<p>In a cluster with 2 namespaces (<code>ns1</code> and <code>ns2</code>), I deploy the same app (<code>deployment</code>) and expose it with a service.</p>

<p>I thought separate namespaces would prevent from executing <code>curl http://deployment.ns1</code> from a pod in <code>ns2</code>, but apparently, it's possible.</p>

<p>So my question is, how to allow/deny such cross namespaces operations? For example:</p>

<ul>
<li>pods in <code>ns1</code> should accept requests from any namespace</li>
<li>pods (or service?) in <code>ns2</code> should deny all requests from other namespaces</li>
</ul>

znat
<p>Good that you are working with namespace isolation.</p>

<ol>
<li><p>Deploy a new kind Network Policy in your ns1 with ingress all. You can lookup the documentation to define network ingress policy to allow all inbound traffic </p></li>
<li><p>Likewise for ns2, you can create a new kind Network Policy and deploy the config in ns2 to deny all ingress. Again the docs will come to rescue to help with you the yaml construct.</p></li>
</ol>

<p>It may look something like this:</p>

<pre><code>kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
 namespace: ns1
 name: web-allow-all-namespaces
spec:
 podSelector:
  matchLabels:
   app: app_name_ns1
 ingress:
 - from:
  - namespaceSelector: {}
</code></pre>
