Invalid example of tenant isolation with CiliumNetworkPolicy

The example cilium network policy for cilium is invalid.

❌ this matches labels on pods, not labels on namespaces

- fromEndpoints:
   - matchLabels:
      capsule.clastix.io/tenant: "{{tenant.name}}"  # Pods in other namespaces with same tenant

❌ fromNamespaces/toNamespaces is not available in CNP

- fromNamespaces:
   - matchLabels:
      company.com/system: "true"  # System namespaces (monitoring, ingress, etc.)
...
- toNamespaces:
   - matchLabels:
     capsule.clastix.io/tenant: "{{tenant.name}}"  # Egress to all tenant namespaces

corrected version:

apiVersion: capsule.clastix.io/v1beta2
kind: GlobalTenantResource
metadata:
  name: default-networkpolicies
  namespace: solar-system
spec:
  resyncPeriod: 60s
  resources:
    - rawItems:
        - apiVersion: cilium.io/v2
          kind: CiliumNetworkPolicy
          metadata:
            name: default-policy
          spec:
            endpointSelector: {}  # Apply to all pods in the namespace
            ingress:
              - fromEndpoints:
                  - matchLabels: {}  # Same namespace pods (intra-namespace)
              - fromEntities:
                  - cluster  # For completeness; can be used to allow internal cluster traffic if needed
              - fromEndpoints:
                  - matchLabels:
                      io.cilium.k8s.namespace.labels.company.com/system: "true"  # System namespaces (monitoring, ingress, etc.)
              - fromEndpoints:
                  - matchLabels:
                      io.cilium.k8s.namespace.labels.capsule.clastix.io/tenant: "{{tenant.name}}"  # Ingress from other namespaces with same tenant
            egress:
              - toCIDR:
                  - 10.96.0.10/32  # kube-dns IP
                toPorts:
                  - ports:
                      - port: "53"
                        protocol: UDP
                      - port: "53"
                        protocol: TCP
              - toEndpoints:
                 - matchLabels:
                     io.cilium.k8s.namespace.labels.capsule.clastix.io/tenant: "{{tenant.name}}"  # Egress to other namespaces with same tenant

Open the networking documentation at the linked “non-native network policies” section and compare the rendered CiliumNetworkPolicy example with the corrected YAML in the issue. Update the example so it uses namespace label selectors and supported fields, then verify the page renders the corrected policy and no longer presents the invalid snippets.