anchor.diff:  ====
   
   Project administrators can neither create `*EgressNetworkPolicy*` objects, nor
  -edit the ones you create in their project.
  -
  -The `default` project (and any other global namespace) cannot have egress
  -policy.
  -
  -[NOTE]
  -====
  -If you merge two projects together (via `oadm pod-network join-projects`),
  +edit the ones you create in their project. There are also several other
  +restrictions on where `*EgressNetworkPolicy*` may be created:
  +
  +. The `default` project (and any other project that has been made global via
  +`oadm pod-network make-projects-global`) cannot have egress policy.
  +
  +. If you merge two projects together (via `oadm pod-network join-projects`),
   then you cannot use egress policy in _any_ of the joined projects.
   
  -If you make a project global (via `oadm pod-network make-projects-global`),
  -then it cannot have an `*EgressNetworkPolicy*`.
  -
  -If an allowed network overlaps with a denied network, then the rules are
  -checked in order, and the first one that matches is enforced.
  -====
  +. No project may have more than one egress policy object.
  +
  +Violating any of these restrictions will result in broken egress policy for the
  +project, and may cause all external network traffic to be dropped.
   
   [[admin-guide-config-pod-access]]
   ==== Configuring Pod Access Limits
  
positive.code: === Limiting Pod Access with Egress Firewall
  
  As an {product-title} cluster administrator, you can use egress policy to limit
  the addresses that some or all pods can access from within the cluster, so that:
  
  - A pod can only talk to internal hosts, and cannot initiate connections to the
  public Internet.
  
negative.code: ----
  +
  When the example above is added in a project, it allows traffic to `1.2.3.0/24`,
  but denies access to all other external IP addresses. (Traffic to other pods is
  not affected, because the policy only applies to _external_ traffic.)
  
  Note that the rules in an `*EgressNetworkPolicy*` are checked in order, and the
  first one that matches takes effect. So if the two rules in the above example
  were swapped, then traffic would *not* be allowed to `1.2.3.0/24`, because the
  `0.0.0.0/0` rule would be checked first, and it would match and deny all
  traffic.
  
  [[admin-guide-manage-pods-limit-bandwidth]]
  == Limiting the Bandwidth Available to Pods
  