# Deny all ingress/egress in demo namespace. Must add DNS and app-specific egress policies.
# Applying as-is can break a workload; review pod labels and CNI enforcement first.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny
  namespace: demo-only
spec:
  podSelector: {}
  policyTypes: [Ingress, Egress]