docs: [Policy Assistant] walkthrough demo with use cases and example files

cmd/policy-assistant/examples/demos/walkthrough/demo-deployment-a.yaml

@@ -0,0 +1,46 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  namespace: demo
+  labels:
+    pod: a
+  name: a
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      pod: a
+  template:
+    metadata:
+      labels:
+        pod: a
+    spec:
+      containers:
+      - command:
+        - /agnhost
+        - serve-hostname
+        - --tcp
+        - --http=false
+        - --port
+        - "80"
+        image: registry.k8s.io/e2e-test-images/agnhost:2.43
+        imagePullPolicy: IfNotPresent
+        name: cont-80-tcp
+        ports:
+        - containerPort: 80
+          name: serve-80-tcp
+          protocol: TCP
+      - command:
+        - /agnhost
+        - serve-hostname
+        - --tcp
+        - --http=false
+        - --port
+        - "81"
+        image: registry.k8s.io/e2e-test-images/agnhost:2.43
+        imagePullPolicy: IfNotPresent
+        name: cont-81-tcp
+        ports:
+        - containerPort: 81
+          name: serve-81-tcp
+          protocol: TCP

cmd/policy-assistant/examples/demos/walkthrough/demo-pod-b.yaml

@@ -0,0 +1,37 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  namespace: demo
+  labels:
+    pod: b
+  name: b
+spec:
+  containers:
+  - command:
+    - /agnhost
+    - serve-hostname
+    - --tcp
+    - --http=false
+    - --port
+    - "80"
+    image: registry.k8s.io/e2e-test-images/agnhost:2.43
+    imagePullPolicy: IfNotPresent
+    name: cont-80-tcp
+    ports:
+    - containerPort: 80
+      name: serve-80-tcp
+      protocol: TCP
+  - command:
+    - /agnhost
+    - serve-hostname
+    - --tcp
+    - --http=false
+    - --port
+    - "81"
+    image: registry.k8s.io/e2e-test-images/agnhost:2.43
+    imagePullPolicy: IfNotPresent
+    name: cont-81-tcp
+    ports:
+    - containerPort: 81
+      name: serve-81-tcp
+      protocol: TCP

cmd/policy-assistant/examples/demos/walkthrough/policies/anp1.yaml

@@ -0,0 +1,18 @@
+apiVersion: policy.networking.k8s.io/v1alpha1
+kind: AdminNetworkPolicy
+metadata:
+  name: anp1
+spec:
+  priority: 1
+  subject:
+    namespaces: {}
+  ingress:
+  - name: "allow-80"
+    action: "Allow"
+    from:
+    - namespaces:
+        namespaceSelector: {}
+    ports:
+      - portNumber:
+          protocol: TCP
+          port: 80

cmd/policy-assistant/examples/demos/walkthrough/policies/anp2.yaml

@@ -0,0 +1,16 @@
+apiVersion: policy.networking.k8s.io/v1alpha1
+kind: AdminNetworkPolicy
+metadata:
+  name: anp2
+spec:
+  priority: 2
+  subject:
+    namespaces: {}
+  ingress:
+  - name: "development-ns"
+    action: "Pass"
+    from:
+    - namespaces:
+        namespaceSelector:
+          matchLabels:
+            development: "true"

cmd/policy-assistant/examples/demos/walkthrough/policies/banp.yaml

@@ -0,0 +1,13 @@
+apiVersion: policy.networking.k8s.io/v1alpha1
+kind: BaselineAdminNetworkPolicy
+metadata:
+  name: default
+spec:
+  subject:
+    namespaces: {}
+  ingress:
+  - name: "baseline-deny"
+    action: "Deny"
+    from:
+    - namespaces:
+        namespaceSelector: {}

cmd/policy-assistant/examples/demos/walkthrough/policies/npv1.yaml

@@ -0,0 +1,12 @@
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  namespace: demo
+  name: deny-anything-to-pod-a
+spec:
+  policyTypes:
+    - Ingress
+  podSelector:
+    matchLabels:
+      pod: a
+  ingress: []

cmd/policy-assistant/examples/demos/walkthrough/traffic.json

@@ -0,0 +1,49 @@
+[
+    {
+        "Source": {
+          "Internal": {
+            "Workload": "demo/deployment/a"
+          }
+        },
+        "Destination": {
+          "Internal": {
+            "Workload": "demo/pod/b"
+          }
+        },
+        "Protocol": "TCP",
+        "ResolvedPort": 80,
+        "ResolvedPortName": "serve-80-tcp"
+    },
+    {
+        "Source": {
+          "Internal": {
+            "Workload": "demo/deployment/a"
+          }
+        },
+        "Destination": {
+          "Internal": {
+            "Workload": "demo/pod/b"
+          }
+        },
+        "Protocol": "TCP",
+        "ResolvedPort": 81,
+        "ResolvedPortName": "serve-81-tcp"
+    },
+    {
+        "Source": {
+          "Internal": {
+            "PodLabels": {"app": "nginx"},
+            "NamespaceLabels": {"development": "true"},
+            "Namespace": "demo2"
+          }
+        },
+        "Destination": {
+          "Internal": {
+            "Workload": "demo/deployment/a"
+          }
+        },
+        "Protocol": "TCP",
+        "ResolvedPort": 81,
+        "ResolvedPortName": "serve-81-tcp"
+    }
+]