<p>I created a kubernetes pod efgh in namespace ns1</p>
<pre><code>kubectl run efgh --image=nginx -n ns1
</code></pre>
<p>I created another pod in default namespace</p>
<pre><code>kubectl run apple --image=nginx
</code></pre>
<p>I created a service efgh in namespace ns1</p>
<pre><code>kubectl expose pod efgh --port=80 -n ns1
</code></pre>
<p>Now I created a network policy to block incoming connections to the pod</p>
<pre><code>apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: test-network-policy
  namespace: ns1
spec:
  podSelector:
    matchLabels:
      run: efgh
  policyTypes:
    - Ingress

  ingress:
    - from:
      - namespaceSelector:
          matchLabels:
            project: ns1

    - from:
      - namespaceSelector:
          matchLabels:
            project: default
        podSelector:
          matchLabels:
            run: apple

      ports:
        - protocol: TCP
          port: 80
</code></pre>
<p>Checking the pods in ns1 gives me</p>
<pre><code>NAME   READY   STATUS    RESTARTS   AGE    IP  
efgh   1/1     Running   0          3h4m   10.44.0.4   
</code></pre>
<p>Checking the services in ns1 gives me</p>
<pre><code>NAME          TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)   AGE
efgh          ClusterIP   10.109.170.238   &lt;none&gt;        80/TCP    164m
</code></pre>
<p>Once I open terminal in apple pod and run below it works</p>
<pre><code>curl http://10-44-0-4.ns1.pod
curl http://10.44.0.4
</code></pre>
<p>but when I try curl by trying to access the pod through the service it fails.</p>
<pre><code>curl http://10.109.170.238
</code></pre>
<p>If i delete the network policy the above curl works</p>
<p>I think this is an issue with my local kubernetes cluster. I tried elsewhere it works</p>
<p>When I did port forward</p>
<pre><code>root@kubemaster:/home/vagrant# kubectl port-forward service/efgh 8080:80 -n ns1
Forwarding from 127.0.0.1:8080 -&gt; 80
Forwarding from [::1]:8080 -&gt; 80
</code></pre>

BJ5
<p>See below, more details here <a href="https://kubernetes.io/docs/concepts/services-networking/service/" rel="nofollow noreferrer">ServiceTypes</a></p>
<pre><code>Publishing Services (ServiceTypes)
For some parts of your application (for example, frontends) you may want to expose a Service onto an external IP address, that's outside of your cluster.

Kubernetes ServiceTypes allow you to specify what kind of Service you want. The default is ClusterIP.

Type values and their behaviors are:

ClusterIP: Exposes the Service on a cluster-internal IP. Choosing this value makes the Service only reachable from within the cluster. This is the default ServiceType.
NodePort: Exposes the Service on each Node's IP at a static port (the NodePort). A ClusterIP Service, to which the NodePort Service routes, is automatically created. You'll be able to contact the NodePort Service, from outside the cluster, by requesting &lt;NodeIP&gt;:&lt;NodePort&gt;.
LoadBalancer: Exposes the Service externally using a cloud provider's load balancer. NodePort and ClusterIP Services, to which the external load balancer routes, are automatically created.
ExternalName: Maps the Service to the contents of the externalName field (e.g. foo.bar.example.com), by returning a CNAME record with its value. No proxying of any kind is set up.
</code></pre>
