<p>How can I achieve that when obviously you can not use <code>spec.namespaceSelector</code> in the netpol?</p>
<pre><code>kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
  name: allow-from-ns-netpol
  namespace: special-ns
spec:
  namespaceSelector:
    matchLabels:
      kubernetes.io/metadata.name: app
  ingress:
    - from:
      - namespaceSelector:     
          matchLabels:
            kubernetes.io/metadata.name: cka-exam 
</code></pre>
<p>So, this doesn't work.</p>

DimiDak
<p>The API resource definition you've provided does not appear to be schema compliant. The <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.26/#networkpolicyspec-v1-networking-k8s-io" rel="nofollow noreferrer">NetworkPolicySpec</a> in Kubernetes v1.26 shows that the following fields are allowed: <code>[policyTypes, podSelector, egress, ingress]</code>.</p>
<p>I recommend taking a look at the <a href="https://kubernetes.io/docs/concepts/services-networking/network-policies/" rel="nofollow noreferrer">Network Policy</a> documentation.</p>
<p>When you define a Network Policy, you assign it to a Namespace. You can then narrow that Network Policy to only apply to select Pods (in that Namespace) using the <code>.spec.podSelector</code> property. As the documentation states, &quot;An empty <code>podSelector</code> selects all pods in the namespace.&quot;</p>
<p>This means if you want block all ingress traffic to the Pods in Namespace <code>special-ns</code>, you would assign the Network Policy to the <code>special-ns</code> Namespace and leave the <code>.spec.podSelector</code> property empty so it selects all of the Pods in <code>special-ns</code>. Without any <code>ingress</code> rules defined, the resource would be the <a href="https://kubernetes.io/docs/concepts/services-networking/network-policies/#default-deny-all-ingress-traffic" rel="nofollow noreferrer">Default deny all ingress traffic</a> definition.</p>
<p>You then use the <code>ingress</code> property to define the restrictions, or rules, on <em>where</em> that incoming traffic can come from. It looks like your existing definition is correct, so ingress traffic will only be allowed from Pods that exist in the Namespace <code>cka-exam</code>.</p>
<pre class="lang-yaml prettyprint-override"><code>kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
  name: allow-from-ns-netpol
  namespace: special-ns
spec:
  ingress:
    - from:
      - namespaceSelector:     
          matchLabels:
            kubernetes.io/metadata.name: cka-exam 
</code></pre>
