<p>I am confused about some elementary network concept in k8s and can someone kindly explain this to me please? thank you!</p>
<p>as described <a href="https://github.com/bmuschko/ckad-crash-course/blob/master/exercises/31-networkpolicy/instructions.md" rel="nofollow noreferrer">here</a>:</p>
<blockquote>
<p>All ingress Pod-to-Pod communication has been denied across all namespaces.
You want to allow the Pod busybox in namespace k1 to communicate with Pod nginx in namespace k2.
You'll create a network policy to achieve that.</p>
</blockquote>
<p>I create two pods in k1 and k2 separately in KIND cluster, and I didn't create any network policy, so I understand pod in k1 are not allowed to talk to pod in k2; and why am I seeing the wget is successful between the two pods here?</p>
<pre><code>$k get ns k1 k2
NAME   STATUS   AGE
k1     Active   10m
k2     Active   10m

$k get pod -A -o wide
NAMESPACE            NAME                                       READY   STATUS    RESTARTS   AGE   IP              NODE               NOMINATED NODE   READINESS GATES
k1                   busybox                                    1/1     Running   0          11m   10.244.0.5      t1-control-plane   &lt;none&gt;           &lt;none&gt;
k2                   nginx                                      1/1     Running   0          11m   10.244.0.6      t1-control-plane   &lt;none&gt;           &lt;none&gt;

$k get NetworkPolicy -A
No resources found

$k exec -it busybox -n k1 -- wget --timeout=5 10.244.0.6:80
Connecting to 10.244.0.6:80 (10.244.0.6:80)
saving to 'index.html'
index.html           100% |********************************|   615  0:00:00 ETA
'index.html' saved
</code></pre>

sqr
<p>Reference:<a href="https://kubernetes.io/docs/concepts/services-networking/network-policies/#default-policies" rel="nofollow noreferrer">https://kubernetes.io/docs/concepts/services-networking/network-policies/#default-policies</a></p>
<blockquote>
<p>By default, if no policies exist in a namespace, then all ingress and
egress traffic is allowed to and from pods in that namespace.</p>
</blockquote>
<p>As in the instructions you linked, you can create a &quot;default&quot; ingress isolation policy for k2 namespace by creating a <code>NetworkPolicy</code> that selects all pods but does not allow any ingress traffic to those pods.</p>
<p>So traffic will be blocked from k1 to k2 only when this policy will be created in the k2 namespace. It will block all ingress traffic to all pods in k2 namespace.</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-ingress
  namespace: k2
spec:
  podSelector: {}
  policyTypes:
  - Ingress
</code></pre>
<p>The instruction say that once you create this default policy which blocks everything, you can then further create more network policies to  allow traffic say from specific pod in k1 namespace to some specific pod in k2 namespace.</p>
<blockquote>
<p>You want to allow the Pod busybox in namespace k1 to communicate with Pod nginx in namespace k2. You'll create a network policy to achieve that</p>
</blockquote>
<p>So if you look in the solution folder, this is the policy which does that:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-ingress-networkpolicy
  namespace: k2
spec:
  podSelector:
    matchLabels:
      app: backend
  policyTypes:
    - Ingress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              role: consumer
      ports:
        - protocol: TCP
          port: 80
</code></pre>
<p>This policy will apply to all pods in namespace k2 which have the label <code>app: backend</code> and will allow ingress traffic (over port 80) to those pods from pods in any namespace, where the namespace has the label <code>role: consumer</code>.</p>
