kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
  name: training-operator-webhook
  namespace: kubeflow
spec:
  podSelector:
    matchExpressions:
    - key: control-plane
      operator: In
      values:
      - kubeflow-training-operator
  # https://www.elastic.co/guide/en/cloud-on-k8s/1.1/k8s-webhook-network-policies.html
  # The kubernetes api server must reach the webhook
  ingress:
  - ports:
    - protocol: TCP
      port: 9443
  policyTypes:
  - Ingress
