<p>I have 3 Kubernetes deployments and services for each of the deployments (namespace = firstspace).
each deployment is labelled as app1, app2, app3 in order.</p>
<p>As an example, if I run the following command. I will get the first pod as the result.</p>
<pre><code>kubectl get pods -l app=app1 --namespace firstspace
</code></pre>
<p>My goal is to restrict the Ingress access of the third pod (app=app3) using the following Network Policy allowing traffic only from the second pod (app=app2) and any pods from another namespace called &quot;secondspace&quot;.</p>
<pre><code>apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: ingress-app3
  namespace: firstspace
spec:
  podSelector: 
    matchLabels:
      app: app3
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          name: secondspace
    - podSelector:
        matchExpressions:
          - {key: app, operator: In, values: [app2]}
  policyTypes:
  - Ingress
</code></pre>
<p>However, when I deploy the network policy to the &quot;firstspace&quot; namespace, I can still curl (and get a sample JSON response) the service of the third pod (app=app3) using the first pod (app=app1).</p>
<p>Following is a sample command. Here, 10.100.150.0 is the ClusterIP of the service created for the third pod.</p>
<pre><code>kubectl exec app1-849b94c6df-rzdls --namespace firstspace-- curl -sL 10.100.150.0:8080/testendpoint
</code></pre>
<p>Can someone help me understand what I'm doing wrong here?</p>

gayashanbc
<p>After some trial and error, I observed the following.
According to the Kubernetes Network Policies <a href="https://kubernetes.io/docs/concepts/services-networking/network-policies/" rel="nofollow noreferrer">documentation</a>, Deployed Network Policies will be only effective if a <a href="https://kubernetes.io/docs/concepts/extend-kubernetes/compute-storage-net/network-plugins/" rel="nofollow noreferrer">network plugin</a> is installed in the Kubernetes cluster.</p>
<p>Since my local <a href="https://minikube.sigs.k8s.io/docs/drivers/hyperv/" rel="nofollow noreferrer">minikube</a> cluster did not have a <a href="https://kubernetes.io/docs/concepts/extend-kubernetes/compute-storage-net/network-plugins/" rel="nofollow noreferrer">network plugin</a> the network policy I have mentioned in the question description was not effective.</p>
<p>After, installing the <a href="https://kubernetes.io/docs/tasks/administer-cluster/network-policy-provider/cilium-network-policy/" rel="nofollow noreferrer">Cillium Network Plugin</a> in my <a href="https://minikube.sigs.k8s.io/docs/drivers/hyperv/" rel="nofollow noreferrer">minikube</a> cluster, the network policy worked as expected.</p>
<p><strong>Notes:</strong></p>
<ul>
<li><a href="https://kubernetes.io/docs/tasks/administer-cluster/network-policy-provider/cilium-network-policy/" rel="nofollow noreferrer">Cillium Network Plugin</a> installation was not successful on <a href="https://minikube.sigs.k8s.io/docs/drivers/hyperv/" rel="nofollow noreferrer">minikube</a> when using <code>docker</code> as the driver. But it worked when selected <code>hyperv</code> as the driver.</li>
<li>I had to create an Egress policy as well for the pod with app=app2 label to allow egress traffic from the pod with app=app3 label (See the example below).</li>
</ul>
<hr />
<pre><code>apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: egress-app2
  namespace: firstspace
spec:
  podSelector: 
    matchLabels:
      app: app2
  egress:
  - to:
    - podSelector:
        matchLabels:
          app: app3
  policyTypes:
  - Egress
</code></pre>
