apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: gse-ingress-allow
  namespace: gse
spec:
  podSelector: 
    matchLabels:
      app: gse
  policyTypes:
    - Ingress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: projectcontour
          podSelector:
            matchLabels:
              app: envoy
      ports:
        - port: 28657