apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-ingress-protected-b-notebooks
spec:
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          app.kubernetes.io/part-of: kubeflow-profile
      podSelector:
        matchExpressions:
          - key: data.statcan.gc.ca/classification
            operator: In
            values:
              - protected-b
  podSelector:
    matchLabels:
      # This matches minio, not etcd or opa
      app.kubernetes.io/instance: minio-gateway
  policyTypes:
  - Ingress
