<p>I have the following pods in the <code>default</code> namespace:</p>
<pre><code>web-test-pod-01             1/1     Running   0              19m   app=web-test-pod-01
web-test-pod-02             1/1     Running   0              18m   app=web-test-pod-02
</code></pre>
<p>And in another namespace called <code>devwebapp</code> I have the following</p>
<pre><code>NAME            READY   STATUS    RESTARTS   AGE   LABELS
pod/webapp-01   1/1     Running   0          47m   run=webapp-01

NAME                    TYPE        CLUSTER-IP     EXTERNAL-IP   PORT(S)   AGE   LABELS
service/svc-webapp-01   ClusterIP   10.109.4.169   &lt;none&gt;        80/TCP    46m   run=webapp-01
</code></pre>
<p>I also have network policy called <code>np-webapp-01</code> and its yaml descriptor:</p>
<pre><code>apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: np-webapp-01
  namespace: devwebapp
spec:
  podSelector:
    matchLabels:
      run: webapp-01
  policyTypes:
    - Ingress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: default
        - podSelector:
            matchLabels:
              app: web-test-pod-01
      ports:
        - protocol: TCP
          port: 80
</code></pre>
<p>I am trying to allow only the pod <code>web-test-pod-01</code> in <code>default</code> namespace to access the <code>svc-webapp-01</code> service but at the moment all pods in <code>default</code> namespace can access it.</p>
<pre><code>$ k exec web-test-pod-01 -- curl -I svc-webapp-01.devwebapp.svc
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0HTTP/1.1 200 OK 0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
   615    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
Server: nginx/1.23.4
Date: Thu, 18 May 2023 08:32:34 GMT
Content-Type: text/html
Content-Length: 615
Last-Modified: Tue, 28 Mar 2023 15:01:54 GMT
Connection: keep-alive
ETag: &quot;64230162-267&quot;
Accept-Ranges: bytes
</code></pre>
<p>The following pod should not be able to access the service but as of now it can reach it!</p>
<pre><code>$ k exec web-test-pod-02 -- curl -I svc-webapp-01.devwebapp.svc
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0HTTP/1.1 200 OK
  0   615    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
Server: nginx/1.23.4
Date: Thu, 18 May 2023 08:33:21 GMT
Content-Type: text/html
Content-Length: 615
Last-Modified: Tue, 28 Mar 2023 15:01:54 GMT
Connection: keep-alive
ETag: &quot;64230162-267&quot;
Accept-Ranges: bytes
</code></pre>
<p>I am not sure why <code>podSelector</code> in the network policy is not taking effect.</p>

Khaled
<p>In network policy for selecting pod and namespace we have two conditions . You can find them in this <a href="https://github.com/ahmetb/kubernetes-network-policy-recipes/blob/master/07-allow-traffic-from-some-pods-in-another-namespace.md#remarks" rel="nofollow noreferrer">git link</a>.</p>
<p>This example below is OR condition(policy is enforced based on namespaceSelector or podSelector)</p>
<pre><code>ingress:
    - from:
      - namespaceSelector:
          matchLabels:
            team: operations
      - podSelector:           
          matchLabels:
            type: monitoring
</code></pre>
<p>You have used the above condition.</p>
<p>while this example is AND condition</p>
<pre><code>ingress:
    - from:
      - namespaceSelector:     
          matchLabels:
            team: operations
        podSelector:          
          matchLabels:
            type: monitoring
</code></pre>
<p>Can you try the ‘AND’ condition and let me know if this works.</p>
<p>Attaching a <a href="https://loft.sh/blog/kubernetes-network-policies-for-isolating-namespaces/#:%7E:text=We%20can%20use%20the%20following%20network%20policy%20to%20allow%20traffic%20from%20another%20namespace%20matching%20label%20env%3Dstaging." rel="nofollow noreferrer">blog</a> written by Ashish Choudhary for reference.</p>
<pre><code>apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
 name: np-webapp-01
 namespace: devwebapp
spec:
 podSelector: {}
 policyTypes:
   - Ingress
 ingress:
   - from:
       - namespaceSelector:
           matchLabels:
             kubernetes.io/metadata.name: default
         podSelector:
           matchLabels:
             app: web-test-pod-01
     ports:
       - port: 80
</code></pre>
