🎯 What It Is

Advanced NetworkPolicy rules let you:

• Allow traffic from specific namespaces (using namespaceSelector)
• Allow traffic to external IPs/networks (using ipBlock)

✅ Essential for multi-team clusters, hybrid cloud, or compliance (e.g., “only finance namespace can access payroll DB”).

💡 Real-World Analogy

Like a corporate network with VLANs:

• Finance VLAN can talk to Payroll Server
• Dev VLAN can talk to CI/CD and package repos (10.0.0.0/8)
• No cross-talk between teams

🧪 Example 1: Allow Traffic Only from frontend Namespace

Assume:

• backend Pods in prod namespace (app: backend)
• frontend Pods in frontend namespace (app: frontend)
• Both namespaces labeled: team: web

Step 1: Label Namespaces

kubectl label ns frontend team=web
kubectl label ns prod team=web

Step 2: Create NetworkPolicy in prod

# allow-frontend-ns-to-backend.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
meta
  name: allow-frontend-ns
  namespace: prod
spec:
  podSelector:
    matchLabels:
      app: backend
  policyTypes:
  - Ingress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          team: web        # ← Only namespaces with this label
      podSelector:
        matchLabels:
          app: frontend    # ← And Pods with this label
    ports:
    - port: 80

✅ Result: Only Pods in namespaces labeled team=web AND with app=frontend can reach backend.

🧪 Example 2: Allow Egress to External Package Repo (IP Block)