<p>I try to create a situation which is shown in the picture.</p>
<p><a href="https://i.stack.imgur.com/fRPC5.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/fRPC5.png" alt="enter image description here" /></a></p>
<pre><code>kubectl run frontend --image=nginx --labels=&quot;app=frontend&quot; --port=30081 --expose
kubectl run backend --image=nginx --labels=&quot;app=backend&quot; --port=30082 --expose
kubectl run database --image=nginx --labels=&quot;app=database&quot; --port=30082
</code></pre>
<p>I created network policy which should block all ingress and egress access which do not have specific label definition.</p>
<pre><code>kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
  name: access-nginx
spec:
  podSelector:
    matchLabels:
     app: frontend
    matchLabels:
      app: backend
    matchLabels:
      app: database
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: frontend
        matchLabels:
          app: backend
        matchLabels:
          app: database
  egress:
  - to
    - podSelector:
        matchLabels:
          app: frontend
        matchLabels:
          app: backend
        matchLabels:
          app: database
  - ports:
    - port: 53
      protocol: UDP
    - port: 53
      protocol: TCP
</code></pre>
<p>I tried to connect to pod frontend without label(command 1) and with correct label(command 2) as is shown below.</p>
<ul>
<li>kubectl run busybox --image=busybox --rm -it --restart=Never -- wget
-O- http://frontend:30081 --timeout 2</li>
<li>kubectl run busybox --image=busybox --rm -it --restart=Never
--labels=app=frontend -- wget -O- http://frontend:30081 --timeout 2</li>
</ul>
<p>I expected that first command which do not use label will be blocked and second command will allow communication but after pressed the second command i see output &quot;wget: can't connect to remote host (10.109.223.254): Connection refused&quot;. Did I define network policy incorrectly?</p>

<p>As mentioned in kubernetes <a href="https://kubernetes.io/docs/concepts/services-networking/network-policies/" rel="nofollow noreferrer">documentation</a> about Network Policy</p>
<blockquote>
<p><strong>Prerequisites</strong></p>
<p>Network policies are implemented by the <a href="https://kubernetes.io/docs/concepts/extend-kubernetes/compute-storage-net/network-plugins/" rel="nofollow noreferrer">network plugin</a>. To use network policies, you must be using a networking solution which supports NetworkPolicy. Creating a NetworkPolicy resource without a controller that implements it will have no effect.</p>
</blockquote>
<p>As far as I know flannel, which is used by katacoda does not support network policy.</p>
<pre><code>controlplane $ kubectl get pods --namespace kube-system
NAME                                      READY   STATUS    RESTARTS   AGE
coredns-66bff467f8-4tmhm                  1/1     Running   0          16m
coredns-66bff467f8-v2dbj                  1/1     Running   0          16m
etcd-controlplane                         1/1     Running   0          16m
katacoda-cloud-provider-58f89f7d9-brnk2   1/1     Running   8          16m
kube-apiserver-controlplane               1/1     Running   0          16m
kube-controller-manager-controlplane      1/1     Running   0          16m
kube-flannel-ds-amd64-h5lrd               1/1     Running   1          16m
kube-flannel-ds-amd64-sdl4b               1/1     Running   0          16m
kube-keepalived-vip-gkhbz                 1/1     Running   0          16m
kube-proxy-6gd8d                          1/1     Running   0          16m
kube-proxy-zkldz                          1/1     Running   0          16m
kube-scheduler-controlplane               1/1     Running   1          16m
</code></pre>
<p>As mentioned <a href="https://github.com/coreos/flannel#:%7E:text=Networking%20details&amp;text=Flannel%20is%20responsible%20for%20providing,traffic%20is%20transported%20between%20hosts.&amp;text=For%20network%20policy%2C%20other%20projects%20such%20as%20Calico%20can%20be%20used." rel="nofollow noreferrer">here</a></p>
<blockquote>
<p>Flannel is focused on networking. For network policy, other projects such as Calico can be used.</p>
</blockquote>
<p>Additionally there is nice <a href="https://itnext.io/benchmark-results-of-kubernetes-network-plugins-cni-over-10gbit-s-network-updated-april-2019-4a9886efe9c4" rel="nofollow noreferrer">tutorial</a> which show which CNI support network policy.</p>
<p><a href="https://i.stack.imgur.com/yc2fI.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/yc2fI.png" alt="enter image description here" /></a></p>
<p>So I would say it´s not possible to do on katacoda playground.</p>
