<p>I have a deployment with several Namespaces and in this namespaces I have several pods, i.e:</p>
<p>NS1:</p>
<ul>
<li>Pod1 -&gt; Label: (app= Pod1)</li>
<li>Pod2 -&gt; Label: (app= Pod2)</li>
<li>PodDB-&gt; Label: (app= PodDB)</li>
</ul>
<p>NS2:</p>
<ul>
<li>Pod1 -&gt; Label: (app= Pod1)</li>
<li>Pod2 -&gt; Label: (app= Pod2)</li>
<li>PodDB -&gt; Label: (app= PodDB)</li>
</ul>
<p>I would like to restrict access between them in a way that Pod1 only can access to PodDB but not with Pod2..I would like also restrict traffic between different namespaces.
I'm reading the docs but I dont understand how to do it. I tried several NetworkPolicies but with no success because I don't know how to apply specific deny/access to a specific pod.</p>
<p>Any help?</p>
<p>Thanks a lot.</p>
<pre><code>apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: test-network-policy
  namespace: uk
spec:
  podSelector:
    matchLabels:
      app: Pod1
  policyTypes:
    - Ingress
  ingress:
    - from:
      - podSelector:
          matchLabels:
            app: Pod2

</code></pre>

Humberto Lantero
<p>You can use this editor to help you create your <code>NetworkPolicies</code>: <a href="https://editor.cilium.io/" rel="nofollow noreferrer">https://editor.cilium.io/</a></p>
<p><a href="https://i.stack.imgur.com/Gezla.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/Gezla.png" alt="Editor network policy" /></a></p>
<p>The following manifest will be applied to pod with label <code>app=Pod1</code> and will disable all incoming/outgoing call to/from such pods, except outgoing calls to pods with labels <code>app=PodDB</code>. (See screenshot below with the colors that helped a lot to understand).</p>
<pre><code>apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: pod1-policy
  namespace: NS1
spec:
  # the following selector specifies to which pods the rules will be applied
  podSelector:
    matchLabels:
      app: Pod1
  policyTypes:
    - Ingress
    - Egress
  # the following rule deny all incoming requests
  ingress: []
  # the following rule authorize outgoing call only to pod with label app=podDB
  egress:
    - to:
        - podSelector:
            matchLabels:
              app: PodDB
</code></pre>
