apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: kserve
  namespace: kubeflow
spec:
  podSelector:
    matchExpressions:
      - key: control-plane
        operator: In
        values:
          - kserve-controller-manager # mutating webhook
  # https://www.elastic.co/guide/en/cloud-on-k8s/1.1/k8s-webhook-network-policies.html
  # The kubernetes api server must reach the webhook
  ingress:
    - ports:
        - protocol: TCP
          port: 9443
  policyTypes:
    - Ingress