apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
    name: allow-tools-ingress
    namespace: ai
spec:
    podSelector:
        matchLabels:
            app: tools
    policyTypes: ["Ingress"]
    ingress:
        - from:
              - ipBlock: { cidr: 0.0.0.0/0 }
          ports:
              - { protocol: TCP, port: 1331 }