Update the example of ACNP for zero-trust

[tnqn]

It doesn't make sense that the ACNP for zero-trust denies traffic
from/to Pods but allows external addresses.

Signed-off-by: Quan Tian qtian@vmware.com

[tnqn]

Some people was following the example and realized this was not really zero-trust as it allows external addresses. Please let me know if this change makes sense to you. @Dyanngg @GraysonWu
I also wonder whether we should change the drop rule of strict-ns-isolation to match all addresses instead of pods in other namespaces only.

[Dyanngg]

Thanks for the fix. To me, I feel like we can keep the strict-ns-isolation as is, since by its name it's purpose is suppose to isolate namespaces from each other. However I'm also fine if we change that drop rule to match all, or maybe simply provide a comment saying that if the rule is written like namespaceSelector: {} it only drops from other Namespaces, and empty drops all.

[tnqn]

Thanks for the fix. To me, I feel like we can keep the strict-ns-isolation as is, since by its name it's purpose is suppose to isolate namespaces from each other. However I'm also fine if we change that drop rule to match all, or maybe simply provide a comment saying that if the rule is written like namespaceSelector: {} it only drops from other Namespaces, and empty drops all.

@Dyanngg Sure, I will leave strict-ns-isolation as is.

[tnqn]

/skip-all