How to block traffic from specific namespace in kubernetes

Question

I have multiple namespaces in my k8 cluster. All I want is that pods in development namespace can communicate with all other pods in other namespaces but should not be able to communicate with resources in production namespace.

I was not able to find a document for this scenario. There is a deny all policy like this

---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-egress
spec:
  podSelector: {}
  policyTypes:
  - Egress
  - Ingress

but it applies at pod level in the same namespace. How can I modify the same to meet my requirements?

Arghya Sadhu Arghya Sadhu · Accepted Answer · 2020-06-08T05:59:27

Referring from the docs here

Label all namespaces in development environment with environment=dev
Label all namespaces in production environment with environment=prod

Then you can have network policy as below

Default deny policy as you have already
Have a policy to whitelist traffic to pods from namespaces with label environment=prod

As below

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: access-nginx
spec:
  podSelector: {}
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          environment: "prod"

How to block traffic from specific namespace in kubernetes

1 Answers