<p>There is already two existing Network Policies present and one of which allows all the outbound traffic for all pods</p>
<pre><code>apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-default
  namespace: sample-namespace
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress
  egress:
  - to:
    - podSelector: {}
  ingress:
  - from:
    - podSelector: {}
</code></pre>
<pre><code>apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-egress
  namespace: sample-namespace
spec:
  podSelector: {}
  policyTypes:
  - Egress
  egress:
  - to:
    - podSelector: {}
    - ipBlock:
        cidr: 0.0.0.0/0
  - ports:
    - port: 53
      protocol: UDP
    - port: 53
      protocol: TCP
</code></pre>
<p>and I want to block all outbound traffic for a certain pod with label <code>app: localstack-server</code> so I created one more Network Policy for it but its not getting applied on that Pod</p>
<pre><code>apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: psp-localstack-default-deny-egress
  namespace: sample-namespace
spec:
  podSelector:
    matchLabels:
      app: localstack-server
  policyTypes:
  - Egress
</code></pre>
<p>I'm able to run <code>curl www.example.com</code> inside that pod and its working fine which it should not have.</p>

Vishwanath Joshi
<p>NetworkPolicies are additive, and they only have allow rules. So for each pod (as selected by podSelector), the traffic that will be allowed is the sum of all network policies that selected this pod. In your case, that's all traffic, since you have a policy that allows all traffic for an empty selector (all pods).</p>
<p>To solve your problem, you should apply the allow all policy to a label selector that applies to all pods, except that one app: localstack-server. So,  add a label like <code>netpol-all-allowed: true</code>, and don't add it to <code>localstack-server.</code>NetworkPolicies are additive, and they only have allow rules. So for each pod (as selected by podSelector), the traffic that will be allowed is the sum of all network policies that selected this pod. In your case, that's all traffic, since you have a policy that allows all traffic for an empty selector (all pods).</p>
<p>To solve your problem, you should apply the allow all policy to a label selector that applies to all pods, except that one app: localstack-server. So,  add a label like <code>netpol-all-allowed: true</code>, and don't add it to <code>localstack-server.</code></p>
