<p>I have two namespaces: <code>prod</code> and <code>default</code>.
I want to disable access for resources inside these namespaces (resources from <code>default</code> NS can't get access for resources from <code>prod</code>, and resources from <code>prod</code> can't get access for resources from <code>default</code>)
BUT allow the opportunity to access these resources for external traffic (ingresses).</p>

<pre><code># namespaces.yaml

---
kind: Namespace
apiVersion: v1
metadata:
  name: prod
  labels:
    tier: prod

---
kind: Namespace
apiVersion: v1
metadata:
  name: default
  labels:
    tier: infra
</code></pre>

<pre><code># network-policies.yaml

---
kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
  name: network
  namespace: prod
spec:
  podSelector: {}
  ingress:
    - from:
      - podSelector: {}
---
kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
  name: network
  namespace: default
spec:
  podSelector: {}
  ingress:
    - from:
      - namespaceSelector:
          matchLabels:
            tier: dev
      - namespaceSelector:
          matchLabels:
            tier: rc
</code></pre>

<pre><code># services.yaml

---
apiVersion: v1
kind: Service
metadata:
  name: {{ include "conference.appService" . }}
  labels:
    app: {{ include "conference.name" . }}
    release: {{ .Release.Name }}
spec:
  type: NodePort
  ports:
    - name: http
      port: 80
      targetPort: http
      protocol: TCP
  selector:
    app: {{ include "conference.name" . }}
    release: {{ .Release.Name }}
    role: app

</code></pre>

<p>Pods from <code>prod</code> have access to the other pods inside given namespace.
Pods from <code>default</code> don't have access to the pods inside <code>prod</code>.</p>

<p>When I try to get access to the service from the browser it's blocked.
When I try to use port-forwarding to the service inside <code>prod</code> - all works fine.</p>

<p>The problem was in from part in network policy.</p>

<pre><code>---
kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
  name: network
  namespace: default
spec:
  podSelector: {}
  ingress:
    - from:
      - ipBlock:
          cidr: 0.0.0.0/0
      - podSelector: {}
      - namespaceSelector:
          matchLabels:
            tier: dev
      - namespaceSelector:
          matchLabels:
            tier: rc
  egress:
    - {}
</code></pre>

<p>The main idea of this selectors it:
<code>podSelector</code> - for selecting the pods IN CURRENT namespace
<code>namespaceSelector</code> - for selecting the namespaces
<code>namespaceSelector.podSelector</code> - for selecting pods inside given namespace</p>

<p>and my problem:</p>

<p><code>ipBlock</code> - for selecting EXTERNAL IP addresses</p>

<p>it's doesn't work for internal IPs so in my case <code>0.0.0.0/0</code> will be OK.
<code>except</code> will not disallow internal traffic.</p>
