diff --git a/contrib/networkpolicies/pvcviewer-webhook b/contrib/networkpolicies/pvcviewer-webhook
new file mode 100644
index 0000000000..dab9816e61
--- /dev/null
+++ b/contrib/networkpolicies/pvcviewer-webhook
@@ -0,0 +1,20 @@
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: pvcviewer-webhook
+  namespace: kubeflow
+spec:
+  podSelector:
+    matchExpressions:
+      - key: app
+        operator: In
+        values:
+          - pvcviewer
+  # https://www.elastic.co/guide/en/cloud-on-k8s/1.1/k8s-webhook-network-policies.html
+  # The kubernetes api server must reach the webhook
+  ingress:
+    - ports:
+        - protocol: TCP
+          port: 9443
+  policyTypes:
+    - Ingress