One verification on the network policy: when we create network policy in a names .

Kubernetes-Slack Discussions
#1

Hailu Meng:
One verification on the network policy: when we create network policy in a namespace, that indicates the policy will apply to the pods selected by podselector in the namespace where the network policy belongs to, right?

#2

Hailu Meng:
Just read the doc one more time, I think the understanding above is correct.

#3

Vitor Jr.:
You’re correct.

#4

Vitor Jr.:
podSelector: Each NetworkPolicy includes a podSelector which selects the grouping of pods to which the policy applies. The example policy selects pods with the label “role=db”. An empty podSelector selects all pods in the namespace.

#5

Hailu Meng:
Thank you sir

#6

Yes, that’s correct.

A NetworkPolicy is namespace-scoped , so it only applies to the pods in the same namespace where the policy is created. More specifically:

  • The podSelector selects the target pods that the policy applies to.
  • The ingress and/or egress sections then define what traffic is allowed to or from those selected pods.
  • Pods that are not selected by the podSelector are not affected by that particular policy.

One thing that often causes confusion is that although the policy itself is scoped to its own namespace, the rules can still reference pods or namespaces outside of it using namespaceSelector , podSelector , or ipBlock , depending on what you’re trying to allow.

If you’d like a visual explanation, I found this Youtube Tutorial - Kubernetes Network Policies - Anatomy of Kubernetes Network Policy that walks through the anatomy of a Kubernetes NetworkPolicy YAML section by section—explaining what each field does and how they all fit together. It might make the concepts much easier to follow:

Hope it helps!

1 Like