<p>Namespace 1: arango</p>
<p>Namespace 2: apache - 8080</p>
<p>Criteria to acheive:</p>
<p>The policy should not allow pods which are not listening in port 8080</p>
<p>The policy Should not allow pods from any other namespace except &quot;arango&quot;</p>
<p>Is the following ingress help acheive this? or is it manadtory to add egress as there are rules to deny other namespace pods and ports except 8080?</p>
<pre><code>apiVersion: networking.k8s.io/v1
metadata:
  name: access-nginx
spec:
  podSelector:
    matchLabels:
      app: arango
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: apache
    ports:
    - protocol: TCP
      port: 8080
</code></pre>

Nishanth
<h3>Your current config</h3>
<p>Your current configuration, is allowing traffic to pods with label <code>app: arango</code> in <code>default namespace</code> on <code>port: 8080</code> from pods which have label <code>app: apache</code> in <code>default namespace</code></p>
<p>It will apply to <code>default namespace</code> as you didn't specify it. If <code>namespace</code> is not defined, Kubernetes always is using <code>default</code> namespace.</p>
<h3>Questions</h3>
<blockquote>
<p>or is it manadtory to add egress as there are rules to deny other namespace pods and ports except 8080?</p>
</blockquote>
<p>It depends on your requirements, if you want filter traffic from your pod to outside, from outside to your pod or both. It's well describe in <a href="https://kubernetes.io/docs/concepts/services-networking/network-policies/#networkpolicy-resource" rel="nofollow noreferrer">Network Policy Resource</a> documentation.</p>
<p><code>NetworkPolicy</code> is <code>namespaced resource</code> so it will run in the namespace it was created in. If you want to allow another <code>namespaces</code> you should use <code>namespaceSelector</code></p>
<blockquote>
<p>The <code>policyTypes</code> field indicates whether or not the given policy applies to <code>ingress traffic to selected pod</code>, <code>egress traffic from selected pods</code>, or both. If no <code>policyTypes</code> are specified on a NetworkPolicy then by default Ingress will always be set and Egress will be set if the NetworkPolicy has any egress rules.</p>
</blockquote>
<p>To sum up, <code>ingress</code> traffic is from outside to your pods and <code>egress</code> is from your pods to outside.</p>
<p>You want to apply two main rules:</p>
<blockquote>
<p>The policy should not allow pods which are not listening in port 8080</p>
</blockquote>
<p>If you would like to use this only for ingress traffic, it would looks like:</p>
<pre><code>  ingress:
  - from:
    ports:
    - protocol: &lt;protocol&gt;
      port: 8080
</code></pre>
<blockquote>
<p>The policy Should not allow pods from any other namespace except &quot;arango&quot;</p>
</blockquote>
<p>Please keep in mind that <code>NetworkPolicy</code> is <code>namespaced resource</code> thus it will work in the <code>Namespace</code> which was created. It should be specify in <code>metadata.namespace</code></p>
<pre><code>apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: network-policy
  namespace: arango
spec:
...
</code></pre>
<h3>Requested Network Policy</h3>
<p>I have tested this on my GKE cluster with Network Policy enabled.</p>
<p>In example below, incoming traffic to pods with label <code>app: arango</code> in <code>arango namespace</code> are allowed only if they come from pod with label <code>app: apache</code>, are listening on <code>port: 8080</code> and were deployed in <code>arango</code> namespace.</p>
<pre><code>apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: access-nginx
  namespace: arango
spec:
  podSelector:
    matchLabels:
      app: arango
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: apache
    ports:
    - protocol: TCP
      port: 8080
</code></pre>
<p><strong>Useful links:</strong></p>
<p><a href="https://www.stackrox.com/post/2019/04/setting-up-kubernetes-network-policies-a-detailed-guide/" rel="nofollow noreferrer">Guide to Kubernetes Ingress Network Policies</a></p>
<p><a href="https://docs.projectcalico.org/security/kubernetes-network-policy" rel="nofollow noreferrer">Get started with Kubernetes network policy</a></p>
<p>If this answer didn't solve your issue, please clarify/provide more details how it should work and I will edit answer.</p>
