apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata: { name: allow-from-probe, namespace: np-test }
spec:
  podSelector: { matchLabels: { app: web } }
  ingress:
    - from: [{ podSelector: { matchLabels: { role: probe } } }]
      ports: [{ port: 80 }]