diff --git a/cesnet-central/deployments/fullhub.yaml b/cesnet-central/deployments/fullhub.yaml
index d0df5cf99a088be969a51e49111e04b17cde7c46..4b9b4ddbab4daf4bc40ede354cd1c0761c00904e 100644
--- a/cesnet-central/deployments/fullhub.yaml
+++ b/cesnet-central/deployments/fullhub.yaml
@@ -39,6 +39,15 @@ singleuser:
     limit: 2
     guarantee: .02
   defaultUrl: "/lab"
+  networkPolicy:
+    egress:
+      - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          serviceSelector:
+            matchLabels:
+              k8s-app: cluster-ingress
   image:
     name: eginotebooks/single-user-eosc
     tag: "sha-dea4fa2"
diff --git a/common/deployments/hub-production.yaml b/common/deployments/hub-production.yaml
index 7cadc18dcd0344dcbd4d9a113c209248925ddc6f..d4242f37418fd9f0d22b13363d7c76c758cf7125 100644
--- a/common/deployments/hub-production.yaml
+++ b/common/deployments/hub-production.yaml
@@ -39,6 +39,15 @@ singleuser:
     limit: 2
     guarantee: .2
   defaultUrl: "/lab"
+  networkPolicy:
+    egress:
+      - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          serviceSelector:
+            matchLabels:
+              k8s-app: cluster-ingress
   image:
     name: eginotebooks/single-user-eosc
     tag: "sha-dea4fa2"
diff --git a/common/deployments/hub-staging.yaml b/common/deployments/hub-staging.yaml
index 6ec841e3698da63c5fc7bfeb9c80640dbefd6120..52f974006904238875b90725af892996703870d5 100644
--- a/common/deployments/hub-staging.yaml
+++ b/common/deployments/hub-staging.yaml
@@ -39,6 +39,15 @@ singleuser:
     limit: 2
     guarantee: .2
   defaultUrl: "/lab"
+  networkPolicy:
+    egress:
+      - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          serviceSelector:
+            matchLabels:
+              k8s-app: cluster-ingress
   image:
     name: eginotebooks/single-user-eosc
     tag: "sha-dea4fa2"
diff --git a/testing/deployments/hub.yaml b/testing/deployments/hub.yaml
index b208d2f4380d3074616ca441c0692abdfb1b770f..92601b2fe761fc4ee7cb5a57168260f39962ebdd 100644
--- a/testing/deployments/hub.yaml
+++ b/testing/deployments/hub.yaml
@@ -40,6 +40,15 @@ singleuser:
     limit: 2
     guarantee: .2
   defaultUrl: "/lab"
+  networkPolicy:
+    egress:
+      - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          serviceSelector:
+            matchLabels:
+              k8s-app: cluster-ingress
   image:
     name: eginotebooks/single-user-eosc
     tag: "sha-dea4fa2"