apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
    name: allow-rag-server-ingress
    namespace: ai
spec:
    podSelector:
        matchLabels:
            app: rag-server
    policyTypes: ["Ingress"]
    ingress:
        - from:
              - ipBlock: { cidr: 0.0.0.0/0 }
          ports:
              - { protocol: TCP, port: 8788 }