<p>I have a simple working NetworkPolicy looking like this</p>
<pre><code>apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: monitoring-network-policy-prometheus-jbn
  namespace: monitoring
spec:
  podSelector:
    matchLabels:
      app: prometheus
  policyTypes:
    - Egress
  egress:
    - to: 
      ports:
        - port: 61678
</code></pre>
<p>But now I want to restrict this a bit more. Instead of allowing egress to all destinations on port 61678 from all pods with label <code>app: prometheus</code> I want to allow only traffic to pods with label <code>k8s-app: aws-node</code></p>
<p>So I change the policy to:</p>
<pre><code>apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: monitoring-network-policy-prometheus-jbn
  namespace: monitoring
spec:
  podSelector:
    matchLabels:
      app: prometheus
  policyTypes:
    - Egress
  egress:
    - to:
      - podSelector:
          matchLabels:
            k8s-app: aws-node
</code></pre>
<p>According to <a href="https://kubernetes.io/docs/concepts/services-networking/network-policies/" rel="nofollow noreferrer">https://kubernetes.io/docs/concepts/services-networking/network-policies/</a> a policy that looks like this</p>
<pre><code>  ...
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          user: alice
    - podSelector:
        matchLabels:
          role: client
  ...
</code></pre>
<p>is described as <code> allows connections from Pods in the local Namespace with the label role=client, or from any Pod in any namespace with the label user=alice.</code></p>
<p>So I would think that this would match a pod with label <code>k8s-app: aws node</code> which is located in the <code>kube-system</code> namespace on any port. But when I try to connect to a pod with that label I get a timeout.</p>
<p>Here is the pod I am connecting to</p>
<pre><code> kubectl get pods -n kube-system -l k8s-app=aws-node
NAME             READY   STATUS    RESTARTS   AGE
aws-node-ngmnd   1/1     Running   0          46h
</code></pre>
<p>I am using AWS EKS with Calio network plugin.</p>
<p>What am I missing here?</p>

<p>This is happening because you omit placing the <code>namespaceSelector</code> in your manifest and by default when <code>namespaceSelector</code> is not preset the system will select the Pods matching <code>PodSelector</code> in the policy's own namespace.</p>
<p>See here:</p>
<blockquote>
<p><strong>podSelector</strong><br />
<em>This is a label selector which selects Pods. This field follows standard label selector semantics; if present but empty, it selects
all pods. If NamespaceSelector is also set, then the NetworkPolicyPeer
as a whole selects the Pods matching PodSelector in the Namespaces
selected by NamespaceSelector. <strong>Otherwise it selects the Pods matching
PodSelector in the policy's own Namespace</strong>.</em></p>
</blockquote>
<p>What can you do solve it? You could set empty namespace selector as per documents:</p>
<blockquote>
<p><strong>namespaceSelector</strong><br />
<em>Selects Namespaces using cluster-scoped labels. This field follows standard label selector semantics; <strong>if present but empty, it selects
all namespaces</strong>. If PodSelector is also set, then the
NetworkPolicyPeer as a whole selects the Pods matching PodSelector in
the Namespaces selected by NamespaceSelector. Otherwise it selects all
Pods in the Namespaces selected by NamespaceSelector.</em></p>
<p>Reference <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.20/#networkpolicypeer-v1-networking-k8s-io" rel="noreferrer">NetworkPolicyPeer</a></p>
</blockquote>
<p>I reproduce this issue and the documentation is correct but a bit misleading about place which should be in fact empty. So the parenthesis should be placed after the <code>matchLabels</code>:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: monitoring-network-policy-prometheus-jbn
  namespace: monitoring
spec:
  podSelector:
    matchLabels:
      app: prometheus
  policyTypes:
    - Egress
  egress:
    - to:
      - podSelector:
          matchLabels:
            k8s-app: aws-node
        namespaceSelector:
          matchLabels: {}
</code></pre>
<p>To answer your concerns about whether calico might be causing some issues. Well in fact it is, but it is suppose to. For network policies to take effect you need to run network plugin that will enforce them.</p>
