reason_desc":"POLICY_DENIED","Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:25:53.021832302Z"}
+{"flow":{"time":"2026-09-13T11:25:54.073461419Z","uuid":"b3f1c0de-5c4e-42db-8b2b-a1c618188c8e","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"DROPPED","drop_reason":133,"ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.238","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":35370,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":1765,"identity":84024,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=stranger","k8s:app=stranger","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"stranger"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","drop_reason_desc":"POLICY_DENIED","Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:25:54.073461419Z"}
+{"flow":{"time":"2026-09-13T11:25:54.073485655Z","uuid":"69a8c164-2036-4272-b47f-726a512ee318","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"DROPPED","drop_reason":133,"ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.238","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":35370,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":1765,"identity":84024,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=stranger","k8s:app=stranger","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"stranger"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":1,"sub_type":133},"traffic_direction":"INGRESS","file":{"name":"bpf_lxc.c","line":2412},"drop_reason_desc":"POLICY_DENIED","Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:25:54.073485655Z"}
+{"flow":{"time":"2026-09-13T11:25:54.164728398Z","uuid":"7c9a7be4-d9e7-40e2-8004-60b0b31801a5","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.60","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":60898,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":815,"identity":98139,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"pos"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","policy_match_type":2,"is_reply":false,"Summary":"TCP Flags: SYN","ingress_allowed_by":[{"name":"shop-frontend","namespace":"cf2cnp-lab27","labels":["k8s:io.cilium.k8s.policy.derived-from=CiliumNetworkPolicy","k8s:io.cilium.k8s.policy.name=shop-frontend","k8s:io.cilium.k8s.policy.namespace=cf2cnp-lab27","k8s:io.cilium.k8s.policy.uid=43d6f2ab-89ab-49b8-923e-18afc8f17fae"],"revision":"56","kind":"CiliumNetworkPolicy"}],"policy_log":[""]},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:25:54.164728398Z"}
+{"flow":{"time":"2026-09-13T11:25:59.181954141Z","uuid":"79c87883-0c8c-447b-b7e1-2f20a596aa89","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.60","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":60912,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":815,"identity":98139,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"pos"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","policy_match_type":2,"is_reply":false,"Summary":"TCP Flags: SYN","ingress_allowed_by":[{"name":"shop-frontend","namespace":"cf2cnp-lab27","labels":["k8s:io.cilium.k8s.policy.derived-from=CiliumNetworkPolicy","k8s:io.cilium.k8s.policy.name=shop-frontend","k8s:io.cilium.k8s.policy.namespace=cf2cnp-lab27","k8s:io.cilium.k8s.policy.uid=43d6f2ab-89ab-49b8-923e-18afc8f17fae"],"revision":"56","kind":"CiliumNetworkPolicy"}],"policy_log":[""]},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:25:59.181954141Z"}
diff --git a/internal/testdata/golden/32-frontend-all/options.json b/internal/testdata/golden/32-frontend-all/options.json
new file mode 100644
index 0000000..0967ef4
--- /dev/null
+++ b/internal/testdata/golden/32-frontend-all/options.json
@@ -0,0 +1 @@
+{}
diff --git a/internal/testdata/golden/32-frontend-exclude-stranger/expected.yaml b/internal/testdata/golden/32-frontend-exclude-stranger/expected.yaml
new file mode 100644
index 0000000..4008326
--- /dev/null
+++ b/internal/testdata/golden/32-frontend-exclude-stranger/expected.yaml
@@ -0,0 +1,23 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: shop-frontend
+  namespace: cf2cnp-lab27
+  labels:
+    app.kubernetes.io/component: frontend
+    app.kubernetes.io/managed-by: cf2cnp
+    app.kubernetes.io/name: shop
+spec:
+  description: 'Allow ingress to shop/frontend in cf2cnp-lab27: from pos on TCP/80'
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/component: frontend
+      app.kubernetes.io/name: shop
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            app.kubernetes.io/name: pos
+      toPorts:
+        - ports:
+            - port: "80"
+              protocol: TCP
diff --git a/internal/testdata/golden/32-frontend-exclude-stranger/flows.ndjson b/internal/testdata/golden/32-frontend-exclude-stranger/flows.ndjson
new file mode 100644
index 0000000..79b7c57
--- /dev/null
+++ b/internal/testdata/golden/32-frontend-exclude-stranger/flows.ndjson
@@ -0,0 +1,32 @@
+{"flow":{"time":"2026-09-13T11:25:04.000149479Z","uuid":"6e21f7fc-5f7e-4e66-a9a7-3f8069e14ffa","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.60","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":40654,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":815,"identity":98139,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"pos"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","policy_match_type":2,"is_reply":false,"Summary":"TCP Flags: SYN","ingress_allowed_by":[{"name":"shop-frontend","namespace":"cf2cnp-lab27","labels":["k8s:io.cilium.k8s.policy.derived-from=CiliumNetworkPolicy","k8s:io.cilium.k8s.policy.name=shop-frontend","k8s:io.cilium.k8s.policy.namespace=cf2cnp-lab27","k8s:io.cilium.k8s.policy.uid=43d6f2ab-89ab-49b8-923e-18afc8f17fae"],"revision":"56","kind":"CiliumNetworkPolicy"}],"policy_log":[""]},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:25:04.000149479Z"}
+{"flow":{"time":"2026-09-13T11:25:08.910792535Z","uuid":"d65f5420-05ce-47b4-8788-42134b2c6a20","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"DROPPED","drop_reason":133,"ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.238","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":36810,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":1765,"identity":84024,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=stranger","k8s:app=stranger","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"stranger"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","drop_reason_desc":"POLICY_DENIED","Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:25:08.910792535Z"}
+{"flow":{"time":"2026-09-13T11:25:08.910805730Z","uuid":"d7b53c89-ee73-4498-a038-e8e0bdda47cc","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"DROPPED","drop_reason":133,"ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.238","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":36810,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":1765,"identity":84024,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=stranger","k8s:app=stranger","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"stranger"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":1,"sub_type":133},"traffic_direction":"INGRESS","file":{"name":"bpf_lxc.c","line":2412},"drop_reason_desc":"POLICY_DENIED","Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:25:08.910805730Z"}
+{"flow":{"time":"2026-09-13T11:25:09.019558146Z","uuid":"7e3a19f1-9b8e-4bbf-bfc2-d8dbffd79733","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.60","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":40658,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":815,"identity":98139,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"pos"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","policy_match_type":2,"is_reply":false,"Summary":"TCP Flags: SYN","ingress_allowed_by":[{"name":"shop-frontend","namespace":"cf2cnp-lab27","labels":["k8s:io.cilium.k8s.policy.derived-from=CiliumNetworkPolicy","k8s:io.cilium.k8s.policy.name=shop-frontend","k8s:io.cilium.k8s.policy.namespace=cf2cnp-lab27","k8s:io.cilium.k8s.policy.uid=43d6f2ab-89ab-49b8-923e-18afc8f17fae"],"revision":"56","kind":"CiliumNetworkPolicy"}],"policy_log":[""]},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:25:09.019558146Z"}
+{"flow":{"time":"2026-09-13T11:25:09.913199679Z","uuid":"c3f8d294-4893-4538-a4c8-8685312ab021","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"DROPPED","drop_reason":133,"ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.238","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":36810,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":1765,"identity":84024,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=stranger","k8s:app=stranger","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"stranger"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","drop_reason_desc":"POLICY_DENIED","Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:25:09.913199679Z"}
+{"flow":{"time":"2026-09-13T11:25:09.913216744Z","uuid":"cec309e8-673f-444e-a8f6-42a39edb0411","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"DROPPED","drop_reason":133,"ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.238","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":36810,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":1765,"identity":84024,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=stranger","k8s:app=stranger","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"stranger"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":1,"sub_type":133},"traffic_direction":"INGRESS","file":{"name":"bpf_lxc.c","line":2412},"drop_reason_desc":"POLICY_DENIED","Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:25:09.913216744Z"}
+{"flow":{"time":"2026-09-13T11:25:14.038880484Z","uuid":"e364defa-39cc-4d39-ad74-91e3acb33ad8","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.60","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":42980,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":815,"identity":98139,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"pos"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","policy_match_type":2,"is_reply":false,"Summary":"TCP Flags: SYN","ingress_allowed_by":[{"name":"shop-frontend","namespace":"cf2cnp-lab27","labels":["k8s:io.cilium.k8s.policy.derived-from=CiliumNetworkPolicy","k8s:io.cilium.k8s.policy.name=shop-frontend","k8s:io.cilium.k8s.policy.namespace=cf2cnp-lab27","k8s:io.cilium.k8s.policy.uid=43d6f2ab-89ab-49b8-923e-18afc8f17fae"],"revision":"56","kind":"CiliumNetworkPolicy"}],"policy_log":[""]},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:25:14.038880484Z"}
+{"flow":{"time":"2026-09-13T11:25:19.057052995Z","uuid":"d5329b0d-301d-40ef-ae5f-95ab8de785f4","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.60","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":42986,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":815,"identity":98139,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"pos"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","policy_match_type":2,"is_reply":false,"Summary":"TCP Flags: SYN","ingress_allowed_by":[{"name":"shop-frontend","namespace":"cf2cnp-lab27","labels":["k8s:io.cilium.k8s.policy.derived-from=CiliumNetworkPolicy","k8s:io.cilium.k8s.policy.name=shop-frontend","k8s:io.cilium.k8s.policy.namespace=cf2cnp-lab27","k8s:io.cilium.k8s.policy.uid=43d6f2ab-89ab-49b8-923e-18afc8f17fae"],"revision":"56","kind":"CiliumNetworkPolicy"}],"policy_log":[""]},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:25:19.057052995Z"}
+{"flow":{"time":"2026-09-13T11:25:19.943179134Z","uuid":"3fbe23a1-0ac4-4cf9-8cc8-08ae77630e9a","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"DROPPED","drop_reason":133,"ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.238","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":56252,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":1765,"identity":84024,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=stranger","k8s:app=stranger","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"stranger"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","drop_reason_desc":"POLICY_DENIED","Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:25:19.943179134Z"}
+{"flow":{"time":"2026-09-13T11:25:19.943186789Z","uuid":"687ad33e-e130-4a9c-a4aa-8d44e7d55d92","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"DROPPED","drop_reason":133,"ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.238","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":56252,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":1765,"identity":84024,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=stranger","k8s:app=stranger","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"stranger"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":1,"sub_type":133},"traffic_direction":"INGRESS","file":{"name":"bpf_lxc.c","line":2412},"drop_reason_desc":"POLICY_DENIED","Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:25:19.943186789Z"}
+{"flow":{"time":"2026-09-13T11:25:20.986771944Z","uuid":"b5df25e0-e54a-47d9-a6b7-b92cfb893e4d","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"DROPPED","drop_reason":133,"ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.238","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":56252,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":1765,"identity":84024,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=stranger","k8s:app=stranger","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"stranger"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","drop_reason_desc":"POLICY_DENIED","Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:25:20.986771944Z"}
+{"flow":{"time":"2026-09-13T11:25:20.986787316Z","uuid":"5b718f5f-8166-4db5-9121-d73101f28891","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"DROPPED","drop_reason":133,"ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.238","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":56252,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":1765,"identity":84024,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=stranger","k8s:app=stranger","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"stranger"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":1,"sub_type":133},"traffic_direction":"INGRESS","file":{"name":"bpf_lxc.c","line":2412},"drop_reason_desc":"POLICY_DENIED","Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:25:20.986787316Z"}
+{"flow":{"time":"2026-09-13T11:25:24.072756822Z","uuid":"79b36ea0-9f5a-42d1-b208-67c43250c06a","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.60","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":32936,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":815,"identity":98139,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"pos"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","policy_match_type":2,"is_reply":false,"Summary":"TCP Flags: SYN","ingress_allowed_by":[{"name":"shop-frontend","namespace":"cf2cnp-lab27","labels":["k8s:io.cilium.k8s.policy.derived-from=CiliumNetworkPolicy","k8s:io.cilium.k8s.policy.name=shop-frontend","k8s:io.cilium.k8s.policy.namespace=cf2cnp-lab27","k8s:io.cilium.k8s.policy.uid=43d6f2ab-89ab-49b8-923e-18afc8f17fae"],"revision":"56","kind":"CiliumNetworkPolicy"}],"policy_log":[""]},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:25:24.072756822Z"}
+{"flow":{"time":"2026-09-13T11:25:29.088304323Z","uuid":"81ffda11-58cc-4bd6-8aa3-d379f2c79832","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.60","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":32950,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":815,"identity":98139,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"pos"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","policy_match_type":2,"is_reply":false,"Summary":"TCP Flags: SYN","ingress_allowed_by":[{"name":"shop-frontend","namespace":"cf2cnp-lab27","labels":["k8s:io.cilium.k8s.policy.derived-from=CiliumNetworkPolicy","k8s:io.cilium.k8s.policy.name=shop-frontend","k8s:io.cilium.k8s.policy.namespace=cf2cnp-lab27","k8s:io.cilium.k8s.policy.uid=43d6f2ab-89ab-49b8-923e-18afc8f17fae"],"revision":"56","kind":"CiliumNetworkPolicy"}],"policy_log":[""]},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:25:29.088304323Z"}
+{"flow":{"time":"2026-09-13T11:25:30.967419754Z","uuid":"efe30d70-a69b-474d-85b0-645c63753e97","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"DROPPED","drop_reason":133,"ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.238","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":42826,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":1765,"identity":84024,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=stranger","k8s:app=stranger","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"stranger"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","drop_reason_desc":"POLICY_DENIED","Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:25:30.967419754Z"}
+{"flow":{"time":"2026-09-13T11:25:30.967425180Z","uuid":"cdd7e802-e3ca-4fc9-84bb-fe36c452f5d3","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"DROPPED","drop_reason":133,"ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.238","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":42826,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":1765,"identity":84024,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=stranger","k8s:app=stranger","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"stranger"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":1,"sub_type":133},"traffic_direction":"INGRESS","file":{"name":"bpf_lxc.c","line":2412},"drop_reason_desc":"POLICY_DENIED","Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:25:30.967425180Z"}
+{"flow":{"time":"2026-09-13T11:25:31.993775907Z","uuid":"ff1f5d30-93bc-4335-bc9b-da944d515a90","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"DROPPED","drop_reason":133,"ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.238","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":42826,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":1765,"identity":84024,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=stranger","k8s:app=stranger","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"stranger"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","drop_reason_desc":"POLICY_DENIED","Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:25:31.993775907Z"}
+{"flow":{"time":"2026-09-13T11:25:31.993783731Z","uuid":"eb8e0191-2d8e-4519-bcec-5be77bed5d10","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"DROPPED","drop_reason":133,"ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.238","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":42826,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":1765,"identity":84024,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=stranger","k8s:app=stranger","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"stranger"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":1,"sub_type":133},"traffic_direction":"INGRESS","file":{"name":"bpf_lxc.c","line":2412},"drop_reason_desc":"POLICY_DENIED","Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:25:31.993783731Z"}
+{"flow":{"time":"2026-09-13T11:25:34.102682332Z","uuid":"7a3a0050-a44c-4707-a2a7-bf3d0f046b83","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.60","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":52248,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":815,"identity":98139,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"pos"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","policy_match_type":2,"is_reply":false,"Summary":"TCP Flags: SYN","ingress_allowed_by":[{"name":"shop-frontend","namespace":"cf2cnp-lab27","labels":["k8s:io.cilium.k8s.policy.derived-from=CiliumNetworkPolicy","k8s:io.cilium.k8s.policy.name=shop-frontend","k8s:io.cilium.k8s.policy.namespace=cf2cnp-lab27","k8s:io.cilium.k8s.policy.uid=43d6f2ab-89ab-49b8-923e-18afc8f17fae"],"revision":"56","kind":"CiliumNetworkPolicy"}],"policy_log":[""]},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:25:34.102682332Z"}
