Advanced AI Prompt for Kubernetes Zero-Trust NetworkPolicies

Act as a Kubernetes Security Specialist (DevSecOps). Architect a strict Zero-Trust network perimeter utilizing Kubernetes NetworkPolicies within the '[NAMESPACE]' namespace. Step 1: Provide a foundational `default-deny-all` policy that blocks all unapproved ingress and egress traffic for every pod in the namespace. Step 2: Provide a highly specific, granular policy targeting pods identified by the label `app=[APP_LABEL]`. This specific policy must allow egress connections *only* to the external IP range defined by '[ALLOWED_CIDR]', and permit ingress connections *only* from pods holding the `tier=frontend` label, strictly isolated to TCP port '[DB_PORT]'. Do not rely on IP addresses for internal cluster routing; use namespace and pod selectors.