<p>I have created  network policy as shown below in default namespace</p>
<hr />
<pre><code>apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: access-nginx
spec:
  podSelector:
    matchLabels:
      run: nginx1
  ingress:
  - from:
    - podSelector:
        matchLabels:
          run: &quot;nginx2&quot;
</code></pre>
<hr />
<p>and having following pod in default namespace</p>
<pre><code>master $ k get pod --show-labels
NAME           READY   STATUS    RESTARTS   AGE   LABELS
nginx1         1/1     Running   0          30m   run=nginx1
nginx2         1/1     Running   0          30m   run=nginx2
nginx3         1/1     Running   0          30m   run=nginx3
</code></pre>
<hr />
<p>when I am trying to access pod from different namespace then I am still able to access pod (nginx1)</p>
<pre><code>  master $ kubectl run busybox -n mynamespace --rm --labels=run=nginx2 -ti --image=busybox -- /bin/sh
/ # wget --spider --timeout=2 nginx1.default
Connecting to nginx1.default (10.107.249.117:80)
   remote file exists
</code></pre>
<hr />
<p>How I can restrict other namespace to access pod in default namespace</p>

<p>The network policy documentation outlines four kinds of selectors that can be specified in an ingress <code>from</code> section or egress <code>to</code> section.</p>
<ul>
<li>podSelector</li>
<li>namespaceSelector</li>
<li>namespaceSelector and podSelector</li>
<li>ipBlock</li>
</ul>
<p>You should use the 3rd type of selector in your use case:<strong>namespaceSelector and podSelector</strong></p>
<pre><code>- namespaceSelector
    matchLabels
      preferedNS: someNS
- podSelector:
    matchLabels:
      run: &quot;nginx2&quot;
</code></pre>
<p><a href="https://kubernetes.io/docs/concepts/services-networking/network-policies/#behavior-of-to-and-from-selectors" rel="nofollow noreferrer">Documentation</a></p>