+{"flow":{"time":"2026-09-13T11:25:39.118719891Z","uuid":"6890816a-7f55-40fd-8f66-15686682d1f9","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.60","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":52264,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":815,"identity":98139,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"pos"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","policy_match_type":2,"is_reply":false,"Summary":"TCP Flags: SYN","ingress_allowed_by":[{"name":"shop-frontend","namespace":"cf2cnp-lab27","labels":["k8s:io.cilium.k8s.policy.derived-from=CiliumNetworkPolicy","k8s:io.cilium.k8s.policy.name=shop-frontend","k8s:io.cilium.k8s.policy.namespace=cf2cnp-lab27","k8s:io.cilium.k8s.policy.uid=43d6f2ab-89ab-49b8-923e-18afc8f17fae"],"revision":"56","kind":"CiliumNetworkPolicy"}],"policy_log":[""]},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:25:39.118719891Z"}
+{"flow":{"time":"2026-09-13T11:25:41.996469028Z","uuid":"e0ca8be1-d594-483e-85ac-d71c5c648532","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"DROPPED","drop_reason":133,"ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.238","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":34012,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":1765,"identity":84024,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=stranger","k8s:app=stranger","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"stranger"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","drop_reason_desc":"POLICY_DENIED","Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:25:41.996469028Z"}
+{"flow":{"time":"2026-09-13T11:25:41.996477892Z","uuid":"df6e5156-2e3e-40e8-9e0d-78c477f0d7f1","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"DROPPED","drop_reason":133,"ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.238","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":34012,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":1765,"identity":84024,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=stranger","k8s:app=stranger","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"stranger"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":1,"sub_type":133},"traffic_direction":"INGRESS","file":{"name":"bpf_lxc.c","line":2412},"drop_reason_desc":"POLICY_DENIED","Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:25:41.996477892Z"}
+{"flow":{"time":"2026-09-13T11:25:43.001499419Z","uuid":"7dbb4619-3c65-49c7-a5f2-76e2f63dcbaf","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"DROPPED","drop_reason":133,"ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.238","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":34012,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":1765,"identity":84024,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=stranger","k8s:app=stranger","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"stranger"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","drop_reason_desc":"POLICY_DENIED","Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:25:43.001499419Z"}
+{"flow":{"time":"2026-09-13T11:25:43.001511534Z","uuid":"5e6ee843-2bd6-4cbc-81b6-74f42ba5f8dc","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"DROPPED","drop_reason":133,"ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.238","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":34012,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":1765,"identity":84024,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=stranger","k8s:app=stranger","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"stranger"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":1,"sub_type":133},"traffic_direction":"INGRESS","file":{"name":"bpf_lxc.c","line":2412},"drop_reason_desc":"POLICY_DENIED","Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:25:43.001511534Z"}
+{"flow":{"time":"2026-09-13T11:25:44.135582843Z","uuid":"46cb05b7-d446-4178-9e9e-d7b90682ebac","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.60","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":48818,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":815,"identity":98139,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"pos"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","policy_match_type":2,"is_reply":false,"Summary":"TCP Flags: SYN","ingress_allowed_by":[{"name":"shop-frontend","namespace":"cf2cnp-lab27","labels":["k8s:io.cilium.k8s.policy.derived-from=CiliumNetworkPolicy","k8s:io.cilium.k8s.policy.name=shop-frontend","k8s:io.cilium.k8s.policy.namespace=cf2cnp-lab27","k8s:io.cilium.k8s.policy.uid=43d6f2ab-89ab-49b8-923e-18afc8f17fae"],"revision":"56","kind":"CiliumNetworkPolicy"}],"policy_log":[""]},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:25:44.135582843Z"}
+{"flow":{"time":"2026-09-13T11:25:49.150317820Z","uuid":"496cc55e-3c06-4d4e-9bbd-9e3e8408eff8","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.60","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":48826,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":815,"identity":98139,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"pos"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","policy_match_type":2,"is_reply":false,"Summary":"TCP Flags: SYN","ingress_allowed_by":[{"name":"shop-frontend","namespace":"cf2cnp-lab27","labels":["k8s:io.cilium.k8s.policy.derived-from=CiliumNetworkPolicy","k8s:io.cilium.k8s.policy.name=shop-frontend","k8s:io.cilium.k8s.policy.namespace=cf2cnp-lab27","k8s:io.cilium.k8s.policy.uid=43d6f2ab-89ab-49b8-923e-18afc8f17fae"],"revision":"56","kind":"CiliumNetworkPolicy"}],"policy_log":[""]},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:25:49.150317820Z"}
+{"flow":{"time":"2026-09-13T11:25:53.021827597Z","uuid":"9879d653-1ae9-41cf-ab1d-7b987986cf90","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"DROPPED","drop_reason":133,"ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.238","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":35370,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":1765,"identity":84024,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=stranger","k8s:app=stranger","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"stranger"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","drop_reason_desc":"POLICY_DENIED","Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:25:53.021827597Z"}
+{"flow":{"time":"2026-09-13T11:25:53.021832302Z","uuid":"7dcb835e-9cac-4411-aa2b-47acc7f0f53b","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"DROPPED","drop_reason":133,"ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.238","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":35370,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":1765,"identity":84024,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=stranger","k8s:app=stranger","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"stranger"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":1,"sub_type":133},"traffic_direction":"INGRESS","file":{"name":"bpf_lxc.c","line":2412},"drop_reason_desc":"POLICY_DENIED","Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:25:53.021832302Z"}
+{"flow":{"time":"2026-09-13T11:25:54.073461419Z","uuid":"b3f1c0de-5c4e-42db-8b2b-a1c618188c8e","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"DROPPED","drop_reason":133,"ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.238","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":35370,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":1765,"identity":84024,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=stranger","k8s:app=stranger","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"stranger"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","drop_reason_desc":"POLICY_DENIED","Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:25:54.073461419Z"}
+{"flow":{"time":"2026-09-13T11:25:54.073485655Z","uuid":"69a8c164-2036-4272-b47f-726a512ee318","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"DROPPED","drop_reason":133,"ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.238","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":35370,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":1765,"identity":84024,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=stranger","k8s:app=stranger","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"stranger"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":1,"sub_type":133},"traffic_direction":"INGRESS","file":{"name":"bpf_lxc.c","line":2412},"drop_reason_desc":"POLICY_DENIED","Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:25:54.073485655Z"}
+{"flow":{"time":"2026-09-13T11:25:54.164728398Z","uuid":"7c9a7be4-d9e7-40e2-8004-60b0b31801a5","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.60","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":60898,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":815,"identity":98139,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"pos"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","policy_match_type":2,"is_reply":false,"Summary":"TCP Flags: SYN","ingress_allowed_by":[{"name":"shop-frontend","namespace":"cf2cnp-lab27","labels":["k8s:io.cilium.k8s.policy.derived-from=CiliumNetworkPolicy","k8s:io.cilium.k8s.policy.name=shop-frontend","k8s:io.cilium.k8s.policy.namespace=cf2cnp-lab27","k8s:io.cilium.k8s.policy.uid=43d6f2ab-89ab-49b8-923e-18afc8f17fae"],"revision":"56","kind":"CiliumNetworkPolicy"}],"policy_log":[""]},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:25:54.164728398Z"}
+{"flow":{"time":"2026-09-13T11:25:59.181954141Z","uuid":"79c87883-0c8c-447b-b7e1-2f20a596aa89","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"FORWARDED","ethernet":{"source":"16:c3:99:2c:8b:f8","destination":"12:d9:0b:35:b6:9e"},"IP":{"source":"10.10.3.60","destination":"10.10.3.20","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":60912,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":815,"identity":98139,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"pos"},"destination":{"ID":1531,"identity":100916,"cluster_name":"poc1","namespace":"cf2cnp-lab27","labels":["k8s:app.kubernetes.io/component=frontend","k8s:app.kubernetes.io/name=shop","k8s:app=shop-frontend","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab27","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab27"],"pod_name":"shop-frontend-7c78889d59-dgl9d","workloads":[{"name":"shop-frontend","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","policy_match_type":2,"is_reply":false,"Summary":"TCP Flags: SYN","ingress_allowed_by":[{"name":"shop-frontend","namespace":"cf2cnp-lab27","labels":["k8s:io.cilium.k8s.policy.derived-from=CiliumNetworkPolicy","k8s:io.cilium.k8s.policy.name=shop-frontend","k8s:io.cilium.k8s.policy.namespace=cf2cnp-lab27","k8s:io.cilium.k8s.policy.uid=43d6f2ab-89ab-49b8-923e-18afc8f17fae"],"revision":"56","kind":"CiliumNetworkPolicy"}],"policy_log":[""]},"node_name":"poc1/poc1-worker2","time":"2026-09-13T11:25:59.181954141Z"}
diff --git a/internal/testdata/golden/32-frontend-exclude-stranger/options.json b/internal/testdata/golden/32-frontend-exclude-stranger/options.json
new file mode 100644
index 0000000..3ebda08
--- /dev/null
+++ b/internal/testdata/golden/32-frontend-exclude-stranger/options.json
@@ -0,0 +1 @@
+{"exclude": "app.kubernetes.io/name=stranger"}
diff --git a/internal/testdata/golden/35-shop-platform/expected.yaml b/internal/testdata/golden/35-shop-platform/expected.yaml
new file mode 100644
index 0000000..8e36530
--- /dev/null
+++ b/internal/testdata/golden/35-shop-platform/expected.yaml
@@ -0,0 +1,175 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: api-gateway
+  namespace: shop-edge
+  labels:
+    app.kubernetes.io/managed-by: cf2cnp
+    app.kubernetes.io/name: api-gateway
+spec:
+  description: 'Allow ingress to api-gateway in shop-edge: from shopper in shop-clients on TCP/80'
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: api-gateway
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            app.kubernetes.io/name: shopper
+            io.kubernetes.pod.namespace: shop-clients
+      toPorts:
+        - ports:
+            - port: "80"
+              protocol: TCP
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: catalog
+  namespace: shop-core
+  labels:
+    app.kubernetes.io/managed-by: cf2cnp
+    app.kubernetes.io/name: catalog
+spec:
+  description: 'Allow ingress to catalog in shop-core: from orders on TCP/80; from api-gateway in shop-edge on TCP/80; from merchant in shop-merchant on TCP/80; from reviews in shop-reviews on TCP/80'
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: catalog
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            app.kubernetes.io/name: orders
+      toPorts:
+        - ports:
+            - port: "80"
+              protocol: TCP
+    - fromEndpoints:
+        - matchLabels:
+            app.kubernetes.io/name: api-gateway
+            io.kubernetes.pod.namespace: shop-edge
+      toPorts:
+        - ports:
+            - port: "80"
+              protocol: TCP
+    - fromEndpoints:
+        - matchLabels:
+            app.kubernetes.io/name: merchant
+            io.kubernetes.pod.namespace: shop-merchant
+      toPorts:
+        - ports:
+            - port: "80"
+              protocol: TCP
+    - fromEndpoints:
+        - matchLabels:
+            app.kubernetes.io/name: reviews
+            io.kubernetes.pod.namespace: shop-reviews
+      toPorts:
+        - ports:
+            - port: "80"
+              protocol: TCP
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: payment-gateway
+  namespace: shop-payments
+  labels:
+    app.kubernetes.io/managed-by: cf2cnp
+    app.kubernetes.io/name: payment-gateway
+spec:
+  description: 'Allow ingress to payment-gateway in shop-payments: from orders in shop-core on TCP/80; from api-gateway in shop-edge on TCP/80'
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: payment-gateway
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            app.kubernetes.io/name: orders
+            io.kubernetes.pod.namespace: shop-core
+      toPorts:
+        - ports:
+            - port: "80"
+              protocol: TCP
+    - fromEndpoints:
+        - matchLabels:
+            app.kubernetes.io/name: api-gateway
+            io.kubernetes.pod.namespace: shop-edge
+      toPorts:
+        - ports:
+            - port: "80"
+              protocol: TCP
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: orders
+  namespace: shop-core
+  labels:
+    app.kubernetes.io/managed-by: cf2cnp
+    app.kubernetes.io/name: orders
+spec:
+  description: 'Allow ingress to orders in shop-core: from api-gateway in shop-edge on TCP/80'
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: orders
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            app.kubernetes.io/name: api-gateway
+            io.kubernetes.pod.namespace: shop-edge
+      toPorts:
+        - ports:
+            - port: "80"
+              protocol: TCP
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: reviews
+  namespace: shop-reviews
+  labels:
+    app.kubernetes.io/managed-by: cf2cnp
+    app.kubernetes.io/name: reviews
+spec:
+  description: 'Allow ingress to reviews in shop-reviews: from api-gateway in shop-edge on TCP/80; from ratings on TCP/80'
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: reviews
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            app.kubernetes.io/name: api-gateway
+            io.kubernetes.pod.namespace: shop-edge
+      toPorts:
+        - ports:
+            - port: "80"
+              protocol: TCP
+    - fromEndpoints:
+        - matchLabels:
+            app.kubernetes.io/name: ratings
+      toPorts:
+        - ports:
+            - port: "80"
+              protocol: TCP
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: merchant
+  namespace: shop-merchant
+  labels:
+    app.kubernetes.io/managed-by: cf2cnp
+    app.kubernetes.io/name: merchant
+spec:
+  description: 'Allow ingress to merchant in shop-merchant: from payment-gateway in shop-payments on TCP/80'
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: merchant
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            app.kubernetes.io/name: payment-gateway
+            io.kubernetes.pod.namespace: shop-payments
+      toPorts:
+        - ports:
+            - port: "80"
+              protocol: TCP
diff --git a/internal/testdata/golden/35-shop-platform/flows.ndjson b/internal/testdata/golden/35-shop-platform/flows.ndjson
new file mode 100644
index 0000000..d7e474f
--- /dev/null
+++ b/internal/testdata/golden/35-shop-platform/flows.ndjson
@@ -0,0 +1,85 @@
+{"flow":{"time":"2026-09-13T14:43:50.263381540Z","uuid":"d23c7d1b-f3bb-44e4-aea8-74498d72135c","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"86:75:fa:35:d9:5b","destination":"92:4b:f1:eb:2f:c0"},"IP":{"source":"10.10.4.12","destination":"10.10.4.192","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":52682,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":616,"identity":78188,"cluster_name":"poc1","namespace":"shop-clients","labels":["k8s:app.kubernetes.io/name=shopper","k8s:app=shopper","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-clients","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-clients"],"pod_name":"shopper"},"destination":{"ID":89,"identity":90295,"cluster_name":"poc1","namespace":"shop-edge","labels":["k8s:app.kubernetes.io/name=api-gateway","k8s:app.kubernetes.io/part-of=shop","k8s:app=api-gateway","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-edge","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-edge"],"pod_name":"api-gateway-7d77448bf5-g59cc","workloads":[{"name":"api-gateway","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:43:50.263381540Z"}
+{"flow":{"time":"2026-09-13T14:43:50.280775520Z","uuid":"c4ec89ab-99ec-4810-81ab-7d1a2133d33b","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"86:75:fa:35:d9:5b","destination":"92:4b:f1:eb:2f:c0"},"IP":{"source":"10.10.4.12","destination":"10.10.4.192","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":52694,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":616,"identity":78188,"cluster_name":"poc1","namespace":"shop-clients","labels":["k8s:app.kubernetes.io/name=shopper","k8s:app=shopper","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-clients","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-clients"],"pod_name":"shopper"},"destination":{"ID":89,"identity":90295,"cluster_name":"poc1","namespace":"shop-edge","labels":["k8s:app.kubernetes.io/name=api-gateway","k8s:app.kubernetes.io/part-of=shop","k8s:app=api-gateway","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-edge","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-edge"],"pod_name":"api-gateway-7d77448bf5-g59cc","workloads":[{"name":"api-gateway","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:43:50.280775520Z"}
+{"flow":{"time":"2026-09-13T14:43:50.308642509Z","uuid":"70e23979-9a36-4be6-aa28-0529f1423df8","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"86:75:fa:35:d9:5b","destination":"92:4b:f1:eb:2f:c0"},"IP":{"source":"10.10.4.12","destination":"10.10.4.192","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":52710,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":616,"identity":78188,"cluster_name":"poc1","namespace":"shop-clients","labels":["k8s:app.kubernetes.io/name=shopper","k8s:app=shopper","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-clients","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-clients"],"pod_name":"shopper"},"destination":{"ID":89,"identity":90295,"cluster_name":"poc1","namespace":"shop-edge","labels":["k8s:app.kubernetes.io/name=api-gateway","k8s:app.kubernetes.io/part-of=shop","k8s:app=api-gateway","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-edge","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-edge"],"pod_name":"api-gateway-7d77448bf5-g59cc","workloads":[{"name":"api-gateway","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:43:50.308642509Z"}
