<p>Using k8s network policy or calico, can I only use these tools for pod to pod cluster network policies.
I already have network rules for external cluster policies. </p>

<p>For example if I apply this calico rule:</p>

<pre><code>apiVersion: projectcalico.org/v3
kind: NetworkPolicy
metadata:
  name: allow-ingress-from-b
  namespace: app
spec:
  selector: app == 'a'
  ingress:
  - action: Allow
    protocol: TCP
    source:
      selector: app == 'b'
    destination:
      ports:
        - 80
</code></pre>

<p>In this example I allow traffic coming from app B to app A.
But this will disallow every other ingress traffic going to A.
Would it be possible to only apply this rule from pod to pod ?</p>

nono
<p>You should read <a href="https://kubernetes.io/docs/concepts/services-networking/network-policies/#networkpolicy-resource" rel="nofollow noreferrer">The NetworkPolicy resource</a>, it provides an example NetworkPolicy with <code>Ingress</code> and <code>Egress</code>.</p>

<pre class="lang-yaml prettyprint-override"><code>apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: test-network-policy
  namespace: default
spec:
  podSelector:
    matchLabels:
      role: db
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - ipBlock:
        cidr: 172.17.0.0/16
        except:
        - 172.17.1.0/24
    - namespaceSelector:
        matchLabels:
          project: myproject
    - podSelector:
        matchLabels:
          role: frontend
    ports:
    - protocol: TCP
      port: 6379
  egress:
  - to:
    - ipBlock:
        cidr: 10.0.0.0/24
    ports:
    - protocol: TCP
      port: 5978
</code></pre>

<p>The explanation is as following:</p>

<blockquote>
  <ol>
  <li>isolates “role=db” pods in the “default” namespace for both ingress and egress traffic (if they weren’t already isolated)</li>
  <li><p>(Ingress rules) allows connections to all pods in the “default” namespace with the label “role=db” on TCP port 6379 from:</p>
  
  <ul>
  <li>any pod in the “default” namespace with the label “role=frontend”</li>
  <li>any pod in a namespace with the label “project=myproject”</li>
  <li>IP addresses in the ranges 172.17.0.0–172.17.0.255 and 172.17.2.0–172.17.255.255 (ie, all of 172.17.0.0/16 except 172.17.1.0/24)</li>
  </ul></li>
  <li>(Egress rules) allows connections from any pod in the “default” namespace with the label “role=db” to CIDR 10.0.0.0/24 on TCP port 5978</li>
  </ol>
  
  <p>See the  <a href="https://kubernetes.io/docs/tasks/administer-cluster/declare-network-policy/" rel="nofollow noreferrer">Declare Network Policy</a>  walkthrough for further examples.</p>
</blockquote>

<p>So if you use a <code>podSelector</code>, you will be able to select pods for this Network Policy to apply to.</p>
