Update minio and metadata-envoy networkpolicy (kubeflow#2205)

* Update minio.yaml

* Add files via upload

* Update kustomization.yaml

(cherry picked from commit cbc18ec)

contrib/networkpolicies/kustomization.yaml

@@ -13,6 +13,7 @@ resources:
   - kfserving.yaml
   - kserve-models-web-app.yaml
   - kserve.yaml
+  - metatada-envoy.yaml
   - metadata-grpc-server.yaml
   - minio.yaml
   - ml-pipeline-ui.yaml 

contrib/networkpolicies/metadata-envoy.yaml

@@ -0,0 +1,24 @@
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: metatada-envoy
+  namespace: kubeflow
+spec:
+  podSelector:
+    matchExpressions:
+      - key: component
+        operator: In
+        values:
+          - metadata-envoy
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchExpressions:
+              - key: kubernetes.io/metadata.name
+                operator: In
+                values:
+                  - istio-system
+        - podSelector: {}
+  policyTypes:
+    - Ingress
+

contrib/networkpolicies/minio.yaml

@@ -18,6 +18,12 @@ spec:
                 operator: In
                 values:
                   - kubeflow-profile
+        - namespaceSelector:
+            matchExpressions:
+              - key: kubernetes.io/metadata.name
+                operator: In
+                values:
+                  - istio-system
         - podSelector: {} # allow all pods from the same namespace
   policyTypes:
     - Ingress