+{"flow":{"time":"2026-09-13T14:43:50.322548061Z","uuid":"b76cb0ea-6521-4f8f-88fd-1ad7c12327da","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"86:75:fa:35:d9:5b","destination":"92:4b:f1:eb:2f:c0"},"IP":{"source":"10.10.4.12","destination":"10.10.4.192","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":52718,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":616,"identity":78188,"cluster_name":"poc1","namespace":"shop-clients","labels":["k8s:app.kubernetes.io/name=shopper","k8s:app=shopper","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-clients","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-clients"],"pod_name":"shopper"},"destination":{"ID":89,"identity":90295,"cluster_name":"poc1","namespace":"shop-edge","labels":["k8s:app.kubernetes.io/name=api-gateway","k8s:app.kubernetes.io/part-of=shop","k8s:app=api-gateway","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-edge","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-edge"],"pod_name":"api-gateway-7d77448bf5-g59cc","workloads":[{"name":"api-gateway","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:43:50.322548061Z"}
+{"flow":{"time":"2026-09-13T14:43:55.348112055Z","uuid":"2c5a3e69-f903-4bb0-aa13-f18fb13cfcdf","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"86:75:fa:35:d9:5b","destination":"92:4b:f1:eb:2f:c0"},"IP":{"source":"10.10.4.12","destination":"10.10.4.192","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":37612,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":616,"identity":78188,"cluster_name":"poc1","namespace":"shop-clients","labels":["k8s:app.kubernetes.io/name=shopper","k8s:app=shopper","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-clients","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-clients"],"pod_name":"shopper"},"destination":{"ID":89,"identity":90295,"cluster_name":"poc1","namespace":"shop-edge","labels":["k8s:app.kubernetes.io/name=api-gateway","k8s:app.kubernetes.io/part-of=shop","k8s:app=api-gateway","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-edge","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-edge"],"pod_name":"api-gateway-7d77448bf5-g59cc","workloads":[{"name":"api-gateway","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:43:55.348112055Z"}
+{"flow":{"time":"2026-09-13T14:43:55.371548621Z","uuid":"34aa55db-046d-498e-9f7a-486a56a24725","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"86:75:fa:35:d9:5b","destination":"92:4b:f1:eb:2f:c0"},"IP":{"source":"10.10.4.12","destination":"10.10.4.192","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":37616,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":616,"identity":78188,"cluster_name":"poc1","namespace":"shop-clients","labels":["k8s:app.kubernetes.io/name=shopper","k8s:app=shopper","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-clients","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-clients"],"pod_name":"shopper"},"destination":{"ID":89,"identity":90295,"cluster_name":"poc1","namespace":"shop-edge","labels":["k8s:app.kubernetes.io/name=api-gateway","k8s:app.kubernetes.io/part-of=shop","k8s:app=api-gateway","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-edge","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-edge"],"pod_name":"api-gateway-7d77448bf5-g59cc","workloads":[{"name":"api-gateway","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:43:55.371548621Z"}
+{"flow":{"time":"2026-09-13T14:43:55.393535483Z","uuid":"ce10e63a-b5cd-48ed-8dc9-ccf4bfb01cf4","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"86:75:fa:35:d9:5b","destination":"92:4b:f1:eb:2f:c0"},"IP":{"source":"10.10.4.12","destination":"10.10.4.192","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":37628,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":616,"identity":78188,"cluster_name":"poc1","namespace":"shop-clients","labels":["k8s:app.kubernetes.io/name=shopper","k8s:app=shopper","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-clients","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-clients"],"pod_name":"shopper"},"destination":{"ID":89,"identity":90295,"cluster_name":"poc1","namespace":"shop-edge","labels":["k8s:app.kubernetes.io/name=api-gateway","k8s:app.kubernetes.io/part-of=shop","k8s:app=api-gateway","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-edge","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-edge"],"pod_name":"api-gateway-7d77448bf5-g59cc","workloads":[{"name":"api-gateway","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:43:55.393535483Z"}
+{"flow":{"time":"2026-09-13T14:43:55.416293275Z","uuid":"c8fa5f37-5211-4820-874c-330862fb636d","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"86:75:fa:35:d9:5b","destination":"92:4b:f1:eb:2f:c0"},"IP":{"source":"10.10.4.12","destination":"10.10.4.192","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":37640,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":616,"identity":78188,"cluster_name":"poc1","namespace":"shop-clients","labels":["k8s:app.kubernetes.io/name=shopper","k8s:app=shopper","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-clients","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-clients"],"pod_name":"shopper"},"destination":{"ID":89,"identity":90295,"cluster_name":"poc1","namespace":"shop-edge","labels":["k8s:app.kubernetes.io/name=api-gateway","k8s:app.kubernetes.io/part-of=shop","k8s:app=api-gateway","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-edge","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-edge"],"pod_name":"api-gateway-7d77448bf5-g59cc","workloads":[{"name":"api-gateway","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:43:55.416293275Z"}
+{"flow":{"time":"2026-09-13T14:44:00.435614335Z","uuid":"0bdd60ec-4032-40d6-a2b0-ebee7d2c8c85","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"86:75:fa:35:d9:5b","destination":"92:4b:f1:eb:2f:c0"},"IP":{"source":"10.10.4.12","destination":"10.10.4.192","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":37644,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":616,"identity":78188,"cluster_name":"poc1","namespace":"shop-clients","labels":["k8s:app.kubernetes.io/name=shopper","k8s:app=shopper","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-clients","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-clients"],"pod_name":"shopper"},"destination":{"ID":89,"identity":90295,"cluster_name":"poc1","namespace":"shop-edge","labels":["k8s:app.kubernetes.io/name=api-gateway","k8s:app.kubernetes.io/part-of=shop","k8s:app=api-gateway","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-edge","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-edge"],"pod_name":"api-gateway-7d77448bf5-g59cc","workloads":[{"name":"api-gateway","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:44:00.435614335Z"}
+{"flow":{"time":"2026-09-13T14:44:00.451339374Z","uuid":"ae89a6e6-cc8e-42df-9ba4-4b2fd3ab255d","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"86:75:fa:35:d9:5b","destination":"92:4b:f1:eb:2f:c0"},"IP":{"source":"10.10.4.12","destination":"10.10.4.192","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":37656,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":616,"identity":78188,"cluster_name":"poc1","namespace":"shop-clients","labels":["k8s:app.kubernetes.io/name=shopper","k8s:app=shopper","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-clients","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-clients"],"pod_name":"shopper"},"destination":{"ID":89,"identity":90295,"cluster_name":"poc1","namespace":"shop-edge","labels":["k8s:app.kubernetes.io/name=api-gateway","k8s:app.kubernetes.io/part-of=shop","k8s:app=api-gateway","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-edge","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-edge"],"pod_name":"api-gateway-7d77448bf5-g59cc","workloads":[{"name":"api-gateway","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:44:00.451339374Z"}
+{"flow":{"time":"2026-09-13T14:44:00.464458527Z","uuid":"aa1ddb55-f5f9-4df4-95d9-a0f9a9a3e7ce","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"86:75:fa:35:d9:5b","destination":"92:4b:f1:eb:2f:c0"},"IP":{"source":"10.10.4.12","destination":"10.10.4.192","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":37658,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":616,"identity":78188,"cluster_name":"poc1","namespace":"shop-clients","labels":["k8s:app.kubernetes.io/name=shopper","k8s:app=shopper","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-clients","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-clients"],"pod_name":"shopper"},"destination":{"ID":89,"identity":90295,"cluster_name":"poc1","namespace":"shop-edge","labels":["k8s:app.kubernetes.io/name=api-gateway","k8s:app.kubernetes.io/part-of=shop","k8s:app=api-gateway","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-edge","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-edge"],"pod_name":"api-gateway-7d77448bf5-g59cc","workloads":[{"name":"api-gateway","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:44:00.464458527Z"}
+{"flow":{"time":"2026-09-13T14:44:00.478757885Z","uuid":"46754d38-960c-4874-ab4d-f1286a53beef","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"86:75:fa:35:d9:5b","destination":"92:4b:f1:eb:2f:c0"},"IP":{"source":"10.10.4.12","destination":"10.10.4.192","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":37668,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":616,"identity":78188,"cluster_name":"poc1","namespace":"shop-clients","labels":["k8s:app.kubernetes.io/name=shopper","k8s:app=shopper","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-clients","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-clients"],"pod_name":"shopper"},"destination":{"ID":89,"identity":90295,"cluster_name":"poc1","namespace":"shop-edge","labels":["k8s:app.kubernetes.io/name=api-gateway","k8s:app.kubernetes.io/part-of=shop","k8s:app=api-gateway","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-edge","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-edge"],"pod_name":"api-gateway-7d77448bf5-g59cc","workloads":[{"name":"api-gateway","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:44:00.478757885Z"}
+{"flow":{"time":"2026-09-13T14:44:05.502430767Z","uuid":"5bb7dc17-85e4-446f-9266-814cfe3095c2","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"86:75:fa:35:d9:5b","destination":"92:4b:f1:eb:2f:c0"},"IP":{"source":"10.10.4.12","destination":"10.10.4.192","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":46326,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":616,"identity":78188,"cluster_name":"poc1","namespace":"shop-clients","labels":["k8s:app.kubernetes.io/name=shopper","k8s:app=shopper","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-clients","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-clients"],"pod_name":"shopper"},"destination":{"ID":89,"identity":90295,"cluster_name":"poc1","namespace":"shop-edge","labels":["k8s:app.kubernetes.io/name=api-gateway","k8s:app.kubernetes.io/part-of=shop","k8s:app=api-gateway","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-edge","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-edge"],"pod_name":"api-gateway-7d77448bf5-g59cc","workloads":[{"name":"api-gateway","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:44:05.502430767Z"}
+{"flow":{"time":"2026-09-13T14:44:05.527367744Z","uuid":"51f5e62a-87f5-4748-9d45-93d98cae4c46","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"86:75:fa:35:d9:5b","destination":"92:4b:f1:eb:2f:c0"},"IP":{"source":"10.10.4.12","destination":"10.10.4.192","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":46342,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":616,"identity":78188,"cluster_name":"poc1","namespace":"shop-clients","labels":["k8s:app.kubernetes.io/name=shopper","k8s:app=shopper","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-clients","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-clients"],"pod_name":"shopper"},"destination":{"ID":89,"identity":90295,"cluster_name":"poc1","namespace":"shop-edge","labels":["k8s:app.kubernetes.io/name=api-gateway","k8s:app.kubernetes.io/part-of=shop","k8s:app=api-gateway","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-edge","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-edge"],"pod_name":"api-gateway-7d77448bf5-g59cc","workloads":[{"name":"api-gateway","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:44:05.527367744Z"}
+{"flow":{"time":"2026-09-13T14:44:05.544441245Z","uuid":"17beffd7-e616-48f4-ab9c-91739f2e9dab","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"86:75:fa:35:d9:5b","destination":"92:4b:f1:eb:2f:c0"},"IP":{"source":"10.10.4.12","destination":"10.10.4.192","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":46346,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":616,"identity":78188,"cluster_name":"poc1","namespace":"shop-clients","labels":["k8s:app.kubernetes.io/name=shopper","k8s:app=shopper","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-clients","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-clients"],"pod_name":"shopper"},"destination":{"ID":89,"identity":90295,"cluster_name":"poc1","namespace":"shop-edge","labels":["k8s:app.kubernetes.io/name=api-gateway","k8s:app.kubernetes.io/part-of=shop","k8s:app=api-gateway","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-edge","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-edge"],"pod_name":"api-gateway-7d77448bf5-g59cc","workloads":[{"name":"api-gateway","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:44:05.544441245Z"}
+{"flow":{"time":"2026-09-13T14:44:05.566591526Z","uuid":"8560a493-7300-45c4-b3ea-9b0ee68124cc","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"86:75:fa:35:d9:5b","destination":"92:4b:f1:eb:2f:c0"},"IP":{"source":"10.10.4.12","destination":"10.10.4.192","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":46360,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":616,"identity":78188,"cluster_name":"poc1","namespace":"shop-clients","labels":["k8s:app.kubernetes.io/name=shopper","k8s:app=shopper","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-clients","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-clients"],"pod_name":"shopper"},"destination":{"ID":89,"identity":90295,"cluster_name":"poc1","namespace":"shop-edge","labels":["k8s:app.kubernetes.io/name=api-gateway","k8s:app.kubernetes.io/part-of=shop","k8s:app=api-gateway","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-edge","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-edge"],"pod_name":"api-gateway-7d77448bf5-g59cc","workloads":[{"name":"api-gateway","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:44:05.566591526Z"}
+{"flow":{"time":"2026-09-13T14:44:10.580566182Z","uuid":"0808d0b5-5f8b-4c15-84c5-80c77572a8a9","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"86:75:fa:35:d9:5b","destination":"92:4b:f1:eb:2f:c0"},"IP":{"source":"10.10.4.12","destination":"10.10.4.192","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":46362,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":616,"identity":78188,"cluster_name":"poc1","namespace":"shop-clients","labels":["k8s:app.kubernetes.io/name=shopper","k8s:app=shopper","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-clients","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-clients"],"pod_name":"shopper"},"destination":{"ID":89,"identity":90295,"cluster_name":"poc1","namespace":"shop-edge","labels":["k8s:app.kubernetes.io/name=api-gateway","k8s:app.kubernetes.io/part-of=shop","k8s:app=api-gateway","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-edge","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-edge"],"pod_name":"api-gateway-7d77448bf5-g59cc","workloads":[{"name":"api-gateway","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:44:10.580566182Z"}
+{"flow":{"time":"2026-09-13T14:44:10.594490684Z","uuid":"19384b7d-6495-42f7-b54c-36311dca5e1e","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"86:75:fa:35:d9:5b","destination":"92:4b:f1:eb:2f:c0"},"IP":{"source":"10.10.4.12","destination":"10.10.4.192","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":46364,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":616,"identity":78188,"cluster_name":"poc1","namespace":"shop-clients","labels":["k8s:app.kubernetes.io/name=shopper","k8s:app=shopper","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-clients","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-clients"],"pod_name":"shopper"},"destination":{"ID":89,"identity":90295,"cluster_name":"poc1","namespace":"shop-edge","labels":["k8s:app.kubernetes.io/name=api-gateway","k8s:app.kubernetes.io/part-of=shop","k8s:app=api-gateway","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-edge","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-edge"],"pod_name":"api-gateway-7d77448bf5-g59cc","workloads":[{"name":"api-gateway","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:44:10.594490684Z"}
+{"flow":{"time":"2026-09-13T14:44:10.611043479Z","uuid":"867492ef-93eb-4862-86e6-b563e8b6301a","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"86:75:fa:35:d9:5b","destination":"92:4b:f1:eb:2f:c0"},"IP":{"source":"10.10.4.12","destination":"10.10.4.192","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":46376,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":616,"identity":78188,"cluster_name":"poc1","namespace":"shop-clients","labels":["k8s:app.kubernetes.io/name=shopper","k8s:app=shopper","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-clients","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-clients"],"pod_name":"shopper"},"destination":{"ID":89,"identity":90295,"cluster_name":"poc1","namespace":"shop-edge","labels":["k8s:app.kubernetes.io/name=api-gateway","k8s:app.kubernetes.io/part-of=shop","k8s:app=api-gateway","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-edge","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-edge"],"pod_name":"api-gateway-7d77448bf5-g59cc","workloads":[{"name":"api-gateway","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:44:10.611043479Z"}
+{"flow":{"time":"2026-09-13T14:44:10.626917714Z","uuid":"4f9cb45e-0975-43e9-b2b9-c23700d9a4da","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"86:75:fa:35:d9:5b","destination":"92:4b:f1:eb:2f:c0"},"IP":{"source":"10.10.4.12","destination":"10.10.4.192","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":46382,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":616,"identity":78188,"cluster_name":"poc1","namespace":"shop-clients","labels":["k8s:app.kubernetes.io/name=shopper","k8s:app=shopper","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-clients","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-clients"],"pod_name":"shopper"},"destination":{"ID":89,"identity":90295,"cluster_name":"poc1","namespace":"shop-edge","labels":["k8s:app.kubernetes.io/name=api-gateway","k8s:app.kubernetes.io/part-of=shop","k8s:app=api-gateway","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-edge","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-edge"],"pod_name":"api-gateway-7d77448bf5-g59cc","workloads":[{"name":"api-gateway","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:44:10.626917714Z"}
+{"flow":{"time":"2026-09-13T14:44:15.649819657Z","uuid":"3c84f066-2a8f-490a-9a1e-60fbd0dc195b","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"86:75:fa:35:d9:5b","destination":"92:4b:f1:eb:2f:c0"},"IP":{"source":"10.10.4.12","destination":"10.10.4.192","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":34260,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":616,"identity":78188,"cluster_name":"poc1","namespace":"shop-clients","labels":["k8s:app.kubernetes.io/name=shopper","k8s:app=shopper","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-clients","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-clients"],"pod_name":"shopper"},"destination":{"ID":89,"identity":90295,"cluster_name":"poc1","namespace":"shop-edge","labels":["k8s:app.kubernetes.io/name=api-gateway","k8s:app.kubernetes.io/part-of=shop","k8s:app=api-gateway","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-edge","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-edge"],"pod_name":"api-gateway-7d77448bf5-g59cc","workloads":[{"name":"api-gateway","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:44:15.649819657Z"}
