diff --git a/k8s/M6-network-policies.yaml b/k8s/M6-network-policies.yaml
new file mode 100644
index 00000000..4d87a658
--- /dev/null
+++ b/k8s/M6-network-policies.yaml
@@ -0,0 +1,35 @@
+---
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: deny-from-other-namespaces
+spec:
+  podSelector: {}
+  ingress:
+  - from:
+    - podSelector: {}
+---
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: allow-webui
+spec:
+  podSelector:
+    matchLabels:
+      app: web
+  ingress:
+  - from: []
+---
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: allow-db
+spec:
+  podSelector:
+    matchLabels:
+      app: db
+  ingress:
+  - from:
+    - podSelector:
+        matchLabels:
+          app: web
diff --git a/slides/k8s/M6-M01-adding-MOVY-tenant.md b/slides/k8s/M6-M01-adding-MOVY-tenant.md
index 62ffb803..4df0ad08 100644
--- a/slides/k8s/M6-M01-adding-MOVY-tenant.md
+++ b/slides/k8s/M6-M01-adding-MOVY-tenant.md
@@ -197,7 +197,14 @@ pod network is still full mesh and any connection is authorized.
 `Network policies` may be seen as the firewall feature in the pod network.  
 They rules ingress and egress network connections considering a described subset of pods.
 
-They are not 
+Please, refer to the [`Network policies` chapter in the High Five M4 module](./4.yml.html#toc-network-policies)
+
+- In our case, we just add the file `~/container.training/k8s/M6-network-policies.yaml`
+</br>in our `./tenants/base/movy` folder
+
+- without forgetting to update our `kustomization.yaml` file
+
+- and without forgetting to commit 😁
 
 ---