<ol>
<li>Let's say,I have 3 nginx pods listening over port 80.</li>
<li>Let's say, I have once service <code>nginx-svc</code> of type <code>ClusterIP</code>, listening over port <code>8080</code> and forwarding requests to above nginx pods over port <code>80</code>.</li>
<li>Let's say, I have another pod <code>busybox</code>.</li>
</ol>
<p>How can I configure the <code>network-policy</code> to allow <code>busybox</code>
pod to access <code>nginx</code> pods only via service <code>nginx-svc</code> but not directly?</p>

<p>You can't achieve it the way yo presented it but you can <a href="https://kubernetes.io/docs/tasks/administer-cluster/declare-network-policy/#limit-access-to-the-nginx-service" rel="nofollow noreferrer">restrict access to the pod for specific service and labels</a> using <code>NetworkPolicy</code>.</p>
<p>For example, if you have deployment with labels <code>app: nginx</code> (you can create it using <code>kubectl create deployment nginx --image=nginx</code>) and you expose it, by using <code>kubectl expose deployment nginx --port=80</code> you can create following NetworkPolicy:</p>
<pre><code>apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: access-nginx
spec:
  podSelector:
    matchLabels:
      app: nginx
  ingress:
  - from:
    - podSelector:
        matchLabels: #mutable fields
          access: &quot;true&quot;
</code></pre>
<p>It will restrict access to pods with only labels <code>app=nginx</code> and <code>access=&quot;true&quot;</code>.</p>
<p>After this network policy is applied, you can create busybox pod with labels <code>access=&quot;true&quot;</code> it will be able to communicate with those pods.</p>
