gistfile1.txt

apiVersion: crd.projectcalico.org/v1
kind: GlobalNetworkPolicy
metadata:
  name: default-deny-cloud-metadata
spec:
  order: 10
  types:
  - Egress
  namespaceSelector: kaas.foobar.com/allow-cloud-meta != 'true'
  egress:
  - action: Deny
    destination:
      nets:
      - 169.254.169.254/32
---
apiVersion: crd.projectcalico.org/v1
kind: GlobalNetworkPolicy
metadata:
  name: allow-all
spec:
  order: 5000
  types:
  - Egress
  namespaceSelector: kaas.foobar.com/allow-cloud-meta != 'true'
  egress:
  - action: Allow
    destination:
      nets:
      - 0.0.0.0/0