<p>I have application running in K3s and want to implement network policy based on namespace only.
<br/><br/> Let's assume that currently I have three namespace A, B and C. I want to allow egress (external call to internet from pod) for <code>namespace-A</code> and remaining <code>namespace[B &amp; C]</code> egress calls should be blocked/denied.<br/><br/> Is this possible in Kubernetes network policy (and not calico or cilium) ?</p>

<p>You can define a <code>deny all egress</code> policy like described in <a href="https://kubernetes.io/docs/concepts/services-networking/network-policies/#default-deny-all-egress-traffic" rel="nofollow noreferrer">the documentation</a>:</p>
<pre><code>apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-egress
  namespce: your-namespace
spec:
  podSelector: {}
  policyTypes:
  - Egress
</code></pre>
<p>This policy will be applied to all pods in the namespace because the pod selector is empty and that means (quoting <a href="https://kubernetes.io/docs/concepts/services-networking/network-policies/#networkpolicy-resource" rel="nofollow noreferrer">documentation</a>):</p>
<blockquote>
<p>An empty podSelector selects all pods in the namespace.</p>
</blockquote>
<p>The policy will block all egress traffic because it has <code>Egress</code> as policy type but it doesn't have any <code>egress</code> section.</p>
<p>If you want to allow in-cluster egress you might want to add an <code>egress</code> section in the policy, like for example:</p>
<pre><code>  egress:
  - to:
    - namespaceSelector:
        matchLabels:
          networking/namespace: kube-system
      podSelector:
        matchLabels:
          k8s-app: kube-dns
    ports:
    - protocol: TCP
      port: 53
    - protocol: UDP
      port: 53
</code></pre>
<p>This allows all traffic from the namespace where you create the network policy to pods labeled with <code>k8s-app: kube-dns</code> in namespace <code>kube-system</code> on port 53 (TCP and UDP).</p>