+{"flow":{"time":"2026-09-13T14:44:15.669336694Z","uuid":"750ed48e-8c46-4e28-b0eb-134ea6b05375","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"86:75:fa:35:d9:5b","destination":"92:4b:f1:eb:2f:c0"},"IP":{"source":"10.10.4.12","destination":"10.10.4.192","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":34264,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":616,"identity":78188,"cluster_name":"poc1","namespace":"shop-clients","labels":["k8s:app.kubernetes.io/name=shopper","k8s:app=shopper","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-clients","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-clients"],"pod_name":"shopper"},"destination":{"ID":89,"identity":90295,"cluster_name":"poc1","namespace":"shop-edge","labels":["k8s:app.kubernetes.io/name=api-gateway","k8s:app.kubernetes.io/part-of=shop","k8s:app=api-gateway","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-edge","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-edge"],"pod_name":"api-gateway-7d77448bf5-g59cc","workloads":[{"name":"api-gateway","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:44:15.669336694Z"}
+{"flow":{"time":"2026-09-13T14:44:15.685283990Z","uuid":"79527050-97d1-4a9d-a337-4aee039222af","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"86:75:fa:35:d9:5b","destination":"92:4b:f1:eb:2f:c0"},"IP":{"source":"10.10.4.12","destination":"10.10.4.192","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":34270,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":616,"identity":78188,"cluster_name":"poc1","namespace":"shop-clients","labels":["k8s:app.kubernetes.io/name=shopper","k8s:app=shopper","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-clients","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-clients"],"pod_name":"shopper"},"destination":{"ID":89,"identity":90295,"cluster_name":"poc1","namespace":"shop-edge","labels":["k8s:app.kubernetes.io/name=api-gateway","k8s:app.kubernetes.io/part-of=shop","k8s:app=api-gateway","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-edge","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-edge"],"pod_name":"api-gateway-7d77448bf5-g59cc","workloads":[{"name":"api-gateway","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:44:15.685283990Z"}
+{"flow":{"time":"2026-09-13T14:44:15.700348703Z","uuid":"42da9b3c-629f-4476-ae7c-10f70f81e0fc","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"86:75:fa:35:d9:5b","destination":"92:4b:f1:eb:2f:c0"},"IP":{"source":"10.10.4.12","destination":"10.10.4.192","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":34284,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":616,"identity":78188,"cluster_name":"poc1","namespace":"shop-clients","labels":["k8s:app.kubernetes.io/name=shopper","k8s:app=shopper","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-clients","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-clients"],"pod_name":"shopper"},"destination":{"ID":89,"identity":90295,"cluster_name":"poc1","namespace":"shop-edge","labels":["k8s:app.kubernetes.io/name=api-gateway","k8s:app.kubernetes.io/part-of=shop","k8s:app=api-gateway","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-edge","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-edge"],"pod_name":"api-gateway-7d77448bf5-g59cc","workloads":[{"name":"api-gateway","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:44:15.700348703Z"}
+{"flow":{"time":"2026-09-13T14:43:50.264732927Z","uuid":"3119380a-1288-4432-ab23-2482e643c7f5","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"2a:8c:da:33:cf:67","destination":"2e:83:f2:70:90:d9"},"IP":{"source":"10.10.4.192","destination":"10.10.4.245","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":55396,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":89,"identity":90295,"cluster_name":"poc1","namespace":"shop-edge","labels":["k8s:app.kubernetes.io/name=api-gateway","k8s:app.kubernetes.io/part-of=shop","k8s:app=api-gateway","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-edge","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-edge"],"pod_name":"api-gateway-7d77448bf5-g59cc","workloads":[{"name":"api-gateway","kind":"Deployment"}]},"destination":{"ID":538,"identity":68095,"cluster_name":"poc1","namespace":"shop-core","labels":["k8s:app.kubernetes.io/name=catalog","k8s:app.kubernetes.io/part-of=shop","k8s:app=catalog","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-core","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-core"],"pod_name":"catalog-c8fcd8bb-pcnwq","workloads":[{"name":"catalog","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:43:50.264732927Z"}
+{"flow":{"time":"2026-09-13T14:43:50.284204117Z","uuid":"0dd47262-b4fd-4098-967b-2e7b33901fa4","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"fa:1e:3e:20:fd:4e","destination":"6e:db:73:4b:21:f2"},"IP":{"source":"10.10.4.192","destination":"10.10.4.215","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":36516,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":89,"identity":90295,"cluster_name":"poc1","namespace":"shop-edge","labels":["k8s:app.kubernetes.io/name=api-gateway","k8s:app.kubernetes.io/part-of=shop","k8s:app=api-gateway","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-edge","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-edge"],"pod_name":"api-gateway-7d77448bf5-g59cc","workloads":[{"name":"api-gateway","kind":"Deployment"}]},"destination":{"ID":2867,"identity":123152,"cluster_name":"poc1","namespace":"shop-core","labels":["k8s:app.kubernetes.io/name=orders","k8s:app.kubernetes.io/part-of=shop","k8s:app=orders","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-core","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-core"],"pod_name":"orders-6ccc94b59d-kwn5q","workloads":[{"name":"orders","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:43:50.284204117Z"}
+{"flow":{"time":"2026-09-13T14:43:51.372558022Z","uuid":"095fad69-f3aa-4d9f-a3dc-52a55947c920","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"2a:8c:da:33:cf:67","destination":"2e:83:f2:70:90:d9"},"IP":{"source":"10.10.4.154","destination":"10.10.4.245","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":60904,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":2457,"identity":130126,"cluster_name":"poc1","namespace":"shop-reviews","labels":["k8s:app.kubernetes.io/name=reviews","k8s:app.kubernetes.io/part-of=shop","k8s:app=reviews","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-reviews","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-reviews"],"pod_name":"reviews-768b7bd9b6-pvj42","workloads":[{"name":"reviews","kind":"Deployment"}]},"destination":{"ID":538,"identity":68095,"cluster_name":"poc1","namespace":"shop-core","labels":["k8s:app.kubernetes.io/name=catalog","k8s:app.kubernetes.io/part-of=shop","k8s:app=catalog","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-core","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-core"],"pod_name":"catalog-c8fcd8bb-pcnwq","workloads":[{"name":"catalog","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:43:51.372558022Z"}
+{"flow":{"time":"2026-09-13T14:43:52.197290707Z","uuid":"7c7b7e30-2b4f-4f75-a5ec-6b8f4b17e82e","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"2a:8c:da:33:cf:67","destination":"2e:83:f2:70:90:d9"},"IP":{"source":"10.10.4.215","destination":"10.10.4.245","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":43158,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":2867,"identity":123152,"cluster_name":"poc1","namespace":"shop-core","labels":["k8s:app.kubernetes.io/name=orders","k8s:app.kubernetes.io/part-of=shop","k8s:app=orders","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-core","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-core"],"pod_name":"orders-6ccc94b59d-kwn5q","workloads":[{"name":"orders","kind":"Deployment"}]},"destination":{"ID":538,"identity":68095,"cluster_name":"poc1","namespace":"shop-core","labels":["k8s:app.kubernetes.io/name=catalog","k8s:app.kubernetes.io/part-of=shop","k8s:app=catalog","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-core","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-core"],"pod_name":"catalog-c8fcd8bb-pcnwq","workloads":[{"name":"catalog","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:43:52.197290707Z"}
+{"flow":{"time":"2026-09-13T14:43:53.063926748Z","uuid":"a6824eb7-9f60-4437-a8c7-c40bc82caf80","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"2a:8c:da:33:cf:67","destination":"2e:83:f2:70:90:d9"},"IP":{"source":"10.10.4.47","destination":"10.10.4.245","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":45810,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":131,"identity":77795,"cluster_name":"poc1","namespace":"shop-merchant","labels":["k8s:app.kubernetes.io/name=merchant","k8s:app.kubernetes.io/part-of=shop","k8s:app=merchant","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-merchant","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-merchant"],"pod_name":"merchant-5c5cc7d9b6-zwn4s","workloads":[{"name":"merchant","kind":"Deployment"}]},"destination":{"ID":538,"identity":68095,"cluster_name":"poc1","namespace":"shop-core","labels":["k8s:app.kubernetes.io/name=catalog","k8s:app.kubernetes.io/part-of=shop","k8s:app=catalog","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-core","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-core"],"pod_name":"catalog-c8fcd8bb-pcnwq","workloads":[{"name":"catalog","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:43:53.063926748Z"}
+{"flow":{"time":"2026-09-13T14:43:53.098602632Z","uuid":"fb05a9f6-7b44-4c36-ae0d-2d65733aa039","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"2a:8c:da:33:cf:67","destination":"2e:83:f2:70:90:d9"},"IP":{"source":"10.10.4.153","destination":"10.10.4.245","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":40472,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":1176,"identity":68336,"cluster_name":"poc1","namespace":"shop-clients","labels":["k8s:app.kubernetes.io/name=stranger","k8s:app=stranger","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-clients","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-clients"],"pod_name":"stranger"},"destination":{"ID":538,"identity":68095,"cluster_name":"poc1","namespace":"shop-core","labels":["k8s:app.kubernetes.io/name=catalog","k8s:app.kubernetes.io/part-of=shop","k8s:app=catalog","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-core","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-core"],"pod_name":"catalog-c8fcd8bb-pcnwq","workloads":[{"name":"catalog","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:43:53.098602632Z"}
+{"flow":{"time":"2026-09-13T14:43:55.355755045Z","uuid":"a457914c-a1c4-4f3a-baea-0db80e4cdbf0","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"2a:8c:da:33:cf:67","destination":"2e:83:f2:70:90:d9"},"IP":{"source":"10.10.4.192","destination":"10.10.4.245","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":38120,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":89,"identity":90295,"cluster_name":"poc1","namespace":"shop-edge","labels":["k8s:app.kubernetes.io/name=api-gateway","k8s:app.kubernetes.io/part-of=shop","k8s:app=api-gateway","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-edge","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-edge"],"pod_name":"api-gateway-7d77448bf5-g59cc","workloads":[{"name":"api-gateway","kind":"Deployment"}]},"destination":{"ID":538,"identity":68095,"cluster_name":"poc1","namespace":"shop-core","labels":["k8s:app.kubernetes.io/name=catalog","k8s:app.kubernetes.io/part-of=shop","k8s:app=catalog","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-core","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-core"],"pod_name":"catalog-c8fcd8bb-pcnwq","workloads":[{"name":"catalog","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:43:55.355755045Z"}
+{"flow":{"time":"2026-09-13T14:43:55.372366435Z","uuid":"1da37d0e-8cf5-4e5b-8fdb-ac2bb7df3559","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"fa:1e:3e:20:fd:4e","destination":"6e:db:73:4b:21:f2"},"IP":{"source":"10.10.4.192","destination":"10.10.4.215","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":41670,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":89,"identity":90295,"cluster_name":"poc1","namespace":"shop-edge","labels":["k8s:app.kubernetes.io/name=api-gateway","k8s:app.kubernetes.io/part-of=shop","k8s:app=api-gateway","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-edge","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-edge"],"pod_name":"api-gateway-7d77448bf5-g59cc","workloads":[{"name":"api-gateway","kind":"Deployment"}]},"destination":{"ID":2867,"identity":123152,"cluster_name":"poc1","namespace":"shop-core","labels":["k8s:app.kubernetes.io/name=orders","k8s:app.kubernetes.io/part-of=shop","k8s:app=orders","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-core","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-core"],"pod_name":"orders-6ccc94b59d-kwn5q","workloads":[{"name":"orders","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:43:55.372366435Z"}
+{"flow":{"time":"2026-09-13T14:43:57.229965857Z","uuid":"5bb4621a-6ee3-4538-ab3e-7e75a6cf008d","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"2a:8c:da:33:cf:67","destination":"2e:83:f2:70:90:d9"},"IP":{"source":"10.10.4.215","destination":"10.10.4.245","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":43164,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":2867,"identity":123152,"cluster_name":"poc1","namespace":"shop-core","labels":["k8s:app.kubernetes.io/name=orders","k8s:app.kubernetes.io/part-of=shop","k8s:app=orders","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-core","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-core"],"pod_name":"orders-6ccc94b59d-kwn5q","workloads":[{"name":"orders","kind":"Deployment"}]},"destination":{"ID":538,"identity":68095,"cluster_name":"poc1","namespace":"shop-core","labels":["k8s:app.kubernetes.io/name=catalog","k8s:app.kubernetes.io/part-of=shop","k8s:app=catalog","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-core","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-core"],"pod_name":"catalog-c8fcd8bb-pcnwq","workloads":[{"name":"catalog","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:43:57.229965857Z"}
+{"flow":{"time":"2026-09-13T14:43:59.389712922Z","uuid":"a6faf485-bb7f-44e7-9f5e-428e94def9bf","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"2a:8c:da:33:cf:67","destination":"2e:83:f2:70:90:d9"},"IP":{"source":"10.10.4.154","destination":"10.10.4.245","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":48166,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":2457,"identity":130126,"cluster_name":"poc1","namespace":"shop-reviews","labels":["k8s:app.kubernetes.io/name=reviews","k8s:app.kubernetes.io/part-of=shop","k8s:app=reviews","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-reviews","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-reviews"],"pod_name":"reviews-768b7bd9b6-pvj42","workloads":[{"name":"reviews","kind":"Deployment"}]},"destination":{"ID":538,"identity":68095,"cluster_name":"poc1","namespace":"shop-core","labels":["k8s:app.kubernetes.io/name=catalog","k8s:app.kubernetes.io/part-of=shop","k8s:app=catalog","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-core","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-core"],"pod_name":"catalog-c8fcd8bb-pcnwq","workloads":[{"name":"catalog","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:43:59.389712922Z"}
+{"flow":{"time":"2026-09-13T14:44:00.083600703Z","uuid":"7383e9c5-ca1e-4afd-a437-9777432b625b","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"2a:8c:da:33:cf:67","destination":"2e:83:f2:70:90:d9"},"IP":{"source":"10.10.4.47","destination":"10.10.4.245","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":45814,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":131,"identity":77795,"cluster_name":"poc1","namespace":"shop-merchant","labels":["k8s:app.kubernetes.io/name=merchant","k8s:app.kubernetes.io/part-of=shop","k8s:app=merchant","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-merchant","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-merchant"],"pod_name":"merchant-5c5cc7d9b6-zwn4s","workloads":[{"name":"merchant","kind":"Deployment"}]},"destination":{"ID":538,"identity":68095,"cluster_name":"poc1","namespace":"shop-core","labels":["k8s:app.kubernetes.io/name=catalog","k8s:app.kubernetes.io/part-of=shop","k8s:app=catalog","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-core","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-core"],"pod_name":"catalog-c8fcd8bb-pcnwq","workloads":[{"name":"catalog","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:44:00.083600703Z"}
+{"flow":{"time":"2026-09-13T14:44:00.133807838Z","uuid":"3e4b8ee2-57e6-4a79-8b6c-afebaedf5421","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"2a:8c:da:33:cf:67","destination":"2e:83:f2:70:90:d9"},"IP":{"source":"10.10.4.153","destination":"10.10.4.245","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":40488,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":1176,"identity":68336,"cluster_name":"poc1","namespace":"shop-clients","labels":["k8s:app.kubernetes.io/name=stranger","k8s:app=stranger","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-clients","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-clients"],"pod_name":"stranger"},"destination":{"ID":538,"identity":68095,"cluster_name":"poc1","namespace":"shop-core","labels":["k8s:app.kubernetes.io/name=catalog","k8s:app.kubernetes.io/part-of=shop","k8s:app=catalog","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-core","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-core"],"pod_name":"catalog-c8fcd8bb-pcnwq","workloads":[{"name":"catalog","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:44:00.133807838Z"}
+{"flow":{"time":"2026-09-13T14:44:00.436769978Z","uuid":"5558496e-1e50-465a-b761-32aa67ed9cd5","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"2a:8c:da:33:cf:67","destination":"2e:83:f2:70:90:d9"},"IP":{"source":"10.10.4.192","destination":"10.10.4.245","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":38126,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":89,"identity":90295,"cluster_name":"poc1","namespace":"shop-edge","labels":["k8s:app.kubernetes.io/name=api-gateway","k8s:app.kubernetes.io/part-of=shop","k8s:app=api-gateway","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-edge","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-edge"],"pod_name":"api-gateway-7d77448bf5-g59cc","workloads":[{"name":"api-gateway","kind":"Deployment"}]},"destination":{"ID":538,"identity":68095,"cluster_name":"poc1","namespace":"shop-core","labels":["k8s:app.kubernetes.io/name=catalog","k8s:app.kubernetes.io/part-of=shop","k8s:app=catalog","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-core","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-core"],"pod_name":"catalog-c8fcd8bb-pcnwq","workloads":[{"name":"catalog","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:44:00.436769978Z"}
