<p>i've a namespace called: <code>test</code>, and containing 3 pods: <code>frontend</code>, <code>backend</code> and <code>database</code>.</p>
<p>this is the manifest of pods:</p>
<pre><code>kind: Pod
apiVersion: v1
metadata:
  name: frontend
  namespace: test
  labels:
    app: todo
    tier: frontend
spec:
  containers:
    - name: frontend
      image: nginx

---

kind: Pod
apiVersion: v1
metadata:
  name: backend
  namespace: test
  labels:
    app: todo
    tier: backend
spec:
  containers:
    - name: backend
      image: nginx

---

kind: Pod
apiVersion: v1
metadata:
  name: database
  namespace: test
  labels:
    app: todo
    tier: database
spec:
  containers:
    - name: database
      image: mysql
      env:
      - name: MYSQL_ROOT_PASSWORD
        value: example
</code></pre>
<p>I would implement a network policy , that allow only allow incoming traffic from the backend to the database but disallow incoming traffic from the frontend.</p>
<p>this my network policy:</p>
<pre><code>apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: app-allow
  namespace: test
spec:
  podSelector:
    matchLabels:
      app: todo
      tier: database
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: todo
          tier: backend
    ports:
    - protocol: TCP
      port: 3306
    - protocol: UDP
      port: 3306
</code></pre>
<p>This is the output of <code>kubectl get pods -n test -o wide</code></p>
<pre><code>NAME       READY   STATUS    RESTARTS   AGE   IP           NODE       NOMINATED NODE   READINESS GATES
backend    1/1     Running   0          28m   172.17.0.5   minikube   &lt;none&gt;           &lt;none&gt;
database   1/1     Running   0          28m   172.17.0.4   minikube   &lt;none&gt;           &lt;none&gt;
frontend   1/1     Running   0          28m   172.17.0.3   minikube   &lt;none&gt;           &lt;none&gt;
</code></pre>
<p>This is the output of <code>kubectl get networkpolicy -n test -o wide</code></p>
<pre><code>NAME        POD-SELECTOR             AGE
app-allow   app=todo,tier=database   21m
</code></pre>
<p>when i execute <code>telnet @ip-of-mysql-pod 3306</code> from the <code>frontend</code> pod , the connection look be established and the network policy is not working</p>
<pre><code>kubectl exec -it pod/frontend bash -n test
kubectl exec [POD] [COMMAND] is DEPRECATED and will be removed in a future version. Use kubectl exec [POD] -- [COMMAND] instead.
root@frontend:/# telnet 172.17.0.4 3306
Trying 172.17.0.4...
Connected to 172.17.0.4.
Escape character is '^]'.
J
8.0.25 k{%J\�#(t%~qI%7caching_sha2_password
</code></pre>
<p>there are something i missing ?</p>
<p>Thanks</p>

Quentin Merlin
<p>It seems that you forgot to add &quot;default deny&quot; policy:</p>
<pre><code>apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-ingress
spec:
  podSelector: {}
  policyTypes:
  - Ingress
</code></pre>
<p>The default behavior of <code>NetworkPolicy</code> is to allow all connections between pod unless explicitly denied.</p>
<p>More details here: <a href="https://kubernetes.io/docs/concepts/services-networking/network-policies/#default-deny-all-ingress-traffic" rel="nofollow noreferrer">https://kubernetes.io/docs/concepts/services-networking/network-policies/#default-deny-all-ingress-traffic</a></p>
