Invalid example of tenant isolation with CiliumNetworkPolicy

[otahirs]

The example cilium network policy for cilium is invalid.

---

❌ this matches labels on pods, not labels on namespaces

- fromEndpoints:
   - matchLabels:
      capsule.clastix.io/tenant: "{{tenant.name}}"  # Pods in other namespaces with same tenant

---

❌ fromNamespaces/toNamespaces is not available in CNP

- fromNamespaces:
   - matchLabels:
      company.com/system: "true"  # System namespaces (monitoring, ingress, etc.)
...
- toNamespaces:
   - matchLabels:
     capsule.clastix.io/tenant: "{{tenant.name}}"  # Egress to all tenant namespaces

---

corrected version:

apiVersion: capsule.clastix.io/v1beta2
kind: GlobalTenantResource
metadata:
  name: default-networkpolicies
  namespace: solar-system
spec:
  resyncPeriod: 60s
  resources:
    - rawItems:
        - apiVersion: cilium.io/v2
          kind: CiliumNetworkPolicy
          metadata:
            name: default-policy
          spec:
            endpointSelector: {}  # Apply to all pods in the namespace
            ingress:
              - fromEndpoints:
                  - matchLabels: {}  # Same namespace pods (intra-namespace)
              - fromEntities:
                  - cluster  # For completeness; can be used to allow internal cluster traffic if needed
              - fromEndpoints:
                  - matchLabels:
                      io.cilium.k8s.namespace.labels.company.com/system: "true"  # System namespaces (monitoring, ingress, etc.)
              - fromEndpoints:
                  - matchLabels:
                      io.cilium.k8s.namespace.labels.capsule.clastix.io/tenant: "{{tenant.name}}"  # Ingress from other namespaces with same tenant
            egress:
              - toCIDR:
                  - 10.96.0.10/32  # kube-dns IP
                toPorts:
                  - ports:
                      - port: "53"
                        protocol: UDP
                      - port: "53"
                        protocol: TCP
              - toEndpoints:
                 - matchLabels:
                     io.cilium.k8s.namespace.labels.capsule.clastix.io/tenant: "{{tenant.name}}"  # Egress to other namespaces with same tenant