apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
   name: allow-from-openshift-ingress
spec:
   ingress:
   - from:
     - namespaceSelector:
         matchLabels:
             network.openshift.io/policy-group: ingress
   podSelector: {}
   policyTypes:
   - Ingress