<p>I'm new to the Kubernetes and try to set up a network policy to protect my api.</p>
<p>Here is my network NetworkPolicy</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: api-network-policy
  namespace: api
spec:
  podSelector: {}

  policyTypes:
    - Ingress
  ingress:
    - from:
      - namespaceSelector:
          matchLabels:
            name: api
      - namespaceSelector:
          matchLabels:
            name: backend
      - podSelector:
          matchLabels:
            rule: database
        
</code></pre>
<p>In my design, all pods in the namespace &quot;api&quot; allows ingress only from namespace:api, namespace:backend and pods with rule of database.
However, when I add a test namespace and send request to the pods in the namespace:api, it doesn't deny that request.</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: test-deployment
  namespace: test
spec:
  selector:
    matchLabels:
      app: test
  template:
    metadata:
      labels:
        app: test
    spec:
      containers:
      - name: test
        image: test
        resources:
          limits:
            memory: &quot;128Mi&quot;
            cpu: &quot;500m&quot;
        ports:
        - containerPort: 5000


---

apiVersion: v1
kind: Service
metadata:
  name: test-service
  namespace: test
spec:
  type: NodePort
  selector:
    app: test
  ports:
  - port: 5000
    targetPort: 5000
    nodePort: 32100
</code></pre>
<p>my ingress:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ingress-backend-service
  namespace: backend
  labels:
    rule: ingress
  annotations:
    kubernetes.io/ingress.class: 'nginx'
    nginx.ingress.kubernetes.io/use-regex: 'true'
    nginx.ingress.kubernetes.io/rewrite-target: /$1
spec:
  rules:
    - http:
        paths:
          - path: /api/?(.*)
            pathType: Prefix
            backend:
              service:
                name: chatbot-server
                port:
                  number: 5000
</code></pre>
<p>one of my api:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: redis-worker-deployment
  namespace: api
spec:
  replicas: 1
  selector:
    matchLabels:
      api: redis-worker
  template:
    metadata:
      labels:
        api: redis-worker
    spec:
      containers:
      - name: redis-worker
        image: redis-worker
        env:
          - name: REDIS_HOST
            value: redis
          - name: REDIS_PORT
            value: &quot;6379&quot;
        resources:
          requests:
            memory: &quot;32Mi&quot;
            cpu: &quot;100m&quot;
          limits:
            memory: &quot;128Mi&quot;
            cpu: &quot;500m&quot;
        ports:
        - containerPort: 5000

---

apiVersion: v1
kind: Service
metadata:
  name: redis-worker-service
  namespace: api
  labels:
    rule: api
spec:
  selector:
    api: redis-worker 
  ports:
  - port: 5000
    targetPort: 5000

</code></pre>
<p>my namespace:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: v1
kind: Namespace
metadata:
  name: test

--- 

apiVersion: v1
kind: Namespace
metadata:
  name: backend

---

apiVersion: v1
kind: Namespace
metadata:
  name: api
</code></pre>
<p>my code in the test pod</p>
<pre class="lang-py prettyprint-override"><code>from flask import Flask, url_for, request, jsonify
import requests
import config
app = Flask(__name__)
@app.route('/', methods=['GET', 'POST'])
def hello():
    x = requests.get(&quot;http://redis-worker-service.api:5000&quot;).json()
    print(x)
    return x
if __name__ == '__main__':
    app.run(host=config.HOST, port=config.PORT, debug=config.DEBUG)
</code></pre>
<p>when I go to http://myminikubeip:32100, the request should be denied but it doesn't work</p>

Abbott
<p>Hi all I make stupid mistakes. I forget to set up a network plugin for Minikube as <a href="https://kubernetes.io/docs/tasks/administer-cluster/network-policy-provider/cilium-network-policy/" rel="nofollow noreferrer">Use Cilium for NetworkPolicy</a></p>
<p>Also, I don't set any egress so all egress will be denied.</p>
<p>fixed one:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: api-network-policy
  namespace: api
spec:
  podSelector: {}
  policyTypes:
    - Ingress
    - Egress
  ingress:
    - from:
      - namespaceSelector:
          matchLabels:
            purpose: api
      - namespaceSelector:
          matchLabels:
            purpose: backend
      - podSelector:
          matchLabels:
            rule: database
  egress:
    - {}
</code></pre>
<p>also, set labels for namespace as following</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: v1
kind: Namespace
metadata:
  name: test

--- 

apiVersion: v1
kind: Namespace
metadata:
  name: backend
  labels:
    purpose: backend

---

apiVersion: v1
kind: Namespace
metadata:
  name: api
  labels:
    purpose: api
</code></pre>
<p>I'm sorry I post such a stupid question and I hope others can learn something from my mistakes.. I'm so sorry</p>
<p><a href="https://github.com/ahmetb/kubernetes-network-policy-recipes" rel="nofollow noreferrer">helpful link for network-policy</a></p>
