Issue description

The lab has a bug while running the deploy pipeline. If the default deny all into the namespace gets applied 5th instead of 6th (of all Network Policies), the access to namespace is cut off and therefore, the final network policy can no longer be applied during pipeline run, therefore it will always fail. There is a workaround to remove the policy during deployment but I think it should not work this way.

I see that there is already an admonition, but being this the case, it doesn't seem like a good setup. 

Workaround:
ensure that all network policies are applied in the correct order within the deploy pipeline script or process, specifically placing the default deny all into namespace as the final policy to be applied (6th step) rather than any other.