## First network policy
### Currently it is not possible to allow traffic to specific pod in an external namespace

### This policy is a wrong (but somehow expected) implementation of allowing traffic into default namespace only from pods with label tier=frontend in the vendor-system namespace
### The two items below will be "OR"ed and mainly the PodSelector refers to "this" namespace

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: wrong-allow-traffic-from-specific-pods-in-external-namespace
  namespace: default
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  ingress: 
    - from:
      - namespaceSelector:
          matchLabels:
            unique-label: vendor-systemNameSpace
      - podSelector:
          matchLabels:
            tier: frontend