+{"flow":{"time":"2026-09-13T14:44:00.452694428Z","uuid":"40d56ef9-409d-4cdd-b8e0-db2f8c062419","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"fa:1e:3e:20:fd:4e","destination":"6e:db:73:4b:21:f2"},"IP":{"source":"10.10.4.192","destination":"10.10.4.215","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":41676,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":89,"identity":90295,"cluster_name":"poc1","namespace":"shop-edge","labels":["k8s:app.kubernetes.io/name=api-gateway","k8s:app.kubernetes.io/part-of=shop","k8s:app=api-gateway","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-edge","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-edge"],"pod_name":"api-gateway-7d77448bf5-g59cc","workloads":[{"name":"api-gateway","kind":"Deployment"}]},"destination":{"ID":2867,"identity":123152,"cluster_name":"poc1","namespace":"shop-core","labels":["k8s:app.kubernetes.io/name=orders","k8s:app.kubernetes.io/part-of=shop","k8s:app=orders","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-core","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-core"],"pod_name":"orders-6ccc94b59d-kwn5q","workloads":[{"name":"orders","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:44:00.452694428Z"}
+{"flow":{"time":"2026-09-13T14:44:02.285277415Z","uuid":"82b9cd0c-4e80-4abd-9b0b-e47af69694bc","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"2a:8c:da:33:cf:67","destination":"2e:83:f2:70:90:d9"},"IP":{"source":"10.10.4.215","destination":"10.10.4.245","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":42436,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":2867,"identity":123152,"cluster_name":"poc1","namespace":"shop-core","labels":["k8s:app.kubernetes.io/name=orders","k8s:app.kubernetes.io/part-of=shop","k8s:app=orders","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-core","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-core"],"pod_name":"orders-6ccc94b59d-kwn5q","workloads":[{"name":"orders","kind":"Deployment"}]},"destination":{"ID":538,"identity":68095,"cluster_name":"poc1","namespace":"shop-core","labels":["k8s:app.kubernetes.io/name=catalog","k8s:app.kubernetes.io/part-of=shop","k8s:app=catalog","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-core","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-core"],"pod_name":"catalog-c8fcd8bb-pcnwq","workloads":[{"name":"catalog","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:44:02.285277415Z"}
+{"flow":{"time":"2026-09-13T14:44:05.510409647Z","uuid":"23be16b8-1ddc-44f2-96ac-70d541c08a8a","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"2a:8c:da:33:cf:67","destination":"2e:83:f2:70:90:d9"},"IP":{"source":"10.10.4.192","destination":"10.10.4.245","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":53396,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":89,"identity":90295,"cluster_name":"poc1","namespace":"shop-edge","labels":["k8s:app.kubernetes.io/name=api-gateway","k8s:app.kubernetes.io/part-of=shop","k8s:app=api-gateway","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-edge","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-edge"],"pod_name":"api-gateway-7d77448bf5-g59cc","workloads":[{"name":"api-gateway","kind":"Deployment"}]},"destination":{"ID":538,"identity":68095,"cluster_name":"poc1","namespace":"shop-core","labels":["k8s:app.kubernetes.io/name=catalog","k8s:app.kubernetes.io/part-of=shop","k8s:app=catalog","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-core","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-core"],"pod_name":"catalog-c8fcd8bb-pcnwq","workloads":[{"name":"catalog","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:44:05.510409647Z"}
+{"flow":{"time":"2026-09-13T14:44:05.527406863Z","uuid":"c9882a8e-99db-42fe-814b-a8d89af75e88","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"fa:1e:3e:20:fd:4e","destination":"6e:db:73:4b:21:f2"},"IP":{"source":"10.10.4.192","destination":"10.10.4.215","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":33818,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":89,"identity":90295,"cluster_name":"poc1","namespace":"shop-edge","labels":["k8s:app.kubernetes.io/name=api-gateway","k8s:app.kubernetes.io/part-of=shop","k8s:app=api-gateway","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-edge","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-edge"],"pod_name":"api-gateway-7d77448bf5-g59cc","workloads":[{"name":"api-gateway","kind":"Deployment"}]},"destination":{"ID":2867,"identity":123152,"cluster_name":"poc1","namespace":"shop-core","labels":["k8s:app.kubernetes.io/name=orders","k8s:app.kubernetes.io/part-of=shop","k8s:app=orders","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-core","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-core"],"pod_name":"orders-6ccc94b59d-kwn5q","workloads":[{"name":"orders","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:44:05.527406863Z"}
+{"flow":{"time":"2026-09-13T14:44:07.099651127Z","uuid":"f73bfce0-a65d-4666-b71b-24d2bab3d54e","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"2a:8c:da:33:cf:67","destination":"2e:83:f2:70:90:d9"},"IP":{"source":"10.10.4.47","destination":"10.10.4.245","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":43468,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":131,"identity":77795,"cluster_name":"poc1","namespace":"shop-merchant","labels":["k8s:app.kubernetes.io/name=merchant","k8s:app.kubernetes.io/part-of=shop","k8s:app=merchant","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-merchant","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-merchant"],"pod_name":"merchant-5c5cc7d9b6-zwn4s","workloads":[{"name":"merchant","kind":"Deployment"}]},"destination":{"ID":538,"identity":68095,"cluster_name":"poc1","namespace":"shop-core","labels":["k8s:app.kubernetes.io/name=catalog","k8s:app.kubernetes.io/part-of=shop","k8s:app=catalog","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-core","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-core"],"pod_name":"catalog-c8fcd8bb-pcnwq","workloads":[{"name":"catalog","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:44:07.099651127Z"}
+{"flow":{"time":"2026-09-13T14:44:07.162309473Z","uuid":"d9e77a25-179d-4214-a02d-bfc24ded8cf9","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"2a:8c:da:33:cf:67","destination":"2e:83:f2:70:90:d9"},"IP":{"source":"10.10.4.153","destination":"10.10.4.245","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":34254,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":1176,"identity":68336,"cluster_name":"poc1","namespace":"shop-clients","labels":["k8s:app.kubernetes.io/name=stranger","k8s:app=stranger","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-clients","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-clients"],"pod_name":"stranger"},"destination":{"ID":538,"identity":68095,"cluster_name":"poc1","namespace":"shop-core","labels":["k8s:app.kubernetes.io/name=catalog","k8s:app.kubernetes.io/part-of=shop","k8s:app=catalog","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-core","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-core"],"pod_name":"catalog-c8fcd8bb-pcnwq","workloads":[{"name":"catalog","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:44:07.162309473Z"}
+{"flow":{"time":"2026-09-13T14:44:07.317084025Z","uuid":"0b71c885-466e-4bc9-a7a8-10840b080e47","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"2a:8c:da:33:cf:67","destination":"2e:83:f2:70:90:d9"},"IP":{"source":"10.10.4.215","destination":"10.10.4.245","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":42448,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":2867,"identity":123152,"cluster_name":"poc1","namespace":"shop-core","labels":["k8s:app.kubernetes.io/name=orders","k8s:app.kubernetes.io/part-of=shop","k8s:app=orders","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-core","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-core"],"pod_name":"orders-6ccc94b59d-kwn5q","workloads":[{"name":"orders","kind":"Deployment"}]},"destination":{"ID":538,"identity":68095,"cluster_name":"poc1","namespace":"shop-core","labels":["k8s:app.kubernetes.io/name=catalog","k8s:app.kubernetes.io/part-of=shop","k8s:app=catalog","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-core","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-core"],"pod_name":"catalog-c8fcd8bb-pcnwq","workloads":[{"name":"catalog","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:44:07.317084025Z"}
+{"flow":{"time":"2026-09-13T14:44:07.407569889Z","uuid":"ca5e14e0-67d7-4bee-b147-2bbb25e763b9","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"2a:8c:da:33:cf:67","destination":"2e:83:f2:70:90:d9"},"IP":{"source":"10.10.4.154","destination":"10.10.4.245","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":35316,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":2457,"identity":130126,"cluster_name":"poc1","namespace":"shop-reviews","labels":["k8s:app.kubernetes.io/name=reviews","k8s:app.kubernetes.io/part-of=shop","k8s:app=reviews","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-reviews","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-reviews"],"pod_name":"reviews-768b7bd9b6-pvj42","workloads":[{"name":"reviews","kind":"Deployment"}]},"destination":{"ID":538,"identity":68095,"cluster_name":"poc1","namespace":"shop-core","labels":["k8s:app.kubernetes.io/name=catalog","k8s:app.kubernetes.io/part-of=shop","k8s:app=catalog","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-core","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-core"],"pod_name":"catalog-c8fcd8bb-pcnwq","workloads":[{"name":"catalog","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:44:07.407569889Z"}
+{"flow":{"time":"2026-09-13T14:44:10.583377519Z","uuid":"adc0807a-29ea-49df-889a-b86c2649d722","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"2a:8c:da:33:cf:67","destination":"2e:83:f2:70:90:d9"},"IP":{"source":"10.10.4.192","destination":"10.10.4.245","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":53400,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":89,"identity":90295,"cluster_name":"poc1","namespace":"shop-edge","labels":["k8s:app.kubernetes.io/name=api-gateway","k8s:app.kubernetes.io/part-of=shop","k8s:app=api-gateway","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-edge","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-edge"],"pod_name":"api-gateway-7d77448bf5-g59cc","workloads":[{"name":"api-gateway","kind":"Deployment"}]},"destination":{"ID":538,"identity":68095,"cluster_name":"poc1","namespace":"shop-core","labels":["k8s:app.kubernetes.io/name=catalog","k8s:app.kubernetes.io/part-of=shop","k8s:app=catalog","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-core","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-core"],"pod_name":"catalog-c8fcd8bb-pcnwq","workloads":[{"name":"catalog","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:44:10.583377519Z"}
+{"flow":{"time":"2026-09-13T14:44:10.595681744Z","uuid":"ec47acfd-4c00-4494-963e-e45dc63a1d79","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"fa:1e:3e:20:fd:4e","destination":"6e:db:73:4b:21:f2"},"IP":{"source":"10.10.4.192","destination":"10.10.4.215","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":33828,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":89,"identity":90295,"cluster_name":"poc1","namespace":"shop-edge","labels":["k8s:app.kubernetes.io/name=api-gateway","k8s:app.kubernetes.io/part-of=shop","k8s:app=api-gateway","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-edge","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-edge"],"pod_name":"api-gateway-7d77448bf5-g59cc","workloads":[{"name":"api-gateway","kind":"Deployment"}]},"destination":{"ID":2867,"identity":123152,"cluster_name":"poc1","namespace":"shop-core","labels":["k8s:app.kubernetes.io/name=orders","k8s:app.kubernetes.io/part-of=shop","k8s:app=orders","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-core","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-core"],"pod_name":"orders-6ccc94b59d-kwn5q","workloads":[{"name":"orders","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:44:10.595681744Z"}
+{"flow":{"time":"2026-09-13T14:44:12.343690497Z","uuid":"05056741-5e68-4591-bb0e-e5543f7290b9","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"2a:8c:da:33:cf:67","destination":"2e:83:f2:70:90:d9"},"IP":{"source":"10.10.4.215","destination":"10.10.4.245","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":46302,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":2867,"identity":123152,"cluster_name":"poc1","namespace":"shop-core","labels":["k8s:app.kubernetes.io/name=orders","k8s:app.kubernetes.io/part-of=shop","k8s:app=orders","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-core","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-core"],"pod_name":"orders-6ccc94b59d-kwn5q","workloads":[{"name":"orders","kind":"Deployment"}]},"destination":{"ID":538,"identity":68095,"cluster_name":"poc1","namespace":"shop-core","labels":["k8s:app.kubernetes.io/name=catalog","k8s:app.kubernetes.io/part-of=shop","k8s:app=catalog","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-core","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-core"],"pod_name":"catalog-c8fcd8bb-pcnwq","workloads":[{"name":"catalog","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:44:12.343690497Z"}
+{"flow":{"time":"2026-09-13T14:44:14.114321509Z","uuid":"72053c20-881d-4a1b-ab1b-973e4c5fc8f0","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"2a:8c:da:33:cf:67","destination":"2e:83:f2:70:90:d9"},"IP":{"source":"10.10.4.47","destination":"10.10.4.245","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":40936,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":131,"identity":77795,"cluster_name":"poc1","namespace":"shop-merchant","labels":["k8s:app.kubernetes.io/name=merchant","k8s:app.kubernetes.io/part-of=shop","k8s:app=merchant","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-merchant","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-merchant"],"pod_name":"merchant-5c5cc7d9b6-zwn4s","workloads":[{"name":"merchant","kind":"Deployment"}]},"destination":{"ID":538,"identity":68095,"cluster_name":"poc1","namespace":"shop-core","labels":["k8s:app.kubernetes.io/name=catalog","k8s:app.kubernetes.io/part-of=shop","k8s:app=catalog","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-core","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-core"],"pod_name":"catalog-c8fcd8bb-pcnwq","workloads":[{"name":"catalog","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:44:14.114321509Z"}
+{"flow":{"time":"2026-09-13T14:44:14.184715292Z","uuid":"c556bd8a-a67e-44a6-8e8b-2b128a2aae49","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"2a:8c:da:33:cf:67","destination":"2e:83:f2:70:90:d9"},"IP":{"source":"10.10.4.153","destination":"10.10.4.245","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":58946,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":1176,"identity":68336,"cluster_name":"poc1","namespace":"shop-clients","labels":["k8s:app.kubernetes.io/name=stranger","k8s:app=stranger","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-clients","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-clients"],"pod_name":"stranger"},"destination":{"ID":538,"identity":68095,"cluster_name":"poc1","namespace":"shop-core","labels":["k8s:app.kubernetes.io/name=catalog","k8s:app.kubernetes.io/part-of=shop","k8s:app=catalog","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-core","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-core"],"pod_name":"catalog-c8fcd8bb-pcnwq","workloads":[{"name":"catalog","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:44:14.184715292Z"}
+{"flow":{"time":"2026-09-13T14:44:15.427765557Z","uuid":"f42b619b-8b68-40bb-b102-55d617715b2f","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"2a:8c:da:33:cf:67","destination":"2e:83:f2:70:90:d9"},"IP":{"source":"10.10.4.154","destination":"10.10.4.245","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":48560,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":2457,"identity":130126,"cluster_name":"poc1","namespace":"shop-reviews","labels":["k8s:app.kubernetes.io/name=reviews","k8s:app.kubernetes.io/part-of=shop","k8s:app=reviews","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-reviews","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-reviews"],"pod_name":"reviews-768b7bd9b6-pvj42","workloads":[{"name":"reviews","kind":"Deployment"}]},"destination":{"ID":538,"identity":68095,"cluster_name":"poc1","namespace":"shop-core","labels":["k8s:app.kubernetes.io/name=catalog","k8s:app.kubernetes.io/part-of=shop","k8s:app=catalog","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-core","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-core"],"pod_name":"catalog-c8fcd8bb-pcnwq","workloads":[{"name":"catalog","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:44:15.427765557Z"}
+{"flow":{"time":"2026-09-13T14:44:15.655464226Z","uuid":"2c244604-0716-4eb5-8cde-3c1b953a604b","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"2a:8c:da:33:cf:67","destination":"2e:83:f2:70:90:d9"},"IP":{"source":"10.10.4.192","destination":"10.10.4.245","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":36338,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":89,"identity":90295,"cluster_name":"poc1","namespace":"shop-edge","labels":["k8s:app.kubernetes.io/name=api-gateway","k8s:app.kubernetes.io/part-of=shop","k8s:app=api-gateway","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-edge","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-edge"],"pod_name":"api-gateway-7d77448bf5-g59cc","workloads":[{"name":"api-gateway","kind":"Deployment"}]},"destination":{"ID":538,"identity":68095,"cluster_name":"poc1","namespace":"shop-core","labels":["k8s:app.kubernetes.io/name=catalog","k8s:app.kubernetes.io/part-of=shop","k8s:app=catalog","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-core","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-core"],"pod_name":"catalog-c8fcd8bb-pcnwq","workloads":[{"name":"catalog","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:44:15.655464226Z"}
+{"flow":{"time":"2026-09-13T14:44:15.670791Z","uuid":"3c5b41c7-1382-4e3d-b6a3-c66d52d00e95","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"fa:1e:3e:20:fd:4e","destination":"6e:db:73:4b:21:f2"},"IP":{"source":"10.10.4.192","destination":"10.10.4.215","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":43326,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":89,"identity":90295,"cluster_name":"poc1","namespace":"shop-edge","labels":["k8s:app.kubernetes.io/name=api-gateway","k8s:app.kubernetes.io/part-of=shop","k8s:app=api-gateway","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-edge","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-edge"],"pod_name":"api-gateway-7d77448bf5-g59cc","workloads":[{"name":"api-gateway","kind":"Deployment"}]},"destination":{"ID":2867,"identity":123152,"cluster_name":"poc1","namespace":"shop-core","labels":["k8s:app.kubernetes.io/name=orders","k8s:app.kubernetes.io/part-of=shop","k8s:app=orders","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-core","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-core"],"pod_name":"orders-6ccc94b59d-kwn5q","workloads":[{"name":"orders","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:44:15.670791Z"}
+{"flow":{"time":"2026-09-13T14:44:17.385215943Z","uuid":"8afe4d1f-4877-46b5-a1dd-897c91423982","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"2a:8c:da:33:cf:67","destination":"2e:83:f2:70:90:d9"},"IP":{"source":"10.10.4.215","destination":"10.10.4.245","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":46312,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":2867,"identity":123152,"cluster_name":"poc1","namespace":"shop-core","labels":["k8s:app.kubernetes.io/name=orders","k8s:app.kubernetes.io/part-of=shop","k8s:app=orders","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-core","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-core"],"pod_name":"orders-6ccc94b59d-kwn5q","workloads":[{"name":"orders","kind":"Deployment"}]},"destination":{"ID":538,"identity":68095,"cluster_name":"poc1","namespace":"shop-core","labels":["k8s:app.kubernetes.io/name=catalog","k8s:app.kubernetes.io/part-of=shop","k8s:app=catalog","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-core","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-core"],"pod_name":"catalog-c8fcd8bb-pcnwq","workloads":[{"name":"catalog","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:44:17.385215943Z"}
