<p>In my K8S cluster, I have a &quot;private&quot; part where I have all my microservices, and a &quot;public&quot; part.</p>
<p>The public part is a blockchain, and I would like to be able to give a blockchain node to clients so that they can audit private blockchain.</p>
<p>Thing is right now, if I register a node within K8S, it will be able to communicate with all namespaces.</p>
<p>My microservices should be able to read and write in the blockchain, but the blockchain nodes should not be able to communicate with other namespaces.</p>

<p>You can use <a href="https://kubernetes.io/docs/concepts/services-networking/network-policies/" rel="nofollow noreferrer">network policy</a> to restrict communication between pods of different namespaces. So the namespaces which are for blockchain can have a label and  you can use network policy to only allow communications from pods which reside in the namespaces with that label.</p>
<p>From the docs <a href="https://kubernetes.io/docs/concepts/services-networking/network-policies/#behavior-of-to-and-from-selectors" rel="nofollow noreferrer">here</a></p>
<p><code>namespaceSelector</code>: This selects particular namespaces for which all Pods should be allowed as ingress sources or egress destinations</p>
<pre><code>  ...
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          app: blockchain
  ...
</code></pre>
