diff --git a/charts/tractusx-connector/templates/networkpolicy.yaml b/charts/tractusx-connector/templates/networkpolicy.yaml
new file mode 100644
index 000000000..7a40cb6a3
--- /dev/null
+++ b/charts/tractusx-connector/templates/networkpolicy.yaml
@@ -0,0 +1,45 @@
+#
+#  Copyright (c) 2023 Contributors to the Eclipse Foundation
+#
+#  See the NOTICE file(s) distributed with this work for additional
+#  information regarding copyright ownership.
+#
+#  This program and the accompanying materials are made available under the
+#  terms of the Apache License, Version 2.0 which is available at
+#  https://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#  WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#  License for the specific language governing permissions and limitations
+#  under the License.
+#
+#  SPDX-License-Identifier: Apache-2.0
+#
+
+{{- if eq (.Values.networkPolicy.enabled | toString) "true" }}
+{{- range tuple "controlplane" "dataplane" }}
+{{- $name := . }}
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ include "txdc.fullname" $ }}-{{ $name }}
+  labels:
+    {{- include (printf "txdc.%s.labels" $name) $ | nindent 4 }}
+spec:
+  podSelector:
+    matchLabels:
+      {{- include (printf "txdc.%s.selectorLabels" $name) $ | nindent 6 }}
+  ingress:
+    - from:
+      {{- toYaml (index $.Values.networkPolicy $name "from") | nindent 6 }}
+      ports:
+      {{- range $key,$value := (index $.Values $name "endpoints") }}
+        - port: {{ $value.port }}
+          protocol: TCP
+      {{- end }}
+  policyTypes:
+    - Ingress
+---
+{{- end }}
+{{- end }}
diff --git a/charts/tractusx-connector/values.yaml b/charts/tractusx-connector/values.yaml
index 2825a2e7f..a09fcde03 100644
--- a/charts/tractusx-connector/values.yaml
+++ b/charts/tractusx-connector/values.yaml
@@ -543,6 +543,21 @@ daps:
       certificate: ""    # must be set externally!
 backendService:
   httpProxyTokenReceiverUrl: ""
+
+networkPolicy:
+  # -- If `true` network policy will be created to restrict access to control- and dataplane
+  enabled: false
+  # -- Configuration of the controlplane component
+  controlplane:
+    # -- Specify from rule network policy for cp (defaults to all namespaces)
+    from:
+    - namespaceSelector: {}
+  # -- Configuration of the dataplane component
+  dataplane:
+    # -- Specify from rule network policy for dp (defaults to all namespaces)
+    from:
+    - namespaceSelector: {}
+
 serviceAccount:
   # Specifies whether a service account should be created
   create: true