<p>I have created  network policy as shown below in default namespace</p>
<hr />
<pre><code>apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: access-nginx
spec:
  podSelector:
    matchLabels:
      run: nginx1
  ingress:
  - from:
    - podSelector:
        matchLabels:
          run: &quot;nginx2&quot;
</code></pre>
<hr />
<p>and having following pod in default namespace</p>
<pre><code>master $ k get pod --show-labels
NAME           READY   STATUS    RESTARTS   AGE   LABELS
nginx1         1/1     Running   0          30m   run=nginx1
nginx2         1/1     Running   0          30m   run=nginx2
nginx3         1/1     Running   0          30m   run=nginx3
</code></pre>
<hr />
<p>when I am trying to access pod from different namespace then I am still able to access pod (nginx1)</p>
<pre><code>  master $ kubectl run busybox -n mynamespace --rm --labels=run=nginx2 -ti --image=busybox -- /bin/sh
/ # wget --spider --timeout=2 nginx1.default
Connecting to nginx1.default (10.107.249.117:80)
   remote file exists
</code></pre>
<hr />
<p>How I can restrict other namespace to access pod in default namespace</p>

sachin
<p>If you want AND condition (match both POD and Namespace condition) to match your requirement. You can do it using below NetworkPolicy yaml file and label command (please take a look how namespaceSelector and PodSelector are defined, it defined inside the same array to mark this as AND condition). But are you sure your network policy has been created in default namespace?</p>
<pre><code>kubectl label ns default name=default

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: access-nginx
spec:
  podSelector:
    matchLabels:
      run: nginx1
  ingress:
   - from:
    - namespaceSelector:
        matchLabels:
          name: &quot;default&quot;
      podSelector:
        matchLabels:
          run: &quot;nginx2&quot;
</code></pre>
