Need to know

An audit found that any pod in the cluster can call catalog's API. Security wants it reachable only from the frontend — and, since customers load items straight from /api/catalog, from the ingress controller.

A NetworkPolicy that selects a pod isolates it: from then on, only the traffic some policy allows gets in. Everything else is silently dropped — no error, just a connection that never answers. catalog-policy.yaml is a start.

The ingress controller runs in the ingress-nginx namespace. A podSelector alone only matches pods in the policy's own namespace; a namespaceSelector matches namespaces by label, and every namespace carries kubernetes.io/metadata.name: <its name>.