apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
    name: allow-openwebui-ingress
    namespace: ai
spec:
    # Select the Open WebUI pods deployed by the Helm release "openwebui"
    podSelector:
        matchLabels:
            app.kubernetes.io/instance: openwebui
    policyTypes: ["Ingress"]
    ingress:
        - from:
              - ipBlock:
                    cidr: 0.0.0.0/0
          ports:
              # Open WebUI typically listens on 8080 (chart default), sometimes 80
              - { protocol: TCP, port: 8080 }
              - { protocol: TCP, port: 80 }