<p>I have created  network policy as shown below in default namespace</p>
<hr />
<pre><code>apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: access-nginx
spec:
  podSelector:
    matchLabels:
      run: nginx1
  ingress:
  - from:
    - podSelector:
        matchLabels:
          run: &quot;nginx2&quot;
</code></pre>
<hr />
<p>and having following pod in default namespace</p>
<pre><code>master $ k get pod --show-labels
NAME           READY   STATUS    RESTARTS   AGE   LABELS
nginx1         1/1     Running   0          30m   run=nginx1
nginx2         1/1     Running   0          30m   run=nginx2
nginx3         1/1     Running   0          30m   run=nginx3
</code></pre>
<hr />
<p>when I am trying to access pod from different namespace then I am still able to access pod (nginx1)</p>
<pre><code>  master $ kubectl run busybox -n mynamespace --rm --labels=run=nginx2 -ti --image=busybox -- /bin/sh
/ # wget --spider --timeout=2 nginx1.default
Connecting to nginx1.default (10.107.249.117:80)
   remote file exists
</code></pre>
<hr />
<p>How I can restrict other namespace to access pod in default namespace</p>

sachin
<p>That's an expected behavior because you are not restricting traffic at namespace level using <code>namespaceSelector</code></p>
<p>Add a label <code>key=value</code> to default namespace and use  <code>namespaceSelector</code> in ingress to only allow traffic from namespaces with that label.</p>
<p><code>key=value</code> is just an example, you can have different label.</p>
<pre><code>kubectl label ns default key=value

---

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: access-nginx
spec:
  podSelector:
    matchLabels:
      run: nginx1
  ingress:
  - from:
    - namespaceSelector
        matchLabels
          key: value
    - podSelector:
        matchLabels:
          run: &quot;nginx2&quot;
</code></pre>
<blockquote>
<p>How I can restrict other namespace to access pod in default namespace</p>
</blockquote>
<p>If you want to restrict at namespace level only then just use <code>namespaceSelector</code></p>
<pre><code>kubectl label ns default key=value

---

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: access-nginx
spec:
  podSelector:
    matchLabels:
      run: nginx1
  ingress:
  - from:
    - namespaceSelector
        matchLabels
          key: value 
</code></pre>
<p>This will block traffic to pod with label <code>run=nginx1</code> from any pod in any  namespace which is not having label <code>key=value</code></p>
<p>For more details refer docs <a href="https://kubernetes.io/docs/concepts/services-networking/network-policies/#behavior-of-to-and-from-selectors" rel="nofollow noreferrer">here</a></p>
