<p>I currently have multiple NFS server Pods running in different namespaces (1 replica per namespace). I have a Service per namespace to wrap this Pod just to have a fixed endpoint. A Persistent Volume connects to this server with the fixed endpoint, so other Pods in the namespace can mount this as a volume using a PVC. Since I create a PV per NFS server, how can I prevent that a PV not bounded to a PVC that belongs to the same namespace reads from it. I tried using a Network Policy, but it looks like the PV (not tied to a namespace) can go around it. Unfortunately, the application deployed in K8s currently has a field where a user can provide any <code>nfs://</code> endpoint to instruct the PV where it needs to access the files.</p>
<p>Using GKE 1.17.</p>
<p>I'm trying this NP:</p>
<pre><code>apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: test-network-policy
  namespace: team1-ns
spec:
  podSelector:
    matchLabels:
      role: nfs-server
  policyTypes:
  - Ingress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          nfs-server: team1-ns
    - podSelector: {}
</code></pre>
<p>am I missing something in the NP, or PVs can actually go around NPs?</p>
<p>Help is really appreciated...</p>

Luis Armando
<p>I would not say that PVs &quot;can go around&quot; NPs, but rather than are not applicable.</p>
<p>PVs, Volumes and StorageClasses provide a layer of abstraction between your pod(s) and the underlying storage implementation.  The actual storage itself is actually attached/mounted to the node and not directly to the container(s) in the pods.</p>
<p>In your case with NFS, the storage driver/plugin attaches the actual NFS share to the node running your pod(s).  So NetworkPolicy cannot possible apply.</p>
