apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: restrict-namespace-ingress
spec:
  generateExisting: true
  background: true
  rules:
    - name: add-network-policy
      match:
        any:
          - resources:
              kinds:
                - Namespace
      exclude:
        any:
          - resources:
              namespaces:
                - kube-*
                - d8-*
                - aqua
      generate:
        kind: NetworkPolicy
        apiVersion: networking.k8s.io/v1
        namespace: "{{request.object.metadata.name}}"
        name: restrict-namespace-ingress
        synchronize: true
        data:
          metadata:
            name: restrict-namespace-ingress
          spec:
            podSelector: {}
            policyTypes:
              - Ingress
            ingress:
              - from:
                  - podSelector: {}
              - from:
                  - namespaceSelector:
                      matchLabels:
                        heritage: deckhouse
              - from:
                  - namespaceSelector:
                      matchLabels:
                        kubernetes.io/metadata.name: kube-system
              - from:
                  - namespaceSelector:
                      matchLabels:
                        kubernetes.io/metadata.name: aqua