<p>I have multiple namespaces in my k8 cluster. All I want is that pods in development namespace can communicate with all other pods in other namespaces but should not be able to communicate with resources in production namespace.</p>

<p>I was not able to find a document for this scenario. There is a deny all policy like this</p>

<pre><code>---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-egress
spec:
  podSelector: {}
  policyTypes:
  - Egress
  - Ingress
</code></pre>

<p>but it applies at pod level in the same namespace.  How can I modify the same to meet my requirements? </p>

<p>Referring from the docs <a href="https://kubernetes.io/docs/concepts/services-networking/network-policies/#networkpolicy-resource" rel="nofollow noreferrer">here</a></p>

<ol>
<li><p>Label all namespaces in development environment with <code>environment=dev</code></p></li>
<li><p>Label all namespaces in production environment with <code>environment=prod</code></p></li>
</ol>

<p>Then you can have network policy as below</p>

<ol>
<li>Default deny policy as you have already</li>
<li>Have a policy to whitelist traffic to pods from namespaces with label <code>environment=prod</code></li>
</ol>

<p>As below</p>

<pre><code>apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: access-nginx
spec:
  podSelector: {}
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          environment: "prod"
</code></pre>