+{"flow":{"time":"2026-09-13T14:43:50.324268007Z","uuid":"f185aeeb-8741-41cb-bf85-41e49fddb5e4","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"8e:78:de:92:a2:2c","destination":"32:e2:35:68:02:7e"},"IP":{"source":"10.10.4.192","destination":"10.10.4.23","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":52200,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":89,"identity":90295,"cluster_name":"poc1","namespace":"shop-edge","labels":["k8s:app.kubernetes.io/name=api-gateway","k8s:app.kubernetes.io/part-of=shop","k8s:app=api-gateway","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-edge","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-edge"],"pod_name":"api-gateway-7d77448bf5-g59cc","workloads":[{"name":"api-gateway","kind":"Deployment"}]},"destination":{"ID":1815,"identity":88001,"cluster_name":"poc1","namespace":"shop-payments","labels":["k8s:app.kubernetes.io/name=payment-gateway","k8s:app.kubernetes.io/part-of=shop","k8s:app=payment-gateway","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-payments","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-payments"],"pod_name":"payment-gateway-6c6846d6b5-85ccg","workloads":[{"name":"payment-gateway","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:43:50.324268007Z"}
+{"flow":{"time":"2026-09-13T14:43:52.207295297Z","uuid":"de8d1b9b-c47c-4c91-b057-ccae599d3867","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"8e:78:de:92:a2:2c","destination":"32:e2:35:68:02:7e"},"IP":{"source":"10.10.4.215","destination":"10.10.4.23","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":44068,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":2867,"identity":123152,"cluster_name":"poc1","namespace":"shop-core","labels":["k8s:app.kubernetes.io/name=orders","k8s:app.kubernetes.io/part-of=shop","k8s:app=orders","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-core","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-core"],"pod_name":"orders-6ccc94b59d-kwn5q","workloads":[{"name":"orders","kind":"Deployment"}]},"destination":{"ID":1815,"identity":88001,"cluster_name":"poc1","namespace":"shop-payments","labels":["k8s:app.kubernetes.io/name=payment-gateway","k8s:app.kubernetes.io/part-of=shop","k8s:app=payment-gateway","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-payments","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-payments"],"pod_name":"payment-gateway-6c6846d6b5-85ccg","workloads":[{"name":"payment-gateway","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:43:52.207295297Z"}
+{"flow":{"time":"2026-09-13T14:43:53.112382680Z","uuid":"92f161da-a7cd-4637-ae3b-426208d3f33a","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"8e:78:de:92:a2:2c","destination":"32:e2:35:68:02:7e"},"IP":{"source":"10.10.4.153","destination":"10.10.4.23","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":33432,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":1176,"identity":68336,"cluster_name":"poc1","namespace":"shop-clients","labels":["k8s:app.kubernetes.io/name=stranger","k8s:app=stranger","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-clients","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-clients"],"pod_name":"stranger"},"destination":{"ID":1815,"identity":88001,"cluster_name":"poc1","namespace":"shop-payments","labels":["k8s:app.kubernetes.io/name=payment-gateway","k8s:app.kubernetes.io/part-of=shop","k8s:app=payment-gateway","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-payments","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-payments"],"pod_name":"payment-gateway-6c6846d6b5-85ccg","workloads":[{"name":"payment-gateway","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:43:53.112382680Z"}
+{"flow":{"time":"2026-09-13T14:43:55.418546598Z","uuid":"7c693157-2fd3-4443-be35-5adeb79e8b18","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"8e:78:de:92:a2:2c","destination":"32:e2:35:68:02:7e"},"IP":{"source":"10.10.4.192","destination":"10.10.4.23","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":35374,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":89,"identity":90295,"cluster_name":"poc1","namespace":"shop-edge","labels":["k8s:app.kubernetes.io/name=api-gateway","k8s:app.kubernetes.io/part-of=shop","k8s:app=api-gateway","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-edge","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-edge"],"pod_name":"api-gateway-7d77448bf5-g59cc","workloads":[{"name":"api-gateway","kind":"Deployment"}]},"destination":{"ID":1815,"identity":88001,"cluster_name":"poc1","namespace":"shop-payments","labels":["k8s:app.kubernetes.io/name=payment-gateway","k8s:app.kubernetes.io/part-of=shop","k8s:app=payment-gateway","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-payments","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-payments"],"pod_name":"payment-gateway-6c6846d6b5-85ccg","workloads":[{"name":"payment-gateway","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:43:55.418546598Z"}
+{"flow":{"time":"2026-09-13T14:43:57.263584534Z","uuid":"9a1665bb-fbf1-46e9-be1b-607718d40adc","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"8e:78:de:92:a2:2c","destination":"32:e2:35:68:02:7e"},"IP":{"source":"10.10.4.215","destination":"10.10.4.23","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":44082,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":2867,"identity":123152,"cluster_name":"poc1","namespace":"shop-core","labels":["k8s:app.kubernetes.io/name=orders","k8s:app.kubernetes.io/part-of=shop","k8s:app=orders","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-core","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-core"],"pod_name":"orders-6ccc94b59d-kwn5q","workloads":[{"name":"orders","kind":"Deployment"}]},"destination":{"ID":1815,"identity":88001,"cluster_name":"poc1","namespace":"shop-payments","labels":["k8s:app.kubernetes.io/name=payment-gateway","k8s:app.kubernetes.io/part-of=shop","k8s:app=payment-gateway","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-payments","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-payments"],"pod_name":"payment-gateway-6c6846d6b5-85ccg","workloads":[{"name":"payment-gateway","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:43:57.263584534Z"}
+{"flow":{"time":"2026-09-13T14:44:00.145303999Z","uuid":"2a2ece77-5f78-410d-9b03-0be148843169","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"8e:78:de:92:a2:2c","destination":"32:e2:35:68:02:7e"},"IP":{"source":"10.10.4.153","destination":"10.10.4.23","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":33434,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":1176,"identity":68336,"cluster_name":"poc1","namespace":"shop-clients","labels":["k8s:app.kubernetes.io/name=stranger","k8s:app=stranger","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-clients","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-clients"],"pod_name":"stranger"},"destination":{"ID":1815,"identity":88001,"cluster_name":"poc1","namespace":"shop-payments","labels":["k8s:app.kubernetes.io/name=payment-gateway","k8s:app.kubernetes.io/part-of=shop","k8s:app=payment-gateway","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-payments","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-payments"],"pod_name":"payment-gateway-6c6846d6b5-85ccg","workloads":[{"name":"payment-gateway","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:44:00.145303999Z"}
+{"flow":{"time":"2026-09-13T14:44:00.480404279Z","uuid":"be99a0b8-fe73-42d1-83d1-dbd1ed5f0da1","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"8e:78:de:92:a2:2c","destination":"32:e2:35:68:02:7e"},"IP":{"source":"10.10.4.192","destination":"10.10.4.23","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":35378,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":89,"identity":90295,"cluster_name":"poc1","namespace":"shop-edge","labels":["k8s:app.kubernetes.io/name=api-gateway","k8s:app.kubernetes.io/part-of=shop","k8s:app=api-gateway","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-edge","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-edge"],"pod_name":"api-gateway-7d77448bf5-g59cc","workloads":[{"name":"api-gateway","kind":"Deployment"}]},"destination":{"ID":1815,"identity":88001,"cluster_name":"poc1","namespace":"shop-payments","labels":["k8s:app.kubernetes.io/name=payment-gateway","k8s:app.kubernetes.io/part-of=shop","k8s:app=payment-gateway","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-payments","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-payments"],"pod_name":"payment-gateway-6c6846d6b5-85ccg","workloads":[{"name":"payment-gateway","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:44:00.480404279Z"}
+{"flow":{"time":"2026-09-13T14:44:02.301832979Z","uuid":"d872d881-52c6-4bb8-91b5-5f00e7303a96","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"8e:78:de:92:a2:2c","destination":"32:e2:35:68:02:7e"},"IP":{"source":"10.10.4.215","destination":"10.10.4.23","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":50154,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":2867,"identity":123152,"cluster_name":"poc1","namespace":"shop-core","labels":["k8s:app.kubernetes.io/name=orders","k8s:app.kubernetes.io/part-of=shop","k8s:app=orders","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-core","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-core"],"pod_name":"orders-6ccc94b59d-kwn5q","workloads":[{"name":"orders","kind":"Deployment"}]},"destination":{"ID":1815,"identity":88001,"cluster_name":"poc1","namespace":"shop-payments","labels":["k8s:app.kubernetes.io/name=payment-gateway","k8s:app.kubernetes.io/part-of=shop","k8s:app=payment-gateway","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-payments","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-payments"],"pod_name":"payment-gateway-6c6846d6b5-85ccg","workloads":[{"name":"payment-gateway","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:44:02.301832979Z"}
+{"flow":{"time":"2026-09-13T14:44:05.568182469Z","uuid":"0abf08c5-315b-462b-b3ac-cb8883b90cf8","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"8e:78:de:92:a2:2c","destination":"32:e2:35:68:02:7e"},"IP":{"source":"10.10.4.192","destination":"10.10.4.23","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":55656,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":89,"identity":90295,"cluster_name":"poc1","namespace":"shop-edge","labels":["k8s:app.kubernetes.io/name=api-gateway","k8s:app.kubernetes.io/part-of=shop","k8s:app=api-gateway","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-edge","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-edge"],"pod_name":"api-gateway-7d77448bf5-g59cc","workloads":[{"name":"api-gateway","kind":"Deployment"}]},"destination":{"ID":1815,"identity":88001,"cluster_name":"poc1","namespace":"shop-payments","labels":["k8s:app.kubernetes.io/name=payment-gateway","k8s:app.kubernetes.io/part-of=shop","k8s:app=payment-gateway","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-payments","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-payments"],"pod_name":"payment-gateway-6c6846d6b5-85ccg","workloads":[{"name":"payment-gateway","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:44:05.568182469Z"}
+{"flow":{"time":"2026-09-13T14:44:07.174703991Z","uuid":"3dd889c2-4e23-496e-acd1-f4d3a6df1f92","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"8e:78:de:92:a2:2c","destination":"32:e2:35:68:02:7e"},"IP":{"source":"10.10.4.153","destination":"10.10.4.23","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":36834,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":1176,"identity":68336,"cluster_name":"poc1","namespace":"shop-clients","labels":["k8s:app.kubernetes.io/name=stranger","k8s:app=stranger","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-clients","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-clients"],"pod_name":"stranger"},"destination":{"ID":1815,"identity":88001,"cluster_name":"poc1","namespace":"shop-payments","labels":["k8s:app.kubernetes.io/name=payment-gateway","k8s:app.kubernetes.io/part-of=shop","k8s:app=payment-gateway","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-payments","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-payments"],"pod_name":"payment-gateway-6c6846d6b5-85ccg","workloads":[{"name":"payment-gateway","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:44:07.174703991Z"}
+{"flow":{"time":"2026-09-13T14:44:07.328045912Z","uuid":"a41313ea-e682-421b-aa53-4b07b26b24d4","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"8e:78:de:92:a2:2c","destination":"32:e2:35:68:02:7e"},"IP":{"source":"10.10.4.215","destination":"10.10.4.23","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":50158,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":2867,"identity":123152,"cluster_name":"poc1","namespace":"shop-core","labels":["k8s:app.kubernetes.io/name=orders","k8s:app.kubernetes.io/part-of=shop","k8s:app=orders","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-core","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-core"],"pod_name":"orders-6ccc94b59d-kwn5q","workloads":[{"name":"orders","kind":"Deployment"}]},"destination":{"ID":1815,"identity":88001,"cluster_name":"poc1","namespace":"shop-payments","labels":["k8s:app.kubernetes.io/name=payment-gateway","k8s:app.kubernetes.io/part-of=shop","k8s:app=payment-gateway","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-payments","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-payments"],"pod_name":"payment-gateway-6c6846d6b5-85ccg","workloads":[{"name":"payment-gateway","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:44:07.328045912Z"}
+{"flow":{"time":"2026-09-13T14:44:10.629208829Z","uuid":"9c879dc2-acb1-4493-8bd9-4904011cfe3d","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"8e:78:de:92:a2:2c","destination":"32:e2:35:68:02:7e"},"IP":{"source":"10.10.4.192","destination":"10.10.4.23","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":55664,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":89,"identity":90295,"cluster_name":"poc1","namespace":"shop-edge","labels":["k8s:app.kubernetes.io/name=api-gateway","k8s:app.kubernetes.io/part-of=shop","k8s:app=api-gateway","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-edge","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-edge"],"pod_name":"api-gateway-7d77448bf5-g59cc","workloads":[{"name":"api-gateway","kind":"Deployment"}]},"destination":{"ID":1815,"identity":88001,"cluster_name":"poc1","namespace":"shop-payments","labels":["k8s:app.kubernetes.io/name=payment-gateway","k8s:app.kubernetes.io/part-of=shop","k8s:app=payment-gateway","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-payments","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-payments"],"pod_name":"payment-gateway-6c6846d6b5-85ccg","workloads":[{"name":"payment-gateway","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:44:10.629208829Z"}
+{"flow":{"time":"2026-09-13T14:44:12.361056883Z","uuid":"672f7d63-ed45-4782-81ee-5b55d8f6cbfd","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"8e:78:de:92:a2:2c","destination":"32:e2:35:68:02:7e"},"IP":{"source":"10.10.4.215","destination":"10.10.4.23","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":56390,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":2867,"identity":123152,"cluster_name":"poc1","namespace":"shop-core","labels":["k8s:app.kubernetes.io/name=orders","k8s:app.kubernetes.io/part-of=shop","k8s:app=orders","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-core","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-core"],"pod_name":"orders-6ccc94b59d-kwn5q","workloads":[{"name":"orders","kind":"Deployment"}]},"destination":{"ID":1815,"identity":88001,"cluster_name":"poc1","namespace":"shop-payments","labels":["k8s:app.kubernetes.io/name=payment-gateway","k8s:app.kubernetes.io/part-of=shop","k8s:app=payment-gateway","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-payments","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-payments"],"pod_name":"payment-gateway-6c6846d6b5-85ccg","workloads":[{"name":"payment-gateway","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:44:12.361056883Z"}
+{"flow":{"time":"2026-09-13T14:44:14.194685095Z","uuid":"879eead2-0a84-49ae-8a15-0f96baee1e7b","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"8e:78:de:92:a2:2c","destination":"32:e2:35:68:02:7e"},"IP":{"source":"10.10.4.153","destination":"10.10.4.23","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":33456,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":1176,"identity":68336,"cluster_name":"poc1","namespace":"shop-clients","labels":["k8s:app.kubernetes.io/name=stranger","k8s:app=stranger","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-clients","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-clients"],"pod_name":"stranger"},"destination":{"ID":1815,"identity":88001,"cluster_name":"poc1","namespace":"shop-payments","labels":["k8s:app.kubernetes.io/name=payment-gateway","k8s:app.kubernetes.io/part-of=shop","k8s:app=payment-gateway","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-payments","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-payments"],"pod_name":"payment-gateway-6c6846d6b5-85ccg","workloads":[{"name":"payment-gateway","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:44:14.194685095Z"}
+{"flow":{"time":"2026-09-13T14:44:15.705147062Z","uuid":"dca522db-3e62-4bd6-bd27-adfc45667b3c","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"8e:78:de:92:a2:2c","destination":"32:e2:35:68:02:7e"},"IP":{"source":"10.10.4.192","destination":"10.10.4.23","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":46034,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":89,"identity":90295,"cluster_name":"poc1","namespace":"shop-edge","labels":["k8s:app.kubernetes.io/name=api-gateway","k8s:app.kubernetes.io/part-of=shop","k8s:app=api-gateway","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-edge","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-edge"],"pod_name":"api-gateway-7d77448bf5-g59cc","workloads":[{"name":"api-gateway","kind":"Deployment"}]},"destination":{"ID":1815,"identity":88001,"cluster_name":"poc1","namespace":"shop-payments","labels":["k8s:app.kubernetes.io/name=payment-gateway","k8s:app.kubernetes.io/part-of=shop","k8s:app=payment-gateway","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-payments","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-payments"],"pod_name":"payment-gateway-6c6846d6b5-85ccg","workloads":[{"name":"payment-gateway","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:44:15.705147062Z"}
+{"flow":{"time":"2026-09-13T14:44:17.398673854Z","uuid":"3363e4c2-5f71-4653-9fcc-714083e8f79d","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"8e:78:de:92:a2:2c","destination":"32:e2:35:68:02:7e"},"IP":{"source":"10.10.4.215","destination":"10.10.4.23","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":56396,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":2867,"identity":123152,"cluster_name":"poc1","namespace":"shop-core","labels":["k8s:app.kubernetes.io/name=orders","k8s:app.kubernetes.io/part-of=shop","k8s:app=orders","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-core","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-core"],"pod_name":"orders-6ccc94b59d-kwn5q","workloads":[{"name":"orders","kind":"Deployment"}]},"destination":{"ID":1815,"identity":88001,"cluster_name":"poc1","namespace":"shop-payments","labels":["k8s:app.kubernetes.io/name=payment-gateway","k8s:app.kubernetes.io/part-of=shop","k8s:app=payment-gateway","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-payments","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-payments"],"pod_name":"payment-gateway-6c6846d6b5-85ccg","workloads":[{"name":"payment-gateway","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:44:17.398673854Z"}
