Skip to main content

Network Policies


Network Policies are used to regulate connectivity between Kubernetes namespaces.
Every namespace in the cluster has network policies which only allow inbound traffic from the ingress controllers namespace (so that incoming requests can be routed to your web applications).

A network policy allows connection based on PodSelector and/or NamespaceSelector. The policy will then filter requests based on namespace or pod labels.

Namespace Label

This example demonstrates using a namespaceSelector to route traffic based on a namespace label.

Any namespace label can be used in the network policy.
For clarity, and to avoid overlap with other namespaces, let’s make our label key:

# 00-namepace.yaml
apiVersion: v1
kind: Namespace
  name: source-namespace
  labels: "source-namespace"  # this is the label "false" "dev"
  annotations: "HMPPS" "court-probation" "" ""

Network Policy

Once the relevant label has been added to the namespace, the policy can be created.

The policy below allows all traffic from namespaces which have a label called with the the value source-namespace to route to the namespace called target-namespace.

# 04-networkpolicy.yaml
# allow-source-namespace.yaml
kind: NetworkPolicy
  name: allow-source-namespace
  namespace: target-namespace
  podSelector: {}
  - Ingress
  - from:
    - namespaceSelector:

Note: For more complex use-cases, or if the policy is going to be specific to a Pod, see here

Accessing the service

To access a service in the target namespace from the source namespace we need to add the target namespace name to the domain name of the service, e.g:

This page was last reviewed on 20 April 2021. It needs to be reviewed again on 20 July 2021 .
This page was set to be reviewed before 20 July 2021. This might mean the content is out of date.