Update cluster network policy docs

Author: mazdakn

calico/network-policy/policy-tiers/tiered-policy.mdx

@@ -54,7 +54,30 @@ The default tier is where:
 ## kube-admin tier:
 
 The `Tier` with name `kube-admin` is where all [Kubernetes ClusterNetworkPolicy](https://network-policy-api.sigs.k8s.io/reference/examples/) resources with Admin Tier reside.
-It is automatically created during installation and has the order of 1,000 and a default action of `Pass`. This is fixed, and should not be changed.
+It is automatically created at startup and has the order of 1,000 and a default action of `Pass`. This is fixed, and cannot be changed.
+
+```yaml
+apiVersion: policy.networking.k8s.io/v1alpha2
+kind: ClusterNetworkPolicy
+metadata:
+  name: accept-default
+spec:
+  tier: Admin
+  priority: 100
+  subject:
+    namespaces:
+      matchLabels:
+        kubernetes.io/metadata.name: default
+  ingress:
+  - name: accept-default-ingress
+    action: "Accept"
+    from:
+    - namespaces:
+        matchLabels:
+          kubernetes.io/metadata.name: default
+```
+
+$[prodname] places the above resource in `kube-admin` tier.
 
 In addition to `ClusterNetworkPolicy` resources, you can also add $[prodname] `NetworkPolicy`/`GlobalNetworkPolicy` resources
 to the kube-admin `Tier`. The `ClusterNetworkPolicy` `priority` field maps to the `order` field in the $[prodname]
@@ -63,7 +86,28 @@ to the kube-admin `Tier`. The `ClusterNetworkPolicy` `priority` field maps to th
 ## kube-baseline tier:
 
 The `Tier` with name `kube-baseline` is where all [Kubernetes ClusterNetworkPolicy](https://network-policy-api.sigs.k8s.io/reference/examples/) resources with Baseline tier reside.
-It is automatically created during installation and has the order of 10,000,000 and a default action of `Pass`. This is fixed, and should not be changed.
+It is automatically created during startup and has the order of 10,000,000 and a default action of `Pass`. This is fixed, and cannot be changed.
+
+```yaml
+apiVersion: policy.networking.k8s.io/v1alpha2
+kind: ClusterNetworkPolicy
+metadata:
+  name: deny-all
+spec:
+  tier: Baseline
+  priority: 1
+  subject:
+    namespaces:
+      matchLabels: {} 
+  ingress:
+  - name: deny-all-ingress
+    action: "Deny"
+    from:
+    - namespaces:
+        matchLabels: {}
+```
+
+$[prodname] places the above resource in `kube-baseline` tier.
 
 In addition to the `ClusterNetworkPolicy` resource, you can also add $[prodname] `NetworkPolicy`/`GlobalNetworkPolicy` resources
 to the kube-baseline `Tier`. The `ClusterNetworkPolicy` `priority` field maps to the `order` field in the $[prodname]