<p>On an Azure AKS cluster with the Calico network policies plugin enabled, I want to:</p>
<ol>
<li>by default block all incoming traffic.</li>
<li>allow all traffic within a namespace (from a pod in a namespace, to another pod in the <strong>same</strong> namespace.</li>
</ol>
<p>I tried something like:</p>
<pre><code>apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny.all
  namespace: test
spec:
  podSelector: {}
  policyTypes:
  - Ingress

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow.same.namespace
  namespace: test
spec:
  podSelector: {}
  ingress:
  - from:
    - podSelector: {}
  policyTypes:
  - Ingress
</code></pre>
<p>But is seems to block traffic between two deployments/pods in the same namespace. What am I doing wrong, am I misreading the documentation?</p>
<p>Perhaps it is good to mention that the above setup seems to work on an AWS EKS based Kubernetes cluster.</p>

<p>After investigation it turned out that:</p>
<ol>
<li>I used terraform to create a k8s cluster with two node pools. System, and worker. (Note: that this is (not yet) possible in the GUI).</li>
<li>Both node pools are in different subnets (system subnet, and worker subnet).</li>
<li>AKS configures kubeproxy to masquerade traffic that goes outside the system subnet.</li>
<li>Pods are deployed on the worker node, and thus use the worker subnet. All traffic that they send outside the node they are running on, is masqueraded.</li>
<li>Calico managed iptables drop the masqueraded traffic. I did not look into more details here.</li>
<li>However, if I change the kubeproxy masquerade setting to either a larger CIDR range, or remove it all together, it works. Azure however resets this setting after a while.</li>
</ol>
<p>In conclusion. I tried to use something that is not yet supported by Azure. I now use a single (larger) subnet for both node pools.</p>