+{"flow":{"time":"2026-09-13T14:43:54.982397009Z","uuid":"19ea4f72-b697-4a15-b2a1-5b9690ef7a19","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"a2:42:8e:8a:b4:ba","destination":"5e:d1:15:ad:51:76"},"IP":{"source":"10.10.4.23","destination":"10.10.4.47","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":47730,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":1815,"identity":88001,"cluster_name":"poc1","namespace":"shop-payments","labels":["k8s:app.kubernetes.io/name=payment-gateway","k8s:app.kubernetes.io/part-of=shop","k8s:app=payment-gateway","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-payments","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-payments"],"pod_name":"payment-gateway-6c6846d6b5-85ccg","workloads":[{"name":"payment-gateway","kind":"Deployment"}]},"destination":{"ID":131,"identity":77795,"cluster_name":"poc1","namespace":"shop-merchant","labels":["k8s:app.kubernetes.io/name=merchant","k8s:app.kubernetes.io/part-of=shop","k8s:app=merchant","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-merchant","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-merchant"],"pod_name":"merchant-5c5cc7d9b6-zwn4s","workloads":[{"name":"merchant","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:43:54.982397009Z"}
+{"flow":{"time":"2026-09-13T14:44:00.999414634Z","uuid":"e92032df-e714-433a-98fa-c7b259c57c5f","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"a2:42:8e:8a:b4:ba","destination":"5e:d1:15:ad:51:76"},"IP":{"source":"10.10.4.23","destination":"10.10.4.47","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":47746,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":1815,"identity":88001,"cluster_name":"poc1","namespace":"shop-payments","labels":["k8s:app.kubernetes.io/name=payment-gateway","k8s:app.kubernetes.io/part-of=shop","k8s:app=payment-gateway","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-payments","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-payments"],"pod_name":"payment-gateway-6c6846d6b5-85ccg","workloads":[{"name":"payment-gateway","kind":"Deployment"}]},"destination":{"ID":131,"identity":77795,"cluster_name":"poc1","namespace":"shop-merchant","labels":["k8s:app.kubernetes.io/name=merchant","k8s:app.kubernetes.io/part-of=shop","k8s:app=merchant","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-merchant","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-merchant"],"pod_name":"merchant-5c5cc7d9b6-zwn4s","workloads":[{"name":"merchant","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:44:00.999414634Z"}
+{"flow":{"time":"2026-09-13T14:44:07.019196265Z","uuid":"79656a6b-ac67-47bb-927e-3180a3aec90b","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"a2:42:8e:8a:b4:ba","destination":"5e:d1:15:ad:51:76"},"IP":{"source":"10.10.4.23","destination":"10.10.4.47","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":54100,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":1815,"identity":88001,"cluster_name":"poc1","namespace":"shop-payments","labels":["k8s:app.kubernetes.io/name=payment-gateway","k8s:app.kubernetes.io/part-of=shop","k8s:app=payment-gateway","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-payments","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-payments"],"pod_name":"payment-gateway-6c6846d6b5-85ccg","workloads":[{"name":"payment-gateway","kind":"Deployment"}]},"destination":{"ID":131,"identity":77795,"cluster_name":"poc1","namespace":"shop-merchant","labels":["k8s:app.kubernetes.io/name=merchant","k8s:app.kubernetes.io/part-of=shop","k8s:app=merchant","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-merchant","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-merchant"],"pod_name":"merchant-5c5cc7d9b6-zwn4s","workloads":[{"name":"merchant","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:44:07.019196265Z"}
+{"flow":{"time":"2026-09-13T14:44:13.031459748Z","uuid":"30bdec7a-c088-4c28-9dfb-1da331f19d7b","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"a2:42:8e:8a:b4:ba","destination":"5e:d1:15:ad:51:76"},"IP":{"source":"10.10.4.23","destination":"10.10.4.47","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":36352,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":1815,"identity":88001,"cluster_name":"poc1","namespace":"shop-payments","labels":["k8s:app.kubernetes.io/name=payment-gateway","k8s:app.kubernetes.io/part-of=shop","k8s:app=payment-gateway","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-payments","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-payments"],"pod_name":"payment-gateway-6c6846d6b5-85ccg","workloads":[{"name":"payment-gateway","kind":"Deployment"}]},"destination":{"ID":131,"identity":77795,"cluster_name":"poc1","namespace":"shop-merchant","labels":["k8s:app.kubernetes.io/name=merchant","k8s:app.kubernetes.io/part-of=shop","k8s:app=merchant","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-merchant","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-merchant"],"pod_name":"merchant-5c5cc7d9b6-zwn4s","workloads":[{"name":"merchant","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:44:13.031459748Z"}
+{"flow":{"time":"2026-09-13T14:43:50.309540184Z","uuid":"47553ae9-79bb-4bf3-9886-65b25f9a1f6e","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"d6:d3:50:8a:6d:c9","destination":"ee:5f:96:7d:6b:77"},"IP":{"source":"10.10.4.192","destination":"10.10.4.154","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":51048,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":89,"identity":90295,"cluster_name":"poc1","namespace":"shop-edge","labels":["k8s:app.kubernetes.io/name=api-gateway","k8s:app.kubernetes.io/part-of=shop","k8s:app=api-gateway","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-edge","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-edge"],"pod_name":"api-gateway-7d77448bf5-g59cc","workloads":[{"name":"api-gateway","kind":"Deployment"}]},"destination":{"ID":2457,"identity":130126,"cluster_name":"poc1","namespace":"shop-reviews","labels":["k8s:app.kubernetes.io/name=reviews","k8s:app.kubernetes.io/part-of=shop","k8s:app=reviews","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-reviews","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-reviews"],"pod_name":"reviews-768b7bd9b6-pvj42","workloads":[{"name":"reviews","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:43:50.309540184Z"}
+{"flow":{"time":"2026-09-13T14:43:50.419717867Z","uuid":"2892c302-a88c-49f5-b753-4bea029ca6bf","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"d6:d3:50:8a:6d:c9","destination":"ee:5f:96:7d:6b:77"},"IP":{"source":"10.10.4.22","destination":"10.10.4.154","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":60854,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":2452,"identity":75551,"cluster_name":"poc1","namespace":"shop-reviews","labels":["k8s:app.kubernetes.io/name=ratings","k8s:app.kubernetes.io/part-of=shop","k8s:app=ratings","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-reviews","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-reviews"],"pod_name":"ratings"},"destination":{"ID":2457,"identity":130126,"cluster_name":"poc1","namespace":"shop-reviews","labels":["k8s:app.kubernetes.io/name=reviews","k8s:app.kubernetes.io/part-of=shop","k8s:app=reviews","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-reviews","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-reviews"],"pod_name":"reviews-768b7bd9b6-pvj42","workloads":[{"name":"reviews","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:43:50.419717867Z"}
+{"flow":{"time":"2026-09-13T14:43:55.395377454Z","uuid":"63860de9-66b6-42b8-a201-2b2114b3603e","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"d6:d3:50:8a:6d:c9","destination":"ee:5f:96:7d:6b:77"},"IP":{"source":"10.10.4.192","destination":"10.10.4.154","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":54368,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":89,"identity":90295,"cluster_name":"poc1","namespace":"shop-edge","labels":["k8s:app.kubernetes.io/name=api-gateway","k8s:app.kubernetes.io/part-of=shop","k8s:app=api-gateway","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-edge","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-edge"],"pod_name":"api-gateway-7d77448bf5-g59cc","workloads":[{"name":"api-gateway","kind":"Deployment"}]},"destination":{"ID":2457,"identity":130126,"cluster_name":"poc1","namespace":"shop-reviews","labels":["k8s:app.kubernetes.io/name=reviews","k8s:app.kubernetes.io/part-of=shop","k8s:app=reviews","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-reviews","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-reviews"],"pod_name":"reviews-768b7bd9b6-pvj42","workloads":[{"name":"reviews","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:43:55.395377454Z"}
+{"flow":{"time":"2026-09-13T14:43:56.470770693Z","uuid":"bac6fef4-7cdd-4829-abe2-371046dabe3d","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"d6:d3:50:8a:6d:c9","destination":"ee:5f:96:7d:6b:77"},"IP":{"source":"10.10.4.22","destination":"10.10.4.154","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":35528,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":2452,"identity":75551,"cluster_name":"poc1","namespace":"shop-reviews","labels":["k8s:app.kubernetes.io/name=ratings","k8s:app.kubernetes.io/part-of=shop","k8s:app=ratings","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-reviews","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-reviews"],"pod_name":"ratings"},"destination":{"ID":2457,"identity":130126,"cluster_name":"poc1","namespace":"shop-reviews","labels":["k8s:app.kubernetes.io/name=reviews","k8s:app.kubernetes.io/part-of=shop","k8s:app=reviews","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-reviews","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-reviews"],"pod_name":"reviews-768b7bd9b6-pvj42","workloads":[{"name":"reviews","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:43:56.470770693Z"}
+{"flow":{"time":"2026-09-13T14:44:00.466866500Z","uuid":"818d2d49-0b56-4a85-8c89-27cb336143fd","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"d6:d3:50:8a:6d:c9","destination":"ee:5f:96:7d:6b:77"},"IP":{"source":"10.10.4.192","destination":"10.10.4.154","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":54372,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":89,"identity":90295,"cluster_name":"poc1","namespace":"shop-edge","labels":["k8s:app.kubernetes.io/name=api-gateway","k8s:app.kubernetes.io/part-of=shop","k8s:app=api-gateway","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-edge","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-edge"],"pod_name":"api-gateway-7d77448bf5-g59cc","workloads":[{"name":"api-gateway","kind":"Deployment"}]},"destination":{"ID":2457,"identity":130126,"cluster_name":"poc1","namespace":"shop-reviews","labels":["k8s:app.kubernetes.io/name=reviews","k8s:app.kubernetes.io/part-of=shop","k8s:app=reviews","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-reviews","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-reviews"],"pod_name":"reviews-768b7bd9b6-pvj42","workloads":[{"name":"reviews","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:44:00.466866500Z"}
+{"flow":{"time":"2026-09-13T14:44:02.515391671Z","uuid":"90e697d1-2d75-4b2f-9a9d-4e82e0be5f68","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"d6:d3:50:8a:6d:c9","destination":"ee:5f:96:7d:6b:77"},"IP":{"source":"10.10.4.22","destination":"10.10.4.154","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":59072,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":2452,"identity":75551,"cluster_name":"poc1","namespace":"shop-reviews","labels":["k8s:app.kubernetes.io/name=ratings","k8s:app.kubernetes.io/part-of=shop","k8s:app=ratings","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-reviews","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-reviews"],"pod_name":"ratings"},"destination":{"ID":2457,"identity":130126,"cluster_name":"poc1","namespace":"shop-reviews","labels":["k8s:app.kubernetes.io/name=reviews","k8s:app.kubernetes.io/part-of=shop","k8s:app=reviews","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-reviews","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-reviews"],"pod_name":"reviews-768b7bd9b6-pvj42","workloads":[{"name":"reviews","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:44:02.515391671Z"}
+{"flow":{"time":"2026-09-13T14:44:05.545806103Z","uuid":"81ff2561-8745-4455-b954-b7ee05e3c4a6","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"d6:d3:50:8a:6d:c9","destination":"ee:5f:96:7d:6b:77"},"IP":{"source":"10.10.4.192","destination":"10.10.4.154","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":33776,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":89,"identity":90295,"cluster_name":"poc1","namespace":"shop-edge","labels":["k8s:app.kubernetes.io/name=api-gateway","k8s:app.kubernetes.io/part-of=shop","k8s:app=api-gateway","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-edge","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-edge"],"pod_name":"api-gateway-7d77448bf5-g59cc","workloads":[{"name":"api-gateway","kind":"Deployment"}]},"destination":{"ID":2457,"identity":130126,"cluster_name":"poc1","namespace":"shop-reviews","labels":["k8s:app.kubernetes.io/name=reviews","k8s:app.kubernetes.io/part-of=shop","k8s:app=reviews","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-reviews","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-reviews"],"pod_name":"reviews-768b7bd9b6-pvj42","workloads":[{"name":"reviews","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:44:05.545806103Z"}
+{"flow":{"time":"2026-09-13T14:44:08.537192809Z","uuid":"7d4acfeb-6499-41e4-867c-1dec8cf72bfb","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"d6:d3:50:8a:6d:c9","destination":"ee:5f:96:7d:6b:77"},"IP":{"source":"10.10.4.22","destination":"10.10.4.154","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":59078,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":2452,"identity":75551,"cluster_name":"poc1","namespace":"shop-reviews","labels":["k8s:app.kubernetes.io/name=ratings","k8s:app.kubernetes.io/part-of=shop","k8s:app=ratings","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-reviews","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-reviews"],"pod_name":"ratings"},"destination":{"ID":2457,"identity":130126,"cluster_name":"poc1","namespace":"shop-reviews","labels":["k8s:app.kubernetes.io/name=reviews","k8s:app.kubernetes.io/part-of=shop","k8s:app=reviews","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-reviews","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-reviews"],"pod_name":"reviews-768b7bd9b6-pvj42","workloads":[{"name":"reviews","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:44:08.537192809Z"}
+{"flow":{"time":"2026-09-13T14:44:10.612240922Z","uuid":"ecf9909f-610e-4da5-a3e9-2d5c902423de","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"d6:d3:50:8a:6d:c9","destination":"ee:5f:96:7d:6b:77"},"IP":{"source":"10.10.4.192","destination":"10.10.4.154","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":33778,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":89,"identity":90295,"cluster_name":"poc1","namespace":"shop-edge","labels":["k8s:app.kubernetes.io/name=api-gateway","k8s:app.kubernetes.io/part-of=shop","k8s:app=api-gateway","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-edge","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-edge"],"pod_name":"api-gateway-7d77448bf5-g59cc","workloads":[{"name":"api-gateway","kind":"Deployment"}]},"destination":{"ID":2457,"identity":130126,"cluster_name":"poc1","namespace":"shop-reviews","labels":["k8s:app.kubernetes.io/name=reviews","k8s:app.kubernetes.io/part-of=shop","k8s:app=reviews","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-reviews","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-reviews"],"pod_name":"reviews-768b7bd9b6-pvj42","workloads":[{"name":"reviews","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:44:10.612240922Z"}
+{"flow":{"time":"2026-09-13T14:44:14.547223396Z","uuid":"e30ccc2a-07f7-4445-a5c8-cfc6c26c7f23","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"d6:d3:50:8a:6d:c9","destination":"ee:5f:96:7d:6b:77"},"IP":{"source":"10.10.4.22","destination":"10.10.4.154","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":47652,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":2452,"identity":75551,"cluster_name":"poc1","namespace":"shop-reviews","labels":["k8s:app.kubernetes.io/name=ratings","k8s:app.kubernetes.io/part-of=shop","k8s:app=ratings","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-reviews","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-reviews"],"pod_name":"ratings"},"destination":{"ID":2457,"identity":130126,"cluster_name":"poc1","namespace":"shop-reviews","labels":["k8s:app.kubernetes.io/name=reviews","k8s:app.kubernetes.io/part-of=shop","k8s:app=reviews","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-reviews","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-reviews"],"pod_name":"reviews-768b7bd9b6-pvj42","workloads":[{"name":"reviews","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:44:14.547223396Z"}
+{"flow":{"time":"2026-09-13T14:44:15.686235984Z","uuid":"6db6dc20-2cd4-4262-b766-1da53b6f061c","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"d6:d3:50:8a:6d:c9","destination":"ee:5f:96:7d:6b:77"},"IP":{"source":"10.10.4.192","destination":"10.10.4.154","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":54448,"destination_port":80,"flags":{"SYN":true}}},"source":{"ID":89,"identity":90295,"cluster_name":"poc1","namespace":"shop-edge","labels":["k8s:app.kubernetes.io/name=api-gateway","k8s:app.kubernetes.io/part-of=shop","k8s:app=api-gateway","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-edge","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-edge"],"pod_name":"api-gateway-7d77448bf5-g59cc","workloads":[{"name":"api-gateway","kind":"Deployment"}]},"destination":{"ID":2457,"identity":130126,"cluster_name":"poc1","namespace":"shop-reviews","labels":["k8s:app.kubernetes.io/name=reviews","k8s:app.kubernetes.io/part-of=shop","k8s:app=reviews","k8s:io.cilium.k8s.namespace.labels.app.kubernetes.io/part-of=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=shop-reviews","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=shop-reviews"],"pod_name":"reviews-768b7bd9b6-pvj42","workloads":[{"name":"reviews","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker","time":"2026-09-13T14:44:15.686235984Z"}
diff --git a/internal/testdata/golden/35-shop-platform/options.json b/internal/testdata/golden/35-shop-platform/options.json
new file mode 100644
index 0000000..3ebda08
--- /dev/null
+++ b/internal/testdata/golden/35-shop-platform/options.json
@@ -0,0 +1 @@
+{"exclude": "app.kubernetes.io/name=stranger"}
diff --git a/internal/testdata/golden/README.md b/internal/testdata/golden/README.md
new file mode 100644
index 0000000..a0459a8
--- /dev/null
+++ b/internal/testdata/golden/README.md
@@ -0,0 +1,17 @@
+# Golden fixtures
+
+One directory per case: `flows.ndjson` (a Hubble capture from the PoC's demos, verbatim), `options.json` (the
+`/generate` query parameters used), and `expected.yaml` — the multi-document answer **cf2cnp 0.6.3** gave for that
+input, captured through `serve` on 2026-09-13. `TestGolden` in `internal/policy` asserts the current code reproduces
+every `expected.yaml` byte for byte; a deliberate change of output regenerates the file in the same commit and says why.
+Regenerate with `hack/golden/regenerate.sh <binary>`.
+
+## Deliberate differences from 0.6.3
+
+- `31-pos-egress-cidr` (regenerated with 0.7.0): 0.6.3 printed the "The DNS rule below turns the DNS proxy on …"
+  comment under the CIDR whenever the document mentioned `k8s-app: kube-dns` — here that was the **plain** 53/UDP rule
+  the pod's own lookup produced, which turns no proxy on. The comment is now tied to an actual `rules.dns` block.
