title: Prevent inter-namespace communication in Kubernetes
body: <p>I am new to Kubernetes networking.</p>
  
  <p>We have separated a Kubernetes cluster into a set of namespaces (e.g. <code>namespace-a</code>, <code>namespace-b</code>). Every namespace has a set of Kubernetes pods. Every pod has a service that is available at <code>my-svc.namespace-x.svc.cluster.local</code>.</p>
  
  <p>Now, we want to <strong>prevent</strong> pods of namespace <code>namespace-a</code> to talk with services or pods that are part of <code>namespace-b</code> and <strong>vice versa</strong>. Communication <strong>within</strong> a namespace should be unrestricted. </p>
  
  <p>This is what I found as an example in the network policies documentation:
  <a href="https://kubernetes.io/docs/concepts/services-networking/network-policies/#the-networkpolicy-resource" rel="noreferrer">https://kubernetes.io/docs/concepts/services-networking/network-policies/#the-networkpolicy-resource</a></p>
  
  <pre><code>apiVersion: networking.k8s.io/v1
  kind: NetworkPolicy
  metadata:
    name: default-deny
  spec:
    podSelector: {}
    policyTypes:
    - Ingress
    - Egress
  </code></pre>
  
  <p>As far as I understand, this prevents network communication completely, for all pods across a namespace. </p>
  
  <ul>
  <li>How can I allow all network traffic, but only <strong>within</strong> a particular namespace?</li>
  <li>Do I need a networking plugin, such as Calico, Flannel or Weave? Which one should I choose?</li>
  </ul>