<p>Suppose I have these <code>ns</code></p>
<pre><code>nginx-master - Running my Ingress controller
monitoring   - Running Prometheus, Grafana
</code></pre>
<pre><code>app1-project (Parent)
  app1-dev
  app1-qa

app2-project(Parent)
  app2-dev
  app2-qa
</code></pre>
<p>I basically wanted to send traffic (ingress/egress) from <code>nginx-master</code> and monitoring to app1-project and app2-project (Propagated to their respective children)</p>
<p>However, blocking any (ingress/egress) traffic from app1-project and app2-project to each other</p>

CloudAdmin
<p>Below config should do the trick for you</p>
<p>First, create labels on the namespaces with <code>project: ingress</code> and <code>project: monitoring</code> respectively.</p>
<p>Then use the below manifest.</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-network-policy
  namespace: app1-project
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          project: ingress
    - namespaceSelector:
        matchLabels:
          project: monitoring
</code></pre>
<p>Having empty egress will deny all egress <a href="https://kubernetes.io/docs/concepts/services-networking/network-policies/#default-deny-all-egress-traffic" rel="nofollow noreferrer">https://kubernetes.io/docs/concepts/services-networking/network-policies/#default-deny-all-egress-traffic</a></p>