+- `31-pos-fqdn`, `31-pos-dns-visibility` (regenerated on the review of 0.7.0, Codex C9): the resolver rule's
+  protocol is `ANY`, not the observed `UDP` — a lookup whose UDP answer is truncated retries over TCP, and the
+  UDP-only rule 0.6.3 wrote denies that retry under default-deny egress. Cilium's own examples write `ANY`. The
+  description says `ANY/53`.
diff --git a/internal/testdata/ingress-pos-to-shop.json b/internal/testdata/ingress-pos-to-shop.json
new file mode 100644
index 0000000..4065de4
--- /dev/null
+++ b/internal/testdata/ingress-pos-to-shop.json
@@ -0,0 +1 @@
+{"flow":{"time":"2026-09-12T23:35:40.070891704Z","uuid":"e8bd1ea8-7f6d-419b-97d0-8e8e05e867a2","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"3e:c8:bc:d2:45:74","destination":"9a:95:6d:a3:3c:ba"},"IP":{"source":"10.10.4.93","destination":"10.10.3.7","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":45248,"destination_port":80,"flags":{"SYN":true}}},"source":{"identity":82359,"cluster_name":"poc1","namespace":"cf2cnp-lab","labels":["k8s:app.kubernetes.io/name=pos","k8s:app=pos","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab"],"pod_name":"pos"},"destination":{"ID":1955,"identity":94334,"cluster_name":"poc1","namespace":"cf2cnp-lab","labels":["k8s:app.kubernetes.io/name=shop","k8s:app=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab"],"pod_name":"shop-6d7d797759-4ddlt","workloads":[{"name":"shop","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-12T23:35:40.070891704Z"}
diff --git a/internal/testdata/ingress-stranger-to-shop.json b/internal/testdata/ingress-stranger-to-shop.json
new file mode 100644
index 0000000..2e549fb
--- /dev/null
+++ b/internal/testdata/ingress-stranger-to-shop.json
@@ -0,0 +1 @@
+{"flow":{"time":"2026-09-12T23:35:42.738361432Z","uuid":"034db8e8-0240-4582-b94d-47a3411ab5d5","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"3e:c8:bc:d2:45:74","destination":"9a:95:6d:a3:3c:ba"},"IP":{"source":"10.10.4.3","destination":"10.10.3.7","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":35528,"destination_port":80,"flags":{"SYN":true}}},"source":{"identity":117659,"cluster_name":"poc1","namespace":"cf2cnp-lab","labels":["k8s:app.kubernetes.io/name=stranger","k8s:app=stranger","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab"],"pod_name":"stranger"},"destination":{"ID":1955,"identity":94334,"cluster_name":"poc1","namespace":"cf2cnp-lab","labels":["k8s:app.kubernetes.io/name=shop","k8s:app=shop","k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=cf2cnp-lab","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=cf2cnp-lab"],"pod_name":"shop-6d7d797759-4ddlt","workloads":[{"name":"shop","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-12T23:35:42.738361432Z"}
diff --git a/internal/testdata/ingress-world-cidr-to-receiver.json b/internal/testdata/ingress-world-cidr-to-receiver.json
new file mode 100644
index 0000000..0b9cc99
--- /dev/null
+++ b/internal/testdata/ingress-world-cidr-to-receiver.json
@@ -0,0 +1,72 @@
+{
+  "flow": {
+    "time": "2026-09-12T23:35:40.070891704Z",
+    "uuid": "e8bd1ea8-7f6d-419b-97d0-8e8e05e867a2",
+    "emitter": {
+      "name": "Hubble",
+      "version": "1.20.1+g7d68cfb3"
+    },
+    "verdict": "AUDIT",
+    "ethernet": {
+      "source": "3e:c8:bc:d2:45:74",
+      "destination": "9a:95:6d:a3:3c:ba"
+    },
+    "IP": {
+      "source": "172.18.255.170",
+      "destination": "10.10.3.7",
+      "ipVersion": "IPv4"
+    },
+    "l4": {
+      "TCP": {
+        "source_port": 45248,
+        "destination_port": 80,
+        "flags": {
+          "SYN": true
+        }
+      }
+    },
+    "source": {
+      "identity": 2,
+      "labels": [
+        "reserved:world"
+      ]
+    },
+    "destination": {
+      "ID": 1955,
+      "identity": 94334,
+      "cluster_name": "poc1",
+      "namespace": "ns-recv",
+      "labels": [
+        "k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=ns-recv",
+        "k8s:io.cilium.k8s.policy.cluster=poc1",
+        "k8s:io.cilium.k8s.policy.serviceaccount=default",
+        "k8s:io.kubernetes.pod.namespace=ns-recv",
+        "k8s:app.kubernetes.io/name=receiver"
+      ],
+      "pod_name": "receiver-7c9d8b6f5-x2k4q",
+      "workloads": [
+        {
+          "name": "shop",
+          "kind": "Deployment"
+        }
+      ]
+    },
+    "Type": "L3_L4",
+    "node_name": "poc1/poc1-worker2",
+    "node_labels": [
+      "beta.kubernetes.io/arch=amd64",
+      "beta.kubernetes.io/os=linux",
+      "kubernetes.io/arch=amd64",
+      "kubernetes.io/hostname=poc1-worker2",
+      "kubernetes.io/os=linux"
+    ],
+    "event_type": {
+      "type": 5
+    },
+    "traffic_direction": "INGRESS",
+    "is_reply": false,
+    "Summary": "TCP Flags: SYN"
+  },
+  "node_name": "poc1/poc1-worker2",
+  "time": "2026-09-12T23:35:40.070891704Z"
+}
diff --git a/internal/testdata/ingress-world-ipv4-cidr-to-receiver.json b/internal/testdata/ingress-world-ipv4-cidr-to-receiver.json
new file mode 100644
index 0000000..3994c51
--- /dev/null
+++ b/internal/testdata/ingress-world-ipv4-cidr-to-receiver.json
@@ -0,0 +1 @@
+{"flow":{"time":"2026-09-12T23:35:40.070891704Z","uuid":"e8bd1ea8-7f6d-419b-97d0-8e8e05e867a2","emitter":{"name":"Hubble","version":"1.20.1+g7d68cfb3"},"verdict":"AUDIT","ethernet":{"source":"3e:c8:bc:d2:45:74","destination":"9a:95:6d:a3:3c:ba"},"IP":{"source":"172.18.255.170","destination":"10.10.3.7","ipVersion":"IPv4"},"l4":{"TCP":{"source_port":45248,"destination_port":80,"flags":{"SYN":true}}},"source":{"identity":9,"labels":["reserved:world-ipv4"]},"destination":{"ID":1955,"identity":94334,"cluster_name":"poc1","namespace":"ns-recv","labels":["k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=ns-recv","k8s:io.cilium.k8s.policy.cluster=poc1","k8s:io.cilium.k8s.policy.serviceaccount=default","k8s:io.kubernetes.pod.namespace=ns-recv","k8s:app.kubernetes.io/name=receiver"],"pod_name":"receiver-7c9d8b6f5-x2k4q","workloads":[{"name":"shop","kind":"Deployment"}]},"Type":"L3_L4","node_name":"poc1/poc1-worker2","node_labels":["beta.kubernetes.io/arch=amd64","beta.kubernetes.io/os=linux","kubernetes.io/arch=amd64","kubernetes.io/hostname=poc1-worker2","kubernetes.io/os=linux"],"event_type":{"type":5},"traffic_direction":"INGRESS","is_reply":false,"Summary":"TCP Flags: SYN"},"node_name":"poc1/poc1-worker2","time":"2026-09-12T23:35:40.070891704Z"}
\ No newline at end of file
diff --git a/internal/testdata/ingress-world6-cidr-to-receiver.json b/internal/testdata/ingress-world6-cidr-to-receiver.json
new file mode 100644
index 0000000..2c0ba81
--- /dev/null
+++ b/internal/testdata/ingress-world6-cidr-to-receiver.json
@@ -0,0 +1,72 @@
+{
+  "flow": {
+    "time": "2026-09-12T23:35:40.070891704Z",
+    "uuid": "e8bd1ea8-7f6d-419b-97d0-8e8e05e867a2",
+    "emitter": {
+      "name": "Hubble",
+      "version": "1.20.1+g7d68cfb3"
+    },
+    "verdict": "AUDIT",
+    "ethernet": {
+      "source": "3e:c8:bc:d2:45:74",
+      "destination": "9a:95:6d:a3:3c:ba"
+    },
+    "IP": {
+      "source": "2001:db8::170",
+      "destination": "10.10.3.7",
+      "ipVersion": "IPv6"
+    },
+    "l4": {
+      "TCP": {
+        "source_port": 45248,
+        "destination_port": 80,
+        "flags": {
+          "SYN": true
+        }
+      }
+    },
+    "source": {
+      "identity": 2,
+      "labels": [
+        "reserved:world"
+      ]
+    },
+    "destination": {
+      "ID": 1955,
+      "identity": 94334,
+      "cluster_name": "poc1",
+      "namespace": "ns-recv",
+      "labels": [
+        "k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=ns-recv",
+        "k8s:io.cilium.k8s.policy.cluster=poc1",
+        "k8s:io.cilium.k8s.policy.serviceaccount=default",
+        "k8s:io.kubernetes.pod.namespace=ns-recv",
+        "k8s:app.kubernetes.io/name=receiver"
+      ],
+      "pod_name": "receiver-7c9d8b6f5-x2k4q",
+      "workloads": [
+        {
+          "name": "shop",
+          "kind": "Deployment"
+        }
+      ]
+    },
+    "Type": "L3_L4",
+    "node_name": "poc1/poc1-worker2",
+    "node_labels": [
+      "beta.kubernetes.io/arch=amd64",
+      "beta.kubernetes.io/os=linux",
+      "kubernetes.io/arch=amd64",
+      "kubernetes.io/hostname=poc1-worker2",
+      "kubernetes.io/os=linux"
+    ],
+    "event_type": {
+      "type": 5
+    },
+    "traffic_direction": "INGRESS",
+    "is_reply": false,
+    "Summary": "TCP Flags: SYN"
+  },
+  "node_name": "poc1/poc1-worker2",
+  "time": "2026-09-12T23:35:40.070891704Z"
+}
diff --git a/internal/testdata/l7-dns-request.json b/internal/testdata/l7-dns-request.json
new file mode 100644
index 0000000..6329276
--- /dev/null
+++ b/internal/testdata/l7-dns-request.json
@@ -0,0 +1 @@
+{"flow": {"time": "2026-09-13T04:30:10.495657798Z", "uuid": "b1bc7cbf-d212-4b15-bd6f-9c7778132e4f", "emitter": {"name": "Hubble", "version": "1.20.1+g7d68cfb3"}, "verdict": "FORWARDED", "IP": {"source": "10.10.4.135", "destination": "10.10.0.232", "ipVersion": "IPv4"}, "l4": {"UDP": {"source_port": 42270, "destination_port": 53}}, "source": {"ID": 1466, "identity": 103600, "cluster_name": "poc1", "namespace": "bank", "labels": ["k8s:app=api", "k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=bank", "k8s:io.cilium.k8s.policy.cluster=poc1", "k8s:io.cilium.k8s.policy.serviceaccount=default", "k8s:io.kubernetes.pod.namespace=bank"], "pod_name": "api-5d6d8cfd55-sj27m", "workloads": [{"name": "api", "kind": "Deployment"}]}, "destination": {"identity": 80806, "cluster_name": "poc1", "namespace": "kube-system", "labels": ["gen:io.cilium.k8s.named-ports-1=metrics.TCP.9153_readiness-probe.TCP.8181", "gen:io.cilium.k8s.named-ports=dns.UDP.53_dns-tcp.TCP.53_liveness-probe.TCP.8080", "k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=kube-system", "k8s:io.cilium.k8s.policy.cluster=poc1", "k8s:io.cilium.k8s.policy.serviceaccount=coredns", "k8s:io.kubernetes.pod.namespace=kube-system", "k8s:k8s-app=kube-dns"], "pod_name": "coredns-789c5fbdb4-vb8r9"}, "Type": "L7", "node_name": "poc1/poc1-worker", "node_labels": ["beta.kubernetes.io/arch=amd64", "beta.kubernetes.io/os=linux", "kubernetes.io/arch=amd64", "kubernetes.io/hostname=poc1-worker", "kubernetes.io/os=linux"], "l7": {"type": "REQUEST", "dns": {"query": "accounts.bank.svc.cluster.local.bank.svc.cluster.local.", "observation_source": "proxy", "qtypes": ["AAAA"]}}, "event_type": {"type": 129}, "traffic_direction": "EGRESS", "is_reply": false, "Summary": "DNS Query accounts.bank.svc.cluster.local.bank.svc.cluster.local. AAAA"}, "node_name": "poc1/poc1-worker", "time": "2026-09-13T04:30:10.495657798Z"}
\ No newline at end of file
diff --git a/internal/testdata/l7-dns-response.json b/internal/testdata/l7-dns-response.json
new file mode 100644
index 0000000..8c0c342
--- /dev/null
+++ b/internal/testdata/l7-dns-response.json
@@ -0,0 +1 @@
+{"flow": {"time": "2026-09-13T04:30:10.495657798Z", "uuid": "b1bc7cbf-d212-4b15-bd6f-9c7778132e4f", "emitter": {"name": "Hubble", "version": "1.20.1+g7d68cfb3"}, "verdict": "FORWARDED", "IP": {"source": "10.10.4.135", "destination": "10.10.0.232", "ipVersion": "IPv4"}, "l4": {"UDP": {"source_port": 42270, "destination_port": 53}}, "source": {"ID": 1466, "identity": 103600, "cluster_name": "poc1", "namespace": "bank", "labels": ["k8s:app=api", "k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=bank", "k8s:io.cilium.k8s.policy.cluster=poc1", "k8s:io.cilium.k8s.policy.serviceaccount=default", "k8s:io.kubernetes.pod.namespace=bank"], "pod_name": "api-5d6d8cfd55-sj27m", "workloads": [{"name": "api", "kind": "Deployment"}]}, "destination": {"identity": 80806, "cluster_name": "poc1", "namespace": "kube-system", "labels": ["gen:io.cilium.k8s.named-ports-1=metrics.TCP.9153_readiness-probe.TCP.8181", "gen:io.cilium.k8s.named-ports=dns.UDP.53_dns-tcp.TCP.53_liveness-probe.TCP.8080", "k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=kube-system", "k8s:io.cilium.k8s.policy.cluster=poc1", "k8s:io.cilium.k8s.policy.serviceaccount=coredns", "k8s:io.kubernetes.pod.namespace=kube-system", "k8s:k8s-app=kube-dns"], "pod_name": "coredns-789c5fbdb4-vb8r9"}, "Type": "L7", "node_name": "poc1/poc1-worker", "node_labels": ["beta.kubernetes.io/arch=amd64", "beta.kubernetes.io/os=linux", "kubernetes.io/arch=amd64", "kubernetes.io/hostname=poc1-worker", "kubernetes.io/os=linux"], "l7": {"type": "RESPONSE", "dns": {"query": "accounts.bank.svc.cluster.local.bank.svc.cluster.local.", "observation_source": "proxy", "qtypes": ["AAAA"]}}, "event_type": {"type": 129}, "traffic_direction": "EGRESS", "is_reply": true, "Summary": "DNS Query accounts.bank.svc.cluster.local.bank.svc.cluster.local. AAAA"}, "node_name": "poc1/poc1-worker", "time": "2026-09-13T04:30:10.495657798Z"}
\ No newline at end of file
diff --git a/internal/testdata/l7-http-request.json b/internal/testdata/l7-http-request.json
new file mode 100644
index 0000000..73498e6
--- /dev/null
+++ b/internal/testdata/l7-http-request.json
@@ -0,0 +1 @@
+{"flow": {"time": "2026-09-13T04:30:10.350543170Z", "uuid": "dc36d8ab-50b7-4576-b9aa-5efef2c64ef2", "emitter": {"name": "Hubble", "version": "1.20.1+g7d68cfb3"}, "verdict": "FORWARDED", "IP": {"source": "192.168.64.1", "destination": "10.10.4.135", "ipVersion": "IPv4"}, "l4": {"TCP": {"source_port": 53015, "destination_port": 8080}}, "source": {"identity": 8, "labels": ["reserved:ingress"]}, "destination": {"identity": 103600, "cluster_name": "poc1", "namespace": "bank", "labels": ["k8s:app=api", "k8s:io.cilium.k8s.namespace.labels.kubernetes.io/metadata.name=bank", "k8s:io.cilium.k8s.policy.cluster=poc1", "k8s:io.cilium.k8s.policy.serviceaccount=default", "k8s:io.kubernetes.pod.namespace=bank"], "pod_name": "api-5d6d8cfd55-sj27m"}, "Type": "L7", "node_name": "poc1/poc1-control-plane2", "node_labels": ["beta.kubernetes.io/arch=amd64", "beta.kubernetes.io/os=linux", "kubernetes.io/arch=amd64", "kubernetes.io/hostname=poc1-control-plane2", "kubernetes.io/os=linux", "node-role.kubernetes.io/control-plane=", "node.kubernetes.io/exclude-from-external-load-balancers="], "l7": {"type": "REQUEST", "http": {"method": "GET", "url": "https://bankapi.poc.local/api/balance/chk-1001", "protocol": "HTTP/2", "headers": [{"key": ":scheme", "value": "https"}, {"key": "Accept", "value": "*/*"}, {"key": "User-Agent", "value": "curl/8.7.1"}, {"key": "X-Envoy-Internal", "value": "true"}, {"key": "X-Forwarded-For", "value": "192.168.64.1"}, {"key": "X-Request-Id", "value": "094bf0e5-358f-4368-a1ae-2de156a21120"}]}}, "event_type": {"type": 129}, "traffic_direction": "EGRESS", "is_reply": false, "Summary": "HTTP/2 GET https://bankapi.poc.local/api/balance/chk-1001"}, "node_name": "poc1/poc1-control-plane2", "time": "2026-09-13T04:30:10.350543170Z"}
\ No newline at end of file
diff --git a/renovate.json b/renovate.json
new file mode 100644
index 0000000..05d5bae
--- /dev/null
+++ b/renovate.json
@@ -0,0 +1,19 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["config:recommended"],
+  "postUpdateOptions": ["gomodTidy"],
+  "packageRules": [
+    {
+      "description": "The Cilium module IS the policy spec cf2cnp supports: a bump is a release. The embedded CRD follows the module: run `go generate ./internal/crd` on the bump and commit it. Hosted Renovate (the Mend GitHub App) does NOT run postUpgradeTasks — they run on a self-hosted Renovate only, and only when the command is on its allowedCommands — so CI is the guard: TestEmbeddedCRDVersionMatchesModule and the byte-for-byte cmp fail the PR until the copy is refreshed.",
+      "matchDatasources": ["go"],
+      "matchPackageNames": ["github.com/cilium/cilium"],
+      "groupName": "cilium policy API (the supported CiliumNetworkPolicy spec)",
+      "labels": ["spec-bump"],
+      "postUpgradeTasks": {
+        "commands": ["go generate ./internal/crd"],
+        "fileFilters": ["internal/crd/**"],
+        "executionMode": "update"
+      }
+    }
+  ]
+